FoxFilter so easily defeated it’s ridiculous ;)
I was tinkering with Firefox, trying to get something to work. I wanted to do something between certain events, rather that on those specific events.
Anyway, deciding I’d take a little peek in the first random Firefox filtering plugin that I could find, downloaded it from “some site”, and unpacked the XPI.
This immediately caught my eye, and any coders should see the obvious error:
//don't hide page if within FoxFilter mgmt pages
if(aURI.spec.indexOf("chrome://foxfilter") != -1)
return;
That is definitely not the way to check for such an URL. Quite a “beginners” error actually. I wanted to confirm this makes the whole filter useless, but was incorrectly thinking that I had to register first before using the plugin — so closed the browser and deleted the add-on.
Later I thought differently, and couldn’t resist finding it again and re-installing it. This time I downloaded it from the Mozilla Add-On site; and an agreement I had to agree to. Oh well…
There this caught my eye though: “The FoxFilter Team has spent HUNDREDS of hours in development, maintenance and support of FoxFilter. We are very proud of our product and are very happy that is helping protect children, teens AND adults from inappropriate content on the Internet.“.
Hundreds of hours missed that obvious error? Took me barely 5 seconds…
OK enough with the being cocky already…
Anyway, downloaded the thing again; re-installed it and confirmed filtering was succesful when I went to “http://www.playboy.com”.
And, confirmed that it horribly failed on “http://www.playboy.com/?chrome://foxfilter“.
Yep, it is that easy. Then to think people pay for something it cannot really do (well until it is patched of course):
Premium Features
In addition to all of the great filtering features that have always been free of charge, we also offer security features as part of our premium service. Security features provide you with the ability to secure your settings with a password and prevent FoxFilter from being bypassed, uninstalled or disabled. A small support fee is required to obtain a registration code which enables the security features.
I’ve always thought that one should never, ever, trust software to do things that they claim to do properly. Even the most advanced logic could be bypassed by a silly mistake before it even reaches your advanced logic. If you got the chance to check it out, you should — just to prevent surprises in the future…
OK back into my lair…

by











