Firefox PSL Override (network.psl.override_file) Not Enforcing Rules – Seeking Guidance

[Jonathan Boice]

Dear PSL Community,

I’m testing Firefox’s PSL override (network.psl.override_file) for local and staging environments by adding domains to effective_tld_names.dat. While Firefox recognizes the override (Services.eTLD.hasRootDomain() returns true), it does not enforce PSL restrictions on cookies or document.domain.

Issue Summary

• Custom PSL file is loaded successfully
• Cookies can still be set for square.site (expected to fail)
• document.domain modifications are still allowed (expected to fail)
• No PSL enforcement logs appear in MOZ_LOG=nsEffectiveTLDService:5,PSL:5

Questions for the PSL Community

1. Does Firefox fully enforce PSL override rules, or does it only recognize them for lookups?
2. Are there additional settings required for PSL enforcement?
3. What is the recommended way to test and validate PSL rule enforcement before committing to a PR?
4. Are there alternative ways to confirm a PSL change works correctly before submitting it?

I’d appreciate any guidance or confirmation on how Firefox handles custom PSL overrides. I want to be confident that the change is correctly applied before preparing a PR. Let me know if more details would help.

Thanks,

Jonathan

[Daniel Veditz]

On Tue, Feb 4, 2025 at 2:03 PM 'Jonathan Boice' via psl-discuss <publicsuff...@googlegroups.com> wrote:

I’m testing Firefox’s PSL override (network.psl.override_file)

I work on the Firefox security team and I've never heard of such a feature, and I can't find any Firefox code that uses that value or references to it on the web. What instructions are you following?

While Firefox recognizes the override (Services.eTLD.hasRootDomain() returns true)

.hasRootDomain() is purely a substring compare, with no reference to any PSL data. I'm not sure why it's in that interface, honestly. My best guess is that someone wanted to call the C++ net::HasRootDomain() from JavaScript so they stuck it on an interface that seemed close enough. What you really wanted to use as a test was Services.eTLD.getKnownPublicSuffixFromHost()

-Dan Veditz

[Daniel Veditz]

On Wed, Feb 5, 2025 at 7:56 PM Daniel Veditz <dve...@mozilla.com> wrote:

What you really wanted to use as a test was Services.eTLD.getKnownPublicSuffixFromHost()

... or maybe Services.eTLD.getBaseDomainFromHost(). Given a host string like "www.mozilla.org" the first one will return "org" and the BaseDomain one will return "mozilla.org" -- whichever is more useful.

[Ian Williams]

Jonathan,

We've also encountered similar painpoints with testing PSL changes prior to submission. The general practice for the PSL is that it's incorporated at build-time, by Firefox and others.
I'm not personally able to find reference to that pref in the Firefox GitHub mirror, and the only other network.psl preference that I could find in my local Firefox installation (network.psl.onUpdate_notify) seems questionable if it's actively used or not.

---

How we do this: in-line with the "incorporated at build-time" mentology, we've been locally patching the $browser build process to incorporate our suggested changes to the PSL, and using that patched build to check if the PSL changes work as-expected. It's not ideal, but it gives us the most-accurate picture on how the browser will interpret the suggested changes.

We actually ended up automating a process to build PSL test environments for our internal teams. This mechanism ingests to-be-proposed PSL changes, and outputs a batteries-included virtual machine with a PSL-patched copy of a browser. This currently is designed for Firefox (their build process is simpler), but could be extended to Chrome/other browsers if needed.

This uses some paid AWS products, including CloudFormation, S3, and EC2; if there's community interest in using this, we could look at sharing this tooling more-broadly.

Regards,
--Ian

[Daniel Veditz]

On Fri, Feb 7, 2025 at 5:43 AM 'Ian Williams' via psl-discuss <publicsuff...@googlegroups.com> wrote:

the only other network.psl preference that I could find in my local Firefox installation (network.psl.onUpdate_notify) seems questionable if it's actively used or not.

It wasn't. It was intended to be used as part of a mechanism to remotely load PSL updates between releases, but in practice we never did. We've recently removed all the code related to that functionality.

-Dan Veditz