July 2016 - tbb-commits - lists.torproject.org

[tor-browser-bundle/maint-6.0] Making the git-gpg-wrapper executable
by gk＠torproject.org 30 Jul '16

30 Jul '16

commit 89a0db3a46be3c97b82c11fa85d66e97ee406971 Author: Georg Koppen <gk(a)torproject.org> Date: Sat Jul 30 10:00:11 2016 +0000 Making the git-gpg-wrapper executable --- gitian/git-gpg-wrapper | 0 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/gitian/git-gpg-wrapper b/gitian/git-gpg-wrapper old mode 100644 new mode 100755

1 0

[tor-browser-bundle/maint-6.0] Update gk's key
by gk＠torproject.org 30 Jul '16

30 Jul '16

commit f40aa39010ca734f40e2888604d7a631aa31f5f5 Author: Georg Koppen <gk(a)torproject.org> Date: Sat Jul 30 09:29:24 2016 +0000 Update gk's key --- gitian/gpg/gk.gpg | Bin 33866 -> 72418 bytes gitian/gpg/torbutton.gpg | Bin 55562 -> 94114 bytes 2 files changed, 0 insertions(+), 0 deletions(-) diff --git a/gitian/gpg/gk.gpg b/gitian/gpg/gk.gpg index ad731ca..2f78b14 100644 Binary files a/gitian/gpg/gk.gpg and b/gitian/gpg/gk.gpg differ diff --git a/gitian/gpg/torbutton.gpg b/gitian/gpg/torbutton.gpg index e4a03dd..da40f76 100644 Binary files a/gitian/gpg/torbutton.gpg and b/gitian/gpg/torbutton.gpg differ

1 0

[tor-browser-bundle/maint-6.0] Version bumps; Changelog update
by gk＠torproject.org 30 Jul '16

30 Jul '16

commit 12dcde3326c98fea5bce7a017269492620cd11ca Author: Georg Koppen <gk(a)torproject.org> Date: Sat Jul 30 11:21:59 2016 +0200 Version bumps; Changelog update --- Bundle-Data/Docs/ChangeLog.txt | 1 + gitian/versions | 12 ++++++------ 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index 2abd47e..c4a255d 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -5,6 +5,7 @@ Tor Browser 6.0.3 -- August 2 * Bug 19417: Disable asmjs for now * Bug 19689: Use proper parent window for plugin prompt * Update HTTPS-Everywhere to 5.2.1 + * Update NoScript to 2.9.0.12 * Bug 19417: Disable asmjs for now * Bug 19715: Disable the meek-google pluggable transport option * Bug 19714: Remove mercurius4 obfs4 bridge diff --git a/gitian/versions b/gitian/versions index c46c735..f6d8648 100755 --- a/gitian/versions +++ b/gitian/versions @@ -10,14 +10,14 @@ DATA_OUTSIDE_APP_DIR=1 VERIFY_TAGS=1 -FIREFOX_VERSION=45.2.0esr +FIREFOX_VERSION=45.3.0esr TORBROWSER_UPDATE_CHANNEL=release -TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-6.0-1-build2 +TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-6.0-1-build1 TOR_TAG=tor-0.2.7.6 TORLAUNCHER_TAG=0.2.9.3 -TORBUTTON_TAG=1.9.5.5 +TORBUTTON_TAG=1.9.5.6 HTTPSE_TAG=5.2.1 NSIS_TAG=v0.3.1 ZLIB_TAG=v1.2.8 @@ -47,7 +47,7 @@ GITIAN_TAG=tor-browser-builder-4-1 OPENSSL_VER=1.0.1t GMP_VER=5.1.3 FIREFOX_LANG_VER=$FIREFOX_VERSION -FIREFOX_LANG_BUILD=build2 +FIREFOX_LANG_BUILD=build1 BINUTILS_VER=2.24 GCC_VER=5.1.0 CLANG_VER=r247539 @@ -66,7 +66,7 @@ NSIS_VER=2.51 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz GMP_PACKAGE=gmp-${GMP_VER}.tar.bz2 -NOSCRIPT_PACKAGE=noscript_security_suite-2.9.0.11-fn+sm+fx.xpi +NOSCRIPT_PACKAGE=noscript_security_suite-2.9.0.12-fx+fn+sm.xpi TOOLCHAIN4_OLD_PACKAGE=multiarch-darwin11-cctools127.2-gcc42-5666.3-llvmgcc42-2336.1-Linux-120724.tar.xz CCTOOLS_PACKAGE=cctools.tar.gz OSXSDK_PACKAGE=MacOSX10.7.sdk.tar.gz @@ -99,7 +99,7 @@ GMP_HASH=752079520b4690531171d0f4532e40f08600215feefede70b24fabdc6f1ab160 OSXSDK_HASH=da77bb0003fcca5ea8c4e8cb2da8828ded750c54afdcac29ec6f3b46ad5e3adf OSXSDK_OLD_HASH=6602d8d5ddb371fbc02e2a5967d9bd0cd7358d46f9417753c8234b923f2ea6fc TOOLCHAIN4_OLD_HASH=65c1b2d302358a6b95a26c6828a66908a199276193bb0b268f2dcc1a997731e9 -NOSCRIPT_HASH=fdd965a69188ac651b08a7d3ada54821a89db10a4685aa73ba59edc0b8243390 +NOSCRIPT_HASH=3fa641dcb60455c950cef0c15effa8ca060b3b05405f46f55cbdb922929027e7 CCTOOLS_HASH=e908fdebc2886ee5491ebfc7e7950af451b3c4e2439c2d7a923ed06ad05113e4 MSVCR100_HASH=1221a09484964a6f38af5e34ee292b9afefccb3dc6e55435fd3aaf7c235d9067 PYCRYPTO_HASH=f2ce1e989b272cfcb677616763e0a2e7ec659effa67a88aa92b3a65528f60a3c

1 0

[tor-browser-bundle/maint-6.0] Bug 19737: Allow git tag signatures made using an expired key
by gk＠torproject.org 30 Jul '16

30 Jul '16

commit adcf907e1d54de5b9fcca736ca28b69d70c738fb Author: Nicolas Vigier <boklm(a)torproject.org> Date: Wed Jul 27 22:53:19 2016 +0200 Bug 19737: Allow git tag signatures made using an expired key We are adding a gitian/git-gpg-wrapper script which validates signatures made using an expired key. To do that, we use gpgv rather than gpg, and any EXPKEYSIG line from the gpg `--status-fd` output is replaced by a GOODSIG line. --- gitian/git-gpg-wrapper | 13 +++++++++++++ gitian/verify-tags.sh | 3 ++- 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/gitian/git-gpg-wrapper b/gitian/git-gpg-wrapper new file mode 100644 index 0000000..f137d6d --- /dev/null +++ b/gitian/git-gpg-wrapper @@ -0,0 +1,13 @@ +#!/bin/bash +# This wrapper script is used by git to verify signatures made using +# an expired key. +# https://bugs.torproject.org/19737 +set -e +if [ $# -eq 4 ] && [ "$1" = '--status-fd=1' ] \ + && [ "$2" = '--verify' ] +then + gpgv "$1" "$3" "$4" | sed 's/^\[GNUPG:\] EXPKEYSIG /\[GNUPG:\] GOODSIG /' + exit ${PIPESTATUS[0]} +else + exec gpg "$@" +fi diff --git a/gitian/verify-tags.sh b/gitian/verify-tags.sh index a966626..e006fb0 100755 --- a/gitian/verify-tags.sh +++ b/gitian/verify-tags.sh @@ -37,10 +37,11 @@ verify_git() { local gpghome=$(mktemp -d) echo "rm -rf '$gpghome'" >> "$CLEANUP" - GNUPGHOME="$gpghome" gpg --import "$keyring" + GNUPGHOME="$gpghome" gpg --no-default-keyring --keyring trustedkeys.gpg --import "$keyring" pushd . cd "$dir" + git config --local gpg.program "$WRAPPER_DIR/git-gpg-wrapper" if ! GNUPGHOME="$gpghome" git tag -v "$tag"; then echo >&2 "$dir: verification of tag $tag against $keyring failed!" exit 1

1 0

[tor-browser/tor-browser-45.2.0esr-6.5-1] fixup! Regression tests for "Omnibox: Add DDG, Startpage, Disconnect, Youtube, Twitter; remove Amazon, eBay, bing"
by mikeperry＠torproject.org 29 Jul '16

29 Jul '16

commit 146ae4cc141f702785f896ff8c90bdfa0ab90b60 Author: difw <something@something> Date: Fri Jul 29 09:32:22 2016 -0700 fixup! Regression tests for "Omnibox: Add DDG, Startpage, Disconnect, Youtube, Twitter; remove Amazon, eBay, bing" Update tests. --- tbb-tests/browser_tor_omnibox.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tbb-tests/browser_tor_omnibox.js b/tbb-tests/browser_tor_omnibox.js index 8648551..082dd84 100644 --- a/tbb-tests/browser_tor_omnibox.js +++ b/tbb-tests/browser_tor_omnibox.js @@ -8,7 +8,7 @@ function test() { engineIDs = browserSearchService.getEngines().map(e => e.identifier); // Check that we have the correct engines installed, in the right order. - is(engineIDs[0], "disconnect", "Default search engine is disconnect"); + is(engineIDs[0], "ddg", "Default search engine is disconnect"); is(engineIDs[1], "youtube", "Secondary search engine is youtube"); is(engineIDs[2], "google", "Google is third search engine"); }

1 0

[tor-browser/tor-browser-45.2.0esr-6.5-1] fixup! Omnibox: Add DDG, Startpage, Disconnect, Youtube, Twitter; remove Amazon, eBay, bing
by mikeperry＠torproject.org 29 Jul '16

29 Jul '16

commit 59a087921cc38432f6829c3bccf3ba23fe184c63 Author: difw <something@something> Date: Thu Jul 28 12:15:05 2016 -0700 fixup! Omnibox: Add DDG, Startpage, Disconnect, Youtube, Twitter; remove Amazon, eBay, bing Switch Default to DuckDuckGo HTTPS. Add .onion. --- browser/app/profile/000-tor-browser.js | 4 ++-- browser/locales/en-US/searchplugins/ddg-onion.xml | 11 +++++++++++ browser/locales/en-US/searchplugins/ddg.xml | 4 ++-- browser/locales/en-US/searchplugins/list.txt | 1 + 4 files changed, 16 insertions(+), 4 deletions(-) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index c60b341..a5c0e7f 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -268,7 +268,7 @@ pref("browser.uiCustomization.state", "{\"placements\":{\"PanelUI-contents\":[\" // Putting the search engine prefs into this file to fix #11236. // Default search engine -pref("browser.search.defaultenginename", "Disconnect"); +pref("browser.search.defaultenginename", "DuckDuckGo"); // Make sure we use the same search engine regardless of locale pref("browser.search.geoSpecificDefaults", false); @@ -276,7 +276,7 @@ pref("browser.search.geoSpecificDefaults", false); // Somewhat surprisingly we get some random behavior if we specify more than // two search engines as below. See // https://bugzilla.mozilla.org/show_bug.cgi?id=1126722 for details. -pref("browser.search.order.extra.1", "Disconnect"); +pref("browser.search.order.extra.1", "DuckDuckGo"); pref("browser.search.order.extra.2", "YouTube"); // Hacks/workarounds: Direct2D seems to crash w/ lots of video cards w/ MinGW? diff --git a/browser/locales/en-US/searchplugins/ddg-onion.xml b/browser/locales/en-US/searchplugins/ddg-onion.xml new file mode 100644 index 0000000..009da7e --- /dev/null +++ b/browser/locales/en-US/searchplugins/ddg-onion.xml @@ -0,0 +1,11 @@ +<SearchPlugin xmlns="http://www.mozilla.org/2006/browser/search/"> +<ShortName>DuckDuckGoOnion</ShortName> +<Description>Duck Duck Go Onion</Description> +<InputEncoding>UTF-8</InputEncoding> +<Image height="16" width="16">data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAMAAAAoLQ9TAAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JgAAgIQAAPoAAACA6AAAdTAAAOpgAAA6mAAAF3CculE8AAAB8lBMVEUAAADkRQzjPwPjQQXkRQ3iPwTiQQXgPQPeQgrcOwPVNgDVNQDWOgbTMwDRMgDQMwDSMwDRNwTQLgDRJgDSJwDSLgDSNwTjOgDiOADjOQDkPADhQAXzs5v+/fv////0vKbiRQvgPQHpdUr85NzuknPdKgDcIwDnZzj2w7HqeU/gPQLsimb/+PftjWn97Obpb0LdJQDeLQDtjmvsi2jgSBDnbULgOQD/39HgLQDeMgDpeFLgSBH0v670uqbaJQD2qImWvP/G1Ob5+/3u//+fvvXyp47dMwDaLwD0u6v0v6/aNQDiXi/aKQD3qozU7/8gSY2vvtg0ZK/OqLDaKQHYKgLgWTfaNADZMgDZMADZLADzqpD7//+xwdz//9H/5Bn/7Bn//ADofADYMADYMQDZOgPXLgDiZDj//97/0AD3tQDvlgHZOgbXLATXMADWMgDfXjLVLQD///z+0AD/3Rn/yRnwnQDcVjbVMQDyv67wuKTSJwDRHQD+8O/tg3/iQQDwhAHnawHWMADvtKfyva7XQxHga0bQGQD2vbH/u8LXIQCmPQzja07XQxLliGn99fPkcVHvhnGZ5VguvUU5wktBwCcAgxzydVv/8/XmiGngdlL+ysi3+I8LtCE80V6P3YmX4sDleljSNQLzr6D7sKPXNQTSIwAEAbMrAAAAF3RSTlMARqSkRvPz80PTpKRG3fPe3hio9/eoGP50jNsAAAABYktHRB5yCiArAAAAyElEQVQYGQXBvUqCYRiA4fu2V9Tn+UQddI3aCpxaOoU6iU4gcqqpoYbALXBuCuoYmttamq JDiEoh4YP+MOi6BNCh+uYKEGiOVNCXXxA2XDVV/UyfKbRCXTLQWAxbP2vt8Ue/uYDvfim91615sb2um6rqtrr/NFb1cUf1Ybd06areU6lSlYpK79jzK1SyJOkfhOl8JGEcqV5zoKrTRqO6yUzIzNu46ijdM1VV9bhuUJ/nZURExLRzUiPQm3kKXHi4BAEGOmOi78A/L1QoU/VHoTsAAAAldEVYdGRhdGU6Y3JlYXRlADIwMTQtMDEtMTlUMjA6MDE6MTEtMDU6MDAuET6cAAAAJXRFWHRkYXRlOm1vZGlmeQAyMDE0LTAxLTE5VDIwOjAxOjExLTA1OjAwX0yGIAAAAABJRU5ErkJggg==</Image> +<Url type="text/html" method="POST" template="http://3g2upl4pq6kufc4m.onion/html/"> + <Param name="q" value="{searchTerms}"/> +</Url> +<SearchForm>http://3g2upl4pq6kufc4m.onion/html/</SearchForm> +</SearchPlugin> + diff --git a/browser/locales/en-US/searchplugins/ddg.xml b/browser/locales/en-US/searchplugins/ddg.xml index d82cdbd..aceb0ac 100644 --- a/browser/locales/en-US/searchplugins/ddg.xml +++ b/browser/locales/en-US/searchplugins/ddg.xml @@ -22,9 +22,9 @@ AScg7HAnIOz2JyDs/ycg7P8nIOz/JyDs/ycg7P8nIOz/JyDs9icg7HAnIOwBAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAJyDsJicg7IAnIOyzJyDs5icg7OYnIOyzJyDsgCcg7CYAAAAAAAAAAAAAAAAA AAAA+B8AAPAPAADAAwAAwAMAAIABAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABAACAAQAAwAMAAMAD AADwDwAA+B8AAA==</Image> -<Url type="text/html" method="POST" template="http://3g2upl4pq6kufc4m.onion/html/"> +<Url type="text/html" method="POST" template="https://duckduckgo.com/"> <Param name="q" value="{searchTerms}"/> </Url> -<SearchForm>http://3g2upl4pq6kufc4m.onion/html/</SearchForm> +<SearchForm>https://duckduckgo.com/</SearchForm> </SearchPlugin> diff --git a/browser/locales/en-US/searchplugins/list.txt b/browser/locales/en-US/searchplugins/list.txt index 71b6c0f..0b4f1fb 100644 --- a/browser/locales/en-US/searchplugins/list.txt +++ b/browser/locales/en-US/searchplugins/list.txt @@ -2,6 +2,7 @@ disconnect youtube twitter wikipedia +ddg-onion startpage yahoo google

1 0

[torbutton/master] Release preparations for 1.9.6.1
by mikeperry＠torproject.org 29 Jul '16

29 Jul '16

commit e403cd883db74649eed86aed0edaf3d101d07fbb Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Thu Jul 28 17:03:03 2016 -0700 Release preparations for 1.9.6.1 CHANGELOG update, version bump --- src/CHANGELOG | 7 +++++++ src/install.rdf | 2 +- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/src/CHANGELOG b/src/CHANGELOG index e62bafd..cd5ce27 100644 --- a/src/CHANGELOG +++ b/src/CHANGELOG @@ -1,3 +1,10 @@ +1.9.6.1 + * Bug 19206: Avoid SOCKS auth and NEWNYM collisions when sharing a tor client + * Bug 19417: Disable asm.js (but add code to clear on New Identity if enabled) + * Bug 19689: Plugin usage prompt is parented to wrong window + * Bug 19273: Improve external app launch handling and associated warnings + * Bug 8725: Block addon resource and url fingerprinting with nsIContentPolicy + 1.9.6 * Bug 18743: Pref to hide 'Sign in to Sync' button in hamburger menu * Bug 18905: Hide unusable items from help menu diff --git a/src/install.rdf b/src/install.rdf index db269d5..e33fdb9 100644 --- a/src/install.rdf +++ b/src/install.rdf @@ -6,7 +6,7 @@ <em:name>Torbutton</em:name> <em:creator>Mike Perry</em:creator> <em:id>torbutton(a)torproject.org</em:id> - <em:version>1.9.6</em:version> + <em:version>1.9.6.1</em:version> <em:homepageURL>https://www.torproject.org/projects/torbrowser.html.en</em:homepageURL> <em:optionsURL>chrome://torbutton/content/preferences.xul</em:optionsURL> <em:iconURL>chrome://torbutton/skin/tor.png</em:iconURL>

1 0

[torbutton/master] Bug 8725: Block `resource://` based fingerprinting with nsIContentPolicy.
by mikeperry＠torproject.org 28 Jul '16

28 Jul '16

commit 3bff5aaea6e1a732ff908527f67d1784ecf23c57 Author: Yawning Angel <yawning(a)schwanenlied.me> Date: Fri Jun 17 01:25:09 2016 +0000 Bug 8725: Block `resource://` based fingerprinting with nsIContentPolicy. Based on ResourceFilter: A direct workaround for https://bugzil.la/863246 https://notabug.org/desktopd/no-resource-uri-leak/src/master/src/resource-f… --- src/chrome.manifest | 4 ++++ src/components/content-policy.js | 48 ++++++++++++++++++++++++++++++++++++++++ 2 files changed, 52 insertions(+) diff --git a/src/chrome.manifest b/src/chrome.manifest index e85a205..340ed27 100644 --- a/src/chrome.manifest +++ b/src/chrome.manifest @@ -170,6 +170,10 @@ category profile-after-change CookieJarSelector @torproject.org/cookie-jar-selec component {65be2be0-ceb4-44c2-91a5-9c75c53430bf} components/torRefSpoofer.js contract @torproject.org/torRefSpoofer;1 {65be2be0-ceb4-44c2-91a5-9c75c53430bf} +component {4c03be7d-492f-990e-f0da-f3689e564898} components/content-policy.js +contract @torproject.org/content-policy;1 {4c03be7d-492f-990e-f0da-f3689e564898} +category content-policy ContentPolicy @torproject.org/content-policy;1 + category profile-after-change RefSpoofer @torproject.org/torRefSpoofer;1 category profile-after-change StartupObserver @torproject.org/startup-observer;1 category profile-after-change DomainIsolator @torproject.org/domain-isolator;1 diff --git a/src/components/content-policy.js b/src/components/content-policy.js new file mode 100644 index 0000000..b4b33a7 --- /dev/null +++ b/src/components/content-policy.js @@ -0,0 +1,48 @@ +/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this file, + * You can obtain one at http://mozilla.org/MPL/2.0/. */ + +/* + * Based on ResourceFilter: A direct workaround for https://bugzil.la/863246 + * https://notabug.org/desktopd/no-resource-uri-leak/src/master/src/resource-f… + */ + +const Ci = Components.interfaces, Cu = Components.utils; + +// Import XPCOMUtils object. +Cu.import("resource://gre/modules/XPCOMUtils.jsm"); + +function ContentPolicy() {} + +ContentPolicy.prototype = { + classDescription: "ContentPolicy", + classID: Components.ID("{4c03be7d-492f-990e-f0da-f3689e564898}"), + contractID: "@torproject.org/content-policy;1", + QueryInterface: XPCOMUtils.generateQI([Ci.nsIContentPolicy]), + + _xpcom_categories: [{category: "content-policy"}], + + shouldLoad: function(aContentType, aContentLocation, aRequestOrigin, aContext, aMimeTypeGuess, aExtra) { + // Accept if no content URI or scheme is not a resource. + if (!aContentLocation || !aContentLocation.schemeIs('resource')) + return Ci.nsIContentPolicy.ACCEPT; + + // Accept if no origin URI, or if the origin URI scheme is chrome/resource. + if (!aRequestOrigin || aRequestOrigin.schemeIs('resource') || aRequestOrigin.schemeIs('chrome')) + return Ci.nsIContentPolicy.ACCEPT; + + // Accept if resource directly loaded into a tab. + if (Ci.nsIContentPolicy.TYPE_DOCUMENT === aContentType) + return Ci.nsIContentPolicy.ACCEPT; + + return Ci.nsIContentPolicy.REJECT_REQUEST; + }, + + shouldProcess: function(aContentType, aContentLocation, aRequestOrigin, aContext, aMimeType, aExtra) { + return Ci.nsIContentPolicy.ACCEPT; + }, +}; + +// Firefox >= 4.0 (Old versions are extremely irrelevant). +var NSGetFactory = XPCOMUtils.generateNSGetFactory([ContentPolicy]);

1 0

[torbutton/master] Bug 8725: Block `chrome://` based fingerprinting with nsIContentPolicy.
by mikeperry＠torproject.org 28 Jul '16

28 Jul '16

commit ace11cd8020aaf0136ee58aa074666f10c14abb9 Author: Yawning Angel <yawning(a)schwanenlied.me> Date: Fri Jun 17 01:27:14 2016 +0000 Bug 8725: Block `chrome://` based fingerprinting with nsIContentPolicy. Most addons do not set `contentaccessible=yes`, however behavior should be consistent even if such addons are installed. This does not affect any of the standard addons shipped with Tor Browser, but will break user installed addons that depend on actually being able to access `chrome://` URLs in this manner. --- src/components/content-policy.js | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src/components/content-policy.js b/src/components/content-policy.js index b4b33a7..c6c8aa9 100644 --- a/src/components/content-policy.js +++ b/src/components/content-policy.js @@ -24,12 +24,12 @@ ContentPolicy.prototype = { _xpcom_categories: [{category: "content-policy"}], shouldLoad: function(aContentType, aContentLocation, aRequestOrigin, aContext, aMimeTypeGuess, aExtra) { - // Accept if no content URI or scheme is not a resource. - if (!aContentLocation || !aContentLocation.schemeIs('resource')) + // Accept if no content URI or scheme is not a resource/chrome. + if (!aContentLocation || !(aContentLocation.schemeIs('resource') || aContentLocation.schemeIs('chrome'))) return Ci.nsIContentPolicy.ACCEPT; - // Accept if no origin URI, or if the origin URI scheme is chrome/resource. - if (!aRequestOrigin || aRequestOrigin.schemeIs('resource') || aRequestOrigin.schemeIs('chrome')) + // Accept if no origin URI or if origin scheme is chrome/resource/about. + if (!aRequestOrigin || aRequestOrigin.schemeIs('resource') || aRequestOrigin.schemeIs('chrome') || aRequestOrigin.schemeIs('about')) return Ci.nsIContentPolicy.ACCEPT; // Accept if resource directly loaded into a tab.

1 0

[torbutton/master] Merge remote-tracking branch 'yawning/bug8725_take3'
by mikeperry＠torproject.org 28 Jul '16

28 Jul '16

commit 3b8e1a3508c7cb15d15c93149acab81ea8c51d9a Merge: 7dd7101 fa67687 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Thu Jul 28 15:06:21 2016 -0700 Merge remote-tracking branch 'yawning/bug8725_take3' src/chrome.manifest | 4 ++ src/components/content-policy.js | 83 ++++++++++++++++++++++++++++++++++++++++ 2 files changed, 87 insertions(+)

1 0