Security News
New Python Packaging Proposal Aims to Solve Phantom Dependency Problem with SBOMs
PEP 770 proposes adding SBOM support to Python packages to improve transparency and catch hidden non-Python dependencies that security tools often miss.
Manage & generate prefs.js files for use when testing Firefox. This tool is intended to simplify the use and tracking of prefs used by our fuzzing tools. The template files can be modified to allow the creation of custom prefs.js files without the need to maintain a separate mostly duplicate version of a prefs file.
The template document is made up of variants, prefs and values.
pref is the name of the preference that will be added to the prefs.js file. This is an unquoted string. Valid prefs can be found in all.js or in StaticPrefList.yml.
review_on_close is optional. It is a list of relevant Bugzilla IDs used to help avoid obsolete entries. When all bugs in the list are closed the entry will be reviewed and removed if appropriate.
value can be a bool
, int
, string
or null
. Adding multiple potential values is possible.
When multiple values are present one is chosen at random when generating the output.
Using a value of null
will exclude the pref from the prefs.js file (acts as browser default).
variant is a subset of values to be used in place of the default values. The default variant is used unless a variant is specified.
There are a few mechanisms in place to help keep the file in order:
# example.yml
variant: # list of extra variants, default is implied
- alt # name of variant
pref:
pref.name: # unquoted name of the pref used in prefs.js
review_on_close: # optional
- 123456
variants:
default: # variant definition, default is required
- 0 # potential value
alt: # extra optional variant
- 1 # if multiple values are defined one is chosen randomly
- null # null is a special case meaning exclude the pref
Prefs are found in the .yml
files in the template directory.
Only prefs that are ready to be tested should be added.
When adding a pref to a template it is encouraged to add a comment that provides justification and points to a bug in Bugzilla for additional context.
If a pref does not already exist and is only used with non-default variants a null
entry must be added to the default variant.
Use pip to install prefpicker.
pip install prefpicker
Use a built-in template to generate an up-to-date prefs.js
file.
prefpicker browser-fuzzing.yml prefs.js
Or generate a prefs.js
file from a custom template using the webrender
variant:
user@machine:~/prefpicker$ prefpicker custom/template.yml ~/Desktop/prefs.js --variant webrender
Loading 'template.yml'...
Loaded 255 prefs and 5 variants
Generating 'prefs.js' using variant 'webrender'...
Done.
The resulting prefs.js
file is ready to be used with Firefox. It will look something like this:
// Generated with PrefPicker @ 2020-02-08 00:50:29 UTC
// Variant 'webrender'
/// ... snip
user_pref("fuzzing.enabled", true);
/// ... snip
// 'gfx.webrender.all' defined by variant 'webrender'
user_pref("gfx.webrender.all", true);
/// ... snip
FAQs
PrefPicker - Manage & generate prefs.js files
We found that prefpicker demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
PEP 770 proposes adding SBOM support to Python packages to improve transparency and catch hidden non-Python dependencies that security tools often miss.
Security News
Socket CEO Feross Aboukhadijeh discusses open source security challenges, including zero-day attacks and supply chain risks, on the Cyber Security Council podcast.
Security News
Research
Socket researchers uncover how threat actors weaponize Out-of-Band Application Security Testing (OAST) techniques across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.