October 2024 - tbb-commits - lists.torproject.org

[Git][tpo/applications/tor-browser][tor-browser-115.16.0esr-13.5-1] fixup! Bug 40597: Implement TorSettings module
by ma1 (＠ma1) 21 Oct '24

21 Oct '24

ma1 pushed to branch tor-browser-115.16.0esr-13.5-1 at The Tor Project / Applications / Tor Browser Commits: 8dbe6b39 by hackademix at 2024-10-21T11:02:24+02:00 fixup! Bug 40597: Implement TorSettings module - - - - - 1 changed file: - toolkit/modules/TorConnect.sys.mjs Changes: ===================================== toolkit/modules/TorConnect.sys.mjs ===================================== @@ -1301,7 +1301,15 @@ export const TorConnect = { // which redirect after bootstrapping getURIsToLoad(uriVariant) { const uris = this.fixupURIs(uriVariant); - lazy.logger.debug(`Will load after bootstrap => [${uris.join(", ")}]`); - return uris.map(uri => this.getRedirectURL(uri)); + const localUriRx = /^(file:\/\/\/|moz-extension:)/; + lazy.logger.debug( + `Will load after bootstrap => [${uris + .filter(uri => !localUriRx.test(uri)) + .join(", ")}]` + ); + + return uris.map(uri => + localUriRx.test(uri) ? uri : this.getRedirectURL(uri) + ); }, }; View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/8dbe6b3… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/8dbe6b3… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-128.3.0esr-14.0-1] fixup! Bug 40597: Implement TorSettings module
by ma1 (＠ma1) 21 Oct '24

21 Oct '24

ma1 pushed to branch tor-browser-128.3.0esr-14.0-1 at The Tor Project / Applications / Tor Browser Commits: fc0af914 by hackademix at 2024-10-18T10:54:46+02:00 fixup! Bug 40597: Implement TorSettings module - - - - - 1 changed file: - toolkit/modules/TorConnect.sys.mjs Changes: ===================================== toolkit/modules/TorConnect.sys.mjs ===================================== @@ -1302,7 +1302,15 @@ export const TorConnect = { // which redirect after bootstrapping getURIsToLoad(uriVariant) { const uris = this.fixupURIs(uriVariant); - lazy.logger.debug(`Will load after bootstrap => [${uris.join(", ")}]`); - return uris.map(uri => this.getRedirectURL(uri)); + const localUriRx = /^(file:\/\/\/|moz-extension:)/; + lazy.logger.debug( + `Will load after bootstrap => [${uris + .filter(uri => !localUriRx.test(uri)) + .join(", ")}]` + ); + + return uris.map(uri => + localUriRx.test(uri) ? uri : this.getRedirectURL(uri) + ); }, }; View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/fc0af91… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/fc0af91… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/mullvad-browser][mullvad-browser-128.3.0esr-14.0-1] Bug 1436226: Ignore user prefs and hardware support for media capabilities...
by morgan (＠morgan) 17 Oct '24

17 Oct '24

morgan pushed to branch mullvad-browser-128.3.0esr-14.0-1 at The Tor Project / Applications / Mullvad Browser Commits: e8ef660b by Fatih at 2024-10-17T20:54:59+00:00 Bug 1436226: Ignore user prefs and hardware support for media capabilities when RFPTarget::MediaCapabilities is enabled. r=tjr,media-playback-reviewers,padenot This patch mostly targeted Android, as media.mediasource.vp9.enabled is disabled on only Android and HW support takes precedence over pref, hence leaking HW support for VP9. However, we ended up modifying the patch to ignore prefs or HW support, fixing both possible user pref leak and HW support leak. Differential Revision: https://phabricator.services.mozilla.com/D221338 - - - - - 5 changed files: - dom/media/eme/MediaKeySystemAccess.cpp - dom/media/mediacapabilities/MediaCapabilities.cpp - dom/media/mediasource/MediaSource.cpp - dom/media/mediasource/MediaSource.h - dom/media/mediasource/SourceBuffer.cpp Changes: ===================================== dom/media/eme/MediaKeySystemAccess.cpp ===================================== @@ -319,8 +319,8 @@ static bool CanDecryptAndDecode( CodecType aCodecType, const KeySystemConfig::ContainerSupport& aContainerSupport, const nsTArray<KeySystemConfig::EMECodecString>& aCodecs, - const Maybe<CryptoScheme>& aScheme, - DecoderDoctorDiagnostics* aDiagnostics) { + const Maybe<CryptoScheme>& aScheme, DecoderDoctorDiagnostics* aDiagnostics, + Maybe<bool> aShouldResistFingerprinting) { MOZ_ASSERT(aCodecType != Invalid); for (const KeySystemConfig::EMECodecString& codec : aCodecs) { MOZ_ASSERT(!codec.IsEmpty()); @@ -332,7 +332,8 @@ static bool CanDecryptAndDecode( if (aContainerSupport.Decrypts(codec, aScheme)) { IgnoredErrorResult rv; - MediaSource::IsTypeSupported(aContentType, aDiagnostics, rv); + MediaSource::IsTypeSupported(aContentType, aDiagnostics, rv, + aShouldResistFingerprinting); if (!rv.Failed()) { // GMP can decrypt and is allowed to return compressed samples to // Gecko to decode, and Gecko has a decoder. @@ -709,9 +710,13 @@ static Sequence<MediaKeySystemMediaCapability> GetSupportedCapabilities( // restrictions... const auto& containerSupport = supportedInMP4 ? aKeySystem.mMP4 : aKeySystem.mWebM; + Maybe<bool> shouldResistFingerprinting = + aDocument ? Some(aDocument->ShouldResistFingerprinting( + RFPTarget::MediaCapabilities)) + : Nothing(); if (!CanDecryptAndDecode(aKeySystem.mKeySystem, contentTypeString, majorType, containerSupport, codecs, scheme, - aDiagnostics)) { + aDiagnostics, shouldResistFingerprinting)) { EME_LOG( "MediaKeySystemConfiguration (label='%s') " "MediaKeySystemMediaCapability('%s','%s','%s') unsupported; " ===================================== dom/media/mediacapabilities/MediaCapabilities.cpp ===================================== @@ -577,8 +577,9 @@ Maybe<MediaContainerType> MediaCapabilities::CheckAudioConfiguration( bool MediaCapabilities::CheckTypeForMediaSource(const nsAString& aType) { IgnoredErrorResult rv; - MediaSource::IsTypeSupported(aType, nullptr /* DecoderDoctorDiagnostics */, - rv); + MediaSource::IsTypeSupported( + aType, nullptr /* DecoderDoctorDiagnostics */, rv, + Some(mParent->ShouldResistFingerprinting(RFPTarget::MediaCapabilities))); return !rv.Failed(); } ===================================== dom/media/mediasource/MediaSource.cpp ===================================== @@ -23,6 +23,7 @@ #include "mozilla/Sprintf.h" #include "mozilla/StaticPrefs_media.h" #include "mozilla/dom/BindingDeclarations.h" +#include "mozilla/dom/Document.h" #include "mozilla/dom/HTMLMediaElement.h" #include "mozilla/gfx/gfxVars.h" #include "mozilla/mozalloc.h" @@ -133,7 +134,8 @@ static void RecordTypeForTelemetry(const nsAString& aType, /* static */ void MediaSource::IsTypeSupported(const nsAString& aType, DecoderDoctorDiagnostics* aDiagnostics, - ErrorResult& aRv) { + ErrorResult& aRv, + Maybe<bool> aShouldResistFingerprinting) { if (aType.IsEmpty()) { return aRv.ThrowTypeError("Empty type"); } @@ -159,16 +161,25 @@ void MediaSource::IsTypeSupported(const nsAString& aType, // Now we know that this media type could be played. // MediaSource imposes extra restrictions, and some prefs. + // Avoid leaking information about the fact that it's pref-disabled, + // or that HW acceleration is available (only applicable to VP9 on Android). + bool shouldResistFingerprinting = + aShouldResistFingerprinting.isSome() + ? aShouldResistFingerprinting.value() + : nsContentUtils::ShouldResistFingerprinting( + "Couldn't drill down ShouldResistFingerprinting", + RFPTarget::MediaCapabilities); const MediaMIMEType& mimeType = containerType->Type(); if (mimeType == MEDIAMIMETYPE("video/mp4") || mimeType == MEDIAMIMETYPE("audio/mp4")) { - if (!StaticPrefs::media_mediasource_mp4_enabled()) { + if (!StaticPrefs::media_mediasource_mp4_enabled() && + !shouldResistFingerprinting) { // Don't leak information about the fact that it's pref-disabled; just act // like we can't play it. Or should this throw "Unknown type"? return aRv.ThrowNotSupportedError("Can't play type"); } if (!StaticPrefs::media_mediasource_vp9_enabled() && hasVP9 && - !IsVP9Forced(aDiagnostics)) { + !IsVP9Forced(aDiagnostics) && !shouldResistFingerprinting) { // Don't leak information about the fact that it's pref-disabled; just act // like we can't play it. Or should this throw "Unknown type"? return aRv.ThrowNotSupportedError("Can't play type"); @@ -177,13 +188,14 @@ void MediaSource::IsTypeSupported(const nsAString& aType, return; } if (mimeType == MEDIAMIMETYPE("video/webm")) { - if (!StaticPrefs::media_mediasource_webm_enabled()) { + if (!StaticPrefs::media_mediasource_webm_enabled() && + !shouldResistFingerprinting) { // Don't leak information about the fact that it's pref-disabled; just act // like we can't play it. Or should this throw "Unknown type"? return aRv.ThrowNotSupportedError("Can't play type"); } if (!StaticPrefs::media_mediasource_vp9_enabled() && hasVP9 && - !IsVP9Forced(aDiagnostics)) { + !IsVP9Forced(aDiagnostics) && !shouldResistFingerprinting) { // Don't leak information about the fact that it's pref-disabled; just act // like we can't play it. Or should this throw "Unknown type"? return aRv.ThrowNotSupportedError("Can't play type"); @@ -191,7 +203,8 @@ void MediaSource::IsTypeSupported(const nsAString& aType, return; } if (mimeType == MEDIAMIMETYPE("audio/webm")) { - if (!StaticPrefs::media_mediasource_webm_enabled()) { + if (!StaticPrefs::media_mediasource_webm_enabled() && + !shouldResistFingerprinting) { // Don't leak information about the fact that it's pref-disabled; just act // like we can't play it. Or should this throw "Unknown type"? return aRv.ThrowNotSupportedError("Can't play type"); @@ -280,13 +293,16 @@ void MediaSource::SetDuration(const media::TimeUnit& aDuration) { already_AddRefed<SourceBuffer> MediaSource::AddSourceBuffer( const nsAString& aType, ErrorResult& aRv) { MOZ_ASSERT(NS_IsMainThread()); + nsCOMPtr<nsPIDOMWindowInner> window = GetOwner(); + Document* doc = window ? window->GetExtantDoc() : nullptr; DecoderDoctorDiagnostics diagnostics; - IsTypeSupported(aType, &diagnostics, aRv); - RecordTypeForTelemetry(aType, GetOwner()); + IsTypeSupported( + aType, &diagnostics, aRv, + doc ? Some(doc->ShouldResistFingerprinting(RFPTarget::MediaCapabilities)) + : Nothing()); + RecordTypeForTelemetry(aType, window); bool supported = !aRv.Failed(); - diagnostics.StoreFormatDiagnostics( - GetOwner() ? GetOwner()->GetExtantDoc() : nullptr, aType, supported, - __func__); + diagnostics.StoreFormatDiagnostics(doc, aType, supported, __func__); MSE_API("AddSourceBuffer(aType=%s)%s", NS_ConvertUTF16toUTF8(aType).get(), supported ? "" : " [not supported]"); if (!supported) { @@ -433,13 +449,16 @@ bool MediaSource::IsTypeSupported(const GlobalObject& aOwner, MOZ_ASSERT(NS_IsMainThread()); DecoderDoctorDiagnostics diagnostics; IgnoredErrorResult rv; - IsTypeSupported(aType, &diagnostics, rv); - bool supported = !rv.Failed(); nsCOMPtr<nsPIDOMWindowInner> window = do_QueryInterface(aOwner.GetAsSupports()); + Document* doc = window ? window->GetExtantDoc() : nullptr; + IsTypeSupported( + aType, &diagnostics, rv, + doc ? Some(doc->ShouldResistFingerprinting(RFPTarget::MediaCapabilities)) + : Nothing()); + bool supported = !rv.Failed(); RecordTypeForTelemetry(aType, window); - diagnostics.StoreFormatDiagnostics(window ? window->GetExtantDoc() : nullptr, - aType, supported, __func__); + diagnostics.StoreFormatDiagnostics(doc, aType, supported, __func__); MOZ_LOG(GetMediaSourceAPILog(), mozilla::LogLevel::Debug, ("MediaSource::%s: IsTypeSupported(aType=%s) %s", __func__, NS_ConvertUTF16toUTF8(aType).get(), ===================================== dom/media/mediasource/MediaSource.h ===================================== @@ -83,7 +83,8 @@ class MediaSource final : public DOMEventTargetHelper, // Throws on aRv if not supported. static void IsTypeSupported(const nsAString& aType, DecoderDoctorDiagnostics* aDiagnostics, - ErrorResult& aRv); + ErrorResult& aRv, + Maybe<bool> aShouldResistFingerprinting); IMPL_EVENT_HANDLER(sourceopen); IMPL_EVENT_HANDLER(sourceended); ===================================== dom/media/mediasource/SourceBuffer.cpp ===================================== @@ -13,6 +13,7 @@ #include "mozilla/ErrorResult.h" #include "mozilla/FloatingPoint.h" #include "mozilla/Preferences.h" +#include "mozilla/dom/Document.h" #include "mozilla/dom/MediaSourceBinding.h" #include "mozilla/dom/TimeRanges.h" #include "mozilla/dom/TypedArray.h" @@ -385,13 +386,16 @@ void SourceBuffer::ChangeType(const nsAString& aType, ErrorResult& aRv) { // previously) of SourceBuffer objects in the sourceBuffers attribute of // the parent media source , then throw a NotSupportedError exception and // abort these steps. + Document* doc = mMediaSource->GetOwner() + ? mMediaSource->GetOwner()->GetExtantDoc() + : nullptr; DecoderDoctorDiagnostics diagnostics; - MediaSource::IsTypeSupported(aType, &diagnostics, aRv); + MediaSource::IsTypeSupported( + aType, &diagnostics, aRv, + doc ? Some(doc->ShouldResistFingerprinting(RFPTarget::MediaCapabilities)) + : Nothing()); bool supported = !aRv.Failed(); - diagnostics.StoreFormatDiagnostics( - mMediaSource->GetOwner() ? mMediaSource->GetOwner()->GetExtantDoc() - : nullptr, - aType, supported, __func__); + diagnostics.StoreFormatDiagnostics(doc, aType, supported, __func__); MSE_API("ChangeType(aType=%s)%s", NS_ConvertUTF16toUTF8(aType).get(), supported ? "" : " [not supported]"); if (!supported) { View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/e8e… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/e8e… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][base-browser-128.3.0esr-14.0-1] Bug 1436226: Ignore user prefs and hardware support for media capabilities...
by morgan (＠morgan) 17 Oct '24

17 Oct '24

morgan pushed to branch base-browser-128.3.0esr-14.0-1 at The Tor Project / Applications / Tor Browser Commits: 8f7307ac by Fatih at 2024-10-17T20:54:18+00:00 Bug 1436226: Ignore user prefs and hardware support for media capabilities when RFPTarget::MediaCapabilities is enabled. r=tjr,media-playback-reviewers,padenot This patch mostly targeted Android, as media.mediasource.vp9.enabled is disabled on only Android and HW support takes precedence over pref, hence leaking HW support for VP9. However, we ended up modifying the patch to ignore prefs or HW support, fixing both possible user pref leak and HW support leak. Differential Revision: https://phabricator.services.mozilla.com/D221338 - - - - - 5 changed files: - dom/media/eme/MediaKeySystemAccess.cpp - dom/media/mediacapabilities/MediaCapabilities.cpp - dom/media/mediasource/MediaSource.cpp - dom/media/mediasource/MediaSource.h - dom/media/mediasource/SourceBuffer.cpp Changes: ===================================== dom/media/eme/MediaKeySystemAccess.cpp ===================================== @@ -319,8 +319,8 @@ static bool CanDecryptAndDecode( CodecType aCodecType, const KeySystemConfig::ContainerSupport& aContainerSupport, const nsTArray<KeySystemConfig::EMECodecString>& aCodecs, - const Maybe<CryptoScheme>& aScheme, - DecoderDoctorDiagnostics* aDiagnostics) { + const Maybe<CryptoScheme>& aScheme, DecoderDoctorDiagnostics* aDiagnostics, + Maybe<bool> aShouldResistFingerprinting) { MOZ_ASSERT(aCodecType != Invalid); for (const KeySystemConfig::EMECodecString& codec : aCodecs) { MOZ_ASSERT(!codec.IsEmpty()); @@ -332,7 +332,8 @@ static bool CanDecryptAndDecode( if (aContainerSupport.Decrypts(codec, aScheme)) { IgnoredErrorResult rv; - MediaSource::IsTypeSupported(aContentType, aDiagnostics, rv); + MediaSource::IsTypeSupported(aContentType, aDiagnostics, rv, + aShouldResistFingerprinting); if (!rv.Failed()) { // GMP can decrypt and is allowed to return compressed samples to // Gecko to decode, and Gecko has a decoder. @@ -709,9 +710,13 @@ static Sequence<MediaKeySystemMediaCapability> GetSupportedCapabilities( // restrictions... const auto& containerSupport = supportedInMP4 ? aKeySystem.mMP4 : aKeySystem.mWebM; + Maybe<bool> shouldResistFingerprinting = + aDocument ? Some(aDocument->ShouldResistFingerprinting( + RFPTarget::MediaCapabilities)) + : Nothing(); if (!CanDecryptAndDecode(aKeySystem.mKeySystem, contentTypeString, majorType, containerSupport, codecs, scheme, - aDiagnostics)) { + aDiagnostics, shouldResistFingerprinting)) { EME_LOG( "MediaKeySystemConfiguration (label='%s') " "MediaKeySystemMediaCapability('%s','%s','%s') unsupported; " ===================================== dom/media/mediacapabilities/MediaCapabilities.cpp ===================================== @@ -577,8 +577,9 @@ Maybe<MediaContainerType> MediaCapabilities::CheckAudioConfiguration( bool MediaCapabilities::CheckTypeForMediaSource(const nsAString& aType) { IgnoredErrorResult rv; - MediaSource::IsTypeSupported(aType, nullptr /* DecoderDoctorDiagnostics */, - rv); + MediaSource::IsTypeSupported( + aType, nullptr /* DecoderDoctorDiagnostics */, rv, + Some(mParent->ShouldResistFingerprinting(RFPTarget::MediaCapabilities))); return !rv.Failed(); } ===================================== dom/media/mediasource/MediaSource.cpp ===================================== @@ -23,6 +23,7 @@ #include "mozilla/Sprintf.h" #include "mozilla/StaticPrefs_media.h" #include "mozilla/dom/BindingDeclarations.h" +#include "mozilla/dom/Document.h" #include "mozilla/dom/HTMLMediaElement.h" #include "mozilla/gfx/gfxVars.h" #include "mozilla/mozalloc.h" @@ -133,7 +134,8 @@ static void RecordTypeForTelemetry(const nsAString& aType, /* static */ void MediaSource::IsTypeSupported(const nsAString& aType, DecoderDoctorDiagnostics* aDiagnostics, - ErrorResult& aRv) { + ErrorResult& aRv, + Maybe<bool> aShouldResistFingerprinting) { if (aType.IsEmpty()) { return aRv.ThrowTypeError("Empty type"); } @@ -159,16 +161,25 @@ void MediaSource::IsTypeSupported(const nsAString& aType, // Now we know that this media type could be played. // MediaSource imposes extra restrictions, and some prefs. + // Avoid leaking information about the fact that it's pref-disabled, + // or that HW acceleration is available (only applicable to VP9 on Android). + bool shouldResistFingerprinting = + aShouldResistFingerprinting.isSome() + ? aShouldResistFingerprinting.value() + : nsContentUtils::ShouldResistFingerprinting( + "Couldn't drill down ShouldResistFingerprinting", + RFPTarget::MediaCapabilities); const MediaMIMEType& mimeType = containerType->Type(); if (mimeType == MEDIAMIMETYPE("video/mp4") || mimeType == MEDIAMIMETYPE("audio/mp4")) { - if (!StaticPrefs::media_mediasource_mp4_enabled()) { + if (!StaticPrefs::media_mediasource_mp4_enabled() && + !shouldResistFingerprinting) { // Don't leak information about the fact that it's pref-disabled; just act // like we can't play it. Or should this throw "Unknown type"? return aRv.ThrowNotSupportedError("Can't play type"); } if (!StaticPrefs::media_mediasource_vp9_enabled() && hasVP9 && - !IsVP9Forced(aDiagnostics)) { + !IsVP9Forced(aDiagnostics) && !shouldResistFingerprinting) { // Don't leak information about the fact that it's pref-disabled; just act // like we can't play it. Or should this throw "Unknown type"? return aRv.ThrowNotSupportedError("Can't play type"); @@ -177,13 +188,14 @@ void MediaSource::IsTypeSupported(const nsAString& aType, return; } if (mimeType == MEDIAMIMETYPE("video/webm")) { - if (!StaticPrefs::media_mediasource_webm_enabled()) { + if (!StaticPrefs::media_mediasource_webm_enabled() && + !shouldResistFingerprinting) { // Don't leak information about the fact that it's pref-disabled; just act // like we can't play it. Or should this throw "Unknown type"? return aRv.ThrowNotSupportedError("Can't play type"); } if (!StaticPrefs::media_mediasource_vp9_enabled() && hasVP9 && - !IsVP9Forced(aDiagnostics)) { + !IsVP9Forced(aDiagnostics) && !shouldResistFingerprinting) { // Don't leak information about the fact that it's pref-disabled; just act // like we can't play it. Or should this throw "Unknown type"? return aRv.ThrowNotSupportedError("Can't play type"); @@ -191,7 +203,8 @@ void MediaSource::IsTypeSupported(const nsAString& aType, return; } if (mimeType == MEDIAMIMETYPE("audio/webm")) { - if (!StaticPrefs::media_mediasource_webm_enabled()) { + if (!StaticPrefs::media_mediasource_webm_enabled() && + !shouldResistFingerprinting) { // Don't leak information about the fact that it's pref-disabled; just act // like we can't play it. Or should this throw "Unknown type"? return aRv.ThrowNotSupportedError("Can't play type"); @@ -280,13 +293,16 @@ void MediaSource::SetDuration(const media::TimeUnit& aDuration) { already_AddRefed<SourceBuffer> MediaSource::AddSourceBuffer( const nsAString& aType, ErrorResult& aRv) { MOZ_ASSERT(NS_IsMainThread()); + nsCOMPtr<nsPIDOMWindowInner> window = GetOwner(); + Document* doc = window ? window->GetExtantDoc() : nullptr; DecoderDoctorDiagnostics diagnostics; - IsTypeSupported(aType, &diagnostics, aRv); - RecordTypeForTelemetry(aType, GetOwner()); + IsTypeSupported( + aType, &diagnostics, aRv, + doc ? Some(doc->ShouldResistFingerprinting(RFPTarget::MediaCapabilities)) + : Nothing()); + RecordTypeForTelemetry(aType, window); bool supported = !aRv.Failed(); - diagnostics.StoreFormatDiagnostics( - GetOwner() ? GetOwner()->GetExtantDoc() : nullptr, aType, supported, - __func__); + diagnostics.StoreFormatDiagnostics(doc, aType, supported, __func__); MSE_API("AddSourceBuffer(aType=%s)%s", NS_ConvertUTF16toUTF8(aType).get(), supported ? "" : " [not supported]"); if (!supported) { @@ -433,13 +449,16 @@ bool MediaSource::IsTypeSupported(const GlobalObject& aOwner, MOZ_ASSERT(NS_IsMainThread()); DecoderDoctorDiagnostics diagnostics; IgnoredErrorResult rv; - IsTypeSupported(aType, &diagnostics, rv); - bool supported = !rv.Failed(); nsCOMPtr<nsPIDOMWindowInner> window = do_QueryInterface(aOwner.GetAsSupports()); + Document* doc = window ? window->GetExtantDoc() : nullptr; + IsTypeSupported( + aType, &diagnostics, rv, + doc ? Some(doc->ShouldResistFingerprinting(RFPTarget::MediaCapabilities)) + : Nothing()); + bool supported = !rv.Failed(); RecordTypeForTelemetry(aType, window); - diagnostics.StoreFormatDiagnostics(window ? window->GetExtantDoc() : nullptr, - aType, supported, __func__); + diagnostics.StoreFormatDiagnostics(doc, aType, supported, __func__); MOZ_LOG(GetMediaSourceAPILog(), mozilla::LogLevel::Debug, ("MediaSource::%s: IsTypeSupported(aType=%s) %s", __func__, NS_ConvertUTF16toUTF8(aType).get(), ===================================== dom/media/mediasource/MediaSource.h ===================================== @@ -83,7 +83,8 @@ class MediaSource final : public DOMEventTargetHelper, // Throws on aRv if not supported. static void IsTypeSupported(const nsAString& aType, DecoderDoctorDiagnostics* aDiagnostics, - ErrorResult& aRv); + ErrorResult& aRv, + Maybe<bool> aShouldResistFingerprinting); IMPL_EVENT_HANDLER(sourceopen); IMPL_EVENT_HANDLER(sourceended); ===================================== dom/media/mediasource/SourceBuffer.cpp ===================================== @@ -13,6 +13,7 @@ #include "mozilla/ErrorResult.h" #include "mozilla/FloatingPoint.h" #include "mozilla/Preferences.h" +#include "mozilla/dom/Document.h" #include "mozilla/dom/MediaSourceBinding.h" #include "mozilla/dom/TimeRanges.h" #include "mozilla/dom/TypedArray.h" @@ -385,13 +386,16 @@ void SourceBuffer::ChangeType(const nsAString& aType, ErrorResult& aRv) { // previously) of SourceBuffer objects in the sourceBuffers attribute of // the parent media source , then throw a NotSupportedError exception and // abort these steps. + Document* doc = mMediaSource->GetOwner() + ? mMediaSource->GetOwner()->GetExtantDoc() + : nullptr; DecoderDoctorDiagnostics diagnostics; - MediaSource::IsTypeSupported(aType, &diagnostics, aRv); + MediaSource::IsTypeSupported( + aType, &diagnostics, aRv, + doc ? Some(doc->ShouldResistFingerprinting(RFPTarget::MediaCapabilities)) + : Nothing()); bool supported = !aRv.Failed(); - diagnostics.StoreFormatDiagnostics( - mMediaSource->GetOwner() ? mMediaSource->GetOwner()->GetExtantDoc() - : nullptr, - aType, supported, __func__); + diagnostics.StoreFormatDiagnostics(doc, aType, supported, __func__); MSE_API("ChangeType(aType=%s)%s", NS_ConvertUTF16toUTF8(aType).get(), supported ? "" : " [not supported]"); if (!supported) { View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/8f7307a… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/8f7307a… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-128.3.0esr-14.0-1] Bug 1436226: Ignore user prefs and hardware support for media capabilities...
by morgan (＠morgan) 17 Oct '24

17 Oct '24

morgan pushed to branch tor-browser-128.3.0esr-14.0-1 at The Tor Project / Applications / Tor Browser Commits: a662a454 by Fatih at 2024-10-17T22:22:51+02:00 Bug 1436226: Ignore user prefs and hardware support for media capabilities when RFPTarget::MediaCapabilities is enabled. r=tjr,media-playback-reviewers,padenot This patch mostly targeted Android, as media.mediasource.vp9.enabled is disabled on only Android and HW support takes precedence over pref, hence leaking HW support for VP9. However, we ended up modifying the patch to ignore prefs or HW support, fixing both possible user pref leak and HW support leak. Differential Revision: https://phabricator.services.mozilla.com/D221338 - - - - - 5 changed files: - dom/media/eme/MediaKeySystemAccess.cpp - dom/media/mediacapabilities/MediaCapabilities.cpp - dom/media/mediasource/MediaSource.cpp - dom/media/mediasource/MediaSource.h - dom/media/mediasource/SourceBuffer.cpp Changes: ===================================== dom/media/eme/MediaKeySystemAccess.cpp ===================================== @@ -319,8 +319,8 @@ static bool CanDecryptAndDecode( CodecType aCodecType, const KeySystemConfig::ContainerSupport& aContainerSupport, const nsTArray<KeySystemConfig::EMECodecString>& aCodecs, - const Maybe<CryptoScheme>& aScheme, - DecoderDoctorDiagnostics* aDiagnostics) { + const Maybe<CryptoScheme>& aScheme, DecoderDoctorDiagnostics* aDiagnostics, + Maybe<bool> aShouldResistFingerprinting) { MOZ_ASSERT(aCodecType != Invalid); for (const KeySystemConfig::EMECodecString& codec : aCodecs) { MOZ_ASSERT(!codec.IsEmpty()); @@ -332,7 +332,8 @@ static bool CanDecryptAndDecode( if (aContainerSupport.Decrypts(codec, aScheme)) { IgnoredErrorResult rv; - MediaSource::IsTypeSupported(aContentType, aDiagnostics, rv); + MediaSource::IsTypeSupported(aContentType, aDiagnostics, rv, + aShouldResistFingerprinting); if (!rv.Failed()) { // GMP can decrypt and is allowed to return compressed samples to // Gecko to decode, and Gecko has a decoder. @@ -709,9 +710,13 @@ static Sequence<MediaKeySystemMediaCapability> GetSupportedCapabilities( // restrictions... const auto& containerSupport = supportedInMP4 ? aKeySystem.mMP4 : aKeySystem.mWebM; + Maybe<bool> shouldResistFingerprinting = + aDocument ? Some(aDocument->ShouldResistFingerprinting( + RFPTarget::MediaCapabilities)) + : Nothing(); if (!CanDecryptAndDecode(aKeySystem.mKeySystem, contentTypeString, majorType, containerSupport, codecs, scheme, - aDiagnostics)) { + aDiagnostics, shouldResistFingerprinting)) { EME_LOG( "MediaKeySystemConfiguration (label='%s') " "MediaKeySystemMediaCapability('%s','%s','%s') unsupported; " ===================================== dom/media/mediacapabilities/MediaCapabilities.cpp ===================================== @@ -577,8 +577,9 @@ Maybe<MediaContainerType> MediaCapabilities::CheckAudioConfiguration( bool MediaCapabilities::CheckTypeForMediaSource(const nsAString& aType) { IgnoredErrorResult rv; - MediaSource::IsTypeSupported(aType, nullptr /* DecoderDoctorDiagnostics */, - rv); + MediaSource::IsTypeSupported( + aType, nullptr /* DecoderDoctorDiagnostics */, rv, + Some(mParent->ShouldResistFingerprinting(RFPTarget::MediaCapabilities))); return !rv.Failed(); } ===================================== dom/media/mediasource/MediaSource.cpp ===================================== @@ -23,6 +23,7 @@ #include "mozilla/Sprintf.h" #include "mozilla/StaticPrefs_media.h" #include "mozilla/dom/BindingDeclarations.h" +#include "mozilla/dom/Document.h" #include "mozilla/dom/HTMLMediaElement.h" #include "mozilla/gfx/gfxVars.h" #include "mozilla/mozalloc.h" @@ -133,7 +134,8 @@ static void RecordTypeForTelemetry(const nsAString& aType, /* static */ void MediaSource::IsTypeSupported(const nsAString& aType, DecoderDoctorDiagnostics* aDiagnostics, - ErrorResult& aRv) { + ErrorResult& aRv, + Maybe<bool> aShouldResistFingerprinting) { if (aType.IsEmpty()) { return aRv.ThrowTypeError("Empty type"); } @@ -159,16 +161,25 @@ void MediaSource::IsTypeSupported(const nsAString& aType, // Now we know that this media type could be played. // MediaSource imposes extra restrictions, and some prefs. + // Avoid leaking information about the fact that it's pref-disabled, + // or that HW acceleration is available (only applicable to VP9 on Android). + bool shouldResistFingerprinting = + aShouldResistFingerprinting.isSome() + ? aShouldResistFingerprinting.value() + : nsContentUtils::ShouldResistFingerprinting( + "Couldn't drill down ShouldResistFingerprinting", + RFPTarget::MediaCapabilities); const MediaMIMEType& mimeType = containerType->Type(); if (mimeType == MEDIAMIMETYPE("video/mp4") || mimeType == MEDIAMIMETYPE("audio/mp4")) { - if (!StaticPrefs::media_mediasource_mp4_enabled()) { + if (!StaticPrefs::media_mediasource_mp4_enabled() && + !shouldResistFingerprinting) { // Don't leak information about the fact that it's pref-disabled; just act // like we can't play it. Or should this throw "Unknown type"? return aRv.ThrowNotSupportedError("Can't play type"); } if (!StaticPrefs::media_mediasource_vp9_enabled() && hasVP9 && - !IsVP9Forced(aDiagnostics)) { + !IsVP9Forced(aDiagnostics) && !shouldResistFingerprinting) { // Don't leak information about the fact that it's pref-disabled; just act // like we can't play it. Or should this throw "Unknown type"? return aRv.ThrowNotSupportedError("Can't play type"); @@ -177,13 +188,14 @@ void MediaSource::IsTypeSupported(const nsAString& aType, return; } if (mimeType == MEDIAMIMETYPE("video/webm")) { - if (!StaticPrefs::media_mediasource_webm_enabled()) { + if (!StaticPrefs::media_mediasource_webm_enabled() && + !shouldResistFingerprinting) { // Don't leak information about the fact that it's pref-disabled; just act // like we can't play it. Or should this throw "Unknown type"? return aRv.ThrowNotSupportedError("Can't play type"); } if (!StaticPrefs::media_mediasource_vp9_enabled() && hasVP9 && - !IsVP9Forced(aDiagnostics)) { + !IsVP9Forced(aDiagnostics) && !shouldResistFingerprinting) { // Don't leak information about the fact that it's pref-disabled; just act // like we can't play it. Or should this throw "Unknown type"? return aRv.ThrowNotSupportedError("Can't play type"); @@ -191,7 +203,8 @@ void MediaSource::IsTypeSupported(const nsAString& aType, return; } if (mimeType == MEDIAMIMETYPE("audio/webm")) { - if (!StaticPrefs::media_mediasource_webm_enabled()) { + if (!StaticPrefs::media_mediasource_webm_enabled() && + !shouldResistFingerprinting) { // Don't leak information about the fact that it's pref-disabled; just act // like we can't play it. Or should this throw "Unknown type"? return aRv.ThrowNotSupportedError("Can't play type"); @@ -280,13 +293,16 @@ void MediaSource::SetDuration(const media::TimeUnit& aDuration) { already_AddRefed<SourceBuffer> MediaSource::AddSourceBuffer( const nsAString& aType, ErrorResult& aRv) { MOZ_ASSERT(NS_IsMainThread()); + nsCOMPtr<nsPIDOMWindowInner> window = GetOwner(); + Document* doc = window ? window->GetExtantDoc() : nullptr; DecoderDoctorDiagnostics diagnostics; - IsTypeSupported(aType, &diagnostics, aRv); - RecordTypeForTelemetry(aType, GetOwner()); + IsTypeSupported( + aType, &diagnostics, aRv, + doc ? Some(doc->ShouldResistFingerprinting(RFPTarget::MediaCapabilities)) + : Nothing()); + RecordTypeForTelemetry(aType, window); bool supported = !aRv.Failed(); - diagnostics.StoreFormatDiagnostics( - GetOwner() ? GetOwner()->GetExtantDoc() : nullptr, aType, supported, - __func__); + diagnostics.StoreFormatDiagnostics(doc, aType, supported, __func__); MSE_API("AddSourceBuffer(aType=%s)%s", NS_ConvertUTF16toUTF8(aType).get(), supported ? "" : " [not supported]"); if (!supported) { @@ -433,13 +449,16 @@ bool MediaSource::IsTypeSupported(const GlobalObject& aOwner, MOZ_ASSERT(NS_IsMainThread()); DecoderDoctorDiagnostics diagnostics; IgnoredErrorResult rv; - IsTypeSupported(aType, &diagnostics, rv); - bool supported = !rv.Failed(); nsCOMPtr<nsPIDOMWindowInner> window = do_QueryInterface(aOwner.GetAsSupports()); + Document* doc = window ? window->GetExtantDoc() : nullptr; + IsTypeSupported( + aType, &diagnostics, rv, + doc ? Some(doc->ShouldResistFingerprinting(RFPTarget::MediaCapabilities)) + : Nothing()); + bool supported = !rv.Failed(); RecordTypeForTelemetry(aType, window); - diagnostics.StoreFormatDiagnostics(window ? window->GetExtantDoc() : nullptr, - aType, supported, __func__); + diagnostics.StoreFormatDiagnostics(doc, aType, supported, __func__); MOZ_LOG(GetMediaSourceAPILog(), mozilla::LogLevel::Debug, ("MediaSource::%s: IsTypeSupported(aType=%s) %s", __func__, NS_ConvertUTF16toUTF8(aType).get(), ===================================== dom/media/mediasource/MediaSource.h ===================================== @@ -83,7 +83,8 @@ class MediaSource final : public DOMEventTargetHelper, // Throws on aRv if not supported. static void IsTypeSupported(const nsAString& aType, DecoderDoctorDiagnostics* aDiagnostics, - ErrorResult& aRv); + ErrorResult& aRv, + Maybe<bool> aShouldResistFingerprinting); IMPL_EVENT_HANDLER(sourceopen); IMPL_EVENT_HANDLER(sourceended); ===================================== dom/media/mediasource/SourceBuffer.cpp ===================================== @@ -13,6 +13,7 @@ #include "mozilla/ErrorResult.h" #include "mozilla/FloatingPoint.h" #include "mozilla/Preferences.h" +#include "mozilla/dom/Document.h" #include "mozilla/dom/MediaSourceBinding.h" #include "mozilla/dom/TimeRanges.h" #include "mozilla/dom/TypedArray.h" @@ -385,13 +386,16 @@ void SourceBuffer::ChangeType(const nsAString& aType, ErrorResult& aRv) { // previously) of SourceBuffer objects in the sourceBuffers attribute of // the parent media source , then throw a NotSupportedError exception and // abort these steps. + Document* doc = mMediaSource->GetOwner() + ? mMediaSource->GetOwner()->GetExtantDoc() + : nullptr; DecoderDoctorDiagnostics diagnostics; - MediaSource::IsTypeSupported(aType, &diagnostics, aRv); + MediaSource::IsTypeSupported( + aType, &diagnostics, aRv, + doc ? Some(doc->ShouldResistFingerprinting(RFPTarget::MediaCapabilities)) + : Nothing()); bool supported = !aRv.Failed(); - diagnostics.StoreFormatDiagnostics( - mMediaSource->GetOwner() ? mMediaSource->GetOwner()->GetExtantDoc() - : nullptr, - aType, supported, __func__); + diagnostics.StoreFormatDiagnostics(doc, aType, supported, __func__); MSE_API("ChangeType(aType=%s)%s", NS_ConvertUTF16toUTF8(aType).get(), supported ? "" : " [not supported]"); if (!supported) { View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/a662a45… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/a662a45… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/mullvad-browser][mullvad-browser-115.16.0esr-13.5-1] fixup! Bug 42019: Empty browser's clipboard on browser shutdown
by ma1 (＠ma1) 17 Oct '24

17 Oct '24

ma1 pushed to branch mullvad-browser-115.16.0esr-13.5-1 at The Tor Project / Applications / Mullvad Browser Commits: f1b8976d by hackademix at 2024-10-17T22:23:03+02:00 fixup! Bug 42019: Empty browser's clipboard on browser shutdown Bug 43209: Check if any data is available before trying to retrieve it from the clipboard. - - - - - 1 changed file: - browser/components/BrowserGlue.sys.mjs Changes: ===================================== browser/components/BrowserGlue.sys.mjs ===================================== @@ -165,8 +165,17 @@ const ClipboardPrivacy = { return trans; }, _computeClipboardHash() { + const flavors = ["text/x-moz-url", "text/plain"]; + if ( + !Services.clipboard.hasDataMatchingFlavors( + flavors, + Ci.nsIClipboard.kGlobalClipboard + ) + ) { + return null; + } const trans = this._createTransferable(); - ["text/x-moz-url", "text/plain"].forEach(trans.addDataFlavor); + flavors.forEach(trans.addDataFlavor); try { Services.clipboard.getData(trans, Ci.nsIClipboard.kGlobalClipboard); const clipboardContent = {}; View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/f1b… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/f1b… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][base-browser-115.16.0esr-13.5-1] fixup! Bug 42019: Empty browser's clipboard on browser shutdown
by ma1 (＠ma1) 17 Oct '24

17 Oct '24

ma1 pushed to branch base-browser-115.16.0esr-13.5-1 at The Tor Project / Applications / Tor Browser Commits: 91df6b5c by hackademix at 2024-10-17T22:22:55+02:00 fixup! Bug 42019: Empty browser's clipboard on browser shutdown Bug 43209: Check if any data is available before trying to retrieve it from the clipboard. - - - - - 1 changed file: - browser/components/BrowserGlue.sys.mjs Changes: ===================================== browser/components/BrowserGlue.sys.mjs ===================================== @@ -165,8 +165,17 @@ const ClipboardPrivacy = { return trans; }, _computeClipboardHash() { + const flavors = ["text/x-moz-url", "text/plain"]; + if ( + !Services.clipboard.hasDataMatchingFlavors( + flavors, + Ci.nsIClipboard.kGlobalClipboard + ) + ) { + return null; + } const trans = this._createTransferable(); - ["text/x-moz-url", "text/plain"].forEach(trans.addDataFlavor); + flavors.forEach(trans.addDataFlavor); try { Services.clipboard.getData(trans, Ci.nsIClipboard.kGlobalClipboard); const clipboardContent = {}; View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/91df6b5… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/91df6b5… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-115.16.0esr-13.5-1] fixup! Bug 42019: Empty browser's clipboard on browser shutdown
by ma1 (＠ma1) 17 Oct '24

17 Oct '24

ma1 pushed to branch tor-browser-115.16.0esr-13.5-1 at The Tor Project / Applications / Tor Browser Commits: 67f0b6ff by hackademix at 2024-10-17T22:22:46+02:00 fixup! Bug 42019: Empty browser's clipboard on browser shutdown Bug 43209: Check if any data is available before trying to retrieve it from the clipboard. - - - - - 1 changed file: - browser/components/BrowserGlue.sys.mjs Changes: ===================================== browser/components/BrowserGlue.sys.mjs ===================================== @@ -169,8 +169,17 @@ const ClipboardPrivacy = { return trans; }, _computeClipboardHash() { + const flavors = ["text/x-moz-url", "text/plain"]; + if ( + !Services.clipboard.hasDataMatchingFlavors( + flavors, + Ci.nsIClipboard.kGlobalClipboard + ) + ) { + return null; + } const trans = this._createTransferable(); - ["text/x-moz-url", "text/plain"].forEach(trans.addDataFlavor); + flavors.forEach(trans.addDataFlavor); try { Services.clipboard.getData(trans, Ci.nsIClipboard.kGlobalClipboard); const clipboardContent = {}; View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/67f0b6f… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/67f0b6f… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/mullvad-browser][mullvad-browser-128.3.0esr-14.0-1] fixup! Bug 42019: Empty browser's clipboard on browser shutdown
by ma1 (＠ma1) 17 Oct '24

17 Oct '24

ma1 pushed to branch mullvad-browser-128.3.0esr-14.0-1 at The Tor Project / Applications / Mullvad Browser Commits: 3fb297c3 by hackademix at 2024-10-17T22:22:09+02:00 fixup! Bug 42019: Empty browser's clipboard on browser shutdown Bug 43209: Check if any data is available before trying to retrieve it from the clipboard. - - - - - 1 changed file: - browser/components/BrowserGlue.sys.mjs Changes: ===================================== browser/components/BrowserGlue.sys.mjs ===================================== @@ -185,8 +185,17 @@ const ClipboardPrivacy = { return trans; }, _computeClipboardHash() { + const flavors = ["text/x-moz-url", "text/plain"]; + if ( + !Services.clipboard.hasDataMatchingFlavors( + flavors, + Ci.nsIClipboard.kGlobalClipboard + ) + ) { + return null; + } const trans = this._createTransferable(); - ["text/x-moz-url", "text/plain"].forEach(trans.addDataFlavor); + flavors.forEach(trans.addDataFlavor); try { Services.clipboard.getData(trans, Ci.nsIClipboard.kGlobalClipboard); const clipboardContent = {}; View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/3fb… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/3fb… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][base-browser-128.3.0esr-14.0-1] fixup! Bug 42019: Empty browser's clipboard on browser shutdown
by ma1 (＠ma1) 17 Oct '24

17 Oct '24

ma1 pushed to branch base-browser-128.3.0esr-14.0-1 at The Tor Project / Applications / Tor Browser Commits: e75a4f4e by hackademix at 2024-10-17T22:21:33+02:00 fixup! Bug 42019: Empty browser's clipboard on browser shutdown Bug 43209: Check if any data is available before trying to retrieve it from the clipboard. - - - - - 1 changed file: - browser/components/BrowserGlue.sys.mjs Changes: ===================================== browser/components/BrowserGlue.sys.mjs ===================================== @@ -185,8 +185,17 @@ const ClipboardPrivacy = { return trans; }, _computeClipboardHash() { + const flavors = ["text/x-moz-url", "text/plain"]; + if ( + !Services.clipboard.hasDataMatchingFlavors( + flavors, + Ci.nsIClipboard.kGlobalClipboard + ) + ) { + return null; + } const trans = this._createTransferable(); - ["text/x-moz-url", "text/plain"].forEach(trans.addDataFlavor); + flavors.forEach(trans.addDataFlavor); try { Services.clipboard.getData(trans, Ci.nsIClipboard.kGlobalClipboard); const clipboardContent = {}; View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/e75a4f4… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/e75a4f4… You're receiving this email because of your account on gitlab.torproject.org.

1 0