security.properties (17139B)
1 # This Source Code Form is subject to the terms of the Mozilla Public 2 # License, v. 2.0. If a copy of the MPL was not distributed with this 3 # file, You can obtain one at http://mozilla.org/MPL/2.0/. 4 5 # Mixed Content Blocker 6 # LOCALIZATION NOTE: "%1$S" is the URI of the blocked mixed content resource 7 BlockMixedDisplayContent = Blocked loading mixed display content “%1$S” 8 BlockMixedActiveContent = Blocked loading mixed active content “%1$S” 9 10 # CORS 11 # LOCALIZATION NOTE: Do not translate "Access-Control-Allow-Origin", Access-Control-Allow-Credentials, Access-Control-Allow-Methods, Access-Control-Allow-Headers 12 CORSDisabled=Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at %1$S. (Reason: CORS disabled). 13 CORSDidNotSucceed2=Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at %1$S. (Reason: CORS request did not succeed). Status code: %2$S. 14 CORSOriginHeaderNotAdded=Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at %1$S. (Reason: CORS header ‘Origin’ cannot be added). 15 CORSExternalRedirectNotAllowed=Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at %1$S. (Reason: CORS request external redirect not allowed). 16 CORSRequestNotHttp=Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at %1$S. (Reason: CORS request not http). 17 CORSMissingAllowOrigin2=Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at %1$S. (Reason: CORS header ‘Access-Control-Allow-Origin’ missing). Status code: %2$S. 18 CORSMultipleAllowOriginNotAllowed=Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at %1$S. (Reason: Multiple CORS header ‘Access-Control-Allow-Origin’ not allowed). 19 CORSAllowOriginNotMatchingOrigin=Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at %1$S. (Reason: CORS header ‘Access-Control-Allow-Origin’ does not match ‘%2$S’). 20 CORSNotSupportingCredentials=Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at ‘%1$S’. (Reason: Credential is not supported if the CORS header ‘Access-Control-Allow-Origin’ is ‘*’). 21 CORSMethodNotFound=Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at %1$S. (Reason: Did not find method in CORS header ‘Access-Control-Allow-Methods’). 22 CORSMissingAllowCredentials=Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at %1$S. (Reason: expected ‘true’ in CORS header ‘Access-Control-Allow-Credentials’). 23 CORSPreflightDidNotSucceed3=Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at %1$S. (Reason: CORS preflight response did not succeed). Status code: %2$S. 24 CORSInvalidAllowMethod=Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at %1$S. (Reason: invalid token ‘%2$S’ in CORS header ‘Access-Control-Allow-Methods’). 25 CORSInvalidAllowHeader=Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at %1$S. (Reason: invalid token ‘%2$S’ in CORS header ‘Access-Control-Allow-Headers’). 26 CORSMissingAllowHeaderFromPreflight2=Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at %1$S. (Reason: header ‘%2$S’ is not allowed according to header ‘Access-Control-Allow-Headers’ from CORS preflight response). 27 CORSAllowHeaderFromPreflightDeprecation=Cross-Origin Request Warning: The Same Origin Policy will disallow reading the remote resource at %1$S soon. (Reason: When the `Access-Control-Allow-Headers` is `*`, the `Authorization` header is not covered. To include the `Authorization` header, it must be explicitly listed in CORS header `Access-Control-Allow-Headers`). 28 29 # LOCALIZATION NOTE: Do not translate "Strict-Transport-Security", "HSTS", "max-age" or "includeSubDomains" 30 STSUnknownError=Strict-Transport-Security: An unknown error occurred processing the header specified by the site. 31 STSCouldNotParseHeader=Strict-Transport-Security: The site specified a header that could not be parsed successfully. 32 STSNoMaxAge=Strict-Transport-Security: The site specified a header that did not include a ‘max-age’ directive. 33 STSMultipleMaxAges=Strict-Transport-Security: The site specified a header that included multiple ‘max-age’ directives. 34 STSInvalidMaxAge=Strict-Transport-Security: The site specified a header that included an invalid ‘max-age’ directive. 35 STSMultipleIncludeSubdomains=Strict-Transport-Security: The site specified a header that included multiple ‘includeSubDomains’ directives. 36 STSInvalidIncludeSubdomains=Strict-Transport-Security: The site specified a header that included an invalid ‘includeSubDomains’ directive. 37 STSCouldNotSaveState=Strict-Transport-Security: An error occurred noting the site as a Strict-Transport-Security host. 38 39 InsecurePasswordsPresentOnPage=Password fields present on an insecure (http://) page. This is a security risk that allows user login credentials to be stolen. 40 InsecureFormActionPasswordsPresent=Password fields present in a form with an insecure (http://) form action. This is a security risk that allows user login credentials to be stolen. 41 InsecurePasswordsPresentOnIframe=Password fields present on an insecure (http://) iframe. This is a security risk that allows user login credentials to be stolen. 42 # LOCALIZATION NOTE: "%1$S" is the URI of the insecure mixed content resource 43 LoadingMixedActiveContent2=Loading mixed (insecure) active content “%1$S” on a secure page 44 LoadingMixedDisplayContent2=Loading mixed (insecure) display content “%1$S” on a secure page 45 # LOCALIZATION NOTE: "%S" is the URI of the insecure mixed content download 46 MixedContentBlockedDownload = Blocked downloading insecure content “%S”. 47 48 # LOCALIZATION NOTE: Do not translate "allow-scripts", "allow-same-origin", "sandbox" or "iframe" 49 BothAllowScriptsAndSameOriginPresent=An iframe which has both allow-scripts and allow-same-origin for its sandbox attribute can remove its sandboxing. 50 # LOCALIZATION NOTE: Do not translate "allow-top-navigation-by-user-activation", "allow-top-navigation", "sandbox" or "iframe" 51 BothAllowTopNavigationAndUserActivationPresent=An iframe which has both allow-top-navigation and allow-top-navigation-by-user-activation for its sandbox attribute will permit top navigations. 52 53 # Sub-Resource Integrity 54 # LOCALIZATION NOTE: Do not translate "script" or "integrity". "%1$S" is the invalid token found in the attribute. 55 MalformedIntegrityHash=The script element has a malformed hash in its integrity attribute: “%1$S”. The correct format is “<hash algorithm>-<hash value>”. 56 # LOCALIZATION NOTE: Do not translate "integrity" 57 InvalidIntegrityLength=The hash contained in the integrity attribute has the wrong length. 58 # LOCALIZATION NOTE: Do not translate "integrity" 59 InvalidIntegrityBase64=The hash contained in the integrity attribute could not be decoded. 60 # LOCALIZATION NOTE: Do not translate "integrity". "%1$S" is the type of hash algorithm in use (e.g. "sha256"). "%2$S" is the URI of the sub-resource. "%3$S" is the hash value we saw. 61 IntegrityMismatch3=None of the “%1$S” hashes in the integrity attribute match the content of the subresource at “%2$S”. The computed hash is “%3$S”. 62 # LOCALIZATION NOTE: "%1$S" is the URI of the sub-resource that cannot be protected using SRI. 63 IneligibleResource=“%1$S” is not eligible for integrity checks since it’s neither CORS-enabled nor same-origin. 64 # LOCALIZATION NOTE: Do not translate "integrity". "%1$S" is the invalid hash algorithm found in the attribute. 65 UnsupportedHashAlg=Unsupported hash algorithm in the integrity attribute: “%1$S” 66 # LOCALIZATION NOTE: Do not translate "integrity" 67 NoValidMetadata=The integrity attribute does not contain any valid metadata. 68 69 # LOCALIZATION NOTE: Do not translate "RC4". 70 WeakCipherSuiteWarning=This site uses the cipher RC4 for encryption, which is deprecated and insecure. 71 72 DeprecatedTLSVersion2=This site uses a deprecated version of TLS. Please upgrade to TLS 1.2 or 1.3. 73 74 #XCTO: nosniff 75 # LOCALIZATION NOTE: Do not translate "X-Content-Type-Options: nosniff". 76 MimeTypeMismatch2=The resource from “%1$S” was blocked due to MIME type (“%2$S”) mismatch (X-Content-Type-Options: nosniff). 77 # LOCALIZATION NOTE: Do not translate "X-Content-Type-Options" and also do not translate "nosniff". 78 XCTOHeaderValueMissing=X-Content-Type-Options header warning: value was “%1$S”; did you mean to send “nosniff”? 79 # LOCALIZATION NOTE: Do not translate "X-Content-Type-Options" and also do not translate "nosniff". 80 XTCOWithMIMEValueMissing=The resource from “%1$S” was not rendered due to an unknown, incorrect or missing MIME type (X-Content-Type-Options: nosniff). 81 82 BlockScriptWithWrongMimeType2=Script from “%1$S” was blocked because of a disallowed MIME type (“%2$S”). 83 WarnScriptWithWrongMimeType=The script from “%1$S” was loaded even though its MIME type (“%2$S”) is not a valid JavaScript MIME type. 84 # LOCALIZATION NOTE: Do not translate "importScripts()" 85 BlockImportScriptsWithWrongMimeType=Loading script from “%1$S” with importScripts() was blocked because of a disallowed MIME type (“%2$S”). 86 BlockWorkerWithWrongMimeType=Loading Worker from “%1$S” was blocked because of a disallowed MIME type (“%2$S”). 87 BlockModuleWithWrongMimeType=Loading module from “%1$S” was blocked because of a disallowed MIME type (“%2$S”). 88 BlockJsonModuleWithWrongMimeType=Loading JSON module from “%1$S” was blocked because of a disallowed MIME type (“%2$S”). 89 90 # LOCALIZATION NOTE: Do not translate "data: URI". 91 BlockTopLevelDataURINavigation=Navigation to toplevel data: URI not allowed (Blocked loading of: “%1$S”) 92 BlockRedirectToDataURI=Redirecting to data: URI not allowed (Blocked loading of: “%1$S”) 93 94 # LOCALIZATION NOTE: Do not translate "file: URI". “%1$S” is the whole URI of the loaded file. “%2$S” is the MIME type e.g. "text/plain". 95 BlockFileScriptWithWrongMimeType=Loading script from file: URI (“%1$S”) was blocked because its MIME type (“%2$S”) is not a valid JavaScript MIME type. 96 97 # LOCALIZATION NOTE: “%S” is the whole URI of the loaded file. 98 BlockExtensionScriptWithWrongExt=Loading script with URI “%S” was blocked because the file extension is not allowed. 99 100 RestrictBrowserEvalUsage=eval() and eval-like uses are not allowed in the Parent Process or in System Contexts (Blocked usage in “%1$S”) 101 102 # LOCALIZATION NOTE (MixedContentAutoUpgrade): 103 # %1$S is the URL of the upgraded request; %2$S is the upgraded scheme. 104 MixedContentAutoUpgrade=Upgrading insecure display request ‘%1$S’ to use ‘%2$S’ 105 # LOCALIZATION NOTE (RunningClearSiteDataValue): 106 # %S is the URI of the resource whose data was cleaned up 107 RunningClearSiteDataValue=Clear-Site-Data header forced the clean up of “%S” data. 108 UnknownClearSiteDataValue=Clear-Site-Data header found. Unknown value “%S”. 109 110 # Reporting API 111 ReportingHeaderInvalidJSON=Reporting Header: invalid JSON value received. 112 ReportingHeaderInvalidNameItem=Reporting Header: invalid name for group. 113 ReportingHeaderDuplicateGroup=Reporting Header: ignoring duplicated group named “%S”. 114 ReportingHeaderInvalidItem=Reporting Header: ignoring invalid item named “%S”. 115 ReportingHeaderInvalidEndpoint=Reporting Header: ignoring invalid endpoint for item named “%S”. 116 # LOCALIZATION NOTE(ReportingHeaderInvalidURLEndpoint): %1$S is the invalid URL, %2$S is the group name 117 ReportingHeaderInvalidURLEndpoint=Reporting Header: ignoring invalid endpoint URL “%1$S” for item named “%2$S”. 118 119 FeaturePolicyUnsupportedFeatureName=Feature Policy: Skipping unsupported feature name “%S”. 120 # TODO: would be nice to add a link to the Feature-Policy MDN documentation here. See bug 1449501 121 FeaturePolicyInvalidEmptyAllowValue= Feature Policy: Skipping empty allow list for feature: “%S”. 122 # TODO: would be nice to add a link to the Feature-Policy MDN documentation here. See bug 1449501 123 FeaturePolicyInvalidAllowValue=Feature Policy: Skipping unsupported allow value “%S”. 124 125 # LOCALIZATION NOTE: "%1$S" is the limitation length (bytes) of referrer URI, "%2$S" is the origin of the referrer URI. 126 ReferrerLengthOverLimitation=HTTP Referrer header: Length is over “%1$S” bytes limit - stripping referrer header down to origin: “%2$S” 127 # LOCALIZATION NOTE: "%1$S" is the limitation length (bytes) of referrer URI, "%2$S" is the origin of the referrer URI. 128 ReferrerOriginLengthOverLimitation=HTTP Referrer header: Length of origin within referrer is over “%1$S” bytes limit - removing referrer with origin “%2$S”. 129 130 # LOCALIZATION NOTE: Do not translate "no-referrer-when-downgrade", "origin-when-cross-origin" and "unsafe-url". %S is the URI of the loading channel. 131 ReferrerPolicyDisallowRelaxingWarning=Referrer Policy: Less restricted policies, including ‘no-referrer-when-downgrade’, ‘origin-when-cross-origin’ and ‘unsafe-url’, will be ignored soon for the cross-site request: %S 132 # LOCALIZATION NOTE: %1$S is the ignored referrer policy, %2$S is the URI of the loading channel. 133 ReferrerPolicyDisallowRelaxingMessage=Referrer Policy: Ignoring the less restricted referrer policy “%1$S” for the cross-site request: %2$S 134 135 # X-Frame-Options 136 # LOCALIZATION NOTE(XFrameOptionsInvalid): %1$S is the header value, %2$S is frame URI. Do not translate "X-Frame-Options". 137 XFrameOptionsInvalid = Invalid X-Frame-Options header was found when loading “%2$S”: “%1$S” is not a valid directive. 138 # LOCALIZATION NOTE(XFrameOptionsDeny): %1$S is the header value, %2$S is frame URI and %3$S is the parent document URI. Do not translate "X-Frame-Options". 139 XFrameOptionsDeny=The loading of “%2$S” in a frame is denied by “X-Frame-Options“ directive set to “%1$S“. 140 141 # HTTPS-Only Mode 142 # LOCALIZATION NOTE: %1$S is the URL of the upgraded request; %2$S is the upgraded scheme. 143 HTTPSOnlyUpgradeRequest = Upgrading insecure request “%1$S” to use “%2$S”. 144 # LOCALIZATION NOTE: %1$S is the URL of request. 145 HTTPSOnlyNoUpgradeException = Not upgrading insecure request “%1$S” because it is exempt. 146 # LOCALIZATION NOTE: %1$S is the URL of the failed request; %2$S is an error-code. 147 HTTPSOnlyFailedRequest = Upgrading insecure request “%1$S” failed. (%2$S) 148 # LOCALIZATION NOTE: %S is the URL of the failed request; 149 HTTPSOnlyFailedDowngradeAgain = Upgrading insecure request “%S” failed. Downgrading to “http” again. 150 # LOCALIZATION NOTE: Hints or indicates a new transaction for a URL is likely coming soon. We use 151 # a speculative connection to start a TCP connection so that the resource is immediately ready 152 # when the transaction is actually submitted. HTTPS-Only and HTTPS-First will upgrade such 153 # speculative TCP connections from http to https. 154 # %1$S is the URL of the upgraded speculative TCP connection; %2$S is the upgraded scheme. 155 HTTPSOnlyUpgradeSpeculativeConnection = Upgrading insecure speculative TCP connection “%1$S” to use “%2$S”. 156 157 HTTPSFirstSchemeless = Upgrading URL loaded in the address bar without explicit protocol scheme to use HTTPS. 158 # LOCALIZATION NOTE: %S is the hostname for which a exception will be added; 159 HTTPSFirstAddingException = Adding exception to temporarily prevent further attempts to automatically load “http://%S” securely. 160 161 # LOCALIZATION NOTE: %S is the URL of the blocked request; 162 IframeSandboxBlockedDownload = Download of “%S” was blocked because the triggering iframe has the sandbox flag set. 163 164 # LOCALIZATION NOTE: %S is the URL of the blocked request; 165 SandboxBlockedCustomProtocols = Blocked navigation to custom protocol “%S” from a sandboxed context. 166 167 # Sanitizer API 168 # LOCALIZATION NOTE: Do not translate Sanitizer, allowElement, attributes, removeAttributes or removeElements. 169 SanitizerAllowElementIgnored2 = Sanitizer: Calling allowElement() with “attributes” or non-empty “removeAttributes” was ignored because of the global “removeElements” list. 170 171 # LOCALIZATION NOTE: %S is the URI of the blocked script. 172 IntegrityPolicyEnforceBlockedScript = The page’s settings blocked a script at %S from being loaded because it is missing integrity metadata. 173 # LOCALIZATION NOTE: %S is the URI of the blocked script. 174 IntegrityPolicyReportOnlyBlockedScript = (Report-Only policy) The page’s settings would block a script at %S from being loaded because it is missing integrity metadata. 175 176 # LOCALIZATION NOTE: %S is the URI of the blocked stylesheet. 177 IntegrityPolicyEnforceBlockedStylesheet = The page’s settings blocked a stylesheet at %S from being loaded because it is missing integrity metadata. 178 # LOCALIZATION NOTE: %S is the URI of the blocked stylesheet. 179 IntegrityPolicyReportOnlyBlockedStylesheet = (Report-Only policy) The page’s settings would block a stylesheet at %S from being loaded because it is missing integrity metadata.