August 2018 - tbb-commits - lists.torproject.org

[tor-browser/tor-browser-60.1.0esr-8.0-1] Bug 1470156 - Part 2: Fixing the crashing problem when using an invalid character in a firstPartyDomain. r=baku
by gk＠torproject.org 13 Aug '18

13 Aug '18

commit 7d9decc785bdc42443ee9835e0244f082d6911fb Author: Tim Huang <tihuang(a)mozilla.com> Date: Tue Jul 3 13:47:45 2018 +0000 Bug 1470156 - Part 2: Fixing the crashing problem when using an invalid character in a firstPartyDomain. r=baku This patch adds a sanitization of firstPartyDomain when calling the OriginAttributes::CreateSuffix() and remove the release assert there. The cookies API for the web extension can use a arbitrary string for the firstPartyDomain. So, we should sanitize the firstPartyDomain before we creating a suffix. The release assert is not required anymore since the firstPartyDomain is sanitized Depends on D1845. Differential Revision: https://phabricator.services.mozilla.com/D1856 --HG-- extra : moz-landing-system : lando --- caps/OriginAttributes.cpp | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/caps/OriginAttributes.cpp b/caps/OriginAttributes.cpp index ea3d7e507f3f..21092e46fb74 100644 --- a/caps/OriginAttributes.cpp +++ b/caps/OriginAttributes.cpp @@ -151,8 +151,10 @@ OriginAttributes::CreateSuffix(nsACString& aStr) const } if (!mFirstPartyDomain.IsEmpty()) { - MOZ_RELEASE_ASSERT(mFirstPartyDomain.FindCharInSet(dom::quota::QuotaManager::kReplaceChars) == kNotFound); - params.Set(NS_LITERAL_STRING("firstPartyDomain"), mFirstPartyDomain); + nsAutoString sanitizedFirstPartyDomain(mFirstPartyDomain); + sanitizedFirstPartyDomain.ReplaceChar(dom::quota::QuotaManager::kReplaceChars, '+'); + + params.Set(NS_LITERAL_STRING("firstPartyDomain"), sanitizedFirstPartyDomain); } aStr.Truncate();

1 0

[tor-browser/tor-browser-60.1.0esr-8.0-1] Bug 1470156 - Part 1: Adding a test case for reassuring mozilla::OriginAttributes::CreateSuffix won't be crashed with invalid characters in firstParty domain. r=baku, mixedpuppy
by gk＠torproject.org 13 Aug '18

13 Aug '18

commit 82446eff1db658db8dae23443deac036b164b769 Author: Tim Huang <tihuang(a)mozilla.com> Date: Tue Jul 3 13:48:18 2018 +0000 Bug 1470156 - Part 1: Adding a test case for reassuring mozilla::OriginAttributes::CreateSuffix won't be crashed with invalid characters in firstParty domain. r=baku,mixedpuppy Differential Revision: https://phabricator.services.mozilla.com/D1845 --HG-- extra : moz-landing-system : lando --- .../mochitest/test_ext_cookies_first_party.html | 37 ++++++++++++++++++++++ 1 file changed, 37 insertions(+) diff --git a/toolkit/components/extensions/test/mochitest/test_ext_cookies_first_party.html b/toolkit/components/extensions/test/mochitest/test_ext_cookies_first_party.html index 64785c45e440..b214148824bd 100644 --- a/toolkit/components/extensions/test/mochitest/test_ext_cookies_first_party.html +++ b/toolkit/components/extensions/test/mochitest/test_ext_cookies_first_party.html @@ -10,6 +10,8 @@ async function background() { const url = "http://ext-cookie-first-party.mochi.test/"; const firstPartyDomain = "ext-cookie-first-party.mochi.test"; + // A first party domain with invalid characters for the file system, which just happens to be a IPv6 address. + const firstPartyDomainInvalidChars = "[2606:4700:4700::1111]"; const expectedError = "First-Party Isolation is enabled, but the required 'firstPartyDomain' attribute was not set."; const assertExpectedCookies = (expected, cookies, message) => { @@ -154,6 +156,38 @@ async function background() { browser.test.sendMessage("test_fpi_enabled"); }; + // Test FPI with a first party domain with invalid characters for + // the file system. + const test_fpi_with_invalid_characters = async () => { + let cookie; + + // Test setting a cookie with a first party domain with invalid characters + // for the file system. + cookie = await browser.cookies.set({url, name: "foo5", value: "bar5", + firstPartyDomain: firstPartyDomainInvalidChars}); + assertExpectedCookies([ + {name: "foo5", value: "bar5", firstPartyDomain: firstPartyDomainInvalidChars}, + ], [cookie], "set: FPI on, w/ firstPartyDomain with invalid characters, FP cookie"); + + // Test getting a cookie with a first party domain with invalid characters + // for the file system. + cookie = await browser.cookies.get({url, name: "foo5", + firstPartyDomain: firstPartyDomainInvalidChars}); + assertExpectedCookies([ + {name: "foo5", value: "bar5", firstPartyDomain: firstPartyDomainInvalidChars}, + ], [cookie], "get: FPI on, w/ firstPartyDomain with invalid characters, FP cookie"); + + // Test removing a cookie with a first party domain with invalid characters + // for the file system. + cookie = await browser.cookies.remove({url, name: "foo5", + firstPartyDomain: firstPartyDomainInvalidChars}); + assertExpectedCookies([ + {url, name: "foo5", firstPartyDomain: firstPartyDomainInvalidChars}, + ], [cookie], "remove: FPI on, w/ firstPartyDomain with invalid characters, FP cookie"); + + browser.test.sendMessage("test_fpi_with_invalid_characters"); + }; + // Test when FPI is disabled again, accessing FP cookies set when FPI is enabled. const test_fpd_cookies_on_fpi_disabled = async () => { let cookie, cookies; @@ -179,6 +213,7 @@ async function background() { switch (message) { case "test_fpi_disabled": return test_fpi_disabled(); case "test_fpi_enabled": return test_fpi_enabled(); + case "test_fpi_with_invalid_characters": return test_fpi_with_invalid_characters(); case "test_fpd_cookies_on_fpi_disabled": return test_fpd_cookies_on_fpi_disabled(); default: return browser.test.notifyFail("unknown-message"); } @@ -210,6 +245,8 @@ add_task(async () => { await enableFirstPartyIsolation(); extension.sendMessage("test_fpi_enabled"); await extension.awaitMessage("test_fpi_enabled"); + extension.sendMessage("test_fpi_with_invalid_characters"); + await extension.awaitMessage("test_fpi_with_invalid_characters"); await disableFirstPartyIsolation(); extension.sendMessage("test_fpd_cookies_on_fpi_disabled"); await extension.awaitMessage("test_fpd_cookies_on_fpi_disabled");

1 0

[tor-browser/tor-browser-60.1.0esr-8.0-1] Bug 1473247 - Part 2: Add a test case for making sure that IP addresses can work properly for the firstPartyDomain. r=arthuredelstein, baku
by gk＠torproject.org 13 Aug '18

13 Aug '18

commit a75945d96b2d8903a86ac1c9016a8d300028b79f Author: Tim Huang <tihuang(a)mozilla.com> Date: Fri Jul 13 19:55:02 2018 +0000 Bug 1473247 - Part 2: Add a test case for making sure that IP addresses can work properly for the firstPartyDomain. r=arthuredelstein,baku Differential Revision: https://phabricator.services.mozilla.com/D1978 --HG-- extra : moz-landing-system : lando --- .../test/browser/browser_firstPartyIsolation.js | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/browser/components/originattributes/test/browser/browser_firstPartyIsolation.js b/browser/components/originattributes/test/browser/browser_firstPartyIsolation.js index 560de8c8f572..06bc21255a94 100644 --- a/browser/components/originattributes/test/browser/browser_firstPartyIsolation.js +++ b/browser/components/originattributes/test/browser/browser_firstPartyIsolation.js @@ -278,3 +278,22 @@ add_task(async function window_open_form_test() { gBrowser.removeTab(tab); await BrowserTestUtils.closeWindow(win); }); + +/** + * A test for using an IP address as the first party domain. + */ +add_task(async function ip_address_test() { + const ipAddr = "127.0.0.1"; + const ipHost = `http://${ipAddr}/browser/browser/components/originattributes/test/browser/`; + + let tab = BrowserTestUtils.addTab(gBrowser, ipHost + "test_firstParty.html"); + await BrowserTestUtils.browserLoaded(tab.linkedBrowser, true); + + await ContentTask.spawn(tab.linkedBrowser, { firstPartyDomain: ipAddr }, async function(attrs) { + info("document principal: " + content.document.nodePrincipal.origin); + Assert.equal(content.document.nodePrincipal.originAttributes.firstPartyDomain, + attrs.firstPartyDomain, "The firstPartyDomain should be set properly for the IP address"); + }); + + gBrowser.removeTab(tab); +});

1 0

[tor-browser/tor-browser-60.1.0esr-8.0-1] Bug 1473247 - Part 1: Fixing the issue that the IP addresses won't be set for first party domains. r=arthuredelstein, baku
by gk＠torproject.org 13 Aug '18

13 Aug '18

commit a8a7f63745d822670462bde4c8db8cbb2ccc397c Author: Tim Huang <tihuang(a)mozilla.com> Date: Fri Jul 13 19:53:15 2018 +0000 Bug 1473247 - Part 1: Fixing the issue that the IP addresses won't be set for first party domains. r=arthuredelstein,baku Right now, the firstPartyDomain won't be set when using IP addresses as first party domains. It is because of that the TLD service won't accept IP addresses as valid hosts. The patch fixes this problem by detecting that if the host is a IP address. If it is, we will still set the firstPartyDoamin with the IP address. Differential Revision: https://phabricator.services.mozilla.com/D1977 --HG-- extra : moz-landing-system : lando --- caps/OriginAttributes.cpp | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/caps/OriginAttributes.cpp b/caps/OriginAttributes.cpp index 3d9c3f9bda78..ea3d7e507f3f 100644 --- a/caps/OriginAttributes.cpp +++ b/caps/OriginAttributes.cpp @@ -11,6 +11,7 @@ #include "nsIEffectiveTLDService.h" #include "nsIURI.h" #include "nsIURIWithPrincipal.h" +#include "nsURLHelper.h" namespace mozilla { @@ -58,6 +59,28 @@ OriginAttributes::SetFirstPartyDomain(const bool aIsTopLevelDocument, return; } + if (rv == NS_ERROR_HOST_IS_IP_ADDRESS) { + // If the host is an IPv4/IPv6 address, we still accept it as a + // valid firstPartyDomain. + nsAutoCString ipAddr; + rv = aURI->GetHost(ipAddr); + NS_ENSURE_SUCCESS_VOID(rv); + + if (net_IsValidIPv6Addr(ipAddr.BeginReading(), ipAddr.Length())) { + // According to RFC2732, the host of an IPv6 address should be an + // IPv6reference. The GetHost() of nsIURI will only return the IPv6 + // address. So, we need to convert it back to IPv6reference here. + mFirstPartyDomain.Truncate(); + mFirstPartyDomain.AssignLiteral("["); + mFirstPartyDomain.Append(NS_ConvertUTF8toUTF16(ipAddr)); + mFirstPartyDomain.AppendLiteral("]"); + } else { + mFirstPartyDomain = NS_ConvertUTF8toUTF16(ipAddr); + } + + return; + } + nsAutoCString scheme; rv = aURI->GetScheme(scheme); NS_ENSURE_SUCCESS_VOID(rv);

1 0

[torbutton/master] Bug 26655: Adjust color and size of onion button
by gk＠torproject.org 13 Aug '18

13 Aug '18

commit e9b4af29d8acf595bd0da4253336db0783ad5b24 Author: Georg Koppen <gk(a)torproject.org> Date: Mon Aug 13 13:18:25 2018 +0000 Bug 26655: Adjust color and size of onion button Icon design by Antonela Debiasi. --- src/chrome/skin/torbutton-update-needed.svg | 16 +++++++++------- src/chrome/skin/torbutton.svg | 10 +++++----- 2 files changed, 14 insertions(+), 12 deletions(-) diff --git a/src/chrome/skin/torbutton-update-needed.svg b/src/chrome/skin/torbutton-update-needed.svg index 73f819ec..12bcca31 100644 --- a/src/chrome/skin/torbutton-update-needed.svg +++ b/src/chrome/skin/torbutton-update-needed.svg @@ -1,11 +1,13 @@ <?xml version="1.0" encoding="UTF-8"?> -<svg width="24px" height="24px" viewBox="0 0 24 24" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"> - <g id="Icon---Tor---Update" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd"> - <g id="Tor-Button-Icon" transform="translate(2.000000, 1.000000)" fill="#0C0C0D"> - <path d="M8.27206791,6.27905236 C7.88283063,6.53485117 6.37928571,7.48491742 6.38222311,7.48303971 C5.92467564,7.77552366 5.55774616,8.01739321 5.22956304,8.24495813 C4.62774003,8.66226724 4.1902024,9.01032507 3.90524298,9.30237927 C2.34845165,10.8521114 1.86583368,12.1863028 2.03292037,14.2840468 C2.17744778,16.6290092 3.98280543,18.7226974 6.62789966,19.5725823 C7.66430091,19.8978216 8.64783036,20 10.3045058,20 C12.4566798,20 14.4305353,19.426444 15.7257727,18.390024 C17.1602235,17.2499732 18,15.5258216 18,13.7581121 C18,11.9676824 17.2065463,10.2463814 15.7919239,9.00433992 C15.0624549,8.37501782 14.1112169,7.77509114 12.728283,7.03810567 C11.4758566,6.39901667 10.3718516,5.26209475 9.95586156,3.83344263 C9.74417905,4.87665258 9.16812751,5.7299448 8.27206791,6.27905236 Z M17.1048177,7.49557522 C18.9563878,9.1179941 20,11.3893805 20,13.7581121 C20,16.1268437 18.889058,18.4306785 16.9701581,19.9557522 C15.1859178,21.3834808 12.6947145,22 10.3045058,22 C8.8232498,22 7.47 665339,21.9351032 6.02906225,21.480826 C2.69623613,20.4100295 0.238697687,17.6843658 0.0367082257,14.4070796 C-0.165281236,11.8761062 0.440687149,9.92920354 2.49424667,7.88495575 C3.53785889,6.81415929 5.69241315,5.58112094 7.1736692,4.60766962 C7.91429722,4.15339233 8.68859016,2.79056047 7.20733411,0.227138643 L7.5103183,0 L11.9204215,1.75221239 C11.3144532,3.63421829 13.0650285,4.96460177 13.637332,5.25663717 C14.9165986,5.9380531 16.1285353,6.6519174 17.1048177,7.49557522 Z" id="Border" fill-rule="nonzero"></path> - <path d="M10,5.80000019 C10.3632315,6.90320629 11.2333653,7.78038283 12.2159038,8.28105702 C13.3397544,8.87914153 14.1127842,9.36599897 14.7055922,9.87671162 C15.8551945,10.8846633 16.5,12.2815477 16.5,13.7345319 C16.5,15.1690781 15.81755,16.5682758 14.6518339,17.4934592 C13.5992506,18.3345433 11.9951837,18.8000002 10.2462051,18.8000002 C10.1620472,18.8000002 10.0800269,18.7996762 10,18.7990042 L10,5.80000019 Z" id="Half-Content"></path> +<svg width="16px" height="16px" viewBox="0 0 16 16" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"> + <g id="Icon---Tor-Update---Grey" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd"> + <g id="Tor-Button-Icon" fill="#0C0C0D" fill-opacity="0.8"> + <path d="M7.06561268,5.02241519 C6.77772045,5.2116121 5.67952408,5.90554501 5.6853992,5.90178938 C5.35790364,6.11113858 5.09635335,6.28354515 4.86413018,6.44457064 C4.45268439,6.72987059 4.15887546,6.96359333 3.97499388,7.15193679 C2.95731966,8.16499644 2.66333288,8.97771922 2.77290903,10.3548433 C2.86347409,11.8242645 4.01769529,13.1628244 5.73360996,13.7141752 C6.42393225,13.9308094 7.08993386,14 8.24418607,14 C9.69409954,14 11.010192,13.6175745 11.8475477,12.9475461 C12.7611494,12.2214478 13.2954545,11.1244618 13.2954545,10.0058997 C13.2954545,8.86286776 12.7876949,7.76058164 11.8769727,6.9600938 C11.3838667,6.53505399 10.722397,6.11798563 9.75901067,5.60447735 C9.08955454,5.26286683 8.4719792,4.75203246 8.02479915,4.11379651 C7.77978416,4.4739196 7.45874047,4.78154253 7.06561268,5.02241519 Z M13.1898674,5.45132743 C14.5364638,6.63126844 15.2954545,8.28318584 15.2954545,10.0058997 C15.2954545,11.7286136 14.4874967,13.4041298 13.0919331,14.5132743 C11.7943039,15.551622 4 9.98251962,16 8.24418607,16 C7.16690894,16 6.1875661,15.9528024 5.13477254,15.6224189 C2.71089901,14.8436578 0.923598318,12.8613569 0.776696891,10.4778761 C0.629795465,8.63716814 1.07049974,7.22123894 2.56399758,5.73451327 C3.32298828,4.95575221 4.88993683,4.05899705 5.96721396,3.35103245 C6.50585253,3.02064897 7.06897466,2.02949853 5.99169753,0.16519174 L6.21204967,0 L9.41939748,1.27433628 C8.97869321,2.64306785 10.2518389,3.61061947 10.6680596,3.82300885 C11.5984353,4.31858407 12.4798439,4.83775811 13.1898674,5.45132743 Z" id="Border" fill-rule="nonzero"></path> + <path d="M8.27272727,5 C8.49625435,5.67889606 9.03172133,6.21869701 9.63636041,6.5268042 C10.3279607,6.89485621 10.8036714,7.19446079 11.1684763,7.5087455 C11.8759239,8.12902347 12.2727273,8.98864463 12.2727273,9.88278877 C12.2727273,10.7655864 11.852758,11.6266312 11.1353943,12.1959748 C10.4876507,12.713565 9.5005326,13 8.42423809,13 C8.37244863,13 8.32197458,12.9998006 8.27272727,12.9993871 L8.27272727,5 Z" id="Half-Content"></path> + </g> + <g id="!" transform="translate(0.000000, 6.100000)"> + <polygon id="Triangle-Copy" fill="#414141" points="5 0.714285714 9.28571429 9.28571429 0.714285714 9.28571429"></polygon> + <path d="M9.78067261,7.86561722 C10.0020131,8.30856238 9.97819173,8.83453755 9.71771774,9.25566142 C9.45724375,9.6767853 8.9972698,9.93299087 8.50210118,9.93276007 L1.42710118,9.93276007 C0.932880889,9.93225088 0.474029854,9.67633171 0.213899592,9.2561101 C-0.0462306709,8.83588849 -0.0706843715,8.31106384 0.149244037,7.86847436 L3.68710118,0.789902932 C3.92904842,0.305811394 4.42377158,0 4.96495832,0 C5.50614506,0 6.00086822,0.305811394 6.24281547,0.789902932 L9.78067261,7.86561722 Z M4.25067261,2.78990293 L4.25067261,5.64704579 C4.25067261,6.0415349 4.57046922,6.3613315 4.96495832,6.3613315 C5.35944743,6.3613315 5.67924404,6.0415349 5.67924404,5.64704579 L5.67924404,2.78990293 C5.67924404,2.39541382 5.35944743,2.07561722 4.96495832,2.07561722 C4.57046922,2.07561722 4.25067261,2.39541382 4.25067261,2.78990293 Z M4.96495832,8.68276007 C5.45806971,8.68276007 5.85781547,8.28301432 5.85781547,7.78990293 C5.85781547,7.29679155 5.45806971,6.89704579 4.96495832,6.89704579 C4.47 184694,6.89704579 4.07210118,7.29679155 4.07210118,7.78990293 C4.07210118,8.28301432 4.47184694,8.68276007 4.96495832,8.68276007 Z" id="Shape-Copy" fill="#FFE900" fill-rule="nonzero"></path> </g> - <polygon id="Triangle" fill="#0C0C0D" points="7 11 13 23 1 23"></polygon> - <path d="M13.6929417,21.0118641 C14.0028183,21.6319873 13.9694684,22.3683526 13.6048048,22.957926 C13.2401412,23.5474994 12.5961777,23.9061872 11.9029417,23.9058641 L1.99794165,23.9058641 C1.30603325,23.9051512 0.663641796,23.5468644 0.299459428,22.9585541 C-0.0647229393,22.3702439 -0.0989581202,21.6354894 0.208941651,21.0158641 L5.16194165,11.1058641 C5.50066779,10.428136 6.19328022,10 6.95094165,10 C7.70860308,10 8.40121551,10.428136 8.73994165,11.1058641 L13.6929417,21.0118641 Z M5.95094165,13.9058641 L5.95094165,17.9058641 C5.95094165,18.4581489 6.3986569,18.9058641 6.95094165,18.9058641 C7.5032264,18.9058641 7.95094165,18.4581489 7.95094165,17.9058641 L7.95094165,13.9058641 C7.95094165,13.3535794 7.5032264,12.9058641 6.95094165,12.9058641 C6.3986569,12.9058641 5.95094165,13.3535794 5.95094165,13.9058641 Z M6.95094165,22.1558641 C7.64129759,22.1558641 8.20094165,21.59622 8.20094165,20.9058641 C8.20094165,20.2155082 7.64129759,19.6558641 6.95094165,19.6558641 C6.26058571, 19.6558641 5.70094165,20.2155082 5.70094165,20.9058641 C5.70094165,21.59622 6.26058571,22.1558641 6.95094165,22.1558641 Z" id="Shape" fill="#FFE900" fill-rule="nonzero"></path> </g> </svg> diff --git a/src/chrome/skin/torbutton.svg b/src/chrome/skin/torbutton.svg index 518e981d..11892c6f 100644 --- a/src/chrome/skin/torbutton.svg +++ b/src/chrome/skin/torbutton.svg @@ -1,9 +1,9 @@ <?xml version="1.0" encoding="UTF-8"?> -<svg width="24px" height="24px" viewBox="0 0 24 24" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"> - <g id="Icon---Tor-" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd"> - <g id="Tor-Button-Icon" transform="translate(2.000000, 1.000000)" fill="#0C0C0D"> - <path d="M8.27206791,6.27905236 C7.88283063,6.53485117 6.37928571,7.48491742 6.38222311,7.48303971 C5.92467564,7.77552366 5.55774616,8.01739321 5.22956304,8.24495813 C4.62774003,8.66226724 4.1902024,9.01032507 3.90524298,9.30237927 C2.34845165,10.8521114 1.86583368,12.1863028 2.03292037,14.2840468 C2.17744778,16.6290092 3.98280543,18.7226974 6.62789966,19.5725823 C7.66430091,19.8978216 8.64783036,20 10.3045058,20 C12.4566798,20 14.4305353,19.426444 15.7257727,18.390024 C17.1602235,17.2499732 18,15.5258216 18,13.7581121 C18,11.9676824 17.2065463,10.2463814 15.7919239,9.00433992 C15.0624549,8.37501782 14.1112169,7.77509114 12.728283,7.03810567 C11.4758566,6.39901667 10.3718516,5.26209475 9.95586156,3.83344263 C9.74417905,4.87665258 9.16812751,5.7299448 8.27206791,6.27905236 Z M17.1048177,7.49557522 C18.9563878,9.1179941 20,11.3893805 20,13.7581121 C20,16.1268437 18.889058,18.4306785 16.9701581,19.9557522 C15.1859178,21.3834808 12.6947145,22 10.3045058,22 C8.8232498,22 7.47 665339,21.9351032 6.02906225,21.480826 C2.69623613,20.4100295 0.238697687,17.6843658 0.0367082257,14.4070796 C-0.165281236,11.8761062 0.440687149,9.92920354 2.49424667,7.88495575 C3.53785889,6.81415929 5.69241315,5.58112094 7.1736692,4.60766962 C7.91429722,4.15339233 8.68859016,2.79056047 7.20733411,0.227138643 L7.5103183,0 L11.9204215,1.75221239 C11.3144532,3.63421829 13.0650285,4.96460177 13.637332,5.25663717 C14.9165986,5.9380531 16.1285353,6.6519174 17.1048177,7.49557522 Z" id="Border" fill-rule="nonzero"></path> - <path d="M10,5.80000019 C10.3632315,6.90320629 11.2333653,7.78038283 12.2159038,8.28105702 C13.3397544,8.87914153 14.1127842,9.36599897 14.7055922,9.87671162 C15.8551945,10.8846633 16.5,12.2815477 16.5,13.7345319 C16.5,15.1690781 15.81755,16.5682758 14.6518339,17.4934592 C13.5992506,18.3345433 11.9951837,18.8000002 10.2462051,18.8000002 C10.1620472,18.8000002 10.0800269,18.7996762 10,18.7990042 L10,5.80000019 Z" id="Half-Content"></path> +<svg width="16px" height="16px" viewBox="0 0 16 16" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"> + <g id="Icon---Tor---Grey" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd" fill-opacity="0.8"> + <g id="Tor-Button-Icon" fill="#0C0C0D"> + <path d="M7.06561268,5.02241519 C6.77772045,5.2116121 5.67952408,5.90554501 5.6853992,5.90178938 C5.35790364,6.11113858 5.09635335,6.28354515 4.86413018,6.44457064 C4.45268439,6.72987059 4.15887546,6.96359333 3.97499388,7.15193679 C2.95731966,8.16499644 2.66333288,8.97771922 2.77290903,10.3548433 C2.86347409,11.8242645 4.01769529,13.1628244 5.73360996,13.7141752 C6.42393225,13.9308094 7.08993386,14 8.24418607,14 C9.69409954,14 11.010192,13.6175745 11.8475477,12.9475461 C12.7611494,12.2214478 13.2954545,11.1244618 13.2954545,10.0058997 C13.2954545,8.86286776 12.7876949,7.76058164 11.8769727,6.9600938 C11.3838667,6.53505399 10.722397,6.11798563 9.75901067,5.60447735 C9.08955454,5.26286683 8.4719792,4.75203246 8.02479915,4.11379651 C7.77978416,4.4739196 7.45874047,4.78154253 7.06561268,5.02241519 Z M13.1898674,5.45132743 C14.5364638,6.63126844 15.2954545,8.28318584 15.2954545,10.0058997 C15.2954545,11.7286136 14.4874967,13.4041298 13.0919331,14.5132743 C11.7943039,15.551622 4 9.98251962,16 8.24418607,16 C7.16690894,16 6.1875661,15.9528024 5.13477254,15.6224189 C2.71089901,14.8436578 0.923598318,12.8613569 0.776696891,10.4778761 C0.629795465,8.63716814 1.07049974,7.22123894 2.56399758,5.73451327 C3.32298828,4.95575221 4.88993683,4.05899705 5.96721396,3.35103245 C6.50585253,3.02064897 7.06897466,2.02949853 5.99169753,0.16519174 L6.21204967,0 L9.41939748,1.27433628 C8.97869321,2.64306785 10.2518389,3.61061947 10.6680596,3.82300885 C11.5984353,4.31858407 12.4798439,4.83775811 13.1898674,5.45132743 Z" id="Border" fill-rule="nonzero"></path> + <path d="M8.27272727,5 C8.49625435,5.67889606 9.03172133,6.21869701 9.63636041,6.5268042 C10.3279607,6.89485621 10.8036714,7.19446079 11.1684763,7.5087455 C11.8759239,8.12902347 12.2727273,8.98864463 12.2727273,9.88278877 C12.2727273,10.7655864 11.852758,11.6266312 11.1353943,12.1959748 C10.4876507,12.713565 9.5005326,13 8.42423809,13 C8.37244863,13 8.32197458,12.9998006 8.27272727,12.9993871 L8.27272727,5 Z" id="Half-Content"></path> </g> </g> </svg>

1 0

[tor-browser-build/master] Bug 27101: fix tor build issue with rust enabled
by gk＠torproject.org 13 Aug '18

13 Aug '18

commit 3ba2bd456ac69f81ffbf5f0baa403ad005aeff34 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Mon Aug 13 15:12:07 2018 +0200 Bug 27101: fix tor build issue with rust enabled Fix build issue introduced by the fix for #25485. --- projects/tor/build | 2 ++ 1 file changed, 2 insertions(+) diff --git a/projects/tor/build b/projects/tor/build index 89a5418..c8f63bc 100644 --- a/projects/tor/build +++ b/projects/tor/build @@ -57,6 +57,8 @@ openssldir=/var/tmp/dist/openssl chmod 700 "$distdir"/Tor/libstdc++/*.so* # This is needed to make RPATH unavailable. See bug 9150. export LD_LIBRARY_PATH="$distdir/Tor/" + # Add libstdc++ to LD_LIBRARY_PATH to avoid rust link issue (bug 27101) + export LD_LIBRARY_PATH="$LD_LIBRARY_PATH:$distdir/Tor/libstdc++/" [% END %] [% IF c("var/osx") %]

1 0

[tor-browser/tor-browser-60.1.0esr-8.0-1] squash! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 13 Aug '18

13 Aug '18

commit 975b6f238bf21fc0e567f7622871a3f55722913d Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Wed Aug 1 09:44:12 2018 -0700 squash! TB4: Tor Browser's Firefox preference overrides. Bug 17252: Enable session identifiers with FPI Session tickets and session identifiers were isolated by OriginAttributes, so we can re-enable them by allowing the default value (true) of "security.ssl.disable_session_identifiers". The pref "security.enable_tls_session_tickets" is obsolete (removed in https://bugzilla.mozilla.org/917049) --- browser/app/profile/000-tor-browser.js | 2 -- 1 file changed, 2 deletions(-) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 57d04f36bc3d..d0fdbe1040b4 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -174,7 +174,6 @@ pref("browser.cache.frecency_experiment", -1); // Third party stuff pref("privacy.firstparty.isolate", true); // Always enforce first party isolation pref("network.cookie.cookieBehavior", 1); -pref("security.enable_tls_session_tickets", false); pref("network.http.spdy.enabled", false); // Stores state and may have keepalive issues (both fixable) pref("network.http.spdy.enabled.v2", false); // Seems redundant, but just in case pref("network.http.spdy.enabled.v3", false); // Seems redundant, but just in case @@ -270,7 +269,6 @@ pref("network.http.pipelining.reschedule-timeout", 15000); pref("network.http.pipelining.read-timeout", 60000); // Hacked pref: Now means "Attempt to pipeline at least this many requests together" pref("network.http.pipelining.max-optimistic-requests", 3); -pref("security.ssl.disable_session_identifiers", true); pref("network.manage-offline-status", false); // No need to leak things to Mozilla, see bug 21790 pref("network.captive-portal-service.enabled", false);

1 0

[tor-browser/tor-browser-60.1.0esr-8.0-1] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 13 Aug '18

13 Aug '18

commit 49b80d55c275d4a59484b8e955d9d4eeac2d8d44 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Aug 1 07:59:54 2018 +0000 fixup! TB4: Tor Browser's Firefox preference overrides. Fixes bug 26409. We rely on the fix for Mozilla's bug 1039069 for providing a spoofed Accept-Language header/JS locale if the user wants to. --- browser/app/profile/000-tor-browser.js | 4 ---- 1 file changed, 4 deletions(-) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 1ab4dd39a13c..57d04f36bc3d 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -147,10 +147,6 @@ pref("browser.zoom.siteSpecific", false); pref("intl.charset.default", "windows-1252"); pref("browser.link.open_newwindow.restriction", 0); // Bug 9881: Open popups in new tabs (to avoid fullscreen popups) pref("dom.gamepad.enabled", false); // bugs.torproject.org/13023 -pref("javascript.use_us_english_locale", true); -// pref("intl.accept_languages", "en-us, en"); // Set by Torbutton -// pref("intl.accept_charsets", "iso-8859-1,*,utf-8"); // Set by Torbutton -// pref("intl.charsetmenu.browser.cache", "UTF-8"); // Set by Torbutton // Disable video statistics fingerprinting vector (bug 15757) pref("media.video_stats.enabled", false); // Set video VP9 to 0 for everyone (bug 22548)

1 0

[torbutton/master] Bug 26409: Remove spoofed locale implementation
by gk＠torproject.org 13 Aug '18

13 Aug '18

commit e950aeac23670983bedd84c6526bb9a865450a25 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Aug 1 08:04:21 2018 +0000 Bug 26409: Remove spoofed locale implementation In bug 1039069 Mozilla implemented the option of spoofing the locale in the Accept-Language header/JS locale if users with localized builds want that for better fingerprinting protection. That makes our workaround in Torbutton obsolete and we can remove it. Otherwise users start to get the respective language prompt twice, which is quite annoying. --- src/chrome/content/torbutton.js | 109 +----------------------------- src/chrome/locale/en/torbutton.properties | 1 - src/defaults/preferences/preferences.js | 2 - 3 files changed, 1 insertion(+), 111 deletions(-) diff --git a/src/chrome/content/torbutton.js b/src/chrome/content/torbutton.js index 18895927..d0195b46 100644 --- a/src/chrome/content/torbutton.js +++ b/src/chrome/content/torbutton.js @@ -12,7 +12,7 @@ let { showDialog } = Cu.import("resource://torbutton/modules/utils.js", {}); let { getLocale, unescapeTorString } = Cu.import("resource://torbutton/modules/utils.js", {}); let SecurityPrefs = Cu.import("resource://torbutton/modules/security-prefs.js", {}); let NoScriptControl = Cu.import("resource://torbutton/modules/noscript-control.js", {}); -let { bindPrefAndInit, observe } = Cu.import("resource://torbutton/modules/utils.js", {}); +let { bindPrefAndInit } = Cu.import("resource://torbutton/modules/utils.js", {}); Cu.importGlobalProperties(["XMLHttpRequest"]); @@ -170,7 +170,6 @@ var torbutton_unique_pref_observer = torbutton_use_nontor_proxy(); break; case "privacy.resistFingerprinting": - case "extensions.torbutton.spoof_english": torbutton_update_fingerprinting_prefs(); break; case "privacy.firstparty.isolate": @@ -463,36 +462,6 @@ var torbutton_abouttor_message_handler = { } }; -function torbutton_should_prompt_for_language_preference() { - return torbutton_get_general_useragent_locale().substring(0, 2) != "en" && - !m_tb_prefs.getBoolPref("extensions.torbutton.prompted_language"); -} - - -// Bug 1506 P3: This code asks the user once if they want to spoof their -// language to English. -// -// Asks the user whether Torbutton should make "English requests", and updates -// the extensions.torbutton.spoof_english preference accordingly. -function torbutton_prompt_for_language_preference() { - var prompts = Cc["@mozilla.org/embedcomp/prompt-service;1"] - .getService(Ci.nsIPromptService); - - // Display two buttons, both with string titles. - var flags = prompts.STD_YES_NO_BUTTONS; - - var message = torbutton_get_property_string("torbutton.popup.prompted_language"); - - m_tb_prefs.setBoolPref("extensions.torbutton.prompted_language", true); - // Display modal prompt, anchored to this window. - var response = prompts.confirmEx(window, "", message, flags, - null, null, null, null, {value: false}); - - // Update preferences to reflect their response and to prevent the prompt from - // being displayed again. - m_tb_prefs.setBoolPref("extensions.torbutton.spoof_english", response == 0); -} - function torbutton_confirm_plugins() { var any_plugins_enabled = false; var PH=Cc["@mozilla.org/plugin/host;1"].getService(Ci.nsIPluginHost); @@ -1641,23 +1610,6 @@ function torbutton_update_disk_prefs() { function torbutton_update_fingerprinting_prefs() { var mode = m_tb_prefs.getBoolPref("privacy.resistFingerprinting"); - if (m_tb_tbb) { - if (mode) { - // Governed also by the spoof_english dialog.. - if (m_tb_prefs.getBoolPref("extensions.torbutton.spoof_english")) { - m_tb_prefs.setCharPref("intl.accept_languages", "en-US, en"); - m_tb_prefs.setBoolPref("javascript.use_us_english_locale", true); - } else { - if(m_tb_prefs.prefHasUserValue("intl.accept_languages")) - m_tb_prefs.clearUserPref("intl.accept_languages"); - m_tb_prefs.setBoolPref("javascript.use_us_english_locale", false); - } - } else { - if(m_tb_prefs.prefHasUserValue("intl.accept_languages")) - m_tb_prefs.clearUserPref("intl.accept_languages"); - } - } - m_tb_prefs.setBoolPref("webgl.min_capability_mode", mode); m_tb_prefs.setBoolPref("webgl.disable-extensions", mode); m_tb_prefs.setBoolPref("dom.network.enabled", !mode); @@ -2019,8 +1971,6 @@ function torbutton_is_windowed(wind) { return true; } -let stopLanguagePromptObserver; - // Bug 1506 P3: This is needed pretty much only for the version check // and the window resizing. See comments for individual functions for // details @@ -2054,15 +2004,6 @@ function torbutton_new_window(event) Ci.nsIWebProgress.NOTIFY_STATE_DOCUMENT); } - // If the default language is not English and we have not already asked, - // add an http-on-modify-request observer that will show a "request English - // language web pages?" prompt the first time a content http or https page - // is opened. - if (torbutton_should_prompt_for_language_preference()) { - stopLanguagePromptObserver = observe("http-on-modify-request", - torbutton_http_connection_observed); - } - // Check the version on every new window. We're already pinging check in these cases. torbutton_do_async_versioncheck(); @@ -2238,54 +2179,6 @@ var torbutton_resizelistener = onSecurityChange: function() {} }; -function torbutton_http_connection_observed(aRequest, aData) { - // If we are loading an HTTP page from content, show the - // "request English language web pages?" prompt. - try { - let httpChannel = aRequest.QueryInterface(Ci.nsIHttpChannel); - if (!aRequest.URI.schemeIs("http") && !aRequest.URI.schemeIs("https")) { - return; - } - if (!httpChannel) return; - let notificationCallbacks = httpChannel.notificationCallbacks; - if (!notificationCallbacks) return; - let loadContext = notificationCallbacks.getInterface(Ci.nsILoadContext); - if (!loadContext) return; - if (!loadContext.isContent) return; - // The above QI did not throw, the scheme is http[s], and we know the - // load context is content, so we must have a true HTTP request from content. - // Stop the observer and display the prompt if another window has - // not already done so. - stopLanguagePromptObserver(); - - if (torbutton_should_prompt_for_language_preference()) { - if (torbutton_is_homepage_url(aRequest.URI)) { - // If the homepage is being loaded, display the prompt after a - // delay to avoid a problem where a blank prompt is displayed. - // In this case, the homepage will be loaded using the current - // spoof English setting, which is OK. - setTimeout(function() { - if (torbutton_should_prompt_for_language_preference()) - torbutton_prompt_for_language_preference(); - }, 2000); - } else { - // No delay is needed. Display the prompt and fix up the - // Accept-Language header before allowing the load to continue. - torbutton_prompt_for_language_preference(); - - // The Accept-Language header for this request was set when the - // channel was created. Reset it to match the value that will be - // used for future requests. - let val = torbutton_get_current_accept_language_value(aRequest.URI); - if (val) - httpChannel.setRequestHeader("Accept-Language", val, false); - } - } - } catch (e) { - torbutton_log(3, e.message); - } -} - // aURI should be an http or https nsIURI object. function torbutton_get_current_accept_language_value(aURI) { diff --git a/src/chrome/locale/en/torbutton.properties b/src/chrome/locale/en/torbutton.properties index d77af1ee..53573df0 100644 --- a/src/chrome/locale/en/torbutton.properties +++ b/src/chrome/locale/en/torbutton.properties @@ -21,7 +21,6 @@ torbutton.popup.external.suggest = To be safe, you should only open downloaded f torbutton.popup.launch = Download file torbutton.popup.cancel = Cancel torbutton.popup.dontask = Automatically download files from now on -torbutton.popup.prompted_language = To give you more privacy, Torbutton can request the English language version of web pages. This may cause web pages that you prefer to read in your native language to display in English instead.\n\nWould you like to request English language web pages for better privacy? torbutton.popup.no_newnym = Torbutton cannot safely give you a new identity. It does not have access to the Tor Control Port.\n\nAre you running Tor Browser Bundle? torbutton.title.prompt_torbrowser = Important Torbutton Information torbutton.popup.prompt_torbrowser = Torbutton works differently now: you can't turn it off any more.\n\nWe made this change because it isn't safe to use Torbutton in a browser that's also used for non-Tor browsing. There were too many bugs there that we couldn't fix any other way.\n\nIf you want to keep using Firefox normally, you should uninstall Torbutton and download Tor Browser Bundle. The privacy properties of Tor Browser are also superior to those of normal Firefox, even when Firefox is used with Torbutton.\n\nTo remove Torbutton, go to Tools->Addons->Extensions and then click the Remove button next to Torbutton. diff --git a/src/defaults/preferences/preferences.js b/src/defaults/preferences/preferences.js index 5cfb0eb3..ab9b4bf4 100644 --- a/src/defaults/preferences/preferences.js +++ b/src/defaults/preferences/preferences.js @@ -19,7 +19,6 @@ pref("extensions.torbutton.use_nontor_proxy",false); // State prefs: pref("extensions.torbutton.startup",false); pref("extensions.torbutton.inserted_button",false); -pref("extensions.torbutton.prompted_language",false); // TODO: This is just part of a stopgap until #14429 gets properly implemented. // See #7255 for details. We display the warning three times to make sure the @@ -29,7 +28,6 @@ pref("extensions.torbutton.maximize_warnings_remaining", 3); // Security prefs: pref("extensions.torbutton.cookie_protections",true); pref("extensions.torbutton.cookie_auto_protect",false); -pref("extensions.torbutton.spoof_english",true); pref("extensions.torbutton.clear_http_auth",true); pref("extensions.torbutton.close_newnym",true); pref("extensions.torbutton.resize_new_windows",true);

1 0

[tor-browser-build/master] Fix typo in README.MAKEFILE
by boklm＠torproject.org 08 Aug '18

08 Aug '18

commit 3788a45e3dc53d310a52b4262d1ceb7615a12e50 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Wed Aug 8 12:17:43 2018 +0200 Fix typo in README.MAKEFILE --- README.MAKEFILE | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.MAKEFILE b/README.MAKEFILE index 8094651..7fd05e9 100644 --- a/README.MAKEFILE +++ b/README.MAKEFILE @@ -47,7 +47,7 @@ testbuild --------- Build a Tor Browser test build. To make the build faster, only the en-US locale is created, without mar files. By default it is based on the -alpha channel, but you can change that by editing rbm.conf.local. +alpha channel, but you can change that by editing rbm.local.conf. The resulting build can be found in directory testbuild. {release,alpha,nightly,testbuild}-linux-x86_64-debug

1 0