morgan pushed to branch tor-browser-153.1.0esr-16.0-1 at The Tor Project / Applications / Tor Browser Commits: 93114cd9 by Pier Angelo Vendrame at 2026-08-20T12:18:13+00:00 fixup! Firefox preference overrides. BB 44511&45228: Review some urlbar prefs. - - - - - 1 changed file: - browser/app/profile/001-base-profile.js Changes: ===================================== browser/app/profile/001-base-profile.js ===================================== @@ -187,21 +187,14 @@ pref("security.tls.version.enable-deprecated", false, locked); // more similar. pref("security.ssl.disable_session_identifiers", true); -// Misc privacy: Remote -pref("browser.send_pings", false); -// Space separated list of URLs that are allowed to send objects (instead of -// only strings) through webchannels. The default for Firefox is some Mozilla -// domains. -pref("webchannel.allowObject.urlWhitelist", ""); -pref("geo.enabled", false); -pref("geo.provider.network.url", ""); -pref("geo.provider.ms-windows-location", false); -pref("geo.provider.use_corelocation", false); -pref("geo.provider.use_gpsd", false); -pref("geo.provider.use_geoclue", false); +// URL bar and (remote) suggestions pref("browser.search.suggest.enabled", false); pref("browser.search.suggest.enabled.private", false); pref("browser.urlbar.suggest.searches", false); +// tor-browser#44511: Global opt-out for rich suggestions. +// Some of them are not remote, but we do not have the needed remote settings +// dump, so just disable all of them. +pref("browser.urlbar.suggest.quicksuggest.all", false); pref("browser.urlbar.suggest.quicksuggest.nonsponsored", false); pref("browser.urlbar.suggest.quicksuggest.sponsored", false); // tor-browser#41576: Do not suggest weather and addons. @@ -212,8 +205,32 @@ pref("browser.urlbar.weather.featureGate", false); // tor-browser#42886: Disable trending results. pref("browser.urlbar.suggest.trending", false); pref("browser.urlbar.trending.featureGate", false); +pref("browser.urlbar.suggest.topsites", false); // tor-browser#41691: Hide "Firefox Suggest" in the UI pref("browser.urlbar.groupLabels.enabled", false); +// tor-browser#42735: Disable recent search suggestions +pref("browser.urlbar.recentsearches.featureGate", false); +pref("browser.urlbar.suggest.recentsearches", false); +pref("browser.urlbar.quicksuggest.enabled", false); +pref("browser.urlbar.quicksuggest.online.available", false); +pref("browser.urlbar.quicksuggest.online.enabled", false); +pref("browser.urlbar.richSuggestions.featureGate", false); +// tor-browser#44511: defense-in-depth to disable remote queries when pasting. +pref("browser.urlbar.maxCharsForSearchSuggestions", 0); + +// Misc privacy: Remote +pref("browser.send_pings", false); +// Space separated list of URLs that are allowed to send objects (instead of +// only strings) through webchannels. The default for Firefox is some Mozilla +// domains. +pref("webchannel.allowObject.urlWhitelist", ""); +pref("geo.enabled", false); +pref("geo.provider.network.url", ""); +pref("geo.provider.ms-windows-location", false); +pref("geo.provider.use_corelocation", false); +pref("geo.provider.use_gpsd", false); +pref("geo.provider.use_geoclue", false); + pref("browser.safebrowsing.malware.enabled", false); pref("browser.safebrowsing.phishing.enabled", false); pref("browser.safebrowsing.downloads.enabled", false); @@ -226,12 +243,6 @@ pref("browser.safebrowsing.provider.google4.updateURL", ""); pref("browser.safebrowsing.provider.google4.gethashURL", ""); pref("browser.safebrowsing.provider.mozilla.updateURL", ""); pref("browser.safebrowsing.provider.mozilla.gethashURL", ""); -// tor-browser#42735: Disable recent search suggestions -pref("browser.urlbar.recentsearches.featureGate", false); -pref("browser.urlbar.suggest.recentsearches", false); - -// tor-browser#44262: Disable adding search engines from HTML forms -pref("browser.urlbar.update2.engineAliasRefresh", false); // Disable the UITour API // See tor-browser#41457 and @@ -770,14 +781,6 @@ pref("security.certerrors.mitm.auto_enable_enterprise_roots", false); // Disable share menus on Mac and Windows tor-browser#41117 pref("browser.menu.share_url.allow", false, locked); -// Disable special URL bar behaviors -pref("browser.urlbar.suggest.topsites", false); -pref("browser.urlbar.quicksuggest.enabled", false); -pref("browser.urlbar.quicksuggest.online.available", false); -pref("browser.urlbar.quicksuggest.online.enabled", false); -pref("browser.urlbar.richSuggestions.featureGate", false); -pref("browser.urlbar.yelp.featureGate", false); -pref("browser.urlbar.mdn.featureGate", false); // tor-browser#41884: Do not start a search when clicking on the new tab button // with the middle mouse button (to prevent searching for anything you might View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/93114cd9... -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/93114cd9... You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help