Reverted jar protocol support has been disabled by default

Published: | Categories: Networking, Privacy & Security

Description

The jar protocol, that allows to directly link to a file in ZIP archives, is no longer available from Web content due to security concerns. No other browsers support this Java archive protocol so far.

To enable the jar support for any reason on Firefox 45 and later, flip the network.jar.block-remote-files preference value to false. Otherwise, loading the jar protocol will lead to the NS_ERROR_UNSAFE_CONTENT_TYPE exception.

Update: Since IBM iNotes is broken due to this change, the jar protocol support has been temporarily restored with Firefox 45.0.1. On Firefox Nightly and Developer Edition, the network.jar.block-remote-files preference will remain true.

Update 2: The iNotes issue has been fixed with IBM Notes/Domino 9.0.1 Fix pack 6 released in May 2016.

Update 3: Given that iNotes no longer relies on the jar support, Mozilla is planning to make it disabled again. Firefox 52 Extended Support Release (ESR) for organizations won’t be affected by this change, so the older versions of iNotes, if any, can still be used on the ESR until May August 2018.

Update 4: The JAR support has been disabled again with Firefox 55.

Update 5 The remote JAR support has been completely removed with Firefox 61.

References