ma1 pushed to branch mullvad-browser-128.7.0esr-14.5-1 at The Tor Project / Applications / Mullvad Browser
Commits:
27ef9572 by Henry Wilkes at 2025-02-03T17:59:01+01:00
fixup! BB 42716: Disable unwanted about: pages
TB 43308: Remove about:logo which exposes a branding asset.
- - - - -
1 changed file:
- docshell/base/nsAboutRedirector.cpp
Changes:
=====================================
docshell/base/nsAboutRedirector.cpp
=====================================
@@ -123,10 +123,9 @@ static const RedirEntry kRedirMap[] = {
nsIAboutModule::IS_SECURE_CHROME_UI},
{"logging", "chrome://global/content/aboutLogging.html",
nsIAboutModule::ALLOW_SCRIPT},
- {"logo", "chrome://branding/content/about.png",
- nsIAboutModule::URI_SAFE_FOR_UNTRUSTED_CONTENT |
- // Linkable for testing reasons.
- nsIAboutModule::MAKE_LINKABLE},
+ // Do not allow web pages to link to about:logo, which varies between
+ // channels. See tor-browser#43308.
+ // Moreover, it exposes firefox-specific branding.
{"memory", "chrome://global/content/aboutMemory.xhtml",
nsIAboutModule::ALLOW_SCRIPT},
{"certificate", "chrome://global/content/certviewer/certviewer.html",
View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/27e…
--
View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/27e…
You're receiving this email because of your account on gitlab.torproject.org.
ma1 pushed to branch base-browser-128.7.0esr-14.5-1 at The Tor Project / Applications / Tor Browser
Commits:
d2b1cdb2 by Henry Wilkes at 2025-02-03T17:58:41+01:00
fixup! BB 42716: Disable unwanted about: pages
TB 43308: Remove about:logo which exposes a branding asset.
- - - - -
1 changed file:
- docshell/base/nsAboutRedirector.cpp
Changes:
=====================================
docshell/base/nsAboutRedirector.cpp
=====================================
@@ -123,10 +123,9 @@ static const RedirEntry kRedirMap[] = {
nsIAboutModule::IS_SECURE_CHROME_UI},
{"logging", "chrome://global/content/aboutLogging.html",
nsIAboutModule::ALLOW_SCRIPT},
- {"logo", "chrome://branding/content/about.png",
- nsIAboutModule::URI_SAFE_FOR_UNTRUSTED_CONTENT |
- // Linkable for testing reasons.
- nsIAboutModule::MAKE_LINKABLE},
+ // Do not allow web pages to link to about:logo, which varies between
+ // channels. See tor-browser#43308.
+ // Moreover, it exposes firefox-specific branding.
{"memory", "chrome://global/content/aboutMemory.xhtml",
nsIAboutModule::ALLOW_SCRIPT},
{"certificate", "chrome://global/content/certviewer/certviewer.html",
View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/d2b1cdb…
--
View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/d2b1cdb…
You're receiving this email because of your account on gitlab.torproject.org.
ma1 pushed to branch mullvad-browser-128.7.0esr-14.5-1 at The Tor Project / Applications / Mullvad Browser
Commits:
911dbf28 by Henry Wilkes at 2025-02-03T17:56:38+01:00
BB 29745: Limit remote access to content accessible resources
- - - - -
1 changed file:
- caps/nsScriptSecurityManager.cpp
Changes:
=====================================
caps/nsScriptSecurityManager.cpp
=====================================
@@ -1044,6 +1044,48 @@ nsresult nsScriptSecurityManager::CheckLoadURIFlags(
}
}
+ // Only allow some "about:" pages to have access to contentaccessible
+ // "chrome://branding/" assets. Otherwise web pages could easily and
+ // consistently detect the differences between channels when their
+ // branding differs. See tor-browser#43308 and tor-browser#42319.
+ // NOTE: The same assets under the alternative URI
+ // "resource:///chrome/browser/content/branding/" should already be
+ // inaccessible to web content, so we only add a condition for the chrome
+ // path.
+ if (targetScheme.EqualsLiteral("chrome")) {
+ nsAutoCString targetHost;
+ rv = aTargetBaseURI->GetHost(targetHost);
+ NS_ENSURE_SUCCESS(rv, rv);
+ if (targetHost.EqualsLiteral("branding")) {
+ // Disallow any Principal whose scheme is not "about", or is a
+ // contentaccessible "about" URI ("about:blank" or "about:srcdoc").
+ // NOTE: "about:blank" and "about:srcdoc" would be unexpected here
+ // since such a document spawned by a web document should inherit the
+ // same Principal URI. I.e. they would be "http:" or "https:" schemes.
+ // But we add this condition for extra assurances.
+ // NOTE: Documents with null Principals, like "about:blank" typed by
+ // the user, would also be excluded since the Principal URI would be
+ // "moz-nullprincipal:".
+ if (!aSourceBaseURI->SchemeIs("about") ||
+ NS_IsContentAccessibleAboutURI(aSourceBaseURI)) {
+ return NS_ERROR_DOM_BAD_URI;
+ }
+ // Also exclude "about:reader" from accessing branding assets. I.e. if
+ // a web page includes `<img src="chrome://branding/..." />` we do not
+ // want it to render within "about:reader" either.
+ // Though it is unknown whether the information within "about:reader"
+ // would be exploitable by a web page, we also want to exclude
+ // "about:reader" for consistency: if it does not display in the
+ // original web page, it should not display in "about:reader" either.
+ nsAutoCString sourcePath;
+ rv = aSourceBaseURI->GetFilePath(sourcePath);
+ NS_ENSURE_SUCCESS(rv, rv);
+ if (sourcePath.EqualsLiteral("reader")) {
+ return NS_ERROR_DOM_BAD_URI;
+ }
+ }
+ }
+
if (targetScheme.EqualsLiteral("resource")) {
if (StaticPrefs::security_all_resource_uri_content_accessible()) {
return NS_OK;
View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/911…
--
View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/911…
You're receiving this email because of your account on gitlab.torproject.org.
ma1 pushed to branch base-browser-128.7.0esr-14.5-1 at The Tor Project / Applications / Tor Browser
Commits:
41490079 by Henry Wilkes at 2025-02-03T17:56:16+01:00
BB 29745: Limit remote access to content accessible resources
- - - - -
1 changed file:
- caps/nsScriptSecurityManager.cpp
Changes:
=====================================
caps/nsScriptSecurityManager.cpp
=====================================
@@ -1044,6 +1044,48 @@ nsresult nsScriptSecurityManager::CheckLoadURIFlags(
}
}
+ // Only allow some "about:" pages to have access to contentaccessible
+ // "chrome://branding/" assets. Otherwise web pages could easily and
+ // consistently detect the differences between channels when their
+ // branding differs. See tor-browser#43308 and tor-browser#42319.
+ // NOTE: The same assets under the alternative URI
+ // "resource:///chrome/browser/content/branding/" should already be
+ // inaccessible to web content, so we only add a condition for the chrome
+ // path.
+ if (targetScheme.EqualsLiteral("chrome")) {
+ nsAutoCString targetHost;
+ rv = aTargetBaseURI->GetHost(targetHost);
+ NS_ENSURE_SUCCESS(rv, rv);
+ if (targetHost.EqualsLiteral("branding")) {
+ // Disallow any Principal whose scheme is not "about", or is a
+ // contentaccessible "about" URI ("about:blank" or "about:srcdoc").
+ // NOTE: "about:blank" and "about:srcdoc" would be unexpected here
+ // since such a document spawned by a web document should inherit the
+ // same Principal URI. I.e. they would be "http:" or "https:" schemes.
+ // But we add this condition for extra assurances.
+ // NOTE: Documents with null Principals, like "about:blank" typed by
+ // the user, would also be excluded since the Principal URI would be
+ // "moz-nullprincipal:".
+ if (!aSourceBaseURI->SchemeIs("about") ||
+ NS_IsContentAccessibleAboutURI(aSourceBaseURI)) {
+ return NS_ERROR_DOM_BAD_URI;
+ }
+ // Also exclude "about:reader" from accessing branding assets. I.e. if
+ // a web page includes `<img src="chrome://branding/..." />` we do not
+ // want it to render within "about:reader" either.
+ // Though it is unknown whether the information within "about:reader"
+ // would be exploitable by a web page, we also want to exclude
+ // "about:reader" for consistency: if it does not display in the
+ // original web page, it should not display in "about:reader" either.
+ nsAutoCString sourcePath;
+ rv = aSourceBaseURI->GetFilePath(sourcePath);
+ NS_ENSURE_SUCCESS(rv, rv);
+ if (sourcePath.EqualsLiteral("reader")) {
+ return NS_ERROR_DOM_BAD_URI;
+ }
+ }
+ }
+
if (targetScheme.EqualsLiteral("resource")) {
if (StaticPrefs::security_all_resource_uri_content_accessible()) {
return NS_OK;
View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/4149007…
--
View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/4149007…
You're receiving this email because of your account on gitlab.torproject.org.
Pier Angelo Vendrame pushed to branch mullvad-browser-128.7.0esr-14.0-1 at The Tor Project / Applications / Mullvad Browser
Commits:
8b25ea05 by Beatriz Rizental at 2025-02-03T16:00:38+01:00
fixup! Add CI for Base Browser
- - - - -
1 changed file:
- .gitlab/ci/mixins.yml
Changes:
=====================================
.gitlab/ci/mixins.yml
=====================================
@@ -4,7 +4,21 @@
before_script:
- git init
- git remote add local "$LOCAL_REPO_PATH"
- - git fetch --depth 500 local
+ - |
+ # Determine the reference of the target branch in the local repository copy.
+ #
+ # 1. List all references in the local repository
+ # 2. Filter the references to the target branch
+ # 3. Remove tags
+ # 4. Keep a single line, in case there are too many matches
+ # 5. Clean up the output
+ # 6. Remove everything before the last two slashes, because the output is like `refs/heads/...` or `refs/remotes/...`
+ TARGET_BRANCH=$(git ls-remote local | grep ${CI_COMMIT_BRANCH:-$CI_MERGE_REQUEST_TARGET_BRANCH_NAME} | grep -v 'refs/tags/' | awk '{print $2}' | tail -1 | sed 's|[^/]*/[^/]*/||')
+ if [ -z "$TARGET_BRANCH" ]; then
+ echo "Target branch $TARGET_BRANCH is not yet in local repository. Stopping the pipeline."
+ exit 1
+ fi
+ - git fetch --depth 500 local $TARGET_BRANCH
- git remote add origin "$CI_REPOSITORY_URL"
- |
if [ -z "${CI_COMMIT_BRANCH:-$CI_MERGE_REQUEST_SOURCE_BRANCH_NAME}" ]; then
@@ -26,7 +40,16 @@
before_script:
- git init
- git remote add local $env:LOCAL_REPO_PATH
- - git fetch --depth 500 local
+ - |
+ $branchName = $env:CI_COMMIT_BRANCH
+ if ([string]::IsNullOrEmpty($branchName)) {
+ $branchName = $env:CI_MERGE_REQUEST_TARGET_BRANCH_NAME
+ }
+ $TARGET_BRANCH = git ls-remote local | Select-String -Pattern $branchName | Select-String -Pattern -NotMatch 'refs/tags/' | Select-Object -Last 1 | ForEach-Object { $_.ToString().Split()[1] -replace '^[^/]*/[^/]*/', '' }
+ if ([string]::IsNullOrEmpty($TARGET_BRANCH)) {
+ Write-Output "Target branch $TARGET_BRANCH is not yet in local repository. Stopping the pipeline."
+ exit 1
+ }
- git remote add origin $env:CI_REPOSITORY_URL
- |
$branchName = $env:CI_COMMIT_BRANCH
View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/8b2…
--
View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/8b2…
You're receiving this email because of your account on gitlab.torproject.org.