- tbb-commits - lists.torproject.org

[Git][tpo/applications/tor-browser][tor-browser-128.2.0esr-14.0-1] fixup! Firefox preference overrides.
by morgan (＠morgan) 29 Aug '24

29 Aug '24

morgan pushed to branch tor-browser-128.2.0esr-14.0-1 at The Tor Project / Applications / Tor Browser Commits: 1cd99490 by Morgan at 2024-08-29T18:59:28+00:00 fixup! Firefox preference overrides. Bug 42687: Disable contentRelevancy component - - - - - 1 changed file: - browser/app/profile/001-base-profile.js Changes: ===================================== browser/app/profile/001-base-profile.js ===================================== @@ -290,6 +290,11 @@ pref("browser.preferences.moreFromMozilla", false); pref("extensions.screenshots.disabled", true); pref("extensions.webcompat-reporter.enabled", false); +// Disable contentRelevancy component (which itself is gated on Nimbus) (tor-browser#42867) +pref("toolkit.contentRelevancy.enabled", false; +pref("toolkit.contentRelevancy.ingestEnabled", false); +pref("toolkit.contentRelevancy.log", false); + pref("browser.search.region", "US"); // Disable GeoIP search lookups (#16254) // Disable use of WiFi location information pref("browser.region.network.scan", false); View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/1cd9949… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/1cd9949… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/mullvad-browser][mullvad-browser-128.2.0esr-14.0-1] fixup! Bug 32308: Use direct browser sizing for letterboxing.
by ma1 (＠ma1) 29 Aug '24

29 Aug '24

ma1 pushed to branch mullvad-browser-128.2.0esr-14.0-1 at The Tor Project / Applications / Mullvad Browser Commits: 28135e70 by Henry Wilkes at 2024-08-30T00:13:26+08:00 fixup! Bug 32308: Use direct browser sizing for letterboxing. Bug 42764: Reduce letterboxing jank from find bar. - - - - - 1 changed file: - toolkit/themes/shared/findbar.css Changes: ===================================== toolkit/themes/shared/findbar.css ===================================== @@ -39,6 +39,14 @@ xul|findbar { transition-duration: 0s; transition-delay: 0s; } + + /* When letterboxing is in use, we do not transition to avoid layout jank. + * This has an additional benefit that the find bar cannot be used to + * fingerprint prefers-reduced-motion. See tor-browser#42764. */ + .letterboxing & { + transition-duration: 0s; + transition-delay: 0s; + } } .findbar-container { View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/281… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/281… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][base-browser-128.2.0esr-14.0-1] fixup! Bug 32308: Use direct browser sizing for letterboxing.
by ma1 (＠ma1) 29 Aug '24

29 Aug '24

ma1 pushed to branch base-browser-128.2.0esr-14.0-1 at The Tor Project / Applications / Tor Browser Commits: 35b22106 by Henry Wilkes at 2024-08-30T00:13:00+08:00 fixup! Bug 32308: Use direct browser sizing for letterboxing. Bug 42764: Reduce letterboxing jank from find bar. - - - - - 1 changed file: - toolkit/themes/shared/findbar.css Changes: ===================================== toolkit/themes/shared/findbar.css ===================================== @@ -39,6 +39,14 @@ xul|findbar { transition-duration: 0s; transition-delay: 0s; } + + /* When letterboxing is in use, we do not transition to avoid layout jank. + * This has an additional benefit that the find bar cannot be used to + * fingerprint prefers-reduced-motion. See tor-browser#42764. */ + .letterboxing & { + transition-duration: 0s; + transition-delay: 0s; + } } .findbar-container { View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/35b2210… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/35b2210… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-128.2.0esr-14.0-1] fixup! Bug 32308: Use direct browser sizing for letterboxing.
by ma1 (＠ma1) 29 Aug '24

29 Aug '24

ma1 pushed to branch tor-browser-128.2.0esr-14.0-1 at The Tor Project / Applications / Tor Browser Commits: 8449d263 by Henry Wilkes at 2024-08-29T16:59:09+01:00 fixup! Bug 32308: Use direct browser sizing for letterboxing. Bug 42764: Reduce letterboxing jank from find bar. - - - - - 1 changed file: - toolkit/themes/shared/findbar.css Changes: ===================================== toolkit/themes/shared/findbar.css ===================================== @@ -39,6 +39,14 @@ xul|findbar { transition-duration: 0s; transition-delay: 0s; } + + /* When letterboxing is in use, we do not transition to avoid layout jank. + * This has an additional benefit that the find bar cannot be used to + * fingerprint prefers-reduced-motion. See tor-browser#42764. */ + .letterboxing & { + transition-duration: 0s; + transition-delay: 0s; + } } .findbar-container { View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/8449d26… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/8449d26… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-115.15.0esr-13.5-2] 2 commits: fixup! Bug 4234: Use the Firefox Update Process for Base Browser.
by Pier Angelo Vendrame (＠pierov) 29 Aug '24

29 Aug '24

Pier Angelo Vendrame pushed to branch tor-browser-115.15.0esr-13.5-2 at The Tor Project / Applications / Tor Browser Commits: 757b1f4d by Pier Angelo Vendrame at 2024-08-28T08:45:55+02:00 fixup! Bug 4234: Use the Firefox Update Process for Base Browser. Bug 42747: Discard unsupported updates earlier. Firefox's updater has a function to select updates, which checks mainly the version number. Therefore, a more recent update that is unsupported will be chosen over a compatible one. We patch this to be able to provide an alternative update path to Windows 7. - - - - - 2f730245 by Pier Angelo Vendrame at 2024-08-28T08:45:55+02:00 fixup! Bug 19121: reinstate the update.xml hash check Revert "Bug 19121: reinstate the update.xml hash check" This reverts commit 39a712fbaf18cb64b6dc601c71bac82718de1a01. - - - - - 3 changed files: - toolkit/mozapps/update/UpdateService.sys.mjs - toolkit/mozapps/update/UpdateTelemetry.sys.mjs - toolkit/mozapps/update/nsIUpdateService.idl Changes: ===================================== toolkit/mozapps/update/UpdateService.sys.mjs ===================================== @@ -2127,8 +2127,6 @@ function UpdatePatch(patch) { } break; case "finalURL": - case "hashFunction": - case "hashValue": case "state": case "type": case "URL": @@ -2148,8 +2146,6 @@ UpdatePatch.prototype = { // over writing nsIUpdatePatch attributes. _attrNames: [ "errorCode", - "hashFunction", - "hashValue", "finalURL", "selected", "size", @@ -2163,8 +2159,6 @@ UpdatePatch.prototype = { */ serialize: function UpdatePatch_serialize(updates) { var patch = updates.createElementNS(URI_UPDATE_NS, "patch"); - patch.setAttribute("hashFunction", this.hashFunction); - patch.setAttribute("hashValue", this.hashValue); patch.setAttribute("size", this.size); patch.setAttribute("type", this.type); patch.setAttribute("URL", this.URL); @@ -3737,18 +3731,20 @@ UpdateService.prototype = { switch (aUpdate.type) { case "major": - if (!majorUpdate) { + if (!majorUpdate || majorUpdate.unsupported) { majorUpdate = aUpdate; } else if ( + !aUpdate.unsupported && vc.compare(majorUpdate.appVersion, aUpdate.appVersion) <= 0 ) { majorUpdate = aUpdate; } break; case "minor": - if (!minorUpdate) { + if (!minorUpdate || minorUpdate.unsupported) { minorUpdate = aUpdate; } else if ( + !aUpdate.unsupported && vc.compare(minorUpdate.appVersion, aUpdate.appVersion) <= 0 ) { minorUpdate = aUpdate; @@ -5792,56 +5788,7 @@ Downloader.prototype = { } LOG("Downloader:_verifyDownload downloaded size == expected size."); - let fileStream = Cc[ - "@mozilla.org/network/file-input-stream;1" - ].createInstance(Ci.nsIFileInputStream); - fileStream.init( - destination, - FileUtils.MODE_RDONLY, - FileUtils.PERMS_FILE, - 0 - ); - - let digest; - try { - let hash = Cc["@mozilla.org/security/hash;1"].createInstance( - Ci.nsICryptoHash - ); - var hashFunction = - Ci.nsICryptoHash[this._patch.hashFunction.toUpperCase()]; - if (hashFunction == undefined) { - throw Components.Exception("", Cr.NS_ERROR_UNEXPECTED); - } - hash.init(hashFunction); - hash.updateFromStream(fileStream, -1); - // NOTE: For now, we assume that the format of _patch.hashValue is hex - // encoded binary (such as what is typically output by programs like - // sha1sum). In the future, this may change to base64 depending on how - // we choose to compute these hashes. - hash = hash.finish(false); - digest = Array.from(hash, (c, i) => - hash.charCodeAt(i).toString(16).padStart(2, "0") - ).join(""); - } catch (e) { - LOG( - "Downloader:_verifyDownload - failed to compute hash of the downloaded update archive" - ); - digest = ""; - } - - fileStream.close(); - - if (digest == this._patch.hashValue.toLowerCase()) { - LOG("Downloader:_verifyDownload hashes match."); - return true; - } - - LOG("Downloader:_verifyDownload hashes do not match. "); - AUSTLMY.pingDownloadCode( - this.isCompleteUpdate, - AUSTLMY.DWNLD_ERR_VERIFY_NO_HASH_MATCH - ); - return false; + return true; }, /** @@ -6477,9 +6424,6 @@ Downloader.prototype = { " is higher than patch size: " + this._patch.size ); - // It's important that we use a different code than - // NS_ERROR_CORRUPTED_CONTENT so that tests can verify the difference - // between a hash error and a wrong download error. AUSTLMY.pingDownloadCode( this.isCompleteUpdate, AUSTLMY.DWNLD_ERR_PATCH_SIZE_LARGER @@ -6498,9 +6442,6 @@ Downloader.prototype = { " is not equal to expected patch size: " + this._patch.size ); - // It's important that we use a different code than - // NS_ERROR_CORRUPTED_CONTENT so that tests can verify the difference - // between a hash error and a wrong download error. AUSTLMY.pingDownloadCode( this.isCompleteUpdate, AUSTLMY.DWNLD_ERR_PATCH_SIZE_NOT_EQUAL ===================================== toolkit/mozapps/update/UpdateTelemetry.sys.mjs ===================================== @@ -190,7 +190,6 @@ export var AUSTLMY = { DWNLD_ERR_VERIFY_NO_REQUEST: 13, DWNLD_ERR_VERIFY_PATCH_SIZE_NOT_EQUAL: 14, DWNLD_ERR_WRITE_FAILURE: 15, - DWNLD_ERR_VERIFY_NO_HASH_MATCH: 16, // Temporary failure code to see if there are failures without an update phase DWNLD_UNKNOWN_PHASE_ERR_WRITE_FAILURE: 40, ===================================== toolkit/mozapps/update/nsIUpdateService.idl ===================================== @@ -39,17 +39,6 @@ interface nsIUpdatePatch : nsISupports */ attribute AString finalURL; - /** - * The hash function to use when determining this file's integrity - */ - attribute AString hashFunction; - - /** - * The value of the hash function named above that should be computed if - * this file is not corrupt. - */ - attribute AString hashValue; - /** * The size of this file, in bytes. */ View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/6935ca… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/6935ca… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/mullvad-browser][mullvad-browser-128.2.0esr-14.0-1] 2 commits: fixup! Bug 41568: Disable LaterRun
by Pier Angelo Vendrame (＠pierov) 29 Aug '24

29 Aug '24

Pier Angelo Vendrame pushed to branch mullvad-browser-128.2.0esr-14.0-1 at The Tor Project / Applications / Mullvad Browser Commits: e4de0ac8 by Henry Wilkes at 2024-08-29T16:42:57+02:00 fixup! Bug 41568: Disable LaterRun Bug 42630: Revert patch. - - - - - ae50f625 by Henry Wilkes at 2024-08-29T16:42:58+02:00 Bug 42630: Disable LaterRun module. - - - - - 2 changed files: - browser/components/BrowserContentHandler.sys.mjs - browser/modules/LaterRun.sys.mjs Changes: ===================================== browser/components/BrowserContentHandler.sys.mjs ===================================== @@ -774,8 +774,8 @@ nsBrowserContentHandler.prototype = { additionalPage = Services.urlFormatter.formatURLPref( "startup.homepage_welcome_url.additional" ); - // Disable 'later run' pages for new profiles (tor-browser#41568) - lazy.LaterRun.selfDestruct(); + // Turn on 'later run' pages for new profiles. + lazy.LaterRun.enable(lazy.LaterRun.ENABLE_REASON_NEW_PROFILE); break; case OVERRIDE_NEW_MSTONE: { // Check whether we will restore a session. If we will, we assume ===================================== browser/modules/LaterRun.sys.mjs ===================================== @@ -61,6 +61,20 @@ export let LaterRun = { }, init(reason) { + // Keep disabled in Base Browser. See tor-browser#41568. + // NOTE: This means that users cannot benefit from feature prompts gated + // behind LaterRun. + // In mozilla ESR 128 it is only used in one place, and is gated behind a + // feature recommendation preference that we switch off in Base Browser + // anyway. See tor-browser#42630. + // But this decision should be reviewed. See tor-browser#43093. + Services.prefs.setBoolPref(kEnabledPref, false); + // Clear any preferences that may have been set before LaterRun was + // disabled. + Services.prefs.clearUserPref(kSessionCountPref); + Services.prefs.clearUserPref(kProfileCreationTime); + Services.prefs.clearUserPref(kUpdateAppliedTime); + if (!this.enabled) { return; } @@ -99,11 +113,8 @@ export let LaterRun = { return Services.prefs.getBoolPref(kEnabledPref, false); }, - enable(reason) { - if (!this.enabled) { - Services.prefs.setBoolPref(kEnabledPref, true); - this.init(reason); - } + enable(_reason) { + // Keep disabled in Base Browser. See tor-browser#41568. }, get hoursSinceInstall() { View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/compare/07… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/compare/07… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][base-browser-128.2.0esr-14.0-1] 2 commits: fixup! Bug 41568: Disable LaterRun
by Pier Angelo Vendrame (＠pierov) 29 Aug '24

29 Aug '24

Pier Angelo Vendrame pushed to branch base-browser-128.2.0esr-14.0-1 at The Tor Project / Applications / Tor Browser Commits: 44820468 by Henry Wilkes at 2024-08-29T16:42:37+02:00 fixup! Bug 41568: Disable LaterRun Bug 42630: Revert patch. - - - - - d44ef5f7 by Henry Wilkes at 2024-08-29T16:42:41+02:00 Bug 42630: Disable LaterRun module. - - - - - 2 changed files: - browser/components/BrowserContentHandler.sys.mjs - browser/modules/LaterRun.sys.mjs Changes: ===================================== browser/components/BrowserContentHandler.sys.mjs ===================================== @@ -757,8 +757,8 @@ nsBrowserContentHandler.prototype = { additionalPage = Services.urlFormatter.formatURLPref( "startup.homepage_welcome_url.additional" ); - // Disable 'later run' pages for new profiles (tor-browser#41568) - lazy.LaterRun.selfDestruct(); + // Turn on 'later run' pages for new profiles. + lazy.LaterRun.enable(lazy.LaterRun.ENABLE_REASON_NEW_PROFILE); break; case OVERRIDE_NEW_MSTONE: { // Check whether we will restore a session. If we will, we assume ===================================== browser/modules/LaterRun.sys.mjs ===================================== @@ -61,6 +61,20 @@ export let LaterRun = { }, init(reason) { + // Keep disabled in Base Browser. See tor-browser#41568. + // NOTE: This means that users cannot benefit from feature prompts gated + // behind LaterRun. + // In mozilla ESR 128 it is only used in one place, and is gated behind a + // feature recommendation preference that we switch off in Base Browser + // anyway. See tor-browser#42630. + // But this decision should be reviewed. See tor-browser#43093. + Services.prefs.setBoolPref(kEnabledPref, false); + // Clear any preferences that may have been set before LaterRun was + // disabled. + Services.prefs.clearUserPref(kSessionCountPref); + Services.prefs.clearUserPref(kProfileCreationTime); + Services.prefs.clearUserPref(kUpdateAppliedTime); + if (!this.enabled) { return; } @@ -99,11 +113,8 @@ export let LaterRun = { return Services.prefs.getBoolPref(kEnabledPref, false); }, - enable(reason) { - if (!this.enabled) { - Services.prefs.setBoolPref(kEnabledPref, true); - this.init(reason); - } + enable(_reason) { + // Keep disabled in Base Browser. See tor-browser#41568. }, get hoursSinceInstall() { View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/8fe2c1… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/8fe2c1… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-128.2.0esr-14.0-1] 2 commits: fixup! Bug 41568: Disable LaterRun
by Pier Angelo Vendrame (＠pierov) 29 Aug '24

29 Aug '24

Pier Angelo Vendrame pushed to branch tor-browser-128.2.0esr-14.0-1 at The Tor Project / Applications / Tor Browser Commits: e85915bc by Henry Wilkes at 2024-08-29T15:11:30+01:00 fixup! Bug 41568: Disable LaterRun Bug 42630: Revert patch. - - - - - 8a110fc4 by Henry Wilkes at 2024-08-29T15:12:01+01:00 Bug 42630: Disable LaterRun module. - - - - - 2 changed files: - browser/components/BrowserContentHandler.sys.mjs - browser/modules/LaterRun.sys.mjs Changes: ===================================== browser/components/BrowserContentHandler.sys.mjs ===================================== @@ -774,8 +774,8 @@ nsBrowserContentHandler.prototype = { additionalPage = Services.urlFormatter.formatURLPref( "startup.homepage_welcome_url.additional" ); - // Disable 'later run' pages for new profiles (tor-browser#41568) - lazy.LaterRun.selfDestruct(); + // Turn on 'later run' pages for new profiles. + lazy.LaterRun.enable(lazy.LaterRun.ENABLE_REASON_NEW_PROFILE); break; case OVERRIDE_NEW_MSTONE: { // Check whether we will restore a session. If we will, we assume ===================================== browser/modules/LaterRun.sys.mjs ===================================== @@ -61,6 +61,20 @@ export let LaterRun = { }, init(reason) { + // Keep disabled in Base Browser. See tor-browser#41568. + // NOTE: This means that users cannot benefit from feature prompts gated + // behind LaterRun. + // In mozilla ESR 128 it is only used in one place, and is gated behind a + // feature recommendation preference that we switch off in Base Browser + // anyway. See tor-browser#42630. + // But this decision should be reviewed. See tor-browser#43093. + Services.prefs.setBoolPref(kEnabledPref, false); + // Clear any preferences that may have been set before LaterRun was + // disabled. + Services.prefs.clearUserPref(kSessionCountPref); + Services.prefs.clearUserPref(kProfileCreationTime); + Services.prefs.clearUserPref(kUpdateAppliedTime); + if (!this.enabled) { return; } @@ -99,11 +113,8 @@ export let LaterRun = { return Services.prefs.getBoolPref(kEnabledPref, false); }, - enable(reason) { - if (!this.enabled) { - Services.prefs.setBoolPref(kEnabledPref, true); - this.init(reason); - } + enable(_reason) { + // Keep disabled in Base Browser. See tor-browser#41568. }, get hoursSinceInstall() { View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/df4211… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/df4211… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-128.2.0esr-14.0-1] fixup! Bug 23247: Communicating security expectations for .onion
by Pier Angelo Vendrame (＠pierov) 29 Aug '24

29 Aug '24

Pier Angelo Vendrame pushed to branch tor-browser-128.2.0esr-14.0-1 at The Tor Project / Applications / Tor Browser Commits: df421101 by Pier Angelo Vendrame at 2024-08-29T10:15:34+02:00 fixup! Bug 23247: Communicating security expectations for .onion Bug 42743: Check for .onion in the actual document URI in pageInfo. One of our patches checks whether we are in a .onion domain when showing the security information in pageInfo.xhtml. However, it checks it in the requested URI rather than doing it on the actually loaded URI, therefore about:neterror is shown as a secure Onion service, which is not consistent with failures in loading clearnet domains with HTTPS. - - - - - 1 changed file: - browser/base/content/pageinfo/security.js Changes: ===================================== browser/base/content/pageinfo/security.js ===================================== @@ -53,16 +53,15 @@ var security = { (Ci.nsIWebProgressListener.STATE_LOADED_MIXED_ACTIVE_CONTENT | Ci.nsIWebProgressListener.STATE_LOADED_MIXED_DISPLAY_CONTENT); var isEV = ui.state & Ci.nsIWebProgressListener.STATE_IDENTITY_EV_TOPLEVEL; - var isOnion = false; - let hostName; - try { - hostName = Services.eTLD.getBaseDomain(this.uri); - } catch (e) { - hostName = this.windowInfo.hostName; - } - if (hostName && hostName.endsWith(".onion")) { - isOnion = true; + let uriInformation = new URL(gDocInfo.documentURIObject.spec); + // If the Onion site could not be loaded, the view-source will be also be + // about:neterror. + if (uriInformation.protocol == "view-source:") { + uriInformation = new URL(uriInformation.pathname); } + const isOnion = + ["http:", "https:"].includes(uriInformation.protocol) && + uriInformation.hostname.endsWith(".onion"); let retval = { cAName: "", View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/df42110… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/df42110… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/mullvad-browser] Pushed new tag mullvad-browser-115.15.0esr-13.5-1-build1
by Pier Angelo Vendrame (＠pierov) 29 Aug '24

29 Aug '24

Pier Angelo Vendrame pushed new tag mullvad-browser-115.15.0esr-13.5-1-build1 at The Tor Project / Applications / Mullvad Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/tree/mullv… You're receiving this email because of your account on gitlab.torproject.org.

1 0