May 2017 - tbb-commits - lists.torproject.org

[tor-browser/tor-browser-52.1.1esr-7.0-1] squash! Bug 18821: Disable libmdns for Android and Desktop
by gk＠torproject.org 30 May '17

30 May '17

commit 0da4a7dc08b0c9b4fa6c454da210e8c3c3ae6197 Author: Georg Koppen <gk(a)torproject.org> Date: Wed May 24 13:45:47 2017 +0000 squash! Bug 18821: Disable libmdns for Android and Desktop Bug 21861: Disable additional mDNS code to avoid proxy bypasses --- dom/presentation/provider/moz.build | 16 ---------------- mobile/android/installer/package-manifest.in | 4 ---- netwerk/dns/mdns/libmdns/moz.build | 16 ---------------- 3 files changed, 36 deletions(… [View More]-) diff --git a/dom/presentation/provider/moz.build b/dom/presentation/provider/moz.build index 18428b5..7f82700 100644 --- a/dom/presentation/provider/moz.build +++ b/dom/presentation/provider/moz.build @@ -12,8 +12,6 @@ EXTRA_COMPONENTS += [ UNIFIED_SOURCES += [ 'DeviceProviderHelpers.cpp', 'DisplayDeviceProvider.cpp', - 'MulticastDNSDeviceProvider.cpp', - 'PresentationDeviceProviderModule.cpp', ] EXTRA_JS_MODULES.presentation += [ @@ -22,19 +20,5 @@ EXTRA_JS_MODULES.presentation += [ 'StateMachineHelper.jsm', ] -if CONFIG['MOZ_WIDGET_TOOLKIT'] == 'android': - EXTRA_COMPONENTS += [ - # For android presentation device - 'AndroidCastDeviceProvider.js', - 'AndroidCastDeviceProvider.manifest', - # for TV 2.5 device backward capability - 'LegacyPresentationControlService.js', - 'LegacyProviders.manifest', - ] - - UNIFIED_SOURCES += [ - 'LegacyMDNSDeviceProvider.cpp', - ] - include('/ipc/chromium/chromium-config.mozbuild') FINAL_LIBRARY = 'xul' diff --git a/mobile/android/installer/package-manifest.in b/mobile/android/installer/package-manifest.in index 417d34a..025094c 100644 --- a/mobile/android/installer/package-manifest.in +++ b/mobile/android/installer/package-manifest.in @@ -404,10 +404,6 @@ @BINPATH@/components/PresentationNetworkHelper.manifest @BINPATH@/components/PresentationDataChannelSessionTransport.js @BINPATH@/components/PresentationDataChannelSessionTransport.manifest -@BINPATH@/components/LegacyProviders.manifest -@BINPATH@/components/LegacyPresentationControlService.js -@BINPATH@/components/AndroidCastDeviceProvider.manifest -@BINPATH@/components/AndroidCastDeviceProvider.js @BINPATH@/components/TVSimulatorService.js @BINPATH@/components/TVSimulatorService.manifest diff --git a/netwerk/dns/mdns/libmdns/moz.build b/netwerk/dns/mdns/libmdns/moz.build index f14e411..422621f 100644 --- a/netwerk/dns/mdns/libmdns/moz.build +++ b/netwerk/dns/mdns/libmdns/moz.build @@ -22,22 +22,6 @@ if (CONFIG['MOZ_WIDGET_TOOLKIT'] == 'gonk' and CONFIG['ANDROID_VERSION'] >= '16' ] -else: - EXTRA_JS_MODULES += [ - 'fallback/DataReader.jsm', - 'fallback/DataWriter.jsm', - 'fallback/DNSPacket.jsm', - 'fallback/DNSRecord.jsm', - 'fallback/DNSResourceRecord.jsm', - 'fallback/DNSTypes.jsm', - 'fallback/MulticastDNS.jsm', - ] - - if CONFIG['MOZ_WIDGET_TOOLKIT'] == 'android': - EXTRA_JS_MODULES += [ - 'MulticastDNSAndroid.jsm', - ] - UNIFIED_SOURCES += [ 'nsDNSServiceInfo.cpp', 'nsMulticastDNSModule.cpp', [View Less]

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 29 May '17

29 May '17

commit c1a5e1abf6ee05b0b1d3b1462b3c9e1c180b153e Author: Georg Koppen <gk(a)torproject.org> Date: Mon May 29 09:10:13 2017 +0000 fixup! TB4: Tor Browser's Firefox preference overrides. Fixes bug 21323. We are using Mixed Content Blocking now in Tor Browser as the advantages of doing so seem to outweigh the downsides. --- browser/app/profile/000-tor-browser.js | 1 - 1 file changed, 1 deletion(-) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/… [View More]

1 0

[tor-browser/tor-browser-52.1.1esr-7.0-1] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 29 May '17

29 May '17

commit 29b34b444229fd09fcf7741a206230385e843fde Author: Georg Koppen <gk(a)torproject.org> Date: Mon May 29 09:10:13 2017 +0000 fixup! TB4: Tor Browser's Firefox preference overrides. Fixes bug 21323. We are using Mixed Content Blocking now in Tor Browser as the advantages of doing so seem to outweigh the downsides. --- browser/app/profile/000-tor-browser.js | 1 - 1 file changed, 1 deletion(-) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/… [View More]

1 0

[tor-browser/tor-browser-52.1.1esr-7.0-1] fixup! Bug 5282: Randomize HTTP request order and pipeline depth.
by gk＠torproject.org 29 May '17

29 May '17

commit e404251e7a4e86981a33be035e7fdb0b7ed42c3b Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Sat May 27 00:22:17 2017 -0700 fixup! Bug 5282: Randomize HTTP request order and pipeline depth. Use format specifiers for unsigned long integers. --- netwerk/protocol/http/nsHttpPipeline.cpp | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/netwerk/protocol/http/nsHttpPipeline.cpp b/netwerk/protocol/http/nsHttpPipeline.cpp index 207c55b..… [View More]

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] fixup! Bug 5282: Randomize HTTP request order and pipeline depth.
by gk＠torproject.org 29 May '17

29 May '17

commit 7aa5a5c8565273ea41a0c003160226f3229373f6 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Sat May 27 00:22:17 2017 -0700 fixup! Bug 5282: Randomize HTTP request order and pipeline depth. Use format specifiers for unsigned long integers. --- netwerk/protocol/http/nsHttpPipeline.cpp | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/netwerk/protocol/http/nsHttpPipeline.cpp b/netwerk/protocol/http/nsHttpPipeline.cpp index 207c55b..… [View More]

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] Bug 21684: Don't expose navigator.AddonManager to content
by gk＠torproject.org 29 May '17

29 May '17

commit e5da14c4ae6e3917928b3004bca7bd49e972089e Author: Georg Koppen <gk(a)torproject.org> Date: Fri May 26 19:18:32 2017 +0000 Bug 21684: Don't expose navigator.AddonManager to content With https://bugzilla.mozilla.org/show_bug.cgi?id=1245571 support for websites to learn about installed add-ons landed. Currently, this is only enabled for AMO related sites but we don't think this functionality is something we want for Tor Browser as it might aid in … [View More]fingerprinting users. The patch does not outright disable access to the API. Privileged code is still able to use it if needed. This should help with usability issues should they arise while mitigating possible fingerprinting and security problems by having this API available to content. This fixes bug 21684 by deleting the whitelist of URLs shipped with Firefox 52. --- toolkit/mozapps/extensions/AddonManagerWebAPI.cpp | 23 ++++------------------- 1 file changed, 4 insertions(+), 19 deletions(-) diff --git a/toolkit/mozapps/extensions/AddonManagerWebAPI.cpp b/toolkit/mozapps/extensions/AddonManagerWebAPI.cpp index ca33f3a..45326fd 100644 --- a/toolkit/mozapps/extensions/AddonManagerWebAPI.cpp +++ b/toolkit/mozapps/extensions/AddonManagerWebAPI.cpp @@ -20,25 +20,10 @@ using namespace mozilla::dom; static bool IsValidHost(const nsACString& host) { - if (host.Equals("addons.mozilla.org") || - host.Equals("discovery.addons.mozilla.org") || - host.Equals("testpilot.firefox.com")) { - return true; - } - - // When testing allow access to the developer sites. - if (Preferences::GetBool("extensions.webapi.testing", false)) { - if (host.LowerCaseEqualsLiteral("addons.allizom.org") || - host.LowerCaseEqualsLiteral("discovery.addons.allizom.org") || - host.LowerCaseEqualsLiteral("addons-dev.allizom.org") || - host.LowerCaseEqualsLiteral("discovery.addons-dev.allizom.org") || - host.LowerCaseEqualsLiteral("testpilot.stage.mozaws.net") || - host.LowerCaseEqualsLiteral("testpilot.dev.mozaws.net") || - host.LowerCaseEqualsLiteral("example.com")) { - return true; - } - } - + // We don't want to allow content to get information about the state of the + // extensions a user has installed. This might aid in fingerprinting. And + // allowing content at all access to this kind of information seems + // potentially risky from a security point as well. Fixes bug 21684. return false; } [View Less]

1 0

[tor-browser/tor-browser-52.1.1esr-7.0-1] Bug 21684: Don't expose navigator.AddonManager to content
by gk＠torproject.org 29 May '17

29 May '17

commit 9de9d5a74472423e5a7e5754f5d93b2d89103dfe Author: Georg Koppen <gk(a)torproject.org> Date: Fri May 26 19:18:32 2017 +0000 Bug 21684: Don't expose navigator.AddonManager to content With https://bugzilla.mozilla.org/show_bug.cgi?id=1245571 support for websites to learn about installed add-ons landed. Currently, this is only enabled for AMO related sites but we don't think this functionality is something we want for Tor Browser as it might aid in … [View More]fingerprinting users. The patch does not outright disable access to the API. Privileged code is still able to use it if needed. This should help with usability issues should they arise while mitigating possible fingerprinting and security problems by having this API available to content. This fixes bug 21684 by deleting the whitelist of URLs shipped with Firefox 52. --- toolkit/mozapps/extensions/AddonManagerWebAPI.cpp | 23 ++++------------------- 1 file changed, 4 insertions(+), 19 deletions(-) diff --git a/toolkit/mozapps/extensions/AddonManagerWebAPI.cpp b/toolkit/mozapps/extensions/AddonManagerWebAPI.cpp index ca33f3a..45326fd 100644 --- a/toolkit/mozapps/extensions/AddonManagerWebAPI.cpp +++ b/toolkit/mozapps/extensions/AddonManagerWebAPI.cpp @@ -20,25 +20,10 @@ using namespace mozilla::dom; static bool IsValidHost(const nsACString& host) { - if (host.Equals("addons.mozilla.org") || - host.Equals("discovery.addons.mozilla.org") || - host.Equals("testpilot.firefox.com")) { - return true; - } - - // When testing allow access to the developer sites. - if (Preferences::GetBool("extensions.webapi.testing", false)) { - if (host.LowerCaseEqualsLiteral("addons.allizom.org") || - host.LowerCaseEqualsLiteral("discovery.addons.allizom.org") || - host.LowerCaseEqualsLiteral("addons-dev.allizom.org") || - host.LowerCaseEqualsLiteral("discovery.addons-dev.allizom.org") || - host.LowerCaseEqualsLiteral("testpilot.stage.mozaws.net") || - host.LowerCaseEqualsLiteral("testpilot.dev.mozaws.net") || - host.LowerCaseEqualsLiteral("example.com")) { - return true; - } - } - + // We don't want to allow content to get information about the state of the + // extensions a user has installed. This might aid in fingerprinting. And + // allowing content at all access to this kind of information seems + // potentially risky from a security point as well. Fixes bug 21684. return false; } [View Less]

1 0

[tor-browser/tor-browser-52.1.1esr-7.0-1] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 25 May '17

25 May '17

commit b9bff8b465284d1ad0a95ca19e2318b4e200f63f Author: Georg Koppen <gk(a)torproject.org> Date: Tue May 23 09:08:40 2017 +0000 fixup! TB4: Tor Browser's Firefox preference overrides. For now we disable WebGL2 due to fingerprinting concerns. We could think about restricting its features to a minimal mode as well in order to make at least some use of it. This is the task for bug 22333, though. --- browser/app/profile/000-tor-browser.js | 1 + 1 file changed, 1 … [View More]

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 25 May '17

25 May '17

commit 2931426f6f8f2541ca6e5b43c62a61ab8bc9eec4 Author: Georg Koppen <gk(a)torproject.org> Date: Tue May 23 09:08:40 2017 +0000 fixup! TB4: Tor Browser's Firefox preference overrides. For now we disable WebGL2 due to fingerprinting concerns. We could think about restricting its features to a minimal mode as well in order to make at least some use of it. This is the task for bug 22333, though. --- browser/app/profile/000-tor-browser.js | 1 + 1 file changed, 1 … [View More]

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] Bug 22320: Use pref name 'referer.hideOnionSource' everywhere
by gk＠torproject.org 25 May '17

25 May '17

commit f59a7bc0288dcf5efaa71ebe8f591d7edea7b7b7 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Wed May 24 12:49:27 2017 -0700 Bug 22320: Use pref name 'referer.hideOnionSource' everywhere Correcting my mistake in https://bugzilla.mozilla.org/show_bug.cgi?id=1305144 --- modules/libpref/init/all.js | 2 +- netwerk/protocol/http/nsHttpHandler.cpp | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/modules/libpref/init/all.js … [View More]

1 0