From 6ae415e597667bc20ec48638ab35833fc8516fcc Mon Sep 17 00:00:00 2001 From: Brian Smith Date: Fri, 18 Sep 2026 14:53:29 +0200 Subject: [PATCH 1/2] feat(docs): Add ClipboardCopy details --- .../reference/policies/ContentAnalysis.mdx | 68 +++++++++++-------- 1 file changed, 39 insertions(+), 29 deletions(-) diff --git a/src/content/docs/reference/policies/ContentAnalysis.mdx b/src/content/docs/reference/policies/ContentAnalysis.mdx index 781587e..f7eb1c0 100644 --- a/src/content/docs/reference/policies/ContentAnalysis.mdx +++ b/src/content/docs/reference/policies/ContentAnalysis.mdx @@ -1,6 +1,6 @@ --- title: "ContentAnalysis" -description: "Configure Firefox to use an agent for Data Loss Prevention (DLP) that is compatible with the Google Chrome Content Analysis Connector Agent SDK." +description: "Configure Firefox to use a third-party agent for Data Loss Prevention (DLP) that is compatible with the Google Chrome Content Analysis Connector Agent SDK." category: "Cloud reporting" --- @@ -12,41 +12,47 @@ Configure Firefox to use an agent for Data Loss Prevention (DLP) that is compati ## Values -- `AgentName` is the name of the DLP agent. This is used in dialogs and notifications about DLP operations. The default is "A DLP Agent". -- `AgentTimeout` is the timeout in number of seconds after a DLP request is sent to the agent. After this timeout, the request will be denied unless `TimeoutResult` is set to 1 or 2. The default is 300. -- `AllowUrlRegexList` is a space-separated list of regular expressions that indicates URLs for which DLP operations will always be allowed without consulting the agent. +- `AgentName`: the name of the DLP agent. This is used in dialogs and notifications about DLP operations. The default is `A DLP Agent`. +- `AgentTimeout`: the timeout in number of seconds after a DLP request is sent to the agent. After this timeout, the request will be denied unless `TimeoutResult` is set to 1 or 2. The default is 300. +- `AllowUrlRegexList`: a space-separated list of regular expressions that indicates URLs for which DLP operations will always be allowed without consulting the agent. The default is `^about:(?!blank|srcdoc).\*`, meaning that any pages that start with `about:` will be exempt from DLP except for `about:blank` and `about:srcdoc`, as these can be controlled by web content. -- `BypassForSameTabOperations` indicates whether Firefox will automatically allow DLP requests whose data comes from the same tab and frame - for example, if data is copied to the clipboard and then pasted on the same page. The default is false. -- `ClientSignature` indicates the required signature of the DLP agent connected to the pipe. If this is a non-empty string and the DLP agent does not have a signature with a Subject Name that exactly matches this value, Firefox will not connect to the pipe. The default is the empty string. -- `DefaultResult` indicates the desired behavior for DLP requests if there is a problem connecting to the DLP agent. The default is 0. +- `BypassForSameTabOperations`: indicates whether Firefox will automatically allow DLP requests whose data comes from the same tab and frame - for example, if data is copied to the clipboard and then pasted on the same page. The default is false. +- `ClientSignature`: the required signature of the DLP agent connected to the pipe. If this is a non-empty string and the DLP agent does not have a signature with a Subject Name that exactly matches this value, Firefox will not connect to the pipe. The default is the empty string. +- `DefaultResult`: the desired behavior for DLP requests if there is a problem connecting to the DLP agent. The default is 0. Possible values are: - `0`: Deny the request (default) - `1`: Warn the user and allow them to choose whether to allow or deny - `2`: Allow the request -- `DenyUrlRegexList` is a space-separated list of regular expressions that indicates URLs for which DLP operations will always be denied without consulting the agent. The default is the empty string. -- `Enabled` indicates whether Firefox should use DLP. Note that if this value is true and no DLP agent is running, all DLP requests will be denied unless `DefaultResult` is set to 1 or 2. +- `DenyUrlRegexList`: a space-separated list of regular expressions that indicates URLs for which DLP operations will always be denied without consulting the agent. The default is the empty string. +- `Enabled`: indicates whether Firefox should use DLP. Note that if this value is true and no DLP agent is running, all DLP requests will be denied unless `DefaultResult` is set to 1 or 2. - `InterceptionPoints` controls settings for specific interception points. - - The `Clipboard` entry controls clipboard operations for files and text. - - `Enabled` indicates whether clipboard operations should use DLP. The default is true. - - `PlainTextOnly` indicates whether to only analyze the text/plain format on the clipboard. If this - value is false, all formats will be analyzed, which some DLP agents may not expect. Regardless of - this value, files will be analyzed as usual. The default is true. - - The `Download` entry controls download operations. (Added in Firefox 142, Firefox ESR 140.2) - - `Enabled` indicates whether download operations should use DLP. The default is false. - - The `DragAndDrop` entry controls drag and drop operations for files and text. - - `Enabled` indicates whether drag and drop operations should use DLP. The default is true. - - `PlainTextOnly` indicates whether to only analyze the text/plain format in what is being dropped. + - `Clipboard`: controls clipboard operations for files and text. + - `Enabled`: indicates whether clipboard operations should use DLP. The default is `true`. + - `PlainTextOnly`: indicates whether to only analyze the text/plain format on the clipboard. If this value is false, all formats will be analyzed, which some DLP agents may not expect. - Regardless of this value, files will be analyzed as usual. The default is true. - - The `FileUpload` entry controls file upload operations for files chosen from the file picker. - - `Enabled` indicates whether file upload operations should use DLP. The default is true. - - The `Print` entry controls print operation. - - `Enabled` indicates whether print operations should use DLP. The default is true. -- `IsPerUser` indicates whether the pipe the DLP agent has created is per-user or per-system. The default is true, meaning per-user. + Regardless of this value, files will be analyzed as usual. The default is `true`. + - `ClipboardCopy`: controls web content copying data to the clipboard. + - `Enabled`: indicates whether clipboard copy operations should use DLP. + The default is false, so that existing DLP deployments are unaffected. + - `PlainTextOnly`: indicates whether to only analyze the text/plain format being copied. + If this value is false, all formats being copied will be analyzed, which some DLP agents may not expect. + Regardless of this value, files being copied will be analyzed as usual. The default is `true`. + - `Download`: controls download operations. (Added in Firefox 142, Firefox ESR 140.2) + - `Enabled`: indicates whether download operations should use DLP. The default is false. + - `DragAndDrop`: controls drag and drop operations for files and text. + - `Enabled`: indicates whether drag and drop operations should use DLP. The default is `true`. + - `PlainTextOnly`: indicates whether to only analyze the text/plain format in what is being dropped. + If this value is false, all formats will be analyzed, which some DLP agents may not expect. + Regardless of this value, files will be analyzed as usual. The default is `true`. + - `FileUpload`: controls file upload operations for files chosen from the file picker. + - `Enabled`: indicates whether file upload operations should use DLP. The default is `true`. + - `Print`: controls print operation. + - `Enabled`: indicates whether print operations should use DLP. The default is `true`. +- `IsPerUser`: indicates whether the pipe the DLP agent has created is per-user or per-system. The default is true, meaning per-user. - `MaxConnectionsCount`: The maximum number of concurrent connections to the DLP agent. For stability reasons, values exceeding 256 will be ignored. Defaults to `32`. -- `PipePathName` is the name of the pipe the DLP agent has created and Firefox will connect to. The default is `path_user`. -- `ShowBlockedResult` indicates whether Firefox should show a notification when a DLP request is denied. The default is true. -- `TimeoutResult` indicates the desired behavior for DLP requests if the DLP agent does not respond to a request in less than `AgentTimeout` seconds. The default is 0. +- `PipePathName`: the name of the pipe the DLP agent has created and Firefox will connect to. The default is `path_user`. +- `ShowBlockedResult`: indicates whether Firefox should show a notification when a DLP request is denied. The default is `true`. +- `TimeoutResult`: the desired behavior for DLP requests if the DLP agent does not respond to a request in less than `AgentTimeout` seconds. The default is `0`. Possible values are: - `0`: Deny the request (default) - `1`: Warn the user and allow them to choose whether to allow or deny @@ -65,6 +71,8 @@ Software\Policies\Mozilla\Firefox\ContentAnalysis\DenyUrlRegexList = "https://ex Software\Policies\Mozilla\Firefox\ContentAnalysis\Enabled = 0x1 | 0x0 Software\Policies\Mozilla\Firefox\ContentAnalysis\InterceptionPoints\Clipboard\Enabled = 0x1 | 0x0 Software\Policies\Mozilla\Firefox\ContentAnalysis\InterceptionPoints\Clipboard\PlainTextOnly = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\ContentAnalysis\InterceptionPoints\ClipboardCopy\Enabled = 0x0 | 0x1 +Software\Policies\Mozilla\Firefox\ContentAnalysis\InterceptionPoints\ClipboardCopy\PlainTextOnly = 0x1 | 0x0 Software\Policies\Mozilla\Firefox\ContentAnalysis\InterceptionPoints\Download\Enabled = 0x0 | 0x1 Software\Policies\Mozilla\Firefox\ContentAnalysis\InterceptionPoints\DragAndDrop\Enabled = 0x1 | 0x0 Software\Policies\Mozilla\Firefox\ContentAnalysis\InterceptionPoints\DragAndDrop\PlainTextOnly = 0x1 | 0x0 @@ -82,4 +90,6 @@ Software\Policies\Mozilla\Firefox\ContentAnalysis\TimeoutResult = 0x0 | 0x1 | 0x **CCK2 Equivalent:** N/A\ -**Preferences Affected:** `browser.contentanalysis.agent_name`, `browser.contentanalysis.agent_timeout`, `browser.contentanalysis.allow_url_regex_list`, `browser.contentanalysis.bypass_for_same_tab_operations`, `browser.contentanalysis.client_signature`, `browser.contentanalysis.default_result`, `browser.contentanalysis.deny_url_regex_list`, `browser.contentanalysis.enabled`, `browser.contentanalysis.interception_point.clipboard.enabled`, `browser.contentanalysis.interception_point.clipboard.plain_text_only`, `browser.contentanalysis.interception_point.download.enabled`, `browser.contentanalysis.interception_point.drag_and_drop.enabled`, `browser.contentanalysis.interception_point.drag_and_drop.plain_text_only`, `browser.contentanalysis.interception_point.file_upload.enabled`, `browser.contentanalysis.interception_point.print.enabled`, `browser.contentanalysis.is_per_user`, `browser.contentanalysis.max_connections`, `browser.contentanalysis.pipe_path_name`, `browser.contentanalysis.show_blocked_result`, `browser.contentanalysis.timeout_result` +**Preferences Affected:** `browser.contentanalysis.agent_name`, `browser.contentanalysis.agent_timeout`, `browser.contentanalysis.allow_url_regex_list`, `browser.contentanalysis.bypass_for_same_tab_operations`, `browser.contentanalysis.client_signature`, `browser.contentanalysis.default_result`, `browser.contentanalysis.deny_url_regex_list`, `browser.contentanalysis.enabled`, `browser.contentanalysis.interception_point.clipboard.enabled`, `browser.contentanalysis.interception_point.clipboard.plain_text_only`, `browser.contentanalysis.interception_point.clipboard_copy.enabled`, `browser.contentanalysis.interception_point.clipboard_copy.plain_text_only`, `browser.contentanalysis.interception_point.download.enabled`, `browser.contentanalysis.interception_point.drag_and_drop.enabled`, `browser.contentanalysis.interception_point.drag_and_drop.plain_text_only`, `browser.contentanalysis.interception_point.file_upload.enabled`, `browser.contentanalysis.interception_point.print.enabled`, `browser.contentanalysis.is_per_user`, `browser.contentanalysis.max_connections`, `browser.contentanalysis.pipe_path_name`, `browser.contentanalysis.show_blocked_result`, `browser.contentanalysis.timeout_result` + +`ClipboardCopy` added in Firefox 158. From cdfbd92879396ef9897ca977f5fa1a717bb44f3d Mon Sep 17 00:00:00 2001 From: Brian Smith Date: Fri, 18 Sep 2026 15:58:04 +0200 Subject: [PATCH 2/2] feat(docs): clarify Clipboard is paste-only --- src/content/docs/reference/policies/ContentAnalysis.mdx | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src/content/docs/reference/policies/ContentAnalysis.mdx b/src/content/docs/reference/policies/ContentAnalysis.mdx index f7eb1c0..bcebea8 100644 --- a/src/content/docs/reference/policies/ContentAnalysis.mdx +++ b/src/content/docs/reference/policies/ContentAnalysis.mdx @@ -26,12 +26,12 @@ Configure Firefox to use an agent for Data Loss Prevention (DLP) that is compati - `DenyUrlRegexList`: a space-separated list of regular expressions that indicates URLs for which DLP operations will always be denied without consulting the agent. The default is the empty string. - `Enabled`: indicates whether Firefox should use DLP. Note that if this value is true and no DLP agent is running, all DLP requests will be denied unless `DefaultResult` is set to 1 or 2. - `InterceptionPoints` controls settings for specific interception points. - - `Clipboard`: controls clipboard operations for files and text. - - `Enabled`: indicates whether clipboard operations should use DLP. The default is `true`. + - `Clipboard`: controls clipboard paste operations for files and text (for copy operations, see `ClipboardCopy`). + - `Enabled`: indicates whether clipboard paste operations should use DLP. The default is `true`. - `PlainTextOnly`: indicates whether to only analyze the text/plain format on the clipboard. - If this value is false, all formats will be analyzed, which some DLP agents may not expect. + If this value is `false`, all formats will be analyzed, which some DLP agents may not expect. Regardless of this value, files will be analyzed as usual. The default is `true`. - - `ClipboardCopy`: controls web content copying data to the clipboard. + - `ClipboardCopy`: controls web content copying data to the clipboard (for paste operations, see `Clipboard`). - `Enabled`: indicates whether clipboard copy operations should use DLP. The default is false, so that existing DLP deployments are unaffected. - `PlainTextOnly`: indicates whether to only analyze the text/plain format being copied.