May 2021 - tbb-commits - lists.torproject.org

[tor-browser-build/master] Bug 40297: Use the right commits for get_gradle_dependencies_list
by sysrqb＠torproject.org 17 May '21

17 May '21

commit d6fbd77f14e646c7030577cea1b10429129850b4 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Fri May 14 11:07:33 2021 +0200 Bug 40297: Use the right commits for get_gradle_dependencies_list --- projects/android-components/config | 4 +++- projects/fenix/config | 4 +++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/projects/android-components/config b/projects/android-components/config index 3b709a6..1f98428 100644 --- a/projects/android-components/config +++ b/projects/android-components/config @@ -16,10 +16,11 @@ var: gradle_dependencies_version: 24 gradle_version: 6.6.1 glean_parser: 2.2.0 + git_branch: '[% project %]-[% c("var/android_components_version") %]-[% c("var/torbrowser_branch") %]-1' targets: nightly: - git_hash: '[% project %]-[% c("var/android_components_version") %]-[% c("var/torbrowser_branch") %]-1' + git_hash: '[% c("var/git_branch") %]' tag_gpg_id: 0 input_files: @@ -81,5 +82,6 @@ steps: get_gradle_dependencies_list: filename: 'gradle-dependencies-list-[% c("var/android_components_version") %].txt' get_gradle_dependencies_list: '[% INCLUDE build %]' + git_hash: '[% c("var/git_branch") %]^{/Bug 40023: Stop PrivateNotificationService}' var: fetch_gradle_dependencies: 1 diff --git a/projects/fenix/config b/projects/fenix/config index 9a54715..6f349ac 100644 --- a/projects/fenix/config +++ b/projects/fenix/config @@ -10,6 +10,7 @@ variant: Beta var: fenix_version: 88.1.3 torbrowser_branch: 10.5 + git_branch: 'tor-browser-[% c("var/fenix_version") %]-[% c("var/torbrowser_branch") %]-1' copyright_year: '[% exec("git show -s --format=%ci").remove("-.*") %]' container: use_container: 1 @@ -20,7 +21,7 @@ var: targets: nightly: - git_hash: 'tor-browser-[% c("var/fenix_version") %]-[% c("var/torbrowser_branch") %]-1' + git_hash: '[% c("var/git_branch") %]' tag_gpg_id: 0 variant: Nightly @@ -64,6 +65,7 @@ steps: use_container: 0 get_gradle_dependencies_list: + git_hash: '[% c("var/git_branch") %]^{/Add Tor integration and UI}' filename: 'gradle-dependencies-list-[% c("var/fenix_version") %].txt' get_gradle_dependencies_list: '[% INCLUDE build %]' var:

1 0

[torbutton/master] fixup! Bug 40035: Localize Cryptocurrency Safety messages
by sysrqb＠torproject.org 13 May '21

13 May '21

commit 2c03b2c398e111fa185f34a616ceb7448c9a0c26 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Thu May 13 16:18:23 2021 +0000 fixup! Bug 40035: Localize Cryptocurrency Safety messages --- chrome/locale/en-US/torbutton.properties | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/chrome/locale/en-US/torbutton.properties b/chrome/locale/en-US/torbutton.properties index 4c153158..0f4594bc 100644 --- a/chrome/locale/en-US/torbutton.properties +++ b/chrome/locale/en-US/torbutton.properties @@ -139,7 +139,7 @@ onionLocation.askEverytime=Ask every time onionLocation.prioritizeOnionsDescription=Prioritize .onion sites when known. onionLocation.onionServicesTitle=Onion Services -# LOCALIZATION NOTE: %S will be replaced with the crytocurrency address. +# LOCALIZATION NOTE: %S will be replaced with the cryptocurrency address. cryptoSafetyPrompt.cryptoWarning=A cryptocurrency address (%S) has been copied from an insecure website. It could have been modified. cryptoSafetyPrompt.whatCanHeading=What can you do about it? cryptoSafetyPrompt.whatCanBody=You can try reconnecting with a new circuit to establish a secure connection, or accept the risk and dismiss this warning.

1 0

[tor-launcher/master] fixup! Bug 27476: about:torconnect fixes and new strings
by sysrqb＠torproject.org 13 May '21

13 May '21

commit 4763691a739ce2cb2b8cfda07eb76ccf2e51f41a Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Thu May 13 16:16:36 2021 +0000 fixup! Bug 27476: about:torconnect fixes and new strings --- src/chrome/locale/en-US/torlauncher.properties | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/chrome/locale/en-US/torlauncher.properties b/src/chrome/locale/en-US/torlauncher.properties index 7787698..e0b07f0 100644 --- a/src/chrome/locale/en-US/torlauncher.properties +++ b/src/chrome/locale/en-US/torlauncher.properties @@ -94,4 +94,4 @@ torlauncher.nsresult.NS_ERROR_NET_RESET=The connection to the server was lost. torlauncher.nsresult.NS_ERROR_CONNECTION_REFUSED=Could not connect to the server. torlauncher.nsresult.NS_ERROR_PROXY_CONNECTION_REFUSED=Could not connect to the proxy. -torlauncher.copiedNLogMessages=Copied %S Logs +torlauncher.copiedNLogMessagesShort=Copied %S Logs

1 0

[tor-browser-spec/master] Bug 40017: Add FF88 audit
by sysrqb＠torproject.org 13 May '21

13 May '21

commit b89f42cdb5117d082d945816ce132da0499173af Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Fri Apr 30 22:45:36 2021 +0000 Bug 40017: Add FF88 audit --- audits/FF88_NETWORK_AUDIT | 141 ++++++++++++++++++++++++++++++++++++++++++++++ audits/code_audit.sh | 6 +- 2 files changed, 146 insertions(+), 1 deletion(-) diff --git a/audits/FF88_NETWORK_AUDIT b/audits/FF88_NETWORK_AUDIT new file mode 100644 index 0000000..6462aad --- /dev/null +++ b/audits/FF88_NETWORK_AUDIT @@ -0,0 +1,141 @@ +=============== Firefox General ============= + +Start: 4068febfd76d9ec557591240d7496be42c27c17f # FIREFOX_87_0_BUILD3 +End: 676143236541851e068696fa4528d87a9bb0088d # FIREFOX_88_0_BUILD1 + +=============== Firefox Native DNS Portion ============= + +PR_GetHostByName +PR_GetIPNodeByName +PR_GetAddrInfoByName +PR_StringToNetAddr (itself is good as it passes AI_NUMERICHOST to getaddrinfo. No resolution.) + +MDNS +TRR (DNS Trusted Recursive Resolver) +Direct Paths to DNS resolution: +nsDNSService::Resolve +nsDNSService::AsyncResolve +nsHostResolver::ResolveHost + +# FF88: Nothing of interest + +============ Firefox Misc Socket Portion ============== + +SOCK_ +SOCKET_ +_SOCKET + +UDPSocket +TCPSocket + PR_NewTCPSocket + AsyncTCPSocket + +Misc PR_Socket + +# FF88: Nothing of interest + +=========== Firefox Misc XPCOM Portion ================ + +Misc XPCOM (including commands for pre-diff review approach) + *SocketProvider + grep -R udp-socket . + grep -R tcp-socket . + grep for tcpsocket + grep -R "NS_" | grep SOCKET | grep "_C" + grep -R "@mozilla.org/network/" . | grep socket | grep -v udp-socket + +# FF88: Nothing of interest + +============ Firefox Rust Portion ================ + +Rust + +# FF88: Nothing of interest (using `java_audit.sh`) + +============ Firefox Android Portion ============= + +Android Java calls + - URLConnection + - XXX: getInputStream? other methods? + - HttpURLConnection + - UrlConnectionDownloader + - ch.boye.httpclientandroidlib.impl.client.* (look for execute() calls) + - grep -n openConnection\( mobile/android/thirdparty/ + - java.net.URL -- has SEVERAL proxy bypass URL fetching methods :/ + - java.net + - javax.net + - ch.boye.httpclientandroidlib.conn.* (esp ssl) + - ch.boye.httpclientandroidlib.impl.conn.* (esp ssl) + - Sudden appearance of thirdparty libs: + - OkHttp + - Retrofit + - Glide + - com.amitshekhar.android + - IntentHelper + - openUriExternal (can come from GeckoAppShell too) + - getHandlersForMimeType + - getHandlersForURL + - getHandlersForIntent + - android.content.Intent - too common; instead find launch methods: + - startActivity + - startActivities + - sendBroadcast + - sendOrderedBroadcast + - startService + - bindService + - android.app.PendingIntent + - android.app.DownloadManager + - ActivityHandlerHelper.startIntentAndCatch + +# FF88 +# Bug 1694481 +# - Removes unused code + +============ Application Services Portion ============= + +Start: 1ee6b32f3ee569036fdf1015cf7ffc01ded2860f # v71.0.0 +End: ad7b64fa03eeeb00815125e635d1fb8809befd40 # v74.0.1 + +# FF88: Nothing related to networking in Java/Koltlin/Rust code (using `code_audit.sh`) + +============ Android Components Portion ============= + +Start: bea80bbaccc431994a534a087b223563826ac256 # v73.0.11 +End: e09d8a00b5eae63767d905a74966be301b5dd059 # v74.0.11 + +# FF88 (using `code_audit.sh`) +# Issue #9823 +# - Make users aware that download was not performed because of a denied permission +# - Review Result: Safe +# - Comments: +# - Calls startActivity(), but the target is hard-coded as the Android Settings + +# Issue #9757 +# - Remove downloads notification when private tabs are closed +# - Review Result: Safe +# - Comment: +# - Calls startService(), but the target is hard-coded as the internal Downloads Service + +# Issue #9713 +# - Autofill: Support alternative authentication methods +# - Review Result: Conditionally Safe +# - Comment: +# - Calls startActivityForResult() with an arbitrary target Activity. +# - Fenix instantiates the configuration using itself as the target. + +============ Fenix Portion ============= + +Start: 9d91b8eeb9d287ee95937b5edfffde383982267a # v87.0.0-rc.1 +End: 5f98c4ec98d663c763dc4ec5ea84a14cdf342d04 # v88.1.1 + +# FF88: (using `java_audit.sh`) +# - 8856a3c1d769586bfd6daa7b3b2df48fb26f1bc3 +# - Integrate Android Autofill support into Nightly and debug builds. +# - Review Result: Safe (but see fenix#40160) + +============ Regression/Prior Vuln Review ========= + +Review proxy bypass bugs; check for new vectors to look for: + - https://trac.torproject.org/projects/tor/query?keywords=~tbb-proxy + - Look for new features like these. Especially external app launch vectors + diff --git a/audits/code_audit.sh b/audits/code_audit.sh index c7c0848..d260d15 100755 --- a/audits/code_audit.sh +++ b/audits/code_audit.sh @@ -55,6 +55,10 @@ initialize_java_symbols() { KEYWORDS+=(ActivityDelegate) # Added in FF87 audit KEYWORDS+=(AutofillService) + # Added in FF88 audit + KEYWORDS+=(AutofillConfiguration) + KEYWORDS+=(Authenticator) + KEYWORDS+=(AutofillUnlockActivity) } initialize_rust_symbols() { @@ -155,7 +159,7 @@ done echo "Diffing patches-${OLD}-${NEW}-${SCOPE}.diff from all ${path[*]} files" # Exclude Deleted and Unmerged files from diff DIFF_FILTER=ACMRTXB -git diff --color=always --color-moved --diff-filter="${DIFF_FILTER}" -U20 -G"${GREP_LINE}" "$OLD" "$NEW" -- "${path[@]}" > "patches-${OLD}-${NEW}-${SCOPE}.diff" +git diff --stat --color=always --color-moved --diff-filter="${DIFF_FILTER}" -U20 -G"${GREP_LINE}" "$OLD" "$NEW" -- "${path[@]}" > "patches-${OLD}-${NEW}-${SCOPE}.diff" # Step 4: Highlight the keyword with an annoying, flashing color export GREP_COLOR="05;37;41"

1 0

[tor-browser/tor-browser-78.10.0esr-10.5-1] squash! 40209: Implement Basic Crypto Safety
by sysrqb＠torproject.org 13 May '21

13 May '21

commit 627d83ded2fb977f68da7fcaad0ee763ec5223ec Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Wed May 5 16:53:11 2021 +0000 squash! 40209: Implement Basic Crypto Safety Bug 40428: Fix string attribute names --- browser/modules/TorStrings.jsm | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/browser/modules/TorStrings.jsm b/browser/modules/TorStrings.jsm index bf522234d588..1e08b168e4af 100644 --- a/browser/modules/TorStrings.jsm +++ b/browser/modules/TorStrings.jsm @@ -115,33 +115,33 @@ var TorStrings = { let retval = { cryptoWarning: getString( - "cryptoSafetyPrompt.cryptoWarning", + "cryptoWarning", "A cryptocurrency address (%S) has been copied from an insecure website. It could have been modified." ), whatCanHeading: getString( - "cryptoSafetyPrompt.whatCanHeading", + "whatCanHeading", "What can you do about it?" ), whatCanBody: getString( - "cryptoSafetyPrompt.whatCanBody", + "whatCanBody", "You can try reconnecting with a new circuit to establish a secure connection, or accept the risk and dismiss this warning." ), - learnMore: getString("cryptoSafetyPrompt.learnMore", "Learn more"), + learnMore: getString("learnMore", "Learn more"), learnMoreURL: `https://support.torproject.org/${getLocale()}/`, primaryAction: getString( - "cryptoSafetyPrompt.primaryAction", + "primaryAction", "Reload Tab with a New Circuit" ), primaryActionAccessKey: getString( - "cryptoSafetyPrompt.primaryActionAccessKey", + "primaryActionAccessKey", "R" ), secondaryAction: getString( - "cryptoSafetyPrompt.secondaryAction", + "secondaryAction", "Dismiss Warning" ), secondaryActionAccessKey: getString( - "cryptoSafetyPrompt.secondaryActionAccessKey", + "secondaryActionAccessKey", "D" ), };

1 0

[tor-launcher/master] Release preparations for 0.2.28
by sysrqb＠torproject.org 12 May '21

12 May '21

commit f3cfdde8282b078341840388670f51e5665cb823 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Fri Apr 9 17:38:31 2021 +0000 Release preparations for 0.2.28 Version bump --- src/install.rdf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/install.rdf b/src/install.rdf index 510052a..c438e7b 100644 --- a/src/install.rdf +++ b/src/install.rdf @@ -7,7 +7,7 @@ <em:creator>The Tor Project, Inc.</em:creator> <em:contributor>Pearl Crescent, LLC</em:contributor> <em:id>tor-launcher(a)torproject.org</em:id> - <em:version>0.2.27</em:version> + <em:version>0.2.28</em:version> <em:multiprocessCompatible>true</em:multiprocessCompatible> <em:homepageURL>https://www.torproject.org/projects/torbrowser.html</em:homepageURL> <em:updateURL>data:text/plain,</em:updateURL>

1 0

[tor-launcher/master] Merge remote-tracking branch 'richardgl/27476_rev2'
by sysrqb＠torproject.org 12 May '21

12 May '21

commit c366446e5eebb9e8acedae7ccef558dc541aedec Merge: f3cfdde e5b0e02 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Wed May 12 20:33:27 2021 +0000 Merge remote-tracking branch 'richardgl/27476_rev2' src/chrome/locale/en-US/network-settings.dtd | 9 +++++++++ src/chrome/locale/en-US/torlauncher.properties | 2 ++ src/components/tl-process.js | 6 +++++- src/modules/tl-util.jsm | 15 +++++++++++++++ 4 files changed, 31 insertions(+), 1 deletion(-)

1 0

[tor-launcher/master] Bug 27476: about:torconnect fixes and new strings
by sysrqb＠torproject.org 12 May '21

12 May '21

commit e5b0e027aa8879e6971b6afb75023a0b9e13c3bb Author: Richard Pospesel <richard(a)torproject.org> Date: Mon Feb 15 16:21:26 2021 +0100 Bug 27476: about:torconnect fixes and new strings - torlauncher.properties::torlauncher.copiedNLogMessagesShort : reduced verbosity version of torlauncher.copiednLogMessages for Copy Log button tooltip - network-settings.dtd::torConnect.copyLog : label for 'Copy Log' button in about:torconnect - added various new strings for about:torconnect to en_US network-settings.dtd - disables legacy launcher unless "TOR_USE_LEGACY_LAUNCHER" environet variable is defined --- src/chrome/locale/en-US/network-settings.dtd | 9 +++++++++ src/chrome/locale/en-US/torlauncher.properties | 2 ++ src/components/tl-process.js | 6 +++++- src/modules/tl-util.jsm | 15 +++++++++++++++ 4 files changed, 31 insertions(+), 1 deletion(-) diff --git a/src/chrome/locale/en-US/network-settings.dtd b/src/chrome/locale/en-US/network-settings.dtd index d4c7def..81163a1 100644 --- a/src/chrome/locale/en-US/network-settings.dtd +++ b/src/chrome/locale/en-US/network-settings.dtd @@ -81,3 +81,12 @@ <!ENTITY torPreferences.viewTorLogs "View the Tor logs."> <!ENTITY torPreferences.viewLogs "View Logs…"> <!ENTITY torPreferences.torLogsDialogTitle "Tor Logs"> + + +<!ENTITY torConnect.tryAgain "Try Connecting Again"> +<!ENTITY torConnect.offline "Offline"> +<!ENTITY torConnect.connectMessage "Changes to Tor Settings will not take effect until you connect to the Tor Network"> +<!ENTITY torConnect.tryAgainMessage "Tor Browser has failed to establish a connection to the Tor Network"> +<!ENTITY torConnect.connectingConcise "Connecting…"> +<!ENTITY torConnect.connectedConcise "Connected"> +<!ENTITY torConnect.copyLog "Copy Tor Logs"> diff --git a/src/chrome/locale/en-US/torlauncher.properties b/src/chrome/locale/en-US/torlauncher.properties index 6ec8c40..7787698 100644 --- a/src/chrome/locale/en-US/torlauncher.properties +++ b/src/chrome/locale/en-US/torlauncher.properties @@ -93,3 +93,5 @@ torlauncher.bootstrapWarning.pt_missing=missing pluggable transport torlauncher.nsresult.NS_ERROR_NET_RESET=The connection to the server was lost. torlauncher.nsresult.NS_ERROR_CONNECTION_REFUSED=Could not connect to the server. torlauncher.nsresult.NS_ERROR_PROXY_CONNECTION_REFUSED=Could not connect to the proxy. + +torlauncher.copiedNLogMessages=Copied %S Logs diff --git a/src/components/tl-process.js b/src/components/tl-process.js index e9d7cde..a4374f9 100644 --- a/src/components/tl-process.js +++ b/src/components/tl-process.js @@ -583,6 +583,10 @@ TorProcessService.prototype = if (aIsRunningTor) this._monitorTorProcessStartup(); + if (!TorLauncherUtil.useLegacyLauncher) { + return; + } + var bridgeConfigIsBad = (this._defaultBridgesStatus == this.kDefaultBridgesStatus_BadConfig); if (TorLauncherUtil.shouldShowNetworkSettings || bridgeConfigIsBad) @@ -814,7 +818,7 @@ TorProcessService.prototype = this.mObsSvc.notifyObservers(errorObj, aNotifyTopic, null); } - if (!errorObj.handled) + if (TorLauncherUtil.useLegacyLauncher && !errorObj.handled) { let msg = aMessage; if (aDetails) diff --git a/src/modules/tl-util.jsm b/src/modules/tl-util.jsm index b721372..76cdb5b 100644 --- a/src/modules/tl-util.jsm +++ b/src/modules/tl-util.jsm @@ -366,6 +366,17 @@ let TorLauncherUtil = // Public return this.getBoolPref(kPrefPromptForLocale, true); */ }, + get useLegacyLauncher() { + const kEnvUseLegacyLauncher = "TOR_USE_LEGACY_LAUNCHER"; + const env = Cc["@mozilla.org/process/environment;1"].getService( + Ci.nsIEnvironment + ); + if (env.exists(kEnvUseLegacyLauncher)) { + return "1" == env.get(kEnvUseLegacyLauncher); + } + return false; + }, + get shouldShowNetworkSettings() { const kPrefPromptAtStartup = "extensions.torlauncher.prompt_at_startup"; @@ -379,6 +390,10 @@ let TorLauncherUtil = // Public return ("1" == env.get(kEnvForceShowNetConfig)); } catch(e) {} + if (!TorLauncherUtil.useLegacyLauncher) { + return true; + } + return this.getBoolPref(kPrefPromptAtStartup, true); },

1 0

[Git][tpo/applications/fenix] Pushed new branch tor-browser-89.0.0b5-10.5-1
by Matthew Finkel (＠sysrqb) 12 May '21

12 May '21

Matthew Finkel pushed new branch tor-browser-89.0.0b5-10.5-1 at The Tor Project / Applications / fenix -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/fenix/-/tree/tor-browser-89.… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[torbutton/master] Bug 40035: Localize Cryptocurrency Safety messages
by sysrqb＠torproject.org 12 May '21

12 May '21

commit a83f09e9208d4e2ea7a7a0c5f87fdac36a551309 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Mon May 3 14:14:37 2021 +0000 Bug 40035: Localize Cryptocurrency Safety messages --- chrome/locale/en-US/torbutton.properties | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/chrome/locale/en-US/torbutton.properties b/chrome/locale/en-US/torbutton.properties index 632605f7..4c153158 100644 --- a/chrome/locale/en-US/torbutton.properties +++ b/chrome/locale/en-US/torbutton.properties @@ -138,3 +138,13 @@ onionLocation.always=Always onionLocation.askEverytime=Ask every time onionLocation.prioritizeOnionsDescription=Prioritize .onion sites when known. onionLocation.onionServicesTitle=Onion Services + +# LOCALIZATION NOTE: %S will be replaced with the crytocurrency address. +cryptoSafetyPrompt.cryptoWarning=A cryptocurrency address (%S) has been copied from an insecure website. It could have been modified. +cryptoSafetyPrompt.whatCanHeading=What can you do about it? +cryptoSafetyPrompt.whatCanBody=You can try reconnecting with a new circuit to establish a secure connection, or accept the risk and dismiss this warning. +cryptoSafetyPrompt.learnMore=Learn more +cryptoSafetyPrompt.primaryAction=Reload Tab with a New Circuit +cryptoSafetyPrompt.primaryActionAccessKey=R +cryptoSafetyPrompt.secondaryAction=Dismiss Warning +cryptoSafetyPrompt.secondaryActionAccessKey=B

1 0