November 2014 - tbb-commits - lists.torproject.org

[torbutton/master] Bug 13742: Remove SafeCache code (in favor of C++ implementation)
by mikeperry＠torproject.org 13 Nov '14

13 Nov '14

commit 1dedacb01855cab10835d165578575603a208cec Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Wed Nov 12 19:38:37 2014 -0800 Bug 13742: Remove SafeCache code (in favor of C++ implementation) --- src/chrome/content/stanford-safecache.js | 448 ------------------------------ src/chrome/content/torbutton.xul | 4 - 2 files changed, 452 deletions(-) diff --git a/src/chrome/content/stanford-safecache.js b/src/chrome/content/stanford-safecache.js deleted file mode 100644 index 0ef52ad..0000000 --- a/src/chrome/content/stanford-safecache.js +++ /dev/null @@ -1,448 +0,0 @@ -// Bug 1506 P3: This file provides important cache isolation properties, -// but it is not very useful without a patched Firefox to go with it. -// It could probably also use some refactoring into an XPCOM component. -// It is currently registered from torbutton.js's "main window" observers, -// which is not the right place. - -/* - -Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: - - * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. - * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. - * Neither the name of Stanford University nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. - -THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - -*/ -// Dual-keyed cache/cookie same-origin policy -// Ensures that cache and cookies set in HTTP headers cannot be used for -// non-cooperative or semi-cooperative tracking. -// -// Author: Edward Pastuszenski -// -// Based on Stanford SafeCache -// Author: Collin Jackson -// Other contributors: Andrew Bortz, John Mitchell, Dan Boneh -// - -////////////////////////////////////////////////////////////////////////////// -// Constants - -const kSSC_ENABLED_PREF = "extensions.torbutton.safecache"; -const kSSC_SC_ENABLED_PREF = "extensions.torbutton.dual_key_cookies"; -const kSSC_TORBUTTON_PREF = "extensions.torbutton.tor_enabled"; -const kSSC_COOKIE_JS_PREF = "extensions.torbutton.cookie_js_allow"; - -//////////////////////////////////////////////////////////////////////////// -// Debug stuff - -/** - * Dump information to the console? - */ -var SSC_debug = true; - -/** - * Sends data to the console if we're in debug mode - * @param msg The string containing the message to display - */ -function SSC_dump(msg) { - if (SSC_debug) - torbutton_log(3, "SSC: " + msg); -} - -//////////////////////////////////////////////////////////////////////////// -// "Major" objects/classes - -/** - * SafeCache HTTP Request Listener - * Watches for the authentication requests and presents password dialog - */ - -function SSC_RequestListener(controller) { - this.controller = controller; - this.thirdPartyUtil = Cc["@mozilla.org/thirdpartyutil;1"]. - getService(Ci.mozIThirdPartyUtil); - this.cookie_permissions = Cc["@mozilla.org/cookie/permission;1"]. - getService(Ci.nsICookiePermission); -} - -SSC_RequestListener.prototype = -{ - controller: null, // The SSC_Controller that created this - - observe: function(subject, topic, data) { - try { - if(this.controller.getEnabled() == 2) return; - if(this.controller.getEnabled() == 1 - && !this.controller.getTorButton()) return; - if (topic == 'http-on-modify-request') { - subject.QueryInterface(Components.interfaces.nsIHttpChannel); - subject.QueryInterface(Components.interfaces.nsIHttpChannelInternal); - subject.QueryInterface(Components.interfaces.nsICachingChannel); - subject.QueryInterface(Components.interfaces.nsIChannel); - this.onModifyRequest(subject); - } else if (topic == 'http-on-examine-response') { - subject.QueryInterface(Components.interfaces.nsIHttpChannel); - subject.QueryInterface(Components.interfaces.nsIHttpChannelInternal); - subject.QueryInterface(Components.interfaces.nsICachingChannel); - subject.QueryInterface(Components.interfaces.nsIChannel); - this.onExamineResponse(subject); - } - } catch(e) {try {torbutton_log(4, "SSC: "+e);} catch(ex) {}} - }, - - bypassCache: function(channel) { - channel.loadFlags |= channel.LOAD_BYPASS_CACHE; - // INHIBIT_PERSISTENT_CACHING instead? - channel.cacheKey = this.newCacheKey(0); - SSC_dump("Bypassed cache for " + channel.URI.spec); - }, - - setCacheKey: function(channel, str) { - try { - channel.cacheDomain = str; - SSC_dump("Set cacheDomain to "+str+" for "+channel.URI.spec); - } catch(e) { - var oldData = this.readCacheKey(channel); - var newKey = this.newCacheKey(this.getHash(str) + oldData); - channel.cacheKey = newKey; - SSC_dump("Set cache key to hash(" + str + ") = " + - newKey.data + " for " + channel.URI.spec); - } - }, - - onModifyRequest: function(channel) { - var parent_host = null; - var parent_spec = null; - if (channel.notificationCallbacks || - channel.loadGroup && channel.loadGroup.notificationCallbacks) { - var callbacks = null; - if (channel.notificationCallbacks) { - callbacks = channel.notificationCallbacks; - } else { - callbacks = channel.loadGroup.notificationCallbacks; - } - try { - var wind = callbacks.QueryInterface( - Components.interfaces.nsIInterfaceRequestor).getInterface( - Components.interfaces.nsIDOMWindow); - parent_host = wind.window.top.location.hostname; - parent_spec = wind.window.top.location.href; - } catch(e) { - } - SSC_dump("Parent "+parent_host+" for "+ channel.URI.spec); - } - - if (channel.documentURI && channel.documentURI == channel.URI) { - parent_host = null; // first party interaction - parent_spec = null; - } else if(!parent_host) { - // Questionable first party interaction.. - try { - var anuri = null; - try { - anuri = this.thirdPartyUtil.getFirstPartyURIFromChannel(channel, false); - } catch (e) { - torbutton_safelog(2, "FirstParty API failed to get parent: "+e+" ", channel.URI.spec); - // We are not using the TBB based on ESR 24. Falling back to the old - // method. - anuri = this.cookie_permissions.getOriginatingURI(channel); - } - parent_host = anuri.host; - parent_spec = anuri.spec; - } catch(e) { - // XXX: This can still fail for OCSP and other windowless requests.. - torbutton_safelog(3, "Cookie API failed to get parent: "+e+" ",channel.URI.spec); - if (!channel.referrer) { - torbutton_safelog(3, "SSC: No cache isolation parent for ", channel.URI.spec); - } else { - parent_host = channel.referrer.host; - parent_spec = channel.referrer.spec; - } - } - } - - // Same-origin policy - var referrer; - if (parent_host && parent_host != channel.URI.host) { - SSC_dump("Segmenting " + channel.URI.spec + - " content loaded by " + parent_host); - this.setCacheKey(channel, parent_host); - referrer = parent_host; - try { - // Disable 3rd party http auth, but exempt the browser (for favicon loads) - // FIXME: Hrmm, this is just going to disable auth for 3rd party domains. - // It would be better if we could isolate the auth, but still - // allow it to be transmitted.. But I guess, who still uses http auth anyways? - if (channel.getRequestHeader("Authorization") !== null) { - if (parent_spec == "chrome://browser/content/browser.xul") { - torbutton_log(3, "Allowing auth for browser load of "+channel.URI.spec); - } else { - torbutton_safelog(4, "Removing 3rd party HTTP auth for url ", - channel.URI.spec+", parent: "+parent_spec); - channel.setRequestHeader("Authorization", null, false); - channel.setRequestHeader("Pragma", null, false); - channel.setRequestHeader("Cache-Control", null, false); - } - } - } catch (e) {} - } else { - referrer = channel.URI.host; - if(!this.readCacheKey(channel)) { - this.setCacheKey(channel, channel.URI.host); - } else { - SSC_dump("Existing cache key detected; leaving it unchanged."); - } - } - - if (this.controller.getBlockThirdPartyCache()) { - if(parent_host && parent_host != channel.URI.host) { - //SSC_dump("Third party cache blocked for " + channel.URI.spec + - //" content loaded by " + parent_host); - this.bypassCache(channel); - } - } - - var cookie = null; - if (this.controller.getSafeCookieEnabled()) { - try{ - cookie = channel.getRequestHeader("Cookie"); - //SSC_dump("Cookie: " + cookie); - } catch(e) {cookie = null;} - } - - if(cookie) { - //Strip the secondary key from every referrer-matched cookie - var newHeader = ""; - var i = 0; - var lastStart = 0; - //State 0: no information on next cookie - //State 1: cookie will be sent. - //State 2: cookie will not be sent. - var state = 0; - while (i < cookie.length) { - //Dual-keyed cookie - if(state == 0 && cookie.charAt(i) == '|'){ - //If referrers match, strip key and send cookie - var cookieReferrer = cookie.toString().substr(lastStart, i - lastStart); - if (referrer == cookieReferrer){ - lastStart = i+1; - state = 1; - } else { - state = 2; - } - } - //Single-keyed cookie that was set via scripting. - if (state == 0 && cookie.charAt(i) == '='){ - if(this.controller.getCookieJS()) state = 1; - else { - if (referrer == channel.getRequestHeader("Host")) state = 1; - else state = 2; - } - } - //End of a cookie - if (cookie.charAt(i) == ';') { - var thisCookie = cookie.toString().substr(lastStart, i - lastStart + 2); - if (state == 1){ - newHeader += thisCookie; - } - if (state == 2){ - SSC_dump("Declining to send " + thisCookie + - " for request by embedded domain " + channel.URI.host + - + " " + channel.getRequestHeader("Host") + - " on embedding page " + referrer); - } - lastStart = i+2; - state = 0; - } - //End of the string - if (i == cookie.length - 1){ - thisCookie = cookie.toString().substr(lastStart, i - lastStart + 1); - if (state == 1){ - newHeader += thisCookie; - } - if (state == 2){ - SSC_dump("Declining to send " + thisCookie + - " for request by embedded domain " + channel.URI.host + - + " " + channel.getRequestHeader("Host") + - " on embedding page " + referrer); - } - lastStart = i+1; - } - i++; - } - channel.setRequestHeader("Cookie", newHeader, false); - } - - }, - - onExamineResponse: function(channel) { - var setCookie; - try{ - setCookie = channel.getResponseHeader("Set-Cookie"); - } catch(e) {setCookie = null;} - - if(setCookie) { - var parent = null; - // XXX: need to use loadGroup here if null.. - if (channel.notificationCallbacks) { - var wind = channel.notificationCallbacks.QueryInterface( - Components.interfaces.nsIInterfaceRequestor).getInterface( - Components.interfaces.nsIDOMWindow); - parent = wind.window.top.location; - } - - if (channel.documentURI && channel.documentURI == channel.URI) { - parent = null; // first party interaction - } - - var referrer; - // Same-origin policy - if (parent && parent.hostname != channel.URI.host) { - //SSC_dump("Segmenting " + channel.URI.host + - //" content loaded by " + parent.host); - referrer = parent.hostname; - } else { - referrer = channel.URI.host; - } - //Dual-key each cookie set in the header - var newHeader = ""; - var i = 0; - var lastStart = 0; - //Some messy code that prevents multiple embedding-domain keys - //from being concatenated to cookie names. - var passedname = false; - var namebar = false; - while (i < setCookie.length) { - if (setCookie.charAt(i) == '=') passedname = true; - else if (setCookie.charAt(i) == '|' && passedname == false) - namebar = true; - if (i == setCookie.length - 1 || setCookie.charAt(i) == '\n'){ - if(!namebar){ - newHeader += referrer + "|" + - setCookie.toString().substr(lastStart, i - lastStart + 1); - } - lastStart = i+1; - passedname = false; - namebar = false; - } - i++; - } - //SSC_dump("MODIFIED Set-Cookie: " + newHeader); - channel.setResponseHeader("Set-Cookie", newHeader, false); - } - }, - - // Read the integer data contained in a cache key - readCacheKey: function(channel) { - try { - return channel.cacheDomain; - } catch(e) { - channel.cacheKey.QueryInterface(Components.interfaces.nsISupportsPRUint32); - return channel.cacheKey.data; - } - }, - - // Construct a new cache key with some integer data - newCacheKey: function(data) { - var cacheKey = - Components.classes["@mozilla.org/supports-PRUint32;1"] - .createInstance(Components.interfaces.nsISupportsPRUint32); - cacheKey.data = data; - return cacheKey; - }, - - strMD5: function(str) { - var converter = - Components.classes["@mozilla.org/intl/scriptableunicodeconverter"]. - createInstance(Components.interfaces.nsIScriptableUnicodeConverter); - - // nsIURI.host is UTF-8 - converter.charset = "UTF-8"; - // result.value will contain the array length - var result = {}; - // data is an array of bytes - var data = converter.convertToByteArray(str, result); - var ch = Components.classes["@mozilla.org/security/hash;1"] - .createInstance(Components.interfaces.nsICryptoHash); - ch.init(ch.MD5); - ch.update(data, data.length); - return ch.finish(false); - }, - - // Get an integer hash of a string - getHash: function(str) { - var hash = this.strMD5(str); - var intHash = 0; - for(var i = 0; i < hash.length && i < 8; i++) - intHash += hash.charCodeAt(i) << (i << 3); - return intHash; - }, -} - -/** - * Master control object. Adds and removes the RequestListener - */ -function SSC_Controller() { - this.prefs = Components.classes["@mozilla.org/preferences-service;1"] - .getService(Components.interfaces.nsIPrefService); - this.addListener(new SSC_RequestListener(this)); -} - -SSC_Controller.prototype = { - - getEnabled: function() { - return (this.prefs.getIntPref(kSSC_ENABLED_PREF)); - }, - - getSafeCookieEnabled: function() { - return (this.prefs.getBoolPref(kSSC_SC_ENABLED_PREF)); - }, - - getBlockThirdPartyCache: function() { - // Meh, no pref for now. Always allow. - return false; - }, - - getTorButton: function() { - return (this.prefs.getBoolPref(kSSC_TORBUTTON_PREF)); - }, - - getCookieJS: function() { - return (this.prefs.getBoolPref(kSSC_COOKIE_JS_PREF)); - }, - - addListener: function(listener) { - this.listener = listener; - var observerService = - Components.classes["@mozilla.org/observer-service;1"] - .getService(Components.interfaces.nsIObserverService); - observerService.addObserver(listener, "http-on-modify-request", false); - // XXX: We need an observer to add this listener when the pref gets set - if (this.getSafeCookieEnabled()) { - observerService.addObserver(listener, "http-on-examine-response", false); - } - }, - - removeListener: function() { - var observerService = - Components.classes["@mozilla.org/observer-service;1"] - .getService(Components.interfaces.nsIObserverService); - observerService.removeObserver(this.listener, "http-on-modify-request"); - if (this.getSafeCookieEnabled()) { - observerService.removeObserver(this.listener, "http-on-examine-response"); - } - }, -} - -//////////////////////////////////////////////////////////////////////////// -// Global stuff -// "What script would be complete without a couple of globals?" --Fritz - -var SSC_controller; - -function SSC_startup() { - if(!SSC_controller) SSC_controller = new SSC_Controller(); - SSC_dump("Loaded controller"); -} diff --git a/src/chrome/content/torbutton.xul b/src/chrome/content/torbutton.xul index 00dc6f0..95624f0 100644 --- a/src/chrome/content/torbutton.xul +++ b/src/chrome/content/torbutton.xul @@ -6,10 +6,6 @@ <overlay id="torbutton-overlay" xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"> - -  - <script src="chrome://torbutton/content/stanford-safecache.js" /> - <script type="application/x-javascript" src="chrome://torbutton/content/torbutton_util.js" /> <script type="application/x-javascript" src="chrome://torbutton/content/tor-circuit-display.js" /> <script type="application/x-javascript" src="chrome://torbutton/content/torbutton.js" />

1 0

[torbutton/master] Changelog and version bump for 1.8.1.0.
by mikeperry＠torproject.org 13 Nov '14

13 Nov '14

commit c711366237e8838e0c00974a5385d17551203c2b Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Wed Nov 12 19:42:49 2014 -0800 Changelog and version bump for 1.8.1.0. --- src/CHANGELOG | 4 ++++ src/install.rdf | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/src/CHANGELOG b/src/CHANGELOG index 53bb7c7..4510b0c 100644 --- a/src/CHANGELOG +++ b/src/CHANGELOG @@ -1,3 +1,7 @@ +1.8.1.0 + * Bug 13746: Properly link Torbutton UI to thirdparty pref. + * Bug 13742: Remove SafeCache code (in favor of C++ implementation) + 1.8.0.3 * misc: Translation imports for security slider diff --git a/src/install.rdf b/src/install.rdf index febbd6e..402b99c 100644 --- a/src/install.rdf +++ b/src/install.rdf @@ -6,7 +6,7 @@ <em:name>Torbutton</em:name> <em:creator>Mike Perry</em:creator> <em:id>torbutton(a)torproject.org</em:id> - <em:version>1.8.0.3</em:version> + <em:version>1.8.1.0</em:version> <em:homepageURL>https://www.torproject.org/projects/torbrowser.html.en</em:homepageURL> <em:optionsURL>chrome://torbutton/content/preferences.xul</em:optionsURL> <em:iconURL>chrome://torbutton/skin/tor.png</em:iconURL>

1 0

[torbutton/master] Update translations.
by mikeperry＠torproject.org 13 Nov '14

13 Nov '14

commit 952518c2f1ef29bbad191523ab9ae7a8204ba18f Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Wed Nov 12 19:44:54 2014 -0800 Update translations. --- src/chrome/locale/it/torbutton.dtd | 14 +++++++------- src/chrome/locale/pt/torbutton.dtd | 14 +++++++------- 2 files changed, 14 insertions(+), 14 deletions(-) diff --git a/src/chrome/locale/it/torbutton.dtd b/src/chrome/locale/it/torbutton.dtd index c8a0669..11741a7 100644 --- a/src/chrome/locale/it/torbutton.dtd +++ b/src/chrome/locale/it/torbutton.dtd @@ -44,7 +44,7 @@ <!ENTITY torbutton.context_menu.openTorWindow.key "d"> <!ENTITY torbutton.button.label "Torbutton"> <!ENTITY torbutton.button.tooltip "Fai clic per inizializzare Torbutton"> -<!ENTITY torbutton.prefs.privacy_security_settings "Privacy and Security Settings"> +<!ENTITY torbutton.prefs.privacy_security_settings "Impostazioni di Privacy e Sicurezza"> <!ENTITY torbutton.prefs.block_thread "Blocca la lettura della cronologia durante l'uso di Tor (essenziale)"> <!ENTITY torbutton.prefs.block_thwrite "Blocca la scrittura della cronologia durante l'uso di Tor (consigliato)"> <!ENTITY torbutton.prefs.block_nthread "Blocca la lettura della cronologia quando non si usa Tor (facoltativo)"> @@ -149,9 +149,9 @@ <!ENTITY torbutton.prefs.restrict_thirdparty "Limita i cookie di terze parti e altri dati di tracciamento"> <!ENTITY torbutton.prefs.block_plugins "Disabilita i plugin del browser (come Flash)"> <!ENTITY torbutton.prefs.resist_fingerprinting "Cambia i dettagli che ti distinguono dagli altri utenti di Tor Browser"> -<!ENTITY torbutton.prefs.sec_caption "Security Level"> -<!ENTITY torbutton.prefs.sec_low "Low (default)"> -<!ENTITY torbutton.prefs.sec_med_low "Medium-Low"> -<!ENTITY torbutton.prefs.sec_med_high "Medium-High"> -<!ENTITY torbutton.prefs.sec_high "High"> -<!ENTITY torbutton.prefs.sec_custom "Custom Values"> +<!ENTITY torbutton.prefs.sec_caption "Livello di Sicurezza"> +<!ENTITY torbutton.prefs.sec_low "Basso (default)"> +<!ENTITY torbutton.prefs.sec_med_low "Medio-Basso"> +<!ENTITY torbutton.prefs.sec_med_high "Medio-Alto"> +<!ENTITY torbutton.prefs.sec_high "Alto"> +<!ENTITY torbutton.prefs.sec_custom "Valori Customizzabili"> diff --git a/src/chrome/locale/pt/torbutton.dtd b/src/chrome/locale/pt/torbutton.dtd index c7388a2..d2b83a9 100644 --- a/src/chrome/locale/pt/torbutton.dtd +++ b/src/chrome/locale/pt/torbutton.dtd @@ -44,7 +44,7 @@ <!ENTITY torbutton.context_menu.openTorWindow.key "d"> <!ENTITY torbutton.button.label "Torbutton"> <!ENTITY torbutton.button.tooltip "Clique para iniciar o Torbutton"> -<!ENTITY torbutton.prefs.privacy_security_settings "Privacy and Security Settings"> +<!ENTITY torbutton.prefs.privacy_security_settings "Privacidade e Definições de Segurança"> <!ENTITY torbutton.prefs.block_thread "Bloquear leitura do histórico durante a utilização do Tor (crucial)"> <!ENTITY torbutton.prefs.block_thwrite "Bloquear escrita no histórico durante a utilização do Tor (recomendado)"> <!ENTITY torbutton.prefs.block_nthread "Bloquear leitura do histórico durante a não utilização do Tor (opcional)"> @@ -149,9 +149,9 @@ <!ENTITY torbutton.prefs.restrict_thirdparty "Restrict third party cookies and other tracking data"> <!ENTITY torbutton.prefs.block_plugins "Desabilitar plugins (como o Flash)"> <!ENTITY torbutton.prefs.resist_fingerprinting "Change details that distinguish you from other Tor Browser users"> -<!ENTITY torbutton.prefs.sec_caption "Security Level"> -<!ENTITY torbutton.prefs.sec_low "Low (default)"> -<!ENTITY torbutton.prefs.sec_med_low "Medium-Low"> -<!ENTITY torbutton.prefs.sec_med_high "Medium-High"> -<!ENTITY torbutton.prefs.sec_high "High"> -<!ENTITY torbutton.prefs.sec_custom "Custom Values"> +<!ENTITY torbutton.prefs.sec_caption "Nível de Segurança"> +<!ENTITY torbutton.prefs.sec_low "Baixo (pré-definido)"> +<!ENTITY torbutton.prefs.sec_med_low "Médio-Baixo"> +<!ENTITY torbutton.prefs.sec_med_high "Médio-Alto"> +<!ENTITY torbutton.prefs.sec_high "Alto"> +<!ENTITY torbutton.prefs.sec_custom "Valores definidos">

1 0

[torbutton/master] Bug 13746: Properly link Torbutton UI to thirdparty pref.
by mikeperry＠torproject.org 13 Nov '14

13 Nov '14

commit 25c576f13caa3d30c872876c1cab0eb3b4845af7 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Wed Nov 12 16:28:31 2014 -0800 Bug 13746: Properly link Torbutton UI to thirdparty pref. --- src/chrome/content/torbutton.js | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/src/chrome/content/torbutton.js b/src/chrome/content/torbutton.js index cd5f2dc..841dca8 100644 --- a/src/chrome/content/torbutton.js +++ b/src/chrome/content/torbutton.js @@ -2120,7 +2120,11 @@ function torbutton_update_thirdparty_prefs() { var mode = m_tb_prefs.getBoolPref("extensions.torbutton.restrict_thirdparty"); try { - m_tb_prefs.setBoolPref("privacy.thirdparty.isolate", mode); + if (mode) { + m_tb_prefs.setIntPref("privacy.thirdparty.isolate", 2); + } else { + m_tb_prefs.setIntPref("privacy.thirdparty.isolate", 0); + } } catch(e) {} if (mode) { @@ -2130,7 +2134,6 @@ function torbutton_update_thirdparty_prefs() { } pref("security.enable_tls_session_tickets", !mode); - pref("network.http.spdy.enabled", !mode); // Force prefs to be synced to disk var prefService = Components.classes["@mozilla.org/preferences-service;1"]

1 0

[tor-browser/tor-browser-31.2.0esr-4.5-1] fixup! TB4: Tor Browser's Firefox preference overrides.
by mikeperry＠torproject.org 13 Nov '14

13 Nov '14

commit 102676cb7ebc3bdbef21cce20516a50788c5e416 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Wed Nov 12 16:19:56 2014 -0800 fixup! TB4: Tor Browser's Firefox preference overrides. Bug #13742: Always enforce third party isolation. --- browser/app/profile/000-tor-browser.js | 1 + 1 file changed, 1 insertion(+) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 83b79b2..b6930a4 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -93,6 +93,7 @@ pref("security.enable_tls_session_tickets", false); pref("network.http.spdy.enabled", false); // Stores state and may have keepalive issues (both fixable) pref("network.http.spdy.enabled.v2", false); // Seems redundant, but just in case pref("network.http.spdy.enabled.v3", false); // Seems redundant, but just in case +pref("privacy.thirdparty.isolate", 2); // Always enforce third party isolation // Proxy and proxy security pref("network.proxy.socks", "127.0.0.1");

1 0

[tor-browser/tor-browser-31.2.0esr-4.5-1] Bug 13742: Isolate cache to URL bar domain.
by mikeperry＠torproject.org 13 Nov '14

13 Nov '14

commit 8425b9a358211777543303d2194b378b2765f144 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Wed Nov 12 16:16:40 2014 -0800 Bug 13742: Isolate cache to URL bar domain. --- netwerk/protocol/http/nsHttpChannel.cpp | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/netwerk/protocol/http/nsHttpChannel.cpp b/netwerk/protocol/http/nsHttpChannel.cpp index 41ef8bb..6e8fa0b 100644 --- a/netwerk/protocol/http/nsHttpChannel.cpp +++ b/netwerk/protocol/http/nsHttpChannel.cpp @@ -66,6 +66,7 @@ #include "nsPerformance.h" #include "CacheObserver.h" #include "mozilla/Telemetry.h" +#include "mozIThirdPartyUtil.h" namespace mozilla { namespace net { @@ -2558,6 +2559,19 @@ nsHttpChannel::OpenCacheEntry(bool usingSSL) nsRefPtr<LoadContextInfo> info = GetLoadContextInfo(this); nsCOMPtr<nsICacheStorage> cacheStorage; nsCOMPtr<nsIURI> openURI; + + /* Obtain optional third party isolation domain */ + nsAutoCString cacheDomain; + nsCOMPtr<nsIURI> firstPartyIsolationURI; + nsCOMPtr<mozIThirdPartyUtil> thirdPartySvc + = do_GetService(THIRDPARTYUTIL_CONTRACTID); + rv = thirdPartySvc->GetFirstPartyIsolationURI(this, nullptr, + getter_AddRefs(firstPartyIsolationURI)); + if (NS_SUCCEEDED(rv) && firstPartyIsolationURI) { + thirdPartySvc->GetFirstPartyHostForIsolation(firstPartyIsolationURI, + cacheDomain); + } + if (!mFallbackKey.IsEmpty() && mFallbackChannel) { // This is a fallback channel, open fallback URI instead rv = NS_NewURI(getter_AddRefs(openURI), mFallbackKey); @@ -2612,7 +2626,7 @@ nsHttpChannel::OpenCacheEntry(bool usingSSL) cacheEntryOpenFlags |= nsICacheStorage::OPEN_BYPASS_IF_BUSY; rv = cacheStorage->AsyncOpenURI( - openURI, mPostID ? nsPrintfCString("%d", mPostID) : EmptyCString(), + openURI, nsPrintfCString("%s@%d", cacheDomain.get(), mPostID), cacheEntryOpenFlags, this); NS_ENSURE_SUCCESS(rv, rv); @@ -2647,7 +2661,7 @@ bypassCacheEntryOpen: NS_ENSURE_SUCCESS(rv, rv); rv = cacheStorage->AsyncOpenURI( - mURI, EmptyCString(), nsICacheStorage::OPEN_TRUNCATE, this); + mURI, cacheDomain, nsICacheStorage::OPEN_TRUNCATE, this); NS_ENSURE_SUCCESS(rv, rv); waitFlags.Keep(WAIT_FOR_OFFLINE_CACHE_ENTRY);

1 0

[tor-browser-bundle/master] update_responses: add support for arch migration
by mikeperry＠torproject.org 12 Nov '14

12 Nov '14

commit 20623d486854403dacc08ae953cc20ebcfeb6802 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Thu Nov 6 23:07:16 2014 +0100 update_responses: add support for arch migration --- tools/update-responses/update_responses | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/tools/update-responses/update_responses b/tools/update-responses/update_responses index a42e700..c788586 100755 --- a/tools/update-responses/update_responses +++ b/tools/update-responses/update_responses @@ -219,6 +219,14 @@ sub write_responses { get_version_files($config, $version); create_missing_incremental_mars($config, $version); my $files = $config->{versions}{$version}{files}; + my $migrate_archs = $config->{versions}{$version}{migrate_archs} // {}; + foreach my $old_os (keys %$migrate_archs) { + my $new_os = $migrate_archs->{$old_os}; + foreach my $lang (keys %{$files->{$new_os}}) { + $files->{$old_os}{$lang}{complete} = + $files->{$new_os}{$lang}{complete}; + } + } foreach my $os (keys %$files) { foreach my $lang (keys %{$files->{$os}}) { my $resp = get_response($config, $version, $os,

1 0

[tor-browser-bundle/master] Merge remote-tracking branch 'boklm/migrate_arch_v2'
by mikeperry＠torproject.org 12 Nov '14

12 Nov '14

commit 086938488c4f0b43d7830d577ab3e50a206d680e Merge: 9495a91 20623d4 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Tue Nov 11 16:54:13 2014 -0800 Merge remote-tracking branch 'boklm/migrate_arch_v2' tools/update-responses/update_responses | 8 ++++++++ 1 file changed, 8 insertions(+)

1 0

[tor-browser-bundle/master] New config for 4.5-alpha-1 updates.
by mikeperry＠torproject.org 12 Nov '14

12 Nov '14

commit 46e9b3191a03ce432c4e7b9a4af86b16102a7819 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Tue Nov 11 16:58:27 2014 -0800 New config for 4.5-alpha-1 updates. --- tools/update-responses/config.yml | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/tools/update-responses/config.yml b/tools/update-responses/config.yml index ad1c512..557b197 100644 --- a/tools/update-responses/config.yml +++ b/tools/update-responses/config.yml @@ -4,20 +4,24 @@ build_targets: linux64: Linux_x86_64-gcc3 win32: WINNT_x86-gcc3 osx32: Darwin_x86-gcc3 + osx64: Darwin_x86_64-gcc3 channels: release: 4.0 - alpha: 4.0 + alpha: 4.5-alpha-1 versions: 4.0: platformVersion: 31.2.0 detailsURL: https://www.torproject.org/projects/torbrowser.html.en download_url: https://www.torproject.org/dist/torbrowser/4.0 - 4.0-alpha-3: - platformVersion: 24.8.1 + 4.5-alpha-1: + platformVersion: 31.2.0 detailsURL: https://www.torproject.org/projects/torbrowser.html.en - download_url: https://www.torproject.org/dist/torbrowser/4.0-alpha-3 + download_url: https://www.torproject.org/dist/torbrowser/4.5-alpha-1 incremental_from: - - 4.0-alpha-2 -# osx32: -# minSupportedOSVersion: 10.7 -# unsupported: 1 + - 4.0 + - 4.0.1 + migrate_archs: + osx32: osx64 + osx32: + minSupportedOSVersion: 10.8 + detailsURL: https://blog.torproject.org/blog/end-life-plan-tor-browser-32-bit-macs#upda…

1 0

[tor-browser-bundle/master] Update target release date.
by mikeperry＠torproject.org 10 Nov '14

10 Nov '14

commit 9495a912a89f4dd17fd04231da21d39cc928742d Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Mon Nov 10 12:02:37 2014 -0800 Update target release date. --- Bundle-Data/Docs/ChangeLog.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index 7588ca5..988b4cd 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -1,4 +1,4 @@ -Tor Browser 4.5-alpha-1 -- Nov 3 2014 +Tor Browser 4.5-alpha-1 -- Nov 13 2014 * All Platforms * Bug 3455: Patch Firefox SOCKS and proxy filters to allow user+pass isolation * Bug 11955: Backport HTTPS Certificate Pinning patches from Firefox 32

1 0