Why doesn't NoScript block MP3/MP4 read directly in Firefox?

[Jellylo]

Hey guys,


I've been using NoScript ever since I switched to Firefox 2.0 and it followed me till Fx 22. Luv it.

Lately Firefox has evolved a LOT, and now among other things, it reads videos and music alone, without plugin or fancy website-authored JS app.


So why doesn't NoScript provide an option to protect from this like it does for WebGL, plugins or even IFrames ? (not to mention that when I hit an URL ending in .mp3 or .mp4, it means I want to download files not read them, but that's Firefox's problem)

The about:config related to this is:
media.windows-media-foundation.enabled


Thanks for your lights, and unless there's a super good reason not to, thanks for considering this as a feature !

[Jellylo]

Actually, NoScript even provides protection for <audio> and <video> HTML tags. So why not for this browser integrated audio/video reader ?

[dhouwn]

You mean when the media file itself is the top-level document? Good question, especially when top-level plugin content is being blocked.

[Jellylo]

You mean when the media file itself is the top-level document?

Yes, although there may be situations where the Firefox reader kicks in on an regular HTML page, but so far I only encountered top level.


(The bot that posted this huge spam right above sounds like he's using Tor )

[Jellylo]

Hey again,

Is anyone able to answer this ? That would be cool.

Thanks!

[Hecuba's daughter]

not to mention that when I hit an URL ending in .mp3 or .mp4, it means I want to download files not read them, but that's Firefox's problem

Yes, it doesn't present a "save or play" dialog. IE9 does. EDIT in Win7 at least. Because the Moz developers use that

Code: Select all

media.windows-media-foundation.enabled

preference to hook directly into the system codecs. /EDIT

A user can get the file from the "media" tab on the "view page info" dialog while the file's playing though - - I would've thought this auto run was a useful preview feature and that there's nothing insecure about it. It's a tossup for me whether I favour this auto preview over saving a file for later running. But I would like a save dialog automatically presented, as it is with IE, whether the file is running or not. Many novice users would be very confused by the current behaviour.

EDIT, and I wonder whether they will also be confused by a GUI config option that reads something along the line of :
play all media files using your operating system or with your plugin of choice - which will be the only way the devs can unhide that system media configuration./EDIT
I haven't checked bugzilla yet. I bet it's getting looked at.

[therube]

URL where this happens?

[Hecuba's daughter]

URL where this happens?

I've had the pref toggled off for a while, so can't remember where these annoyances turned up except for live feed downloads like

Code: Select all

http://downloads.bbc.co.uk/podcasts/radio4/whnews/rss.xml

With live bookmarks as your default handler go there and try to context "save as" any of the media files.
Play the files and try to context "save as" on the native media player they are run in.

EDIT Sorry, can't reproduce the lack of save dialog now. Can only display the lack of a placeholder for the native player. /EDIT