Bug 389169

Summary:	No setting to disable JavaScript and 3rd party content in Akregator
Product:	[Applications] akregator	Reporter:	Unknown <null>
Component:	internal browser	Assignee:	kdepim bugs <kdepim-bugs>
Status:	RESOLVED FIXED
Severity:	major	CC:	Martin, montel
Priority:	NOR
Version:	unspecified
Target Milestone:	---
Platform:	openSUSE
OS:	Linux
URL:	http://www.kde.org/dotkdeorg.rdf
Latest Commit:	https://commits.kde.org/akregator/ffdfd9fe4c7ee20bda5c362830ed3450bce6fe8a	Version Fixed In:	5.8.0
Sentry Crash Report:

Description Unknown 2018-01-18 15:55:42 UTC

I notice that on some of the RSS feeds which Akregator reads there are embedded, playable YouTube videos (e.g. http://www.kde.org/dotkdeorg.rdf). This means: JavaScript code is running and this is dangerous in the age of Spectre/Meltdown.

Additionally I can't find a setting to disable images/css from 3rd parties
(i.e. not coming from the original website) to prevent tracking.

Comment 1 Unknown 2018-01-18 15:56:06 UTC

akregator-17.04.2-2.1.x86_64

Comment 2 Laurent Montel 2018-01-18 22:24:04 UTC

Git commit ffdfd9fe4c7ee20bda5c362830ed3450bce6fe8a by Laurent Montel.
Committed on 18/01/2018 at 22:23.
Pushed by mlaurent into branch 'master'.

Fix Bug 389169 - No setting to disable JavaScript and 3rd party content in Akregator

FIXED-IN: 5.8.0

M  +34   -22   configuration/ui/settings_browser.ui
M  +4    -0    interfaces/akregator.kcfg
M  +2    -1    src/frame/webengine/akrwebengineviewer.cpp

https://commits.kde.org/akregator/ffdfd9fe4c7ee20bda5c362830ed3450bce6fe8a

Comment 3 Unknown 2018-01-18 22:52:45 UTC

That was quick. Thank you!

Could you please confirm if the fix addresses both issues (JS + 3rd party resources)?

Comment 4 Laurent Montel 2018-01-19 06:20:08 UTC

(In reply to george from comment #3)
> That was quick. Thank you!
> 
> Could you please confirm if the fix addresses both issues (JS + 3rd party
> resources)?

for image/css we have adblock support (which is broken currently :) )
I work on.

Comment 5 Unknown 2018-01-19 10:22:03 UTC

Thanks for explaining. In that case this should not be considered RESOLVED FIXED as it is obviously not?

Unfortunately I am afraid that Adblock is not good enough. It would be great if you rather support something like uBlock Origin and uMatrix which are great extensions for enhancing online privacy. Or provide similar functionality in Akregator.

Comment 6 Martin Steigerwald 2018-01-19 18:37:17 UTC

I opened a bug report that is related to this one some time ago:

Bug #387550 - According to panopticlick 3.0 test does not protect against trackers 

(I also added it to the privacy goal in Phabricator)

It would be great to integrate uBlock Origin / uBlock Matrix, maybe even in a generic way, so that all KDE applications can easily use it. However, as an interim measure I think fixing Adblock is beneficial, it is better than nothing.