August 2020 - tbb-commits - lists.torproject.org

[tor-browser-build/master] Bug 40010: Add NSS for application-services
by sysrqb＠torproject.org 10 Aug '20

10 Aug '20

commit 53131fdc6d54bdd3bda261c64aa81fc3e8fbe228 Author: Georg Koppen <gk(a)torproject.org> Date: Tue Jun 30 10:12:32 2020 +0000 Bug 40010: Add NSS for application-services --- projects/nss/bug_13028.patch | 79 ++++++++++++++++++++++++ projects/nss/build | 139 +++++++++++++++++++++++++++++++++++++++++++ projects/nss/config | 27 +++++++++ projects/nss/config.patch | 37 ++++++++++++ projects/nss/configure.patch | 11 ++++ 5 files changed, 293 insertions(+) diff --git a/projects/nss/bug_13028.patch b/projects/nss/bug_13028.patch new file mode 100644 index 0000000..60bbd35 --- /dev/null +++ b/projects/nss/bug_13028.patch @@ -0,0 +1,79 @@ +From 2f0888c348561249d3083555db33c5619840dbfa Mon Sep 17 00:00:00 2001 +From: Mike Perry <mikeperry-git(a)torproject.org> +Date: Mon, 29 Sep 2014 14:30:19 -0700 +Subject: [PATCH] Bug 13028: Prevent potential proxy bypass cases. + +It looks like these cases should only be invoked in the NSS command line +tools, and not the browser, but I decided to patch them anyway because there +literally is a maze of network function pointers being passed around, and it's +very hard to tell if some random code might not pass in the proper proxied +versions of the networking code here by accident. + +diff --git a/security/nss/lib/certhigh/ocsp.c b/security/nss/lib/certhigh/ocsp.c +index cea8456606bf..86fa971cfbef 100644 +--- a/security/nss/lib/certhigh/ocsp.c ++++ b/security/nss/lib/certhigh/ocsp.c +@@ -2932,6 +2932,14 @@ ocsp_ConnectToHost(const char *host, PRUint16 port) + PRNetAddr addr; + char *netdbbuf = NULL; + ++ // XXX: Do we need a unittest ifdef here? We don't want to break the tests, but ++ // we want to ensure nothing can ever hit this code in production. ++#if 1 ++ printf("Tor Browser BUG: Attempted OSCP direct connect to %s, port %u\n", host, ++ port); ++ goto loser; ++#endif ++ + sock = PR_NewTCPSocket(); + if (sock == NULL) + goto loser; +diff --git a/security/nss/lib/libpkix/pkix_pl_nss/module/pkix_pl_socket.c b/security/nss/lib/libpkix/pkix_pl_nss/module/pkix_pl_socket.c +index e8698376b5be..85791d84a932 100644 +--- a/security/nss/lib/libpkix/pkix_pl_nss/module/pkix_pl_socket.c ++++ b/security/nss/lib/libpkix/pkix_pl_nss/module/pkix_pl_socket.c +@@ -1334,6 +1334,13 @@ pkix_pl_Socket_Create( + plContext), + PKIX_COULDNOTCREATESOCKETOBJECT); + ++ // XXX: Do we need a unittest ifdef here? We don't want to break the tests, but ++ // we want to ensure nothing can ever hit this code in production. ++#if 1 ++ printf("Tor Browser BUG: Attempted pkix direct socket connect\n"); ++ PKIX_ERROR(PKIX_PRNEWTCPSOCKETFAILED); ++#endif ++ + socket->isServer = isServer; + socket->timeout = timeout; + socket->clientSock = NULL; +@@ -1433,6 +1440,13 @@ pkix_pl_Socket_CreateByName( + + localCopyName = PL_strdup(serverName); + ++ // XXX: Do we need a unittest ifdef here? We don't want to break the tests, but ++ // we want to ensure nothing can ever hit this code in production. ++#if 1 ++ printf("Tor Browser BUG: Attempted pkix direct connect to %s\n", serverName); ++ PKIX_ERROR(PKIX_PRNEWTCPSOCKETFAILED); ++#endif ++ + sepPtr = strchr(localCopyName, ':'); + /* First strip off the portnum, if present, from the end of the name */ + if (sepPtr) { +@@ -1582,6 +1596,13 @@ pkix_pl_Socket_CreateByHostAndPort( + PKIX_ENTER(SOCKET, "pkix_pl_Socket_CreateByHostAndPort"); + PKIX_NULLCHECK_THREE(hostname, pStatus, pSocket); + ++ // XXX: Do we need a unittest ifdef here? We don't want to break the tests, but ++ // we want to ensure nothing can ever hit this code in production. ++#if 1 ++ printf("Tor Browser BUG: Attempted pkix direct connect to %s, port %u\n", hostname, ++ portnum); ++ PKIX_ERROR(PKIX_PRNEWTCPSOCKETFAILED); ++#endif + + prstatus = PR_GetHostByName(hostname, buf, sizeof(buf), &hostent); + +-- +2.27.0 + diff --git a/projects/nss/build b/projects/nss/build new file mode 100644 index 0000000..791a680 --- /dev/null +++ b/projects/nss/build @@ -0,0 +1,139 @@ +#!/bin/bash +[% c("var/set_default_env") -%] +[% pc(c('var/compiler'), 'var/setup', { compiler_tarfile => c('input_files_by_name/' _ c('var/compiler')) }) %] +distdir=/var/tmp/dist/nss +builddir=/var/tmp/build/[% project %] +mkdir /var/tmp/build +tar -C /var/tmp/dist -xf [% c('input_files_by_name/ninja') %] +export PATH=/var/tmp/dist/ninja:$PATH + +# application-services uses a newer NDK, 21d, than all the other projects... +export ANDROID_NDK_API_VERSION=[% pc("fenix-android-toolchain", "var/android_ndk_version") %][% pc('fenix-android-toolchain', 'var/android_ndk_revision') %] +export ANDROID_NDK_HOME=/var/tmp/dist/[% c('var/compiler') %]/android-ndk/android-ndk-r$ANDROID_NDK_API_VERSION +# We need to add the new path to our build tools to PATH +export PATH=$ANDROID_NDK_HOME/toolchains/llvm/prebuilt/linux-x86_64/bin:$PATH +export ANDROID_NDK_ROOT=$ANDROID_NDK_HOME +export NDK_HOST_TAG=linux-x86_64 + +nspr_64="" +[% IF c("var/configure_host") == "arm-linux-androideabi" -%] + gyp_arch="arm" +[% ELSIF c("var/configure_host") == "i686-linux-android" -%] + gyp_arch="ia32" +[% ELSIF c("var/configure_host") == "x86_64-linux-android" -%] + gyp_arch="x64" + nspr_64="--enable-64bit" +[% ELSIF c("var/configure_host") == "aarch64-linux-android" -%] + gyp_arch="arm64" + nspr_64="--enable-64bit" +[% END -%] + +export AR="[% c('var/cross_prefix') %]-ar" +# XXX: Mozilla really uses the NDK_API_VERSION here, which is weird. +export CC="[% c('var/cross_prefix') %][% pc('fenix-android-toolchain', 'var/android_ndk_version') %]-clang" +export CXX="[% c('var/cross_prefix') %][% pc('fenix-android-toolchain', 'var/android_ndk_version') %]-clang++" +export LD="[% c('var/cross_prefix') %]-ld" +export NM="[% c('var/cross_prefix') %]-nm" +export RANLIB="[% c('var/cross_prefix') %]-ranlib" +export READELF="[% c('var/cross_prefix') %]-readelf" + +tar -C /var/tmp/build -xf [% c('input_files_by_name/nss') %] +mv /var/tmp/build/[% project %]-[% c('version') %] $builddir +cd $builddir +# Early return hack to prevent NSPR Android setup +# which does not work with ndk unified headers and clang. See: +# application-services/libs/build-all.sh +cat $rootdir/configure.patch | patch nspr/configure +# Some NSS symbols clash with OpenSSL symbols, rename them using +# C preprocessor define macros. See: +# application-services/libs/build-all.sh +patch -p2 < $rootdir/config.patch +# Let's apply our proxy bypass defense-in-depth here as well to be on the safe +# side. +patch -p2 < $rootdir/bug_13028.patch + +# Building NSPR +mkdir $builddir/nspr_build +cd $builddir/nspr_build +../nspr/configure \ + $nspr_64 \ + --target=[% c("var/configure_host") %] \ + --disable-debug \ + --enable-optimize +make +cd .. + +# Building NSS +mkdir $builddir/nss_build +gyp -f ninja-android "$builddir/nss/nss.gyp" \ + --depth "$builddir/nss/" \ + --generator-output=. \ + -DOS=android \ + -Dnspr_lib_dir="$builddir/nspr_build/dist/lib" \ + -Dnspr_include_dir="$builddir/nspr_build/dist/include/nspr" \ + -Dnss_dist_dir="$builddir/nss_build" \ + -Dnss_dist_obj_dir="$builddir/nss_build" \ + -Dhost_arch="$gyp_arch" \ + -Dtarget_arch="$gyp_arch" \ + -Dstatic_libs=1 \ + -Ddisable_dbm=1 \ + -Dsign_libs=0 \ + -Denable_sslkeylogfile=0 \ + -Ddisable_tests=1 \ + -Ddisable_libpkix=1 + +gendir="$builddir/nss/out/Release" +ninja -C "$gendir" + +mkdir -p $distdir/include/nss +mkdir -p $distdir/lib +cp -p -L "$builddir/nss_build/lib/libcertdb.a" "$distdir/lib" +cp -p -L "$builddir/nss_build/lib/libcerthi.a" "$distdir/lib" +cp -p -L "$builddir/nss_build/lib/libcryptohi.a" "$distdir/lib" +cp -p -L "$builddir/nss_build/lib/libfreebl_static.a" "$distdir/lib" +cp -p -L "$builddir/nss_build/lib/libnss_static.a" "$distdir/lib" +cp -p -L "$builddir/nss_build/lib/libnssb.a" "$distdir/lib" +cp -p -L "$builddir/nss_build/lib/libnssdev.a" "$distdir/lib" +cp -p -L "$builddir/nss_build/lib/libnsspki.a" "$distdir/lib" +cp -p -L "$builddir/nss_build/lib/libnssutil.a" "$distdir/lib" +cp -p -L "$builddir/nss_build/lib/libpk11wrap_static.a" "$distdir/lib" +cp -p -L "$builddir/nss_build/lib/libpkcs12.a" "$distdir/lib" +cp -p -L "$builddir/nss_build/lib/libpkcs7.a" "$distdir/lib" +cp -p -L "$builddir/nss_build/lib/libsmime.a" "$distdir/lib" +cp -p -L "$builddir/nss_build/lib/libsoftokn_static.a" "$distdir/lib" +cp -p -L "$builddir/nss_build/lib/libssl.a" "$distdir/lib" + +# HW specific. +# https://searchfox.org/nss/rev/08c4d05078d00089f8d7540651b0717a9d66f87e/lib/… +[% IF c("var/configure_host") == "i686-linux-android" || c("var/configure_host") == "x86_64-linux-android"-%] + cp -p -L "$builddir/nss_build/lib/libgcm-aes-x86_c_lib.a" "$distdir/lib" +[% END %] +[% IF c("var/configure_host") == "arm-linux-androideabi" || c("var/configure_host") == "aarch64-linux-android"-%] + cp -p -L "$builddir/nss_build/lib/libarmv8_c_lib.a" "$distdir/lib" +[% END %] +[% IF c("var/configure_host") == "aarch64-linux-android" -%] + cp -p -L "$builddir/nss_build/lib/libgcm-aes-aarch64_c_lib.a" "$distdir/lib" +[% END %] +[% IF c("var/configure_host") == "arm-linux-androideabi" -%] + cp -p -L "$builddir/nss_build/lib/libgcm-aes-arm32-neon_c_lib.a" "$distdir/lib" +[% END %] +# https://searchfox.org/nss/rev/08c4d05078d00089f8d7540651b0717a9d66f87e/lib/… +# https://searchfox.org/nss/rev/08c4d05078d00089f8d7540651b0717a9d66f87e/lib/… +[% IF c("var/configure_host") == "x86_64-linux-android"-%] + cp -p -L "$builddir/nss_build/lib/libintel-gcm-wrap_c_lib.a" "$distdir/lib" + cp -p -L "$builddir/nss_build/lib/libintel-gcm-s_lib.a" "$distdir/lib" + cp -p -L "$builddir/nss_build/lib/libhw-acc-crypto-avx.a" "$distdir/lib" + cp -p -L "$builddir/nss_build/lib/libhw-acc-crypto-avx2.a" "$distdir/lib" +[% END %] +cp -p -L "$builddir/nspr_build/dist/lib/libplc4.a" "$distdir/lib" +cp -p -L "$builddir/nspr_build/dist/lib/libplds4.a" "$distdir/lib" +cp -p -L "$builddir/nspr_build/dist/lib/libnspr4.a" "$distdir/lib" + +cp -p -L -R "$builddir/nss_build/public/nss/"* "$distdir/include/nss" +cp -p -L -R "$builddir/nspr_build/dist/include/nspr/"* "$distdir/include/nss" + +cd /var/tmp/dist +[% c('tar', { + tar_src => [ project ], + tar_args => '-czf ' _ dest_dir _ '/' _ c('filename'), + }) %] diff --git a/projects/nss/config b/projects/nss/config new file mode 100644 index 0000000..e2b875e --- /dev/null +++ b/projects/nss/config @@ -0,0 +1,27 @@ +# vim: filetype=yaml sw=2 +filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' +# The required versions for application-services can be found at the respective +# commit in libs/build-all.sh +version: 3.54 +# XXX: maybe that's extractable automatically from `version` somehow? +version_path: 3_54 +nspr_version: 4.26 +var: + container: + use_container: 1 + deps: + - build-essential + - gyp + +input_files: + - project: container-image + - name: '[% c("var/compiler") %]' + project: '[% c("var/compiler") %]' + - name: ninja + project: ninja + - URL: 'https://ftp.mozilla.org/pub/security/nss/releases/NSS_[% c("version_path") %]_RTM/src/nss-[% c("version") %]-with-nspr-[% c("nspr_version") %].tar.gz' + name: nss + sha256sum: e0e81f0ff264d810f130d3cd9334722f7f883c752430483131d1ca5ac62d3f70 + - filename: configure.patch + - filename: config.patch + - filename: bug_13028.patch diff --git a/projects/nss/config.patch b/projects/nss/config.patch new file mode 100644 index 0000000..e7f5012 --- /dev/null +++ b/projects/nss/config.patch @@ -0,0 +1,37 @@ +From c11dc3a73349fc7d8fa451f9e3a4e3952aa54fd2 Mon Sep 17 00:00:00 2001 +From: Georg Koppen <gk(a)torproject.org> +Date: Wed, 1 Jul 2020 09:57:01 +0000 +Subject: [PATCH] Patch for building NSS for application-services + +See: application-services/libs/build-all.sh + +diff --git a/security/nss/coreconf/config.gypi b/security/nss/coreconf/config.gypi +index 62d3cc71ecaf..dd30de079081 100644 +--- a/security/nss/coreconf/config.gypi ++++ b/security/nss/coreconf/config.gypi +@@ -144,6 +144,23 @@ + '<(nspr_include_dir)', + '<(nss_dist_dir)/private/<(module)', + ], ++ 'defines': [ ++ 'HMAC_Update=NSS_HMAC_Update', ++ 'HMAC_Init=NSS_HMAC_Init', ++ 'CMAC_Update=NSS_CMAC_Update', ++ 'CMAC_Init=NSS_CMAC_Init', ++ 'MD5_Update=NSS_MD5_Update', ++ 'SHA1_Update=NSS_SHA1_Update', ++ 'SHA256_Update=NSS_SHA256_Update', ++ 'SHA224_Update=NSS_SHA224_Update', ++ 'SHA512_Update=NSS_SHA512_Update', ++ 'SHA384_Update=NSS_SHA384_Update', ++ 'SEED_set_key=NSS_SEED_set_key', ++ 'SEED_encrypt=NSS_SEED_encrypt', ++ 'SEED_decrypt=NSS_SEED_decrypt', ++ 'SEED_ecb_encrypt=NSS_SEED_ecb_encrypt', ++ 'SEED_cbc_encrypt=NSS_SEED_cbc_encrypt', ++ ], + 'conditions': [ + [ 'mozpkix_only==1 and OS=="linux"', { + 'include_dirs': [ +-- +2.27.0 diff --git a/projects/nss/configure.patch b/projects/nss/configure.patch new file mode 100644 index 0000000..4ce8465 --- /dev/null +++ b/projects/nss/configure.patch @@ -0,0 +1,11 @@ +@@ -2662,6 +2662,9 @@ + + case "$target" in + *-android*|*-linuxandroid*) ++ $as_echo "#define ANDROID 1" >>confdefs.h ++ ;; ++ unreachable) + if test -z "$android_ndk" ; then + as_fn_error $? "You must specify --with-android-ndk=/path/to/ndk when targeting Android." "$LINENO" 5 + fi +

1 0

[tor-browser-build/master] Bug 40011: Add SQLCipher for application-services
by sysrqb＠torproject.org 10 Aug '20

10 Aug '20

commit 01cb89f0a1c6e46db7add953cfb63b1924ee8377 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Jul 1 14:32:40 2020 +0000 Bug 40011: Add SQLCipher for application-services --- projects/sqlcipher/build | 131 ++++++++++++++++++++++++++++++++++++++++++++++ projects/sqlcipher/config | 21 ++++++++ 2 files changed, 152 insertions(+) diff --git a/projects/sqlcipher/build b/projects/sqlcipher/build new file mode 100644 index 0000000..d364000 --- /dev/null +++ b/projects/sqlcipher/build @@ -0,0 +1,131 @@ +#!/bin/bash +[% c("var/set_default_env") -%] +[% pc(c('var/compiler'), 'var/setup', { compiler_tarfile => c('input_files_by_name/' _ c('var/compiler')) }) %] +distdir=/var/tmp/dist/sqlcipher +builddir=/var/tmp/build/[% project %] +mkdir /var/tmp/build +tar -C /var/tmp/dist -xf [% c('input_files_by_name/nss') %] + +# application-services uses a newer NDK, 21d, than all the other projects... +export ANDROID_NDK_API_VERSION=[% pc("fenix-android-toolchain", "var/android_ndk_version") %][% pc('fenix-android-toolchain', 'var/android_ndk_revision') %] +export ANDROID_NDK_HOME=/var/tmp/dist/[% c('var/compiler') %]/android-ndk/android-ndk-r$ANDROID_NDK_API_VERSION +# We need to add the new path to our build tools to PATH +export PATH=$ANDROID_NDK_HOME/toolchains/llvm/prebuilt/linux-x86_64/bin:$PATH +export ANDROID_NDK_ROOT=$ANDROID_NDK_HOME +export NDK_HOST_TAG=linux-x86_64 + +export AR="[% c('var/cross_prefix') %]-ar" +# XXX: Mozilla really uses the NDK_API_VERSION here, which is weird. +export CC="[% c('var/cross_prefix') %][% pc('fenix-android-toolchain', 'var/android_ndk_version') %]-clang" +export CXX="[% c('var/cross_prefix') %][% pc('fenix-android-toolchain', 'var/android_ndk_version') %]-clang++" +export LD="[% c('var/cross_prefix') %]-ld" +export RANLIB="[% c('var/cross_prefix') %]-ranlib" + +host="" +[% IF c("var/configure_host") == "arm-linux-androideabi" -%] + host="arm-linux" +[% ELSIF c("var/configure_host") == "i686-linux-android" -%] + host="i686-linux" +[% ELSIF c("var/configure_host") == "x86_64-linux-android" -%] + host="x86_64-linux" +[% ELSIF c("var/configure_host") == "aarch64-linux-android" -%] + host="arm-linux" +[% END -%] + +SQLCIPHER_CFLAGS=" \ + -DSQLITE_HAS_CODEC \ + -DSQLITE_SOUNDEX \ + -DHAVE_USLEEP=1 \ + -DSQLITE_MAX_VARIABLE_NUMBER=99999 \ + -DSQLITE_THREADSAFE=1 \ + -DSQLITE_DEFAULT_JOURNAL_SIZE_LIMIT=1048576 \ + -DNDEBUG=1 \ + -DSQLITE_ENABLE_MEMORY_MANAGEMENT=1 \ + -DSQLITE_ENABLE_LOAD_EXTENSION \ + -DSQLITE_ENABLE_COLUMN_METADATA \ + -DSQLITE_ENABLE_UNLOCK_NOTIFY \ + -DSQLITE_ENABLE_RTREE \ + -DSQLITE_ENABLE_STAT3 \ + -DSQLITE_ENABLE_STAT4 \ + -DSQLITE_ENABLE_JSON1 \ + -DSQLITE_ENABLE_FTS3_PARENTHESIS \ + -DSQLITE_ENABLE_FTS4 \ + -DSQLITE_ENABLE_FTS5 \ + -DSQLCIPHER_CRYPTO_NSS \ + -DSQLITE_ENABLE_DBSTAT_VTAB \ + -DSQLITE_SECURE_DELETE \ + -DSQLITE_DEFAULT_PAGE_SIZE=32768 \ + -DSQLITE_MAX_DEFAULT_PAGE_SIZE=32768 \ + -I/var/tmp/dist/nss/include \ +" + +LIBS="\ + -lcertdb \ + -lcerthi \ + -lcryptohi \ + -lfreebl_static \ + -lnspr4 \ + -lnss_static \ + -lnssb \ + -lnssdev \ + -lnsspki \ + -lnssutil \ + -lpk11wrap_static \ + -lplc4 \ + -lplds4 \ + -lsoftokn_static \ +" + +[% IF c("var/configure_host") == "i686-linux-android" || c("var/configure_host") == "x86_64-linux-android"-%] + LIBS="${LIBS} -lgcm-aes-x86_c_lib" +[% END %] +[% IF c("var/configure_host") == "arm-linux-android" || c("var/configure_host") == "aarch64-linux-android"-%] + LIBS="${LIBS} -larmv8_c_lib" +[% END %] +[% IF c("var/configure_host") == "aarch64-linux-android" -%] + LIBS="${LIBS} -lgcm-aes-aarch64_c_lib" +[% END %] +[% IF c("var/configure_host") == "arm-linux-androideabi" -%] + LIBS="${LIBS} -lgcm-aes-arm32-neon_c_lib" +[% END %] +[% IF c("var/configure_host") == "x86_64-linux-android"-%] + LIBS="${LIBS} -lintel-gcm-wrap_c_lib -lintel-gcm-s_lib -lhw-acc-crypto-avx -lhw-acc-crypto-avx2" +[% END %] + +tar -C /var/tmp/build -xf [% c('input_files_by_name/sqlcipher') %] +mv /var/tmp/build/[% project %]-[% c('version') %] $builddir +cd $builddir + +mkdir $builddir/build +cd build +../configure \ + --host="$host" \ + --with-pic \ + --verbose \ + --disable-shared \ + --with-crypto-lib=none \ + --disable-tcl \ + --enable-tempstore=yes \ + CFLAGS="${SQLCIPHER_CFLAGS}" \ + LDFLAGS="-L/var/tmp/dist/nss/lib" \ + LIBS="${LIBS} -llog -lm" + +make sqlite3.h +make sqlite3ext.h +make libsqlcipher.la + +mkdir -p $distdir/include/sqlcipher +mkdir -p $distdir/lib + +cp -p "$builddir/build/sqlite3.h" "$distdir/include/sqlcipher" +cp -p "$builddir/build/sqlite3ext.h" "$distdir/include/sqlcipher" +cp -p "$builddir/build/.libs/libsqlcipher.a" "$distdir/lib" + +# Just in case, ensure that the created binaries are not -w. +chmod +w "$distdir/lib/libsqlcipher.a" + +cd /var/tmp/dist +[% c('tar', { + tar_src => [ project ], + tar_args => '-czf ' _ dest_dir _ '/' _ c('filename'), + }) %] diff --git a/projects/sqlcipher/config b/projects/sqlcipher/config new file mode 100644 index 0000000..fb4ae3a --- /dev/null +++ b/projects/sqlcipher/config @@ -0,0 +1,21 @@ +# vim: filetype=yaml sw=2 +filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' +# The required versions for application-services can be found at the respective +# commit in libs/build-all.sh +version: 4.4.0 +var: + container: + use_container: 1 + deps: + - build-essential + - tcl + +input_files: + - project: container-image + - name: '[% c("var/compiler") %]' + project: '[% c("var/compiler") %]' + - name: nss + project: nss + - URL: 'https://github.com/sqlcipher/sqlcipher/archive/v[% c("version") %].tar.gz' + name: sqlcipher + sha256sum: 0924b2ae1079717954498bda78a30de20ce2a6083076b16214a711567821d148

1 0

[tor-browser/tor-browser-78.1.0esr-10.0-1] fixup! Bug 10760: Integrate TorButton to TorBrowser core
by gk＠torproject.org 10 Aug '20

10 Aug '20

commit 09628dac32ee9a839cfeef284e8531ddb161e15d Author: Georg Koppen <gk(a)torproject.org> Date: Mon Aug 10 07:35:16 2020 +0000 fixup! Bug 10760: Integrate TorButton to TorBrowser core --- toolkit/torproject/torbutton | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/toolkit/torproject/torbutton b/toolkit/torproject/torbutton index 6a779b549e59..f55f5953c6ad 160000 --- a/toolkit/torproject/torbutton +++ b/toolkit/torproject/torbutton @@ -1 +1 @@ -Subproject commit 6a779b549e59dbb72ca81e0808619643a1a1926e +Subproject commit f55f5953c6adb6d75cad74fbb6c3b8fa2d617004

1 0

[tor-browser/tor-browser-78.1.0esr-10.0-1] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 07 Aug '20

07 Aug '20

commit 502fe9064244210138e634bdb44b1a1712092d21 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Wed Aug 5 15:07:30 2020 -0400 fixup! TB4: Tor Browser's Firefox preference overrides. Fixes #40066. --- browser/app/profile/000-tor-browser.js | 10 +--------- mobile/android/app/000-tor-browser-android.js | 10 ---------- 2 files changed, 1 insertion(+), 19 deletions(-) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index e86252ccd98c..3be6e460b628 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -33,10 +33,6 @@ pref("app.releaseNotesURL", "about:blank"); pref("app.update.staging.enabled", false); #endif -// No need to contact the Kinto-based blocklist system in addition to the old -// one which is still used, see bug 22071. -pref("services.blocklist.update_enabled", false); - // Disable "Slow startup" warnings and associated disk history // (bug #13346) pref("browser.slowStartup.notificationDisabled", true); @@ -73,7 +69,7 @@ pref("browser.ssb.enabled", false); // Misc privacy: Remote pref("browser.send_pings", false); pref("geo.enabled", false); -pref("geo.wifi.uri", ""); +pref("geo.provider.network.url", ""); pref("browser.search.suggest.enabled", false); pref("browser.safebrowsing.malware.enabled", false); pref("browser.safebrowsing.phishing.enabled", false); @@ -94,9 +90,6 @@ pref("datareporting.policy.dataSubmissionEnabled", false); pref("toolkit.telemetry.unified", false); pref("toolkit.telemetry.enabled", false); pref("toolkit.telemetry.updatePing.enabled", false); // Make sure updater telemetry is disabled; see #25909. -// No experiments, use Tor Browser. See 21797. -pref("experiments.enabled", false); -pref("browser.syncPromoViewsLeftMap", "{\"addons\":0, \"passwords\":0, \"bookmarks\":0}"); // Don't promote sync pref("identity.fxaccounts.enabled", false); // Disable sync by default pref("services.sync.engine.prefs", false); // Never sync prefs, addons, or tabs with other browsers pref("services.sync.engine.addons", false); @@ -133,7 +126,6 @@ pref("dom.w3c_pointer_events.enabled", false); pref("dom.vr.enabled", false); // Bug 21607: Disable WebVR for now // Disable randomised Firefox HTTP cache decay user test groups (Bug: 13575) pref("security.webauth.webauthn", false); // Bug 26614: Disable Web Authentication API for now -pref("browser.cache.frecency_experiment", -1); // Disable intermediate preloading (Bug 30682) pref("security.remote_settings.intermediates.enabled", false); // Bug 2874: Block Components.interfaces from content diff --git a/mobile/android/app/000-tor-browser-android.js b/mobile/android/app/000-tor-browser-android.js index db9e23063738..23fd39beac77 100644 --- a/mobile/android/app/000-tor-browser-android.js +++ b/mobile/android/app/000-tor-browser-android.js @@ -24,19 +24,9 @@ pref("privacy.clearOnShutdown.passwords",true); pref("privacy.clearOnShutdown.sessions",true); pref("privacy.clearOnShutdown.siteSettings",true); -// Disable Control media casting & mirroring features -pref("browser.casting.enabled", false); - // controls if we want camera support -pref("device.camera.enabled", false); pref("media.realtime_decoder.enabled", false); -// Do not fetch updated per-site user-agent strings from Mozilla -// See ua-update.json.in for the packaged UA override list -// See https://bugzilla.mozilla.org/show_bug.cgi?id=897221 -pref("general.useragent.updates.enabled", false); -pref("general.useragent.updates.url", ""); - // Enable touch events on Android (highlighting text, etc) pref("dom.w3c_touch_events.enabled", 2);

1 0

[tor-browser-build/master] Bug 40016: update Snowflake to discover NAT type
by gk＠torproject.org 07 Aug '20

07 Aug '20

commit 251a6f767679b14b4e13b09920fe909d41462814 Author: Cecylia Bocovich <cohosh(a)torproject.org> Date: Thu Jul 9 13:03:30 2020 +0000 Bug 40016: update Snowflake to discover NAT type This updates Snowflake and the set of default stun servers used by the Snowflake client. --- projects/pion-stun/config | 2 +- projects/snowflake/config | 2 +- .../tor-browser/Bundle-Data/PTConfigs/linux/torrc-defaults-appendix | 2 +- projects/tor-browser/Bundle-Data/PTConfigs/mac/torrc-defaults-appendix | 2 +- .../tor-browser/Bundle-Data/PTConfigs/windows/torrc-defaults-appendix | 2 +- .../tor-onion-proxy-library/0001-Bug-30318-Add-snowflake-support.patch | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/projects/pion-stun/config b/projects/pion-stun/config index 37405eb..546e379 100644 --- a/projects/pion-stun/config +++ b/projects/pion-stun/config @@ -1,7 +1,7 @@ # vim: filetype=yaml sw=2 version: '[% c("abbrev") %]' git_url: https://github.com/pion/stun -git_hash: 51fef3542ed793994ff3da9c9b897fb23d744503 # v0.3.3 +git_hash: 4fa7a9d658b6037114fd35b6cb257979ed474a9b # v0.3.5 filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' build: '[% c("projects/go/var/build_go_lib") %]' diff --git a/projects/snowflake/config b/projects/snowflake/config index 898fe70..10fe1cc 100644 --- a/projects/snowflake/config +++ b/projects/snowflake/config @@ -1,7 +1,7 @@ # vim: filetype=yaml sw=2 version: '[% c("abbrev") %]' git_url: https://git.torproject.org/pluggable-transports/snowflake.git -git_hash: 7043a055f9fb0680281ecffd7d458a43f2ce65b5 +git_hash: 82031289a3362ff3fa199628276d76e840491431 filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' var: diff --git a/projects/tor-browser/Bundle-Data/PTConfigs/linux/torrc-defaults-appendix b/projects/tor-browser/Bundle-Data/PTConfigs/linux/torrc-defaults-appendix index ac89698..411c6e1 100644 --- a/projects/tor-browser/Bundle-Data/PTConfigs/linux/torrc-defaults-appendix +++ b/projects/tor-browser/Bundle-Data/PTConfigs/linux/torrc-defaults-appendix @@ -2,4 +2,4 @@ ClientTransportPlugin meek_lite,obfs2,obfs3,obfs4,scramblesuit exec ./TorBrowser/Tor/PluggableTransports/obfs4proxy ## snowflake configuration -ClientTransportPlugin snowflake exec ./TorBrowser/Tor/PluggableTransports/snowflake-client -url https://snowflake-broker.azureedge.net/ -front ajax.aspnetcdn.com -ice stun:stun.l.google.com:19302 +ClientTransportPlugin snowflake exec ./TorBrowser/Tor/PluggableTransports/snowflake-client -url https://snowflake-broker.azureedge.net/ -front ajax.aspnetcdn.com -ice stun:stun.l.google.com:19302,stun:stun.voip.blackberry.com:3478,stun:stun.altar.com.pl:3478,stun:stun.antisip.com:3478,stun:stun.bluesip.net:3478,stun:stun.dus.net:3478,stun:stun.epygi.com:3478,stun:stun.sonetel.com:3478,stun:stun.sonetel.net:3478,stun:stun.stunprotocol.org:3478,stun:stun.uls.co.za:3478,stun:stun.voipgate.com:3478,stun:stun.voys.nl:3478 diff --git a/projects/tor-browser/Bundle-Data/PTConfigs/mac/torrc-defaults-appendix b/projects/tor-browser/Bundle-Data/PTConfigs/mac/torrc-defaults-appendix index 154bda4..baa0a6e 100644 --- a/projects/tor-browser/Bundle-Data/PTConfigs/mac/torrc-defaults-appendix +++ b/projects/tor-browser/Bundle-Data/PTConfigs/mac/torrc-defaults-appendix @@ -2,4 +2,4 @@ ClientTransportPlugin meek_lite,obfs2,obfs3,obfs4,scramblesuit exec PluggableTransports/obfs4proxy ## snowflake configuration -ClientTransportPlugin snowflake exec PluggableTransports/snowflake-client -url https://snowflake-broker.azureedge.net/ -front ajax.aspnetcdn.com -ice stun:stun.l.google.com:19302 +ClientTransportPlugin snowflake exec PluggableTransports/snowflake-client -url https://snowflake-broker.azureedge.net/ -front ajax.aspnetcdn.com -ice stun:stun.l.google.com:19302,stun:stun.voip.blackberry.com:3478,stun:stun.altar.com.pl:3478,stun:stun.antisip.com:3478,stun:stun.bluesip.net:3478,stun:stun.dus.net:3478,stun:stun.epygi.com:3478,stun:stun.sonetel.com:3478,stun:stun.sonetel.net:3478,stun:stun.stunprotocol.org:3478,stun:stun.uls.co.za:3478,stun:stun.voipgate.com:3478,stun:stun.voys.nl:3478 diff --git a/projects/tor-browser/Bundle-Data/PTConfigs/windows/torrc-defaults-appendix b/projects/tor-browser/Bundle-Data/PTConfigs/windows/torrc-defaults-appendix index af16b3c..42502f4 100644 --- a/projects/tor-browser/Bundle-Data/PTConfigs/windows/torrc-defaults-appendix +++ b/projects/tor-browser/Bundle-Data/PTConfigs/windows/torrc-defaults-appendix @@ -2,4 +2,4 @@ ClientTransportPlugin meek_lite,obfs2,obfs3,obfs4,scramblesuit exec TorBrowser\Tor\PluggableTransports\obfs4proxy.exe ## snowflake configuration -ClientTransportPlugin snowflake exec TorBrowser\Tor\PluggableTransports\snowflake-client.exe -url https://snowflake-broker.azureedge.net/ -front ajax.aspnetcdn.com -ice stun:stun.l.google.com:19302 +ClientTransportPlugin snowflake exec TorBrowser\Tor\PluggableTransports\snowflake-client.exe -url https://snowflake-broker.azureedge.net/ -front ajax.aspnetcdn.com -ice stun:stun.l.google.com:19302,stun:stun.voip.blackberry.com:3478,stun:stun.altar.com.pl:3478,stun:stun.antisip.com:3478,stun:stun.bluesip.net:3478,stun:stun.dus.net:3478,stun:stun.epygi.com:3478,stun:stun.sonetel.com:3478,stun:stun.sonetel.net:3478,stun:stun.stunprotocol.org:3478,stun:stun.uls.co.za:3478,stun:stun.voipgate.com:3478,stun:stun.voys.nl:3478 diff --git a/projects/tor-onion-proxy-library/0001-Bug-30318-Add-snowflake-support.patch b/projects/tor-onion-proxy-library/0001-Bug-30318-Add-snowflake-support.patch index 03e06aa..f168eed 100644 --- a/projects/tor-onion-proxy-library/0001-Bug-30318-Add-snowflake-support.patch +++ b/projects/tor-onion-proxy-library/0001-Bug-30318-Add-snowflake-support.patch @@ -71,7 +71,7 @@ index 2405097..bcb6a37 100644 - buffer.append("ClientTransportPlugin meek_lite,obfs3,obfs4 exec ").append(clientPath).append('\n'); + public TorConfigBuilder transportPlugin(String obfsPath, String snowPath) { + buffer.append("ClientTransportPlugin meek_lite,obfs3,obfs4 exec ").append(obfsPath).append('\n'); -+ buffer.append("ClientTransportPlugin snowflake exec ").append(snowPath).append(" -url https://snowflake-broker.azureedge.net/ -front ajax.aspnetcdn.com -ice stun:stun.l.google.com:19302\n"); ++ buffer.append("ClientTransportPlugin snowflake exec ").append(snowPath).append(" -url https://snowflake-broker.azureedge.net/ -front ajax.aspnetcdn.com -ice stun:stun.l.google.com:19302,stun:stun.voip.blackberry.com:3478,stun:stun.altar.com.pl:3478,stun:stun.antisip.com:3478,stun:stun.bluesip.net:3478,stun:stun.dus.net:3478,stun:stun.epygi.com:3478,stun:stun.sonetel.com:3478,stun:stun.sonetel.net:3478,stun:stun.stunprotocol.org:3478,stun:stun.uls.co.za:3478,stun:stun.voipgate.com:3478,stun:stun.voys.nl:3478\n"); return this; }

1 0

[tor-browser-build/master] Merge remote-tracking branch 'gitlab/merge-requests/11' into master
by gk＠torproject.org 07 Aug '20

07 Aug '20

commit de185dd7b4e5188905ed972496e69dd537bd0534 Merge: eeb2153 251a6f7 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Aug 7 18:27:14 2020 +0000 Merge remote-tracking branch 'gitlab/merge-requests/11' into master projects/pion-stun/config | 2 +- projects/snowflake/config | 2 +- .../tor-browser/Bundle-Data/PTConfigs/linux/torrc-defaults-appendix | 2 +- projects/tor-browser/Bundle-Data/PTConfigs/mac/torrc-defaults-appendix | 2 +- .../tor-browser/Bundle-Data/PTConfigs/windows/torrc-defaults-appendix | 2 +- .../tor-onion-proxy-library/0001-Bug-30318-Add-snowflake-support.patch | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-)

1 0

[tor-browser/tor-browser-78.1.0esr-10.0-1] fixup! Bug 21952: Implement Onion-Location
by gk＠torproject.org 07 Aug '20

07 Aug '20

commit 9a78f236a3243d7748e44262ce5a0f1a4be44144 Author: Alex Catarineu <acat(a)torproject.org> Date: Thu Jul 2 21:38:54 2020 +0200 fixup! Bug 21952: Implement Onion-Location Fixes #40019. --- dom/base/Document.cpp | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/dom/base/Document.cpp b/dom/base/Document.cpp index acc59f5fe70c..0d49a6a18419 100644 --- a/dom/base/Document.cpp +++ b/dom/base/Document.cpp @@ -6029,16 +6029,17 @@ void Document::GetHeaderData(nsAtom* aHeaderField, nsAString& aData) const { static bool IsValidOnionLocation(nsIURI* aDocumentURI, nsIURI* aOnionLocationURI) { bool isHttpish; - nsAutoCString onionHost; + nsAutoCString host; return aDocumentURI && aOnionLocationURI && NS_SUCCEEDED(aDocumentURI->SchemeIs("https", &isHttpish)) && - isHttpish && + isHttpish && NS_SUCCEEDED(aDocumentURI->GetAsciiHost(host)) && + !StringEndsWith(host, NS_LITERAL_CSTRING(".onion")) && ((NS_SUCCEEDED(aOnionLocationURI->SchemeIs("http", &isHttpish)) && isHttpish) || (NS_SUCCEEDED(aOnionLocationURI->SchemeIs("https", &isHttpish)) && isHttpish)) && - NS_SUCCEEDED(aOnionLocationURI->GetAsciiHost(onionHost)) && - StringEndsWith(onionHost, NS_LITERAL_CSTRING(".onion")); + NS_SUCCEEDED(aOnionLocationURI->GetAsciiHost(host)) && + StringEndsWith(host, NS_LITERAL_CSTRING(".onion")); } void Document::SetHeaderData(nsAtom* aHeaderField, const nsAString& aData) {

1 0

[torbutton/master] Merge remote-tracking branch 'gitlab/merge-requests/3' into master
by gk＠torproject.org 07 Aug '20

07 Aug '20

commit f55f5953c6adb6d75cad74fbb6c3b8fa2d617004 Merge: c36ccb58 0b80394c Author: Georg Koppen <gk(a)torproject.org> Date: Fri Aug 7 14:31:41 2020 +0000 Merge remote-tracking branch 'gitlab/merge-requests/3' into master components/domain-isolator.js | 8 +++++++- components/dragDropFilter.js | 9 ++++++++- components/external-app-blocker.js | 9 ++++++++- components/startup-observer.js | 9 ++++++++- components/torCheckService.js | 9 ++++++++- components/torbutton-logger.js | 16 ++++++++-------- 6 files changed, 47 insertions(+), 13 deletions(-)

1 0

[torbutton/master] Bug 40002: Fix generateNSGetFactory being moved to ComponentUtils
by gk＠torproject.org 07 Aug '20

07 Aug '20

commit 0b80394c77f8d3c4f9df7594e692da857300b60f Author: Alex Catarineu <acat(a)torproject.org> Date: Thu Jul 30 20:53:07 2020 +0200 Bug 40002: Fix generateNSGetFactory being moved to ComponentUtils This was changed in https://bugzilla.mozilla.org/show_bug.cgi?id=1649554. --- components/domain-isolator.js | 8 +++++++- components/dragDropFilter.js | 9 ++++++++- components/external-app-blocker.js | 9 ++++++++- components/startup-observer.js | 9 ++++++++- components/torCheckService.js | 9 ++++++++- components/torbutton-logger.js | 16 ++++++++-------- 6 files changed, 47 insertions(+), 13 deletions(-) diff --git a/components/domain-isolator.js b/components/domain-isolator.js index 38d0abe8..06fe1e2e 100644 --- a/components/domain-isolator.js +++ b/components/domain-isolator.js @@ -11,6 +11,10 @@ const { Services } = ChromeUtils.import("resource://gre/modules/Services.jsm"); const { XPCOMUtils } = ChromeUtils.import("resource://gre/modules/XPCOMUtils.jsm"); +XPCOMUtils.defineLazyModuleGetters(this, { + ComponentUtils: "resource://gre/modules/ComponentUtils.jsm", +}); + // Make the logger available. let logger = Cc["@torproject.org/torbutton-logger;1"] .getService(Ci.nsISupports).wrappedJSObject; @@ -199,4 +203,6 @@ DomainIsolator.prototype = { }; // Assign factory to global object. -const NSGetFactory = XPCOMUtils.generateNSGetFactory([DomainIsolator]); +const NSGetFactory = XPCOMUtils.generateNSGetFactory + ? XPCOMUtils.generateNSGetFactory([DomainIsolator]) + : ComponentUtils.generateNSGetFactory([DomainIsolator]); diff --git a/components/dragDropFilter.js b/components/dragDropFilter.js index f48d1b38..361424d1 100644 --- a/components/dragDropFilter.js +++ b/components/dragDropFilter.js @@ -9,6 +9,10 @@ const { XPCOMUtils } = ChromeUtils.import("resource://gre/modules/XPCOMUtils.jsm"); const { Services } = ChromeUtils.import("resource://gre/modules/Services.jsm"); +XPCOMUtils.defineLazyModuleGetters(this, { + ComponentUtils: "resource://gre/modules/ComponentUtils.jsm", +}); + // Module specific constants const kMODULE_NAME = "Torbutton Drag and Drop Handler"; const kCONTRACT_ID = "@torproject.org/torbutton-dragDropFilter;1"; @@ -79,4 +83,7 @@ DragDropFilter.prototype = } }; -var NSGetFactory = XPCOMUtils.generateNSGetFactory([DragDropFilter]); +// Assign factory to global object. +const NSGetFactory = XPCOMUtils.generateNSGetFactory + ? XPCOMUtils.generateNSGetFactory([DragDropFilter]) + : ComponentUtils.generateNSGetFactory([DragDropFilter]); diff --git a/components/external-app-blocker.js b/components/external-app-blocker.js index 89d6d252..2fa80d9d 100644 --- a/components/external-app-blocker.js +++ b/components/external-app-blocker.js @@ -16,6 +16,10 @@ const { XPCOMUtils } = ChromeUtils.import("resource://gre/modules/XPCOMUtils.jsm const { Services } = ChromeUtils.import("resource://gre/modules/Services.jsm"); const { PromptUtils } = ChromeUtils.import("resource://gre/modules/SharedPromptUtils.jsm"); +XPCOMUtils.defineLazyModuleGetters(this, { + ComponentUtils: "resource://gre/modules/ComponentUtils.jsm", +}); + let { torbutton_get_property_string } = ChromeUtils.import("resource://torbutton/modules/utils.js", {}); // Module specific constants @@ -131,4 +135,7 @@ ExternalAppBlocker.prototype = }, }; -var NSGetFactory = XPCOMUtils.generateNSGetFactory([ExternalAppBlocker]); +// Assign factory to global object. +const NSGetFactory = XPCOMUtils.generateNSGetFactory + ? XPCOMUtils.generateNSGetFactory([ExternalAppBlocker]) + : ComponentUtils.generateNSGetFactory([ExternalAppBlocker]); diff --git a/components/startup-observer.js b/components/startup-observer.js index d2d1d610..c81eebab 100644 --- a/components/startup-observer.js +++ b/components/startup-observer.js @@ -15,6 +15,10 @@ const { Services } = ChromeUtils.import("resource://gre/modules/Services.jsm"); const { XPCOMUtils } = ChromeUtils.import("resource://gre/modules/XPCOMUtils.jsm"); +XPCOMUtils.defineLazyModuleGetters(this, { + ComponentUtils: "resource://gre/modules/ComponentUtils.jsm", +}); + XPCOMUtils.defineLazyModuleGetters(this, { FileUtils: "resource://gre/modules/FileUtils.jsm", FileSource: "resource://gre/modules/L10nRegistry.jsm", @@ -205,4 +209,7 @@ StartupObserver.prototype = { _xpcom_categories: [{category:"profile-after-change"}], }; -var NSGetFactory = XPCOMUtils.generateNSGetFactory([StartupObserver]); +// Assign factory to global object. +const NSGetFactory = XPCOMUtils.generateNSGetFactory + ? XPCOMUtils.generateNSGetFactory([StartupObserver]) + : ComponentUtils.generateNSGetFactory([StartupObserver]); diff --git a/components/torCheckService.js b/components/torCheckService.js index 409cc2c5..07b1aa99 100644 --- a/components/torCheckService.js +++ b/components/torCheckService.js @@ -10,6 +10,10 @@ const { Services } = ChromeUtils.import("resource://gre/modules/Services.jsm"); const { XPCOMUtils } = ChromeUtils.import("resource://gre/modules/XPCOMUtils.jsm"); +XPCOMUtils.defineLazyModuleGetters(this, { + ComponentUtils: "resource://gre/modules/ComponentUtils.jsm", +}); + // Module specific constants const kMODULE_NAME = "Torbutton Tor Check Service"; const kMODULE_CONTRACTID = "@torproject.org/torbutton-torCheckService;1"; @@ -131,4 +135,7 @@ TBTorCheckService.prototype = }, }; -var NSGetFactory = XPCOMUtils.generateNSGetFactory([TBTorCheckService]); +// Assign factory to global object. +const NSGetFactory = XPCOMUtils.generateNSGetFactory + ? XPCOMUtils.generateNSGetFactory([TBTorCheckService]) + : ComponentUtils.generateNSGetFactory([TBTorCheckService]); diff --git a/components/torbutton-logger.js b/components/torbutton-logger.js index 1c946fa7..d80d13c4 100644 --- a/components/torbutton-logger.js +++ b/components/torbutton-logger.js @@ -16,6 +16,10 @@ const kMODULE_CID = Components.ID("f36d72c9-9718-4134-b550-e109638331d7"); const { Services } = ChromeUtils.import("resource://gre/modules/Services.jsm"); const { XPCOMUtils } = ChromeUtils.import("resource://gre/modules/XPCOMUtils.jsm"); +XPCOMUtils.defineLazyModuleGetters(this, { + ComponentUtils: "resource://gre/modules/ComponentUtils.jsm", +}); + function TorbuttonLogger() { // Register observer Services.prefs.addObserver("extensions.torbutton", this); @@ -154,11 +158,7 @@ TorbuttonLogger.prototype = } } -/** -* XPCOMUtils.generateNSGetFactory was introduced in Mozilla 2 (Firefox 4). -* XPCOMUtils.generateNSGetModule is for Mozilla 1.9.2 (Firefox 3.6). -*/ -if (XPCOMUtils.generateNSGetFactory) - var NSGetFactory = XPCOMUtils.generateNSGetFactory([TorbuttonLogger]); -else - var NSGetModule = XPCOMUtils.generateNSGetModule([TorbuttonLogger]); +// Assign factory to global object. +const NSGetFactory = XPCOMUtils.generateNSGetFactory + ? XPCOMUtils.generateNSGetFactory([TorbuttonLogger]) + : ComponentUtils.generateNSGetFactory([TorbuttonLogger]);

1 0

[tor-browser/tor-browser-78.1.0esr-10.0-1] Bug 40025: Remove Mozilla add-on install permissions
by gk＠torproject.org 07 Aug '20

07 Aug '20

commit 988c57a8c8b2f0a2576920ade8468ef80b6fa32b Author: Alex Catarineu <acat(a)torproject.org> Date: Mon Jul 27 18:12:55 2020 +0200 Bug 40025: Remove Mozilla add-on install permissions --- browser/app/permissions | 6 ------ 1 file changed, 6 deletions(-) diff --git a/browser/app/permissions b/browser/app/permissions index da6b6728043d..5c4c302f5ba5 100644 --- a/browser/app/permissions +++ b/browser/app/permissions @@ -11,12 +11,6 @@ origin uitour 1 https://3g2upl4pq6kufc4m.onion origin uitour 1 about:tor -# XPInstall -origin install 1 https://addons.mozilla.org - # Remote troubleshooting origin remote-troubleshooting 1 https://support.mozilla.org -# addon install -origin install 1 https://private-network.firefox.com -origin install 1 https://fpn.firefox.com

1 0