- tbb-commits - lists.torproject.org

[tor-browser-build/maint-7.5] Release preparations for 7.5.4
by gk＠torproject.org 02 May '18

02 May '18

commit ad2095ad97cdb3b27f800561529578f3bac511f7 Author: Georg Koppen <gk(a)torproject.org> Date: Wed May 2 07:52:50 2018 +0000 Release preparations for 7.5.4 Changelog update and versions bump --- projects/firefox-langpacks/config | 2 +- projects/firefox/config | 6 +++--- projects/https-everywhere/config | 2 +- projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt | 11 +++++++++++ rbm.conf | 5 ++--- 5 files changed, 18 insertions(+), 8 deletions(-) diff --git a/projects/firefox-langpacks/config b/projects/firefox-langpacks/config index 04cd7dd..4e42939 100644 --- a/projects/firefox-langpacks/config +++ b/projects/firefox-langpacks/config @@ -4,7 +4,7 @@ filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/buil var: ff_version: '[% pc("firefox", "var/firefox_version") %]' - ff_build: build2 + ff_build: build1 ff_arch: linux-i686 input_filename: 'dl-langpack-[% c("var/ff_arch") %]-[% c("version") %]' diff --git a/projects/firefox/config b/projects/firefox/config index 22c7a0b..886cfdc 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -1,13 +1,13 @@ # vim: filetype=yaml sw=2 version: '[% c("abbrev") %]' filename: 'firefox-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %]' -git_hash: 'tor-browser-[% c("var/firefox_version") %]-[% c("var/torbrowser_branch") %]-1-build1' +git_hash: 'tor-browser-[% c("var/firefox_version") %]-[% c("var/torbrowser_branch") %]-1-build2' tag_gpg_id: 1 git_url: https://git.torproject.org/tor-browser.git gpg_keyring: torbutton.gpg var: - firefox_platform_version: 52.7.3 + firefox_platform_version: 52.8.0 firefox_version: '[% c("var/firefox_platform_version") %]esr' torbrowser_branch: 7.5 torbrowser_update_channel: alpha @@ -28,7 +28,7 @@ targets: torbrowser_update_channel: release nightly: - git_hash: 'tor-browser-[% c("var/firefox_version") %]-[% c("var/torbrowser_branch") %]-2' + git_hash: 'tor-browser-[% c("var/firefox_version") %]-[% c("var/torbrowser_branch") %]-1' tag_gpg_id: 0 var: torbrowser_update_channel: default diff --git a/projects/https-everywhere/config b/projects/https-everywhere/config index 38eb2be..cfa0a78 100644 --- a/projects/https-everywhere/config +++ b/projects/https-everywhere/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 2018.3.13 +version: 2018.4.11 git_url: https://git.torproject.org/https-everywhere.git git_hash: '[% c("version") %]' git_submodule: 1 diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index f9a328a..7f5a736 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,14 @@ +Tor Browser 7.5.4 -- May 9 2018 + * All platforms + * Update Firefox to 52.8.0esr + * Update HTTPS Everywhere to 2018.4.11 + * Update NoScript to 5.1.8.5 + * Bug 23439: Exempt .onion domains from mixed content warnings + * Bug 22614: Make e10s/non-e10s Tor Browsers indistinguishable + * Bug 22659: Changes to `intl.accept.languages` get overwritten after restart + * Bug 25973: Backport off-by-one fix (bug 1352073) + * Bug 25020: Add a tbb_version.json file + Tor Browser 7.5.3 -- March 26 2018 * All platforms * Update Firefox to 52.7.3esr diff --git a/rbm.conf b/rbm.conf index 1f7d0d4..ca427f9 100644 --- a/rbm.conf +++ b/rbm.conf @@ -15,11 +15,10 @@ buildconf: git_signtag_opt: '-s' var: - torbrowser_version: '7.5.3' + torbrowser_version: '7.5.4' torbrowser_build: 'build1' torbrowser_incremental_from: - - 7.5.1 - - 7.5.2 + - 7.5.3 project_name: tor-browser multi_lingual: 0 build_mar: 1

1 0

[tor-browser-build/maint-7.5] Bug 25020: fix a typo in tbb_version.json filename
by gk＠torproject.org 02 May '18

02 May '18

commit f99490f12132557981907254495d2b1d6053018e Author: Nicolas Vigier <boklm(a)torproject.org> Date: Sat Feb 24 21:54:29 2018 +0100 Bug 25020: fix a typo in tbb_version.json filename --- projects/tor-browser/build | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/projects/tor-browser/build b/projects/tor-browser/build index 978d988..c542818 100644 --- a/projects/tor-browser/build +++ b/projects/tor-browser/build @@ -199,7 +199,7 @@ echo "pref(\"general.useragent.locale\", \"en-US\");" >> defaults/preferences/00 zip -Xm omni.ja defaults/preferences/000-tor-browser.js rm -rf defaults # create tbb_version.json file for #25020 -echo '{"version":"[% c("var/torbrowser_version") %]","architecture":"[% c("var/mar_osname") %]","channel":"[% c("var/channel") %]","locale":"en-US"}' > ../tbb_verson.json +echo '{"version":"[% c("var/torbrowser_version") %]","architecture":"[% c("var/mar_osname") %]","channel":"[% c("var/channel") %]","locale":"en-US"}' > ../tbb_version.json popd # Prepare our language packs for using the proper search engines and embed @@ -330,7 +330,7 @@ cp $rootdir/[% c('input_files_by_name/firefox') %]/mar-tools-*.zip "$OUTDIR"/ zip -Xm omni.ja defaults/preferences/000-tor-browser.js rm -rf defaults # create tbb_version.json file for #25020 - echo '{"version":"[% c("var/torbrowser_version") %]","architecture":"[% c("var/mar_osname") %]","channel":"[% c("var/channel") %]","locale":"[% lang %]"}' > ../tbb_verson.json + echo '{"version":"[% c("var/torbrowser_version") %]","architecture":"[% c("var/mar_osname") %]","channel":"[% c("var/channel") %]","locale":"[% lang %]"}' > ../tbb_version.json popd # Set the update.locale (it is used to replace %LOCALE% within

1 0

[tor-browser-build/maint-7.5] Bug 25020: add a tbb_version.json file
by gk＠torproject.org 02 May '18

02 May '18

commit 38e9d1caaa0d7cf49e4052e7c709b48ebdba9e31 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Thu Feb 8 14:55:10 2018 +0100 Bug 25020: add a tbb_version.json file Add a tbb_version.json file containing informations about the installed bundle. --- projects/tor-browser/build | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/projects/tor-browser/build b/projects/tor-browser/build index 7431e26..978d988 100644 --- a/projects/tor-browser/build +++ b/projects/tor-browser/build @@ -198,6 +198,8 @@ echo "pref(\"general.useragent.locale\", \"en-US\");" >> defaults/preferences/00 [% c("var/touch") %] defaults/preferences/000-tor-browser.js zip -Xm omni.ja defaults/preferences/000-tor-browser.js rm -rf defaults +# create tbb_version.json file for #25020 +echo '{"version":"[% c("var/torbrowser_version") %]","architecture":"[% c("var/mar_osname") %]","channel":"[% c("var/channel") %]","locale":"en-US"}' > ../tbb_verson.json popd # Prepare our language packs for using the proper search engines and embed @@ -327,6 +329,8 @@ cp $rootdir/[% c('input_files_by_name/firefox') %]/mar-tools-*.zip "$OUTDIR"/ [% c("var/touch") %] defaults/preferences/000-tor-browser.js zip -Xm omni.ja defaults/preferences/000-tor-browser.js rm -rf defaults + # create tbb_version.json file for #25020 + echo '{"version":"[% c("var/torbrowser_version") %]","architecture":"[% c("var/mar_osname") %]","channel":"[% c("var/channel") %]","locale":"[% lang %]"}' > ../tbb_verson.json popd # Set the update.locale (it is used to replace %LOCALE% within

1 0

[tor-browser-build/maint-7.5] Bug 25572: Update NoScript to version 5.1.8.5
by gk＠torproject.org 02 May '18

02 May '18

commit f0f669e25747a9c33f07d365397a030a21ede864 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Apr 11 11:59:12 2018 +0000 Bug 25572: Update NoScript to version 5.1.8.5 --- projects/tor-browser/config | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/projects/tor-browser/config b/projects/tor-browser/config index 661b8e2..dec5648 100644 --- a/projects/tor-browser/config +++ b/projects/tor-browser/config @@ -66,9 +66,9 @@ input_files: name: snowflake enable: '[% c("var/snowflake") %]' - filename: Bundle-Data - - URL: https://addons.cdn.mozilla.net/user-media/addons/722/noscript_security_suit… + - URL: https://secure.informaction.com/download/releases/noscript-5.1.8.5.xpi name: noscript - sha256sum: 1c85a72cd0d7d210f8dd463f9700214703a5f28319c2b1679db00f861a5289f7 + sha256sum: 7180f8d24ca31989682dee229b95e3503699f2bb25cb593a6a1f2ce0a2253792 - filename: 'RelativeLink/start-tor-browser.desktop' enable: '[% c("var/linux") %]' - filename: 'RelativeLink/execdesktop'

1 0

[tor-browser/tor-browser-52.8.0esr-7.5-1] Bug 1005640 - Flush StringBundle cache when app-locales change. r=valentin
by gk＠torproject.org 02 May '18

02 May '18

commit 724133ad5d58124b2eaf236bfc65f46bf54bbe8a Author: Zibi Braniecki <gandalf(a)mozilla.com> Date: Tue Apr 18 01:03:05 2017 -0700 Bug 1005640 - Flush StringBundle cache when app-locales change. r=valentin StringBundle caches bundles, so when language chain changes we should flush the cache to enable new strings to be loaded. This also affects localized prefs like intl.accept_languages. Then in HttpHandler we have to mark the value as dirty so that next time it's called it actually recalculates using flushed string bundle with the new locale. MozReview-Commit-ID: DKWEDUli4yH --HG-- extra : rebase_source : 75ecc4204deca066d7492d1494492a91685f36be This fixes bug 22659 on our side. --- intl/strres/nsStringBundle.cpp | 4 +++- netwerk/protocol/http/nsHttpHandler.cpp | 34 +++++++++++++++++++-------------- netwerk/protocol/http/nsHttpHandler.h | 3 ++- 3 files changed, 25 insertions(+), 16 deletions(-) diff --git a/intl/strres/nsStringBundle.cpp b/intl/strres/nsStringBundle.cpp index ab840a469a4c..a763ba228b66 100644 --- a/intl/strres/nsStringBundle.cpp +++ b/intl/strres/nsStringBundle.cpp @@ -529,6 +529,7 @@ nsStringBundleService::Init() os->AddObserver(this, "profile-do-change", true); os->AddObserver(this, "chrome-flush-caches", true); os->AddObserver(this, "xpcom-category-entry-added", true); + os->AddObserver(this, "intl:app-locales-changed", true); } // instantiate the override service, if there is any. @@ -546,7 +547,8 @@ nsStringBundleService::Observe(nsISupports* aSubject, { if (strcmp("memory-pressure", aTopic) == 0 || strcmp("profile-do-change", aTopic) == 0 || - strcmp("chrome-flush-caches", aTopic) == 0) + strcmp("chrome-flush-caches", aTopic) == 0 || + strcmp("intl:app-locales-changed", aTopic) == 0) { flushBundleCache(); } diff --git a/netwerk/protocol/http/nsHttpHandler.cpp b/netwerk/protocol/http/nsHttpHandler.cpp index 4276c7144eb3..21ce43d35fd5 100644 --- a/netwerk/protocol/http/nsHttpHandler.cpp +++ b/netwerk/protocol/http/nsHttpHandler.cpp @@ -203,6 +203,7 @@ nsHttpHandler::nsHttpHandler() , mProduct("Gecko") , mCompatFirefoxEnabled(false) , mUserAgentIsDirty(true) + , mAcceptLanguagesIsDirty(true) , mPromptTempRedirect(true) , mEnablePersistentHttpsCaching(false) , mDoNotTrackEnabled(false) @@ -466,8 +467,13 @@ nsHttpHandler::AddStandardRequestHeaders(nsHttpRequestHead *request, bool isSecu // Add the "Accept-Language" header. This header is also exposed to the // service worker. + if (mAcceptLanguagesIsDirty) { + rv = SetAcceptLanguages(); + MOZ_ASSERT(NS_SUCCEEDED(rv)); + } + + // Add the "Accept-Language" header if (!mAcceptLanguages.IsEmpty()) { - // Add the "Accept-Language" header rv = request->SetHeader(nsHttp::Accept_Language, mAcceptLanguages, false, nsHttpHeaderArray::eVarietyRequestOverride); @@ -1484,16 +1490,10 @@ nsHttpHandler::PrefsChanged(nsIPrefBranch *prefs, const char *pref) // if (PREF_CHANGED(INTL_ACCEPT_LANGUAGES)) { - nsCOMPtr<nsIPrefLocalizedString> pls; - prefs->GetComplexValue(INTL_ACCEPT_LANGUAGES, - NS_GET_IID(nsIPrefLocalizedString), - getter_AddRefs(pls)); - if (pls) { - nsXPIDLString uval; - pls->ToString(getter_Copies(uval)); - if (uval) - SetAcceptLanguages(NS_ConvertUTF16toUTF8(uval).get()); - } + // We don't want to set the new accept languages here since + // this pref is a complex type and it may be racy with flushing + // string resources. + mAcceptLanguagesIsDirty = true; } // @@ -1870,12 +1870,18 @@ PrepareAcceptLanguages(const char *i_AcceptLanguages, nsACString &o_AcceptLangua } nsresult -nsHttpHandler::SetAcceptLanguages(const char *aAcceptLanguages) +nsHttpHandler::SetAcceptLanguages() { + mAcceptLanguagesIsDirty = false; + + const nsAdoptingCString& acceptLanguages = + Preferences::GetLocalizedCString(INTL_ACCEPT_LANGUAGES); + nsAutoCString buf; - nsresult rv = PrepareAcceptLanguages(aAcceptLanguages, buf); - if (NS_SUCCEEDED(rv)) + nsresult rv = PrepareAcceptLanguages(acceptLanguages.get(), buf); + if (NS_SUCCEEDED(rv)) { mAcceptLanguages.Assign(buf); + } return rv; } diff --git a/netwerk/protocol/http/nsHttpHandler.h b/netwerk/protocol/http/nsHttpHandler.h index 155740f3d223..bb30afc500f8 100644 --- a/netwerk/protocol/http/nsHttpHandler.h +++ b/netwerk/protocol/http/nsHttpHandler.h @@ -393,7 +393,7 @@ private: void PrefsChanged(nsIPrefBranch *prefs, const char *pref); nsresult SetAccept(const char *); - nsresult SetAcceptLanguages(const char *); + nsresult SetAcceptLanguages(); nsresult SetAcceptEncodings(const char *, bool mIsSecure); nsresult InitConnectionMgr(); @@ -497,6 +497,7 @@ private: nsCString mUserAgent; nsXPIDLCString mUserAgentOverride; bool mUserAgentIsDirty; // true if mUserAgent should be rebuilt + bool mAcceptLanguagesIsDirty; bool mPromptTempRedirect;

1 0

[tor-browser/tor-browser-52.8.0esr-7.5-1] Bug 22614: Make e10s/non-e10s Tor Browsers indistinguishable
by gk＠torproject.org 02 May '18

02 May '18

commit deaa82b4f8ab411198ca300f614df3970221455e Author: Fernando Fernandez Mancera <ffmancera(a)riseup.net> Date: Fri Feb 2 11:38:01 2018 +0100 Bug 22614: Make e10s/non-e10s Tor Browsers indistinguishable e10s in its current form probably brings some fingerprinting risks with it. E.g. users of accessibility tools (not only those users) won't have e10s enabled on windows and macOS. In order to solve this issue "dom.disable_window_showModalDialog" is set to "true". --- browser/app/profile/000-tor-browser.js | 2 ++ 1 file changed, 2 insertions(+) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 32922418b12f..6fa34860a7b5 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -177,6 +177,8 @@ pref("media.webspeech.synth.enabled", false); // Bug 10283: Disable SpeechSynthe pref("dom.webaudio.enabled", false); // Bug 13017: Disable Web Audio API pref("dom.maxHardwareConcurrency", 1); // Bug 21675: Spoof single-core cpu pref("dom.w3c_touch_events.enabled", 0); // Bug 10286: Always disable Touch API +// Make e10s/non-e10s Tor Browsers indistinguishable (Bug: 22614) +pref("dom.disable_window_showModalDialog", true); // Third party stuff pref("privacy.firstparty.isolate", true); // Always enforce first party isolation

1 0

[tor-browser/tor-browser-52.8.0esr-7.5-1] Bug 23439: Exempt .onion domains from mixed content warnings
by gk＠torproject.org 02 May '18

02 May '18

commit e52a50f2099501efd4e2892a702a1a3730439426 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Mar 21 08:21:01 2018 +0000 Bug 23439: Exempt .onion domains from mixed content warnings Tests --- browser/base/content/test/general/browser.ini | 4 +++ .../test/general/browser_no_mcb_for_onions.js | 39 ++++++++++++++++++++++ .../test/general/test_no_mcb_for_onions.html | 28 ++++++++++++++++ 3 files changed, 71 insertions(+) diff --git a/browser/base/content/test/general/browser.ini b/browser/base/content/test/general/browser.ini index 96e591ffea7b..321e444c2cde 100644 --- a/browser/base/content/test/general/browser.ini +++ b/browser/base/content/test/general/browser.ini @@ -492,3 +492,7 @@ tags = mcb [browser_newwindow_focus.js] skip-if = (os == "linux" && !e10s) # Bug 1263254 - Perma fails on Linux without e10s for some reason. [browser_bug1299667.js] +[browser_no_mcb_for_onions.js] +tags = mcb +support-files = + test_no_mcb_for_onions.html diff --git a/browser/base/content/test/general/browser_no_mcb_for_onions.js b/browser/base/content/test/general/browser_no_mcb_for_onions.js new file mode 100644 index 000000000000..8023b78276f3 --- /dev/null +++ b/browser/base/content/test/general/browser_no_mcb_for_onions.js @@ -0,0 +1,39 @@ +/* Any copyright is dedicated to the Public Domain. + * http://creativecommons.org/publicdomain/zero/1.0/ */ + +// The test loads a HTTPS web page with active content from HTTP .onion URLs +// and makes sure that the mixed content flags on the docshell are not set. +// +// Note that the URLs referenced within the test page intentionally use the +// unassigned port 8 because we don't want to actually load anything, we just +// want to check that the URLs are not blocked. + +const TEST_URL = getRootDirectory(gTestPath).replace("chrome://mochitests/content", "https://example.com") + "test_no_mcb_for_onions.html"; + +const PREF_BLOCK_DISPLAY = "security.mixed_content.block_display_content"; +const PREF_BLOCK_ACTIVE = "security.mixed_content.block_active_content"; +const PREF_ONION_WHITELIST = "dom.securecontext.whitelist_onions"; + +add_task(async function allowOnionMixedContent() { + registerCleanupFunction(function() { + gBrowser.removeCurrentTab(); + }); + + await SpecialPowers.pushPrefEnv({set: [[PREF_BLOCK_DISPLAY, true]]}); + await SpecialPowers.pushPrefEnv({set: [[PREF_BLOCK_ACTIVE, true]]}); + await SpecialPowers.pushPrefEnv({set: [[PREF_ONION_WHITELIST, true]]}); + + const tab = await BrowserTestUtils.openNewForegroundTab(gBrowser, TEST_URL); + const browser = gBrowser.getBrowserForTab(tab); + + await ContentTask.spawn(browser, null, function() { + is(docShell.hasMixedDisplayContentBlocked, false, "hasMixedDisplayContentBlocked not set"); + is(docShell.hasMixedActiveContentBlocked, false, "hasMixedActiveContentBlocked not set"); + }); + + await assertMixedContentBlockingState(browser, { + activeBlocked: false, + activeLoaded: false, + passiveLoaded: false, + }); +}); diff --git a/browser/base/content/test/general/test_no_mcb_for_onions.html b/browser/base/content/test/general/test_no_mcb_for_onions.html new file mode 100644 index 000000000000..9715d526bf87 --- /dev/null +++ b/browser/base/content/test/general/test_no_mcb_for_onions.html @@ -0,0 +1,28 @@ + +<!DOCTYPE HTML> +<html> + <head> + <meta charset="utf8"> + <title>Bug 1382359</title> + </head> + + <style> + @font-face { + src: url("http://123456789abcdef.onion:8/test.ttf"); + } + </style> + + <body> + <img src="http://123456789abcdef.onion:8/test.png"> + + <iframe src="http://123456789abcdef.onion:8/test.html"></iframe> + </body> + + <script src="http://123456789abcdef.onion:8/test.js"></script> + + <link href="http://123456789abcdef.onion:8/test.css" rel="stylesheet"></link> + + <script> + fetch("http://123456789abcdef.onion:8"); + </script> +</html>

1 0

[tor-browser/tor-browser-52.8.0esr-7.5-1] Bug 23439: Exempt .onion domains from mixed content warnings
by gk＠torproject.org 02 May '18

02 May '18

commit c4d20a867e257b15895cc2123e2c88b80df70b41 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Tue Mar 20 15:02:32 2018 -0400 Bug 23439: Exempt .onion domains from mixed content warnings --- dom/html/HTMLFormElement.cpp | 5 +++++ dom/security/nsContentSecurityManager.cpp | 7 +++--- dom/security/nsMixedContentBlocker.cpp | 37 ++++++++++++++++++++++++++++--- dom/security/nsMixedContentBlocker.h | 2 ++ 4 files changed, 44 insertions(+), 7 deletions(-) diff --git a/dom/html/HTMLFormElement.cpp b/dom/html/HTMLFormElement.cpp index 5164391f8d2b..71b6248d5b06 100644 --- a/dom/html/HTMLFormElement.cpp +++ b/dom/html/HTMLFormElement.cpp @@ -14,6 +14,7 @@ #include "mozilla/dom/AutocompleteErrorEvent.h" #include "mozilla/dom/nsCSPUtils.h" #include "mozilla/dom/nsCSPContext.h" +#include "mozilla/dom/nsMixedContentBlocker.h" #include "mozilla/dom/HTMLFormControlsCollection.h" #include "mozilla/dom/HTMLFormElementBinding.h" #include "mozilla/Move.h" @@ -907,6 +908,10 @@ HTMLFormElement::DoSecureToInsecureSubmitCheck(nsIURI* aActionURL, return NS_OK; } + if (nsMixedContentBlocker::IsPotentiallyTrustworthyOnion(aActionURL)) { + return NS_OK; + } + nsCOMPtr<nsPIDOMWindowOuter> window = OwnerDoc()->GetWindow(); if (!window) { return NS_ERROR_FAILURE; diff --git a/dom/security/nsContentSecurityManager.cpp b/dom/security/nsContentSecurityManager.cpp index c95226b56e91..aa4f735a5c4f 100644 --- a/dom/security/nsContentSecurityManager.cpp +++ b/dom/security/nsContentSecurityManager.cpp @@ -10,6 +10,7 @@ #include "nsMixedContentBlocker.h" #include "mozilla/dom/Element.h" +#include "mozilla/dom/nsMixedContentBlocker.h" NS_IMPL_ISUPPORTS(nsContentSecurityManager, nsIContentSecurityManager, @@ -689,11 +690,9 @@ nsContentSecurityManager::IsOriginPotentiallyTrustworthy(nsIPrincipal* aPrincipa } } } - // Maybe we have a .onion URL. Treat it as whitelisted as well when + // Maybe we have a .onion URL. Treat it as whitelisted as well if // `dom.securecontext.whitelist_onions` is `true`. - bool whitelistOnions = - Preferences::GetBool("dom.securecontext.whitelist_onions", false); - if (whitelistOnions && StringEndsWith(host, NS_LITERAL_CSTRING(".onion"))) { + if (nsMixedContentBlocker::IsPotentiallyTrustworthyOnion(uri)) { *aIsTrustWorthy = true; return NS_OK; } diff --git a/dom/security/nsMixedContentBlocker.cpp b/dom/security/nsMixedContentBlocker.cpp index a9aca5333491..98e262f0bcf4 100644 --- a/dom/security/nsMixedContentBlocker.cpp +++ b/dom/security/nsMixedContentBlocker.cpp @@ -394,6 +394,29 @@ nsMixedContentBlocker::ShouldLoad(uint32_t aContentType, return rv; } +/* Maybe we have a .onion URL. Treat it as whitelisted as well if + * `dom.securecontext.whitelist_onions` is `true`. + */ +bool +nsMixedContentBlocker::IsPotentiallyTrustworthyOnion(nsIURI* aURL) { + static bool sInited = false; + static bool sWhiteListOnions = false; + if (!sInited) { + Preferences::AddBoolVarCache(&sWhiteListOnions, + "dom.securecontext.whitelist_onions"); + sInited = true; + } + if (!sWhiteListOnions) { + return false; + } + + nsAutoCString host; + nsresult rv = aURL->GetHost(host); + NS_ENSURE_SUCCESS(rv, false); + return StringEndsWith(host, NS_LITERAL_CSTRING(".onion")); +} + + /* Static version of ShouldLoad() that contains all the Mixed Content Blocker * logic. Called from non-static ShouldLoad(). */ @@ -696,6 +719,17 @@ nsMixedContentBlocker::ShouldLoad(bool aHadInsecureImageRedirect, return NS_OK; } + bool isHttpScheme = false; + rv = innerContentLocation->SchemeIs("http", &isHttpScheme); + NS_ENSURE_SUCCESS(rv, rv); + + // .onion URLs are encrypted and authenticated. Don't treat them as mixed + // content if potentially trustworthy (i.e. whitelisted). + if (isHttpScheme && IsPotentiallyTrustworthyOnion(innerContentLocation)) { + *aDecision = ACCEPT; + return NS_OK; + } + // The page might have set the CSP directive 'upgrade-insecure-requests'. In such // a case allow the http: load to succeed with the promise that the channel will // get upgraded to https before fetching any data from the netwerk. @@ -707,9 +741,6 @@ nsMixedContentBlocker::ShouldLoad(bool aHadInsecureImageRedirect, // we only have to check against http: here. Skip mixed content blocking if the // subresource load uses http: and the CSP directive 'upgrade-insecure-requests' // is present on the page. - bool isHttpScheme = false; - rv = innerContentLocation->SchemeIs("http", &isHttpScheme); - NS_ENSURE_SUCCESS(rv, rv); nsIDocument* document = docShell->GetDocument(); MOZ_ASSERT(document, "Expected a document"); if (isHttpScheme && document->GetUpgradeInsecureRequests(isPreload)) { diff --git a/dom/security/nsMixedContentBlocker.h b/dom/security/nsMixedContentBlocker.h index 539c3ebbb7f0..24fbac171dac 100644 --- a/dom/security/nsMixedContentBlocker.h +++ b/dom/security/nsMixedContentBlocker.h @@ -43,6 +43,8 @@ public: nsMixedContentBlocker(); + static bool IsPotentiallyTrustworthyOnion(nsIURI* aURL); + /* Static version of ShouldLoad() that contains all the Mixed Content Blocker * logic. Called from non-static ShouldLoad(). * Called directly from imageLib when an insecure redirect exists in a cached

1 0

[tor-browser-build/maint-7.5] Bump rbm (picking up fix for #25746)
by gk＠torproject.org 02 May '18

02 May '18

commit 3a30e46411ffd05bf43b3a5d38be4c86a698b248 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Apr 11 09:08:29 2018 +0000 Bump rbm (picking up fix for #25746) --- rbm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rbm b/rbm index db41d8e..8adbc46 160000 --- a/rbm +++ b/rbm @@ -1 +1 @@ -Subproject commit db41d8e754ed8cd6cee7bca18d76d59f8f7f369b +Subproject commit 8adbc46dc9e8358abad75ac81faf4646d8165b9e

1 0

[tor-browser/tor-browser-52.7.3esr-8.0-1] Bug 1352073 - Fix off-by-one in Vector::insert. r=luke, a=lizzard
by gk＠torproject.org 02 May '18

02 May '18

commit 833b057519dcd6c62ac3f16cff93b17311c6a4c4 Author: Benjamin Bouvier <benj(a)benj.me> Date: Fri Mar 31 11:01:35 2017 +0200 Bug 1352073 - Fix off-by-one in Vector::insert. r=luke, a=lizzard MozReview-Commit-ID: HY0DYSAbi6M --- mfbt/Vector.h | 4 ++-- mfbt/tests/TestVector.cpp | 52 +++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 54 insertions(+), 2 deletions(-) diff --git a/mfbt/Vector.h b/mfbt/Vector.h index fc43afcf163e..07e370426492 100644 --- a/mfbt/Vector.h +++ b/mfbt/Vector.h @@ -1232,10 +1232,10 @@ Vector<T, N, AP>::insert(T* aP, U&& aVal) } } else { T oldBack = Move(back()); - if (!append(Move(oldBack))) { /* Dup the last element. */ + if (!append(Move(oldBack))) { return nullptr; } - for (size_t i = oldLength; i > pos; --i) { + for (size_t i = oldLength - 1; i > pos; --i) { (*this)[i] = Move((*this)[i - 1]); } (*this)[pos] = Forward<U>(aVal); diff --git a/mfbt/tests/TestVector.cpp b/mfbt/tests/TestVector.cpp index d969bcbc2ceb..e28b432d6919 100644 --- a/mfbt/tests/TestVector.cpp +++ b/mfbt/tests/TestVector.cpp @@ -22,6 +22,7 @@ struct mozilla::detail::VectorTesting static void testReverse(); static void testExtractRawBuffer(); static void testExtractOrCopyRawBuffer(); + static void testInsert(); }; void @@ -141,6 +142,15 @@ struct S destructCount++; } + S& operator=(S&& rhs) { + j = rhs.j; + rhs.j = 0; + k = Move(rhs.k); + rhs.k.reset(); + moveCount++; + return *this; + } + S(const S&) = delete; S& operator=(const S&) = delete; }; @@ -346,6 +356,47 @@ mozilla::detail::VectorTesting::testExtractOrCopyRawBuffer() free(buf); } +void +mozilla::detail::VectorTesting::testInsert() +{ + S::resetCounts(); + + Vector<S, 8> vec; + MOZ_RELEASE_ASSERT(vec.reserve(8)); + for (size_t i = 0; i < 7; i++) { + vec.infallibleEmplaceBack(i, i * i); + } + + MOZ_RELEASE_ASSERT(vec.length() == 7); + MOZ_ASSERT(vec.reserved() == 8); + MOZ_RELEASE_ASSERT(S::constructCount == 7); + MOZ_RELEASE_ASSERT(S::moveCount == 0); + MOZ_RELEASE_ASSERT(S::destructCount == 0); + + S s(42, 43); + MOZ_RELEASE_ASSERT(vec.insert(vec.begin() + 4, Move(s))); + + for (size_t i = 0; i < vec.length(); i++) { + const S& s = vec[i]; + MOZ_RELEASE_ASSERT(s.k); + if (i < 4) { + MOZ_RELEASE_ASSERT(s.j == i && *s.k == i * i); + } else if (i == 4) { + MOZ_RELEASE_ASSERT(s.j == 42 && *s.k == 43); + } else { + MOZ_RELEASE_ASSERT(s.j == i - 1 && *s.k == (i - 1) * (i - 1)); + } + } + + MOZ_RELEASE_ASSERT(vec.length() == 8); + MOZ_ASSERT(vec.reserved() == 8); + MOZ_RELEASE_ASSERT(S::constructCount == 8); + MOZ_RELEASE_ASSERT(S::moveCount == 1 /* move in insert() call */ + + 1 /* move the back() element */ + + 3 /* elements to shift */); + MOZ_RELEASE_ASSERT(S::destructCount == 1); +} + int main() { @@ -355,4 +406,5 @@ main() VectorTesting::testReverse(); VectorTesting::testExtractRawBuffer(); VectorTesting::testExtractOrCopyRawBuffer(); + VectorTesting::testInsert(); }

1 0

[tor-browser/tor-browser-52.7.3esr-7.5-1] Bug 1352073 - Fix off-by-one in Vector::insert. r=luke, a=lizzard
by gk＠torproject.org 02 May '18

02 May '18

commit 6d4dc3e0fc543ac39393ab474409406ad9552b96 Author: Benjamin Bouvier <benj(a)benj.me> Date: Fri Mar 31 11:01:35 2017 +0200 Bug 1352073 - Fix off-by-one in Vector::insert. r=luke, a=lizzard MozReview-Commit-ID: HY0DYSAbi6M --- mfbt/Vector.h | 4 ++-- mfbt/tests/TestVector.cpp | 52 +++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 54 insertions(+), 2 deletions(-) diff --git a/mfbt/Vector.h b/mfbt/Vector.h index fc43afcf163e..07e370426492 100644 --- a/mfbt/Vector.h +++ b/mfbt/Vector.h @@ -1232,10 +1232,10 @@ Vector<T, N, AP>::insert(T* aP, U&& aVal) } } else { T oldBack = Move(back()); - if (!append(Move(oldBack))) { /* Dup the last element. */ + if (!append(Move(oldBack))) { return nullptr; } - for (size_t i = oldLength; i > pos; --i) { + for (size_t i = oldLength - 1; i > pos; --i) { (*this)[i] = Move((*this)[i - 1]); } (*this)[pos] = Forward<U>(aVal); diff --git a/mfbt/tests/TestVector.cpp b/mfbt/tests/TestVector.cpp index d969bcbc2ceb..e28b432d6919 100644 --- a/mfbt/tests/TestVector.cpp +++ b/mfbt/tests/TestVector.cpp @@ -22,6 +22,7 @@ struct mozilla::detail::VectorTesting static void testReverse(); static void testExtractRawBuffer(); static void testExtractOrCopyRawBuffer(); + static void testInsert(); }; void @@ -141,6 +142,15 @@ struct S destructCount++; } + S& operator=(S&& rhs) { + j = rhs.j; + rhs.j = 0; + k = Move(rhs.k); + rhs.k.reset(); + moveCount++; + return *this; + } + S(const S&) = delete; S& operator=(const S&) = delete; }; @@ -346,6 +356,47 @@ mozilla::detail::VectorTesting::testExtractOrCopyRawBuffer() free(buf); } +void +mozilla::detail::VectorTesting::testInsert() +{ + S::resetCounts(); + + Vector<S, 8> vec; + MOZ_RELEASE_ASSERT(vec.reserve(8)); + for (size_t i = 0; i < 7; i++) { + vec.infallibleEmplaceBack(i, i * i); + } + + MOZ_RELEASE_ASSERT(vec.length() == 7); + MOZ_ASSERT(vec.reserved() == 8); + MOZ_RELEASE_ASSERT(S::constructCount == 7); + MOZ_RELEASE_ASSERT(S::moveCount == 0); + MOZ_RELEASE_ASSERT(S::destructCount == 0); + + S s(42, 43); + MOZ_RELEASE_ASSERT(vec.insert(vec.begin() + 4, Move(s))); + + for (size_t i = 0; i < vec.length(); i++) { + const S& s = vec[i]; + MOZ_RELEASE_ASSERT(s.k); + if (i < 4) { + MOZ_RELEASE_ASSERT(s.j == i && *s.k == i * i); + } else if (i == 4) { + MOZ_RELEASE_ASSERT(s.j == 42 && *s.k == 43); + } else { + MOZ_RELEASE_ASSERT(s.j == i - 1 && *s.k == (i - 1) * (i - 1)); + } + } + + MOZ_RELEASE_ASSERT(vec.length() == 8); + MOZ_ASSERT(vec.reserved() == 8); + MOZ_RELEASE_ASSERT(S::constructCount == 8); + MOZ_RELEASE_ASSERT(S::moveCount == 1 /* move in insert() call */ + + 1 /* move the back() element */ + + 3 /* elements to shift */); + MOZ_RELEASE_ASSERT(S::destructCount == 1); +} + int main() { @@ -355,4 +406,5 @@ main() VectorTesting::testReverse(); VectorTesting::testExtractRawBuffer(); VectorTesting::testExtractOrCopyRawBuffer(); + VectorTesting::testInsert(); }

1 0

[tor-launcher/master] Bug 25807: Change front domain to unbreak Moat
by gk＠torproject.org 30 Apr '18

30 Apr '18

commit add227697f9af12056ca26f6e510572cd9c5faef Author: Georg Koppen <gk(a)torproject.org> Date: Thu Apr 26 07:00:10 2018 +0000 Bug 25807: Change front domain to unbreak Moat Google forbids to use www.google.com as front domain now, breaking Moat. We change that domain to dontbeevil.appspot.com which seems still to be working. That's only a stopgap solution, though, to get Moat unblocked for now. --- src/defaults/preferences/prefs.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/defaults/preferences/prefs.js b/src/defaults/preferences/prefs.js index cab235a..938e1b8 100644 --- a/src/defaults/preferences/prefs.js +++ b/src/defaults/preferences/prefs.js @@ -46,7 +46,7 @@ pref("extensions.torlauncher.torrc_path", ""); pref("extensions.torlauncher.tordatadir_path", ""); // BridgeDB-related preferences (used for Moat). -pref("extensions.torlauncher.bridgedb_front", "www.google.com"); +pref("extensions.torlauncher.bridgedb_front", "dontbeevil.appspot.com"); pref("extensions.torlauncher.bridgedb_reflector", "https://tor-bridges-hyphae-channel.appspot.com"); pref("extensions.torlauncher.moat_service", "https://bridges.torproject.org/moat"); pref("extensions.torlauncher.bridgedb_bridge_type", "obfs4");

1 0

[tor-browser/tor-browser-52.7.3esr-8.0-1] Bug 1334776 - Store header names into nsHttpHeaderArray. r=mcmanus
by gk＠torproject.org 30 Apr '18

30 Apr '18

commit f2829fa4eaf3756863dd524562055c1d7a221df7 Author: Dragana Damjanovic <dd.mozilla(a)gmail.com> Date: Thu Apr 27 16:48:36 2017 +0200 Bug 1334776 - Store header names into nsHttpHeaderArray. r=mcmanus Backported to TBB/ESR52 by Arthur Edelstein <arthuredelstein(a)gmail.com> --- dom/security/test/cors/test_CrossSiteXHR.html | 2 +- netwerk/protocol/http/HttpBaseChannel.cpp | 18 +--- netwerk/protocol/http/PHttpChannelParams.h | 15 +++- netwerk/protocol/http/nsHttpHeaderArray.cpp | 100 +++++++++++++++++---- netwerk/protocol/http/nsHttpHeaderArray.h | 36 ++++++-- netwerk/protocol/http/nsHttpRequestHead.cpp | 23 ++++- netwerk/protocol/http/nsHttpRequestHead.h | 4 +- netwerk/protocol/http/nsHttpResponseHead.cpp | 50 ++++++++--- netwerk/protocol/http/nsHttpResponseHead.h | 6 +- netwerk/test/unit/test_bug1064258.js | 2 +- .../test/unit/test_original_sent_received_head.js | 14 +-- 11 files changed, 204 insertions(+), 66 deletions(-) diff --git a/dom/security/test/cors/test_CrossSiteXHR.html b/dom/security/test/cors/test_CrossSiteXHR.html index b3cda3b871f3..d9aef5c60cd0 100644 --- a/dom/security/test/cors/test_CrossSiteXHR.html +++ b/dom/security/test/cors/test_CrossSiteXHR.html @@ -743,7 +743,7 @@ function runTest() { is(res.responseHeaders[header], test.responseHeaders[header], "|xhr.getResponseHeader()|wrong response header (" + header + ") in test for " + test.toSource()); - is(res.allResponseHeaders[header], test.responseHeaders[header], + is(res.allResponseHeaders[header.toLowerCase()], test.responseHeaders[header], "|xhr.getAllResponseHeaderss()|wrong response header (" + header + ") in test for " + test.toSource()); } diff --git a/netwerk/protocol/http/HttpBaseChannel.cpp b/netwerk/protocol/http/HttpBaseChannel.cpp index e68bff1d115e..97120b97a5d3 100644 --- a/netwerk/protocol/http/HttpBaseChannel.cpp +++ b/netwerk/protocol/http/HttpBaseChannel.cpp @@ -1678,13 +1678,7 @@ HttpBaseChannel::SetRequestHeader(const nsACString& aHeader, return NS_ERROR_INVALID_ARG; } - nsHttpAtom atom = nsHttp::ResolveAtom(flatHeader.get()); - if (!atom) { - NS_WARNING("failed to resolve atom"); - return NS_ERROR_NOT_AVAILABLE; - } - - return mRequestHead.SetHeader(atom, flatValue, aMerge); + return mRequestHead.SetHeader(aHeader, flatValue, aMerge); } NS_IMETHODIMP @@ -1701,13 +1695,7 @@ HttpBaseChannel::SetEmptyRequestHeader(const nsACString& aHeader) return NS_ERROR_INVALID_ARG; } - nsHttpAtom atom = nsHttp::ResolveAtom(flatHeader.get()); - if (!atom) { - NS_WARNING("failed to resolve atom"); - return NS_ERROR_NOT_AVAILABLE; - } - - return mRequestHead.SetEmptyHeader(atom); + return mRequestHead.SetEmptyHeader(aHeader); } NS_IMETHODIMP @@ -1763,7 +1751,7 @@ HttpBaseChannel::SetResponseHeader(const nsACString& header, mResponseHeadersModified = true; - return mResponseHead->SetHeader(atom, value, merge); + return mResponseHead->SetHeader(header, value, merge); } NS_IMETHODIMP diff --git a/netwerk/protocol/http/PHttpChannelParams.h b/netwerk/protocol/http/PHttpChannelParams.h index 4df5c7832ee8..b04f57306c58 100644 --- a/netwerk/protocol/http/PHttpChannelParams.h +++ b/netwerk/protocol/http/PHttpChannelParams.h @@ -98,7 +98,11 @@ struct ParamTraits<mozilla::net::nsHttpHeaderArray::nsEntry> static void Write(Message* aMsg, const paramType& aParam) { - WriteParam(aMsg, aParam.header); + if (aParam.headerNameOriginal.IsEmpty()) { + WriteParam(aMsg, aParam.header); + } else { + WriteParam(aMsg, aParam.headerNameOriginal); + } WriteParam(aMsg, aParam.value); switch (aParam.variety) { case mozilla::net::nsHttpHeaderArray::eVarietyUnknown: @@ -124,11 +128,18 @@ struct ParamTraits<mozilla::net::nsHttpHeaderArray::nsEntry> static bool Read(const Message* aMsg, PickleIterator* aIter, paramType* aResult) { uint8_t variety; - if (!ReadParam(aMsg, aIter, &aResult->header) || + nsAutoCString header; + if (!ReadParam(aMsg, aIter, &header) || !ReadParam(aMsg, aIter, &aResult->value) || !ReadParam(aMsg, aIter, &variety)) return false; + mozilla::net::nsHttpAtom atom = mozilla::net::nsHttp::ResolveAtom(header); + aResult->header = atom; + if (!header.Equals(atom.get())) { + aResult->headerNameOriginal = header; + } + switch (variety) { case 0: aResult->variety = mozilla::net::nsHttpHeaderArray::eVarietyUnknown; diff --git a/netwerk/protocol/http/nsHttpHeaderArray.cpp b/netwerk/protocol/http/nsHttpHeaderArray.cpp index 670300dea50b..98c5a6b9ba47 100644 --- a/netwerk/protocol/http/nsHttpHeaderArray.cpp +++ b/netwerk/protocol/http/nsHttpHeaderArray.cpp @@ -18,8 +18,33 @@ namespace net { //----------------------------------------------------------------------------- // nsHttpHeaderArray <public> //----------------------------------------------------------------------------- + +nsresult +nsHttpHeaderArray::SetHeader(const nsACString &headerName, + const nsACString &value, + bool merge, + nsHttpHeaderArray::HeaderVariety variety) +{ + nsHttpAtom header = nsHttp::ResolveAtom(PromiseFlatCString(headerName).get()); + if (!header) { + NS_WARNING("failed to resolve atom"); + return NS_ERROR_NOT_AVAILABLE; + } + return SetHeader(header, headerName, value, merge, variety); +} + +nsresult +nsHttpHeaderArray::SetHeader(nsHttpAtom header, + const nsACString &value, + bool merge, + nsHttpHeaderArray::HeaderVariety variety) +{ + return SetHeader(header, EmptyCString(), value, merge, variety); +} + nsresult nsHttpHeaderArray::SetHeader(nsHttpAtom header, + const nsACString &headerName, const nsACString &value, bool merge, nsHttpHeaderArray::HeaderVariety variety) @@ -51,7 +76,7 @@ nsHttpHeaderArray::SetHeader(nsHttpAtom header, MOZ_ASSERT(!entry || variety != eVarietyRequestDefault, "Cannot set default entry which overrides existing entry!"); if (!entry) { - return SetHeader_internal(header, value, variety); + return SetHeader_internal(header, headerName, value, variety); } else if (merge && !IsSingletonHeader(header)) { return MergeHeader(header, entry, value, variety); } else { @@ -59,7 +84,7 @@ nsHttpHeaderArray::SetHeader(nsHttpAtom header, if (entry->variety == eVarietyResponseNetOriginalAndResponse) { MOZ_ASSERT(variety == eVarietyResponse); entry->variety = eVarietyResponseNetOriginal; - return SetHeader_internal(header, value, variety); + return SetHeader_internal(header, headerName, value, variety); } else { entry->value = value; entry->variety = variety; @@ -71,6 +96,7 @@ nsHttpHeaderArray::SetHeader(nsHttpAtom header, nsresult nsHttpHeaderArray::SetHeader_internal(nsHttpAtom header, + const nsACString &headerName, const nsACString &value, nsHttpHeaderArray::HeaderVariety variety) { @@ -79,14 +105,26 @@ nsHttpHeaderArray::SetHeader_internal(nsHttpAtom header, return NS_ERROR_OUT_OF_MEMORY; } entry->header = header; + // Only save original form of a header if it is different than the header + // atom string. + if (!headerName.Equals(header.get())) { + entry->headerNameOriginal = headerName; + } entry->value = value; entry->variety = variety; return NS_OK; } nsresult -nsHttpHeaderArray::SetEmptyHeader(nsHttpAtom header, HeaderVariety variety) +nsHttpHeaderArray::SetEmptyHeader(const nsACString &headerName, + HeaderVariety variety) { + nsHttpAtom header = nsHttp::ResolveAtom(PromiseFlatCString(headerName).get()); + if (!header) { + NS_WARNING("failed to resolve atom"); + return NS_ERROR_NOT_AVAILABLE; + } + MOZ_ASSERT((variety == eVarietyResponse) || (variety == eVarietyRequestDefault) || (variety == eVarietyRequestOverride), @@ -104,11 +142,12 @@ nsHttpHeaderArray::SetEmptyHeader(nsHttpAtom header, HeaderVariety variety) entry->variety = eVarietyResponseNetOriginal; } - return SetHeader_internal(header, EmptyCString(), variety); + return SetHeader_internal(header, headerName, EmptyCString(), variety); } nsresult nsHttpHeaderArray::SetHeaderFromNet(nsHttpAtom header, + const nsACString &headerNameOriginal, const nsACString &value, bool response) { @@ -125,7 +164,7 @@ nsHttpHeaderArray::SetHeaderFromNet(nsHttpAtom header, LOG(("Ignoring Empty Header: %s\n", header.get())); if (response) { // Set header as original but not as response header. - return SetHeader_internal(header, value, + return SetHeader_internal(header, headerNameOriginal, value, eVarietyResponseNetOriginal); } return NS_OK; // ignore empty headers by default @@ -135,7 +174,7 @@ nsHttpHeaderArray::SetHeaderFromNet(nsHttpAtom header, if (response) { variety = eVarietyResponseNetOriginalAndResponse; } - return SetHeader_internal(header, value, variety); + return SetHeader_internal(header, headerNameOriginal, value, variety); } else if (!IsSingletonHeader(header)) { HeaderVariety variety = eVarietyRequestOverride; @@ -147,7 +186,7 @@ nsHttpHeaderArray::SetHeaderFromNet(nsHttpAtom header, return rv; } if (response) { - rv = SetHeader_internal(header, value, + rv = SetHeader_internal(header, headerNameOriginal, value, eVarietyResponseNetOriginal); } return rv; @@ -164,7 +203,7 @@ nsHttpHeaderArray::SetHeaderFromNet(nsHttpAtom header, } if (response) { - return SetHeader_internal(header, value, + return SetHeader_internal(header, headerNameOriginal, value, eVarietyResponseNetOriginal); } } @@ -174,6 +213,7 @@ nsHttpHeaderArray::SetHeaderFromNet(nsHttpAtom header, nsresult nsHttpHeaderArray::SetResponseHeaderFromCache(nsHttpAtom header, + const nsACString &headerNameOriginal, const nsACString &value, nsHttpHeaderArray::HeaderVariety variety) { @@ -183,7 +223,7 @@ nsHttpHeaderArray::SetResponseHeaderFromCache(nsHttpAtom header, "eVarietyResponseNetOriginal"); if (variety == eVarietyResponseNetOriginal) { - return SetHeader_internal(header, value, + return SetHeader_internal(header, headerNameOriginal, value, eVarietyResponseNetOriginal); } else { nsTArray<nsEntry>::index_type index = 0; @@ -203,7 +243,8 @@ nsHttpHeaderArray::SetResponseHeaderFromCache(nsHttpAtom header, } } while (index != mHeaders.NoIndex); // If we are here, we have not found an entry so add a new one. - return SetHeader_internal(header, value, eVarietyResponse); + return SetHeader_internal(header, headerNameOriginal, value, + eVarietyResponse); } } @@ -260,8 +301,16 @@ nsHttpHeaderArray::GetOriginalHeader(nsHttpAtom aHeader, if (entry.variety == eVarietyResponse) { continue; } + + nsAutoCString hdr; + if (entry.headerNameOriginal.IsEmpty()) { + hdr = nsDependentCString(entry.header); + } else { + hdr = entry.headerNameOriginal; + } + rv = NS_OK; - if (NS_FAILED(aVisitor->VisitHeader(nsDependentCString(entry.header), + if (NS_FAILED(aVisitor->VisitHeader(hdr, entry.value))) { break; } @@ -298,8 +347,14 @@ nsHttpHeaderArray::VisitHeaders(nsIHttpHeaderVisitor *visitor, nsHttpHeaderArray } else if (filter == eFilterResponseOriginal && entry.variety == eVarietyResponse) { continue; } - rv = visitor->VisitHeader( - nsDependentCString(entry.header), entry.value); + + nsAutoCString hdr; + if (entry.headerNameOriginal.IsEmpty()) { + hdr = nsDependentCString(entry.header); + } else { + hdr = entry.headerNameOriginal; + } + rv = visitor->VisitHeader(hdr, entry.value); if NS_FAILED(rv) { return rv; } @@ -310,6 +365,7 @@ nsHttpHeaderArray::VisitHeaders(nsIHttpHeaderVisitor *visitor, nsHttpHeaderArray /*static*/ nsresult nsHttpHeaderArray::ParseHeaderLine(const nsACString& line, nsHttpAtom *hdr, + nsACString *headerName, nsACString *val) { // @@ -360,6 +416,7 @@ nsHttpHeaderArray::ParseHeaderLine(const nsACString& line, // assign return values if (hdr) *hdr = atom; if (val) val->Assign(p, p2 - p + 1); + if (headerName) headerName->Assign(sub); return NS_OK; } @@ -397,7 +454,11 @@ nsHttpHeaderArray::Flatten(nsACString &buf, bool pruneProxyHeaders, continue; } - buf.Append(entry.header); + if (entry.headerNameOriginal.IsEmpty()) { + buf.Append(entry.header); + } else { + buf.Append(entry.headerNameOriginal); + } buf.AppendLiteral(": "); buf.Append(entry.value); buf.AppendLiteral("\r\n"); @@ -415,7 +476,12 @@ nsHttpHeaderArray::FlattenOriginalHeader(nsACString &buf) continue; } - buf.Append(entry.header); + if (entry.headerNameOriginal.IsEmpty()) { + buf.Append(entry.header); + } else { + buf.Append(entry.headerNameOriginal); + } + buf.AppendLiteral(": "); buf.Append(entry.value); buf.AppendLiteral("\r\n"); @@ -423,11 +489,13 @@ nsHttpHeaderArray::FlattenOriginalHeader(nsACString &buf) } const char * -nsHttpHeaderArray::PeekHeaderAt(uint32_t index, nsHttpAtom &header) const +nsHttpHeaderArray::PeekHeaderAt(uint32_t index, nsHttpAtom &header, + nsACString &headerNameOriginal) const { const nsEntry &entry = mHeaders[index]; header = entry.header; + headerNameOriginal = entry.headerNameOriginal; return entry.value.get(); } diff --git a/netwerk/protocol/http/nsHttpHeaderArray.h b/netwerk/protocol/http/nsHttpHeaderArray.h index 91b91f04aa1c..4c4b92911a5d 100644 --- a/netwerk/protocol/http/nsHttpHeaderArray.h +++ b/netwerk/protocol/http/nsHttpHeaderArray.h @@ -49,19 +49,30 @@ public: }; // Used by internal setters: to set header from network use SetHeaderFromNet + nsresult SetHeader(const nsACString &headerName, + const nsACString &value, + bool merge, HeaderVariety variety); nsresult SetHeader(nsHttpAtom header, const nsACString &value, bool merge, HeaderVariety variety); + nsresult SetHeader(nsHttpAtom header, + const nsACString &headerName, + const nsACString &value, + bool merge, HeaderVariety variety); // Used by internal setters to set an empty header - nsresult SetEmptyHeader(nsHttpAtom header, HeaderVariety variety); + nsresult SetEmptyHeader(const nsACString &headerName, HeaderVariety variety); // Merges supported headers. For other duplicate values, determines if error // needs to be thrown or 1st value kept. // For the response header we keep the original headers as well. - nsresult SetHeaderFromNet(nsHttpAtom header, const nsACString &value, + nsresult SetHeaderFromNet(nsHttpAtom header, + const nsACString &headerNameOriginal, + const nsACString &value, bool response); - nsresult SetResponseHeaderFromCache(nsHttpAtom header, const nsACString &value, + nsresult SetResponseHeaderFromCache(nsHttpAtom header, + const nsACString &headerNameOriginal, + const nsACString &value, HeaderVariety variety); nsresult GetHeader(nsHttpAtom header, nsACString &value) const; @@ -97,15 +108,17 @@ public: // parse a header line, return the header atom and a pointer to the // header value (the substring of the header line -- do not free). static nsresult ParseHeaderLine(const nsACString& line, - nsHttpAtom *header=nullptr, - nsACString* value=nullptr); + nsHttpAtom *header = nullptr, + nsACString *headerNameOriginal = nullptr, + nsACString* value = nullptr); void Flatten(nsACString &, bool pruneProxyHeaders, bool pruneTransients); void FlattenOriginalHeader(nsACString &); uint32_t Count() const { return mHeaders.Length(); } - const char *PeekHeaderAt(uint32_t i, nsHttpAtom &header) const; + const char *PeekHeaderAt(uint32_t i, nsHttpAtom &header, + nsACString &headerNameOriginal) const; void Clear(); @@ -113,6 +126,7 @@ public: struct nsEntry { nsHttpAtom header; + nsCString headerNameOriginal; nsCString value; HeaderVariety variety = eVarietyUnknown; @@ -140,7 +154,9 @@ private: int32_t LookupEntry(nsHttpAtom header, nsEntry **); nsresult MergeHeader(nsHttpAtom header, nsEntry *entry, const nsACString &value, HeaderVariety variety); - nsresult SetHeader_internal(nsHttpAtom header, const nsACString &value, + nsresult SetHeader_internal(nsHttpAtom header, + const nsACString &headerName, + const nsACString &value, HeaderVariety variety); // Header cannot be merged: only one value possible @@ -257,7 +273,11 @@ nsHttpHeaderArray::MergeHeader(nsHttpAtom header, if (entry->variety == eVarietyResponseNetOriginalAndResponse) { MOZ_ASSERT(variety == eVarietyResponse); entry->variety = eVarietyResponseNetOriginal; - nsresult rv = SetHeader_internal(header, newValue, eVarietyResponse); + // Copy entry->headerNameOriginal because in SetHeader_internal we are going + // to a new one and a realocation can happen. + nsCString headerNameOriginal = entry->headerNameOriginal; + nsresult rv = SetHeader_internal(header, headerNameOriginal, + newValue, eVarietyResponse); if (NS_FAILED(rv)) { return rv; } diff --git a/netwerk/protocol/http/nsHttpRequestHead.cpp b/netwerk/protocol/http/nsHttpRequestHead.cpp index 094a79457094..b366a8d54264 100644 --- a/netwerk/protocol/http/nsHttpRequestHead.cpp +++ b/netwerk/protocol/http/nsHttpRequestHead.cpp @@ -131,6 +131,20 @@ nsHttpRequestHead::Origin(nsACString &aOrigin) } nsresult +nsHttpRequestHead::SetHeader(const nsACString &h, const nsACString &v, + bool m /*= false*/) +{ + ReentrantMonitorAutoEnter mon(mReentrantMonitor); + + if (mInVisitHeaders) { + return NS_ERROR_FAILURE; + } + + return mHeaders.SetHeader(h, v, m, + nsHttpHeaderArray::eVarietyRequestOverride); +} + +nsresult nsHttpRequestHead::SetHeader(nsHttpAtom h, const nsACString &v, bool m /*= false*/) { @@ -158,7 +172,7 @@ nsHttpRequestHead::SetHeader(nsHttpAtom h, const nsACString &v, bool m, } nsresult -nsHttpRequestHead::SetEmptyHeader(nsHttpAtom h) +nsHttpRequestHead::SetEmptyHeader(const nsACString &h) { ReentrantMonitorAutoEnter mon(mReentrantMonitor); @@ -253,6 +267,7 @@ nsHttpRequestHead::ParseHeaderSet(const char *buffer) { ReentrantMonitorAutoEnter mon(mReentrantMonitor); nsHttpAtom hdr; + nsAutoCString headerNameOriginal; nsAutoCString val; while (buffer) { const char *eof = strchr(buffer, '\r'); @@ -262,9 +277,13 @@ nsHttpRequestHead::ParseHeaderSet(const char *buffer) if (NS_SUCCEEDED(nsHttpHeaderArray::ParseHeaderLine( nsDependentCSubstring(buffer, eof - buffer), &hdr, + &headerNameOriginal, &val))) { - mHeaders.SetHeaderFromNet(hdr, val, false); + mHeaders.SetHeaderFromNet(hdr, + headerNameOriginal, + val, + false); } buffer = eof + 1; if (*buffer == '\n') { diff --git a/netwerk/protocol/http/nsHttpRequestHead.h b/netwerk/protocol/http/nsHttpRequestHead.h index 415968083477..b7020d33a0ac 100644 --- a/netwerk/protocol/http/nsHttpRequestHead.h +++ b/netwerk/protocol/http/nsHttpRequestHead.h @@ -57,10 +57,12 @@ public: int32_t port); void Origin(nsACString &aOrigin); + nsresult SetHeader(const nsACString &h, const nsACString &v, + bool m=false); nsresult SetHeader(nsHttpAtom h, const nsACString &v, bool m=false); nsresult SetHeader(nsHttpAtom h, const nsACString &v, bool m, nsHttpHeaderArray::HeaderVariety variety); - nsresult SetEmptyHeader(nsHttpAtom h); + nsresult SetEmptyHeader(const nsACString &h); nsresult GetHeader(nsHttpAtom h, nsACString &v); nsresult ClearHeader(nsHttpAtom h); diff --git a/netwerk/protocol/http/nsHttpResponseHead.cpp b/netwerk/protocol/http/nsHttpResponseHead.cpp index 6d384c48872e..fa6430b8231f 100644 --- a/netwerk/protocol/http/nsHttpResponseHead.cpp +++ b/netwerk/protocol/http/nsHttpResponseHead.cpp @@ -137,6 +137,26 @@ nsHttpResponseHead::Immutable() } nsresult +nsHttpResponseHead::SetHeader(const nsACString &hdr, + const nsACString &val, + bool merge) +{ + ReentrantMonitorAutoEnter monitor(mReentrantMonitor); + + if (mInVisitHeaders) { + return NS_ERROR_FAILURE; + } + + nsHttpAtom atom = nsHttp::ResolveAtom(PromiseFlatCString(hdr).get()); + if (!atom) { + NS_WARNING("failed to resolve atom"); + return NS_ERROR_NOT_AVAILABLE; + } + + return SetHeader_locked(atom, hdr, val, merge); +} + +nsresult nsHttpResponseHead::SetHeader(nsHttpAtom hdr, const nsACString &val, bool merge) @@ -147,24 +167,25 @@ nsHttpResponseHead::SetHeader(nsHttpAtom hdr, return NS_ERROR_FAILURE; } - return SetHeader_locked(hdr, val, merge); + return SetHeader_locked(hdr, EmptyCString(), val, merge); } nsresult -nsHttpResponseHead::SetHeader_locked(nsHttpAtom hdr, +nsHttpResponseHead::SetHeader_locked(nsHttpAtom atom, + const nsACString &hdr, const nsACString &val, bool merge) { - nsresult rv = mHeaders.SetHeader(hdr, val, merge, + nsresult rv = mHeaders.SetHeader(atom, hdr, val, merge, nsHttpHeaderArray::eVarietyResponse); if (NS_FAILED(rv)) return rv; // respond to changes in these headers. we need to reparse the entire // header since the change may have merged in additional values. - if (hdr == nsHttp::Cache_Control) - ParseCacheControl(mHeaders.PeekHeader(hdr)); - else if (hdr == nsHttp::Pragma) - ParsePragma(mHeaders.PeekHeader(hdr)); + if (atom == nsHttp::Cache_Control) + ParseCacheControl(mHeaders.PeekHeader(atom)); + else if (atom == nsHttp::Pragma) + ParsePragma(mHeaders.PeekHeader(atom)); return NS_OK; } @@ -316,6 +337,7 @@ nsHttpResponseHead::ParseCachedOriginalHeaders(char *block) char *p = block; nsHttpAtom hdr = {0}; + nsAutoCString headerNameOriginal; nsAutoCString val; nsresult rv; @@ -331,12 +353,13 @@ nsHttpResponseHead::ParseCachedOriginalHeaders(char *block) *p = 0; if (NS_FAILED(nsHttpHeaderArray::ParseHeaderLine( - nsDependentCString(block, p - block), &hdr, &val))) { + nsDependentCString(block, p - block), &hdr, &headerNameOriginal, &val))) { return NS_OK; } rv = mHeaders.SetResponseHeaderFromCache(hdr, + headerNameOriginal, val, nsHttpHeaderArray::eVarietyResponseNetOriginal); @@ -567,18 +590,21 @@ nsresult nsHttpResponseHead::ParseHeaderLine_locked(const nsACString &line, bool originalFromNetHeaders) { nsHttpAtom hdr = {0}; + nsAutoCString headerNameOriginal; nsAutoCString val; - if (NS_FAILED(nsHttpHeaderArray::ParseHeaderLine(line, &hdr, &val))) { + if (NS_FAILED(nsHttpHeaderArray::ParseHeaderLine(line, &hdr, &headerNameOriginal, &val))) { return NS_OK; } nsresult rv; if (originalFromNetHeaders) { rv = mHeaders.SetHeaderFromNet(hdr, + headerNameOriginal, val, true); } else { rv = mHeaders.SetResponseHeaderFromCache(hdr, + headerNameOriginal, val, nsHttpHeaderArray::eVarietyResponse); } @@ -856,7 +882,8 @@ nsHttpResponseHead::UpdateHeaders(nsHttpResponseHead *aOther) uint32_t i, count = aOther->mHeaders.Count(); for (i=0; i<count; ++i) { nsHttpAtom header; - const char *val = aOther->mHeaders.PeekHeaderAt(i, header); + nsAutoCString headerNameOriginal; + const char *val = aOther->mHeaders.PeekHeaderAt(i, header, headerNameOriginal); if (!val) { continue; @@ -890,7 +917,8 @@ nsHttpResponseHead::UpdateHeaders(nsHttpResponseHead *aOther) LOG(("new response header [%s: %s]\n", header.get(), val)); // overwrite the current header value with the new value... - SetHeader_locked(header, nsDependentCString(val)); + SetHeader_locked(header, headerNameOriginal, + nsDependentCString(val)); } } diff --git a/netwerk/protocol/http/nsHttpResponseHead.h b/netwerk/protocol/http/nsHttpResponseHead.h index 0a912f4b403b..8b51386ea229 100644 --- a/netwerk/protocol/http/nsHttpResponseHead.h +++ b/netwerk/protocol/http/nsHttpResponseHead.h @@ -65,6 +65,8 @@ public: */ int64_t TotalEntitySize(); + nsresult SetHeader(const nsACString &h, const nsACString &v, + bool m=false); nsresult SetHeader(nsHttpAtom h, const nsACString &v, bool m=false); nsresult GetHeader(nsHttpAtom h, nsACString &v); void ClearHeader(nsHttpAtom h); @@ -137,8 +139,8 @@ public: bool HasContentType(); bool HasContentCharset(); private: - nsresult SetHeader_locked(nsHttpAtom h, const nsACString &v, - bool m=false); + nsresult SetHeader_locked(nsHttpAtom atom, const nsACString &h, + const nsACString &v, bool m=false); void AssignDefaultStatusText(); void ParseVersion(const char *); void ParseCacheControl(const char *); diff --git a/netwerk/test/unit/test_bug1064258.js b/netwerk/test/unit/test_bug1064258.js index 3f76837ae935..da982c2d6f07 100644 --- a/netwerk/test/unit/test_bug1064258.js +++ b/netwerk/test/unit/test_bug1064258.js @@ -133,7 +133,7 @@ function cacheCheck2(status, entry) do_check_eq(entry.dataSize, 0); try { do_check_neq(entry.getMetaDataElement("response-head"), null); - do_check_true(entry.getMetaDataElement("response-head").match('Etag: testetag')); + do_check_true(entry.getMetaDataElement("response-head").match('etag: testetag')); } catch (ex) { do_throw("Missing response head"); diff --git a/netwerk/test/unit/test_original_sent_received_head.js b/netwerk/test/unit/test_original_sent_received_head.js index c4d02d5d2299..eab359a108ae 100644 --- a/netwerk/test/unit/test_original_sent_received_head.js +++ b/netwerk/test/unit/test_original_sent_received_head.js @@ -114,11 +114,11 @@ function checkResponse(request, data, context) { var locationHeaderFound = 0; request.visitResponseHeaders({ visitHeader: function visit(aName, aValue) { - if (aName == "Link") { + if (aName == "link") { linkHeaderFound++; do_check_eq(aValue, "value1, value2"); } - if (aName == "Location") { + if (aName == "location") { locationHeaderFound++; do_check_eq(aValue, "loc"); } @@ -132,7 +132,7 @@ function checkResponse(request, data, context) { var locationOrgHeaderFound = 0; request.visitOriginalResponseHeaders({ visitHeader: function visitOrg(aName, aValue) { - if (aName == "Link") { + if (aName == "link") { if (linkOrgHeaderFound == 0) { do_check_eq(aValue, ""); } else if (linkOrgHeaderFound == 1 ) { @@ -142,7 +142,7 @@ function checkResponse(request, data, context) { } linkOrgHeaderFound++; } - if (aName == "Location") { + if (aName == "location") { locationOrgHeaderFound++; do_check_eq(aValue, "loc"); } @@ -176,7 +176,7 @@ function checkResponse(request, data, context) { var locationOrgHeaderFound2 = 0; request.visitOriginalResponseHeaders({ visitHeader: function visitOrg(aName, aValue) { - if (aName == "Link") { + if (aName == "link") { if (linkOrgHeaderFound2 == 0) { do_check_eq(aValue, ""); } else if (linkOrgHeaderFound2 == 1 ) { @@ -186,7 +186,7 @@ function checkResponse(request, data, context) { } linkOrgHeaderFound2++; } - if (aName == "Location") { + if (aName == "location") { locationOrgHeaderFound2++; do_check_eq(aValue, "loc"); } @@ -199,7 +199,7 @@ function checkResponse(request, data, context) { if (dbg) { print("============== Test GetResponseHeader"); } var linkOrgHeaderFound3 = 0; - request.getOriginalResponseHeader("Link",{ + request.getOriginalResponseHeader("link",{ visitHeader: function visitOrg(aName, aValue) { if (linkOrgHeaderFound3 == 0) { do_check_eq(aValue, "");

1 0

[tor-browser/tor-browser-52.7.3esr-8.0-1] Bug 1334776 - ResponseHeader Visitor will get original header casing. We need to fix it at some places in devtools.
by gk＠torproject.org 30 Apr '18

30 Apr '18

commit b238251db34180e957c0807e8e8adbd9e086cf11 Author: Dragana Damjanovic <dd.mozilla(a)gmail.com> Date: Thu Apr 27 16:48:43 2017 +0200 Bug 1334776 - ResponseHeader Visitor will get original header casing. We need to fix it at some places in devtools. Backported to TBB/ESR52 by Arthur Edelstein <arthuredelstein(a)gmail.com> Fixes bug 25938. --- devtools/client/netmonitor/filter-predicates.js | 4 ++-- .../client/netmonitor/test/browser_net_copy_headers.js | 16 ++++++++-------- devtools/client/netmonitor/test/browser_net_filter-01.js | 4 ++-- .../netmonitor/test/browser_net_timing-division.js | 4 ++-- devtools/client/shared/AppCacheUtils.jsm | 8 ++++---- devtools/client/shared/curl.js | 8 ++++---- .../webconsole/net/test/mochitest/browser_net_headers.js | 4 ++-- ...er_webconsole_bug_630733_response_redirect_headers.js | 2 +- devtools/shared/webconsole/test/test_network_get.html | 8 ++++---- .../shared/webconsole/test/test_network_longstring.html | 4 ++-- devtools/shared/webconsole/test/test_network_post.html | 8 ++++---- 11 files changed, 35 insertions(+), 35 deletions(-) diff --git a/devtools/client/netmonitor/filter-predicates.js b/devtools/client/netmonitor/filter-predicates.js index 9c8e49c622b2..75ee422aad60 100644 --- a/devtools/client/netmonitor/filter-predicates.js +++ b/devtools/client/netmonitor/filter-predicates.js @@ -72,7 +72,7 @@ function isWS({ requestHeaders, responseHeaders }) { // Find the 'upgrade' header. let upgradeHeader = requestHeaders.headers.find(header => { - return (header.name == "Upgrade"); + return (header.name.toLowerCase() == "upgrade"); }); // If no header found on request, check response - mainly to get @@ -81,7 +81,7 @@ function isWS({ requestHeaders, responseHeaders }) { if (!upgradeHeader && responseHeaders && Array.isArray(responseHeaders.headers)) { upgradeHeader = responseHeaders.headers.find(header => { - return (header.name == "Upgrade"); + return (header.name.toLowerCase() == "upgrade"); }); } diff --git a/devtools/client/netmonitor/test/browser_net_copy_headers.js b/devtools/client/netmonitor/test/browser_net_copy_headers.js index 36ce2fb34789..bb582c8e1359 100644 --- a/devtools/client/netmonitor/test/browser_net_copy_headers.js +++ b/devtools/client/netmonitor/test/browser_net_copy_headers.js @@ -49,12 +49,12 @@ add_task(function* () { const EXPECTED_RESPONSE_HEADERS = [ `${httpVersion} ${status} ${statusText}`, - "Last-Modified: Sun, 3 May 2015 11:11:11 GMT", - "Content-Type: text/html", - "Content-Length: 465", - "Connection: close", - "Server: httpd.js", - "Date: Sun, 3 May 2015 11:11:11 GMT" + "last-modified: Sun, 3 May 2015 11:11:11 GMT", + "content-type: text/html", + "content-length: 465", + "connection: close", + "server: httpd.js", + "date: Sun, 3 May 2015 11:11:11 GMT" ].join("\n"); yield waitForClipboardPromise(function setup() { @@ -62,8 +62,8 @@ add_task(function* () { }, function validate(result) { // Fake the "Last-Modified" and "Date" headers because they will vary: result = String(result) - .replace(/Last-Modified: [^\n]+ GMT/, "Last-Modified: Sun, 3 May 2015 11:11:11 GMT") - .replace(/Date: [^\n]+ GMT/, "Date: Sun, 3 May 2015 11:11:11 GMT"); + .replace(/last-modified: [^\n]+ GMT/, "last-modified: Sun, 3 May 2015 11:11:11 GMT") + .replace(/date: [^\n]+ GMT/, "date: Sun, 3 May 2015 11:11:11 GMT"); return result === EXPECTED_RESPONSE_HEADERS; }); info("Clipboard contains the currently selected item's response headers."); diff --git a/devtools/client/netmonitor/test/browser_net_filter-01.js b/devtools/client/netmonitor/test/browser_net_filter-01.js index b0d76c6293e0..7b3a8c457dd3 100644 --- a/devtools/client/netmonitor/test/browser_net_filter-01.js +++ b/devtools/client/netmonitor/test/browser_net_filter-01.js @@ -181,9 +181,9 @@ add_task(function* () { "The details pane should still be visible after filtering."); is(RequestsMenu.items.length, visibility.length, - "There should be a specific amount of items in the requests menu."); + "There should be a specific amount of items in the requests menu."); is(RequestsMenu.visibleItems.length, visibility.filter(e => e).length, - "There should be a specific amount of visbile items in the requests menu."); + "There should be a specific amount of visbile items in the requests menu."); for (let i = 0; i < visibility.length; i++) { is(RequestsMenu.getItemAtIndex(i).target.hidden, !visibility[i], diff --git a/devtools/client/netmonitor/test/browser_net_timing-division.js b/devtools/client/netmonitor/test/browser_net_timing-division.js index 0114ba235500..ff2379dc28c4 100644 --- a/devtools/client/netmonitor/test/browser_net_timing-division.js +++ b/devtools/client/netmonitor/test/browser_net_timing-division.js @@ -48,9 +48,9 @@ add_task(function* () { let lastRequest = RequestsMenu.getItemAtIndex(1); info("First request happened at: " + - firstRequest.attachment.responseHeaders.headers.find(e => e.name == "Date").value); + firstRequest.attachment.responseHeaders.headers.find(e => e.name == "date").value); info("Last request happened at: " + - lastRequest.attachment.responseHeaders.headers.find(e => e.name == "Date").value); + lastRequest.attachment.responseHeaders.headers.find(e => e.name == "date").value); ok(secDivs.length, "There should be at least one division on the seconds time scale."); diff --git a/devtools/client/shared/AppCacheUtils.jsm b/devtools/client/shared/AppCacheUtils.jsm index a2beca993c32..7c8007d9ffe2 100644 --- a/devtools/client/shared/AppCacheUtils.jsm +++ b/devtools/client/shared/AppCacheUtils.jsm @@ -86,7 +86,7 @@ AppCacheUtils.prototype = { _parseManifest: function ACU__parseManifest(uriInfo) { let deferred = defer(); let manifestName = uriInfo.name; - let manifestLastModified = new Date(uriInfo.responseHeaders["Last-Modified"]); + let manifestLastModified = new Date(uriInfo.responseHeaders["last-modified"]); if (uriInfo.charset.toLowerCase() != "utf-8") { this._addError(0, "notUTF8", uriInfo.charset); @@ -158,7 +158,7 @@ AppCacheUtils.prototype = { // Check that the resource was not modified after the manifest was last // modified. If it was then the manifest file should be refreshed. let resourceLastModified = - new Date(uriInfo.responseHeaders["Last-Modified"]); + new Date(uriInfo.responseHeaders["last-modified"]); if (manifestLastModified < resourceLastModified) { this._addError(parsedUri.line, "fileChangedButNotManifest", @@ -230,12 +230,12 @@ AppCacheUtils.prototype = { result.requestHeaders = {}; request.visitRequestHeaders(function (header, value) { - result.requestHeaders[header] = value; + result.requestHeaders[header.toLowerCase()] = value; }); result.responseHeaders = {}; request.visitResponseHeaders(function (header, value) { - result.responseHeaders[header] = value; + result.responseHeaders[header.toLowerCase()] = value; }); deferred.resolve(result); diff --git a/devtools/client/shared/curl.js b/devtools/client/shared/curl.js index 978cbad9c845..ae954fe9f412 100644 --- a/devtools/client/shared/curl.js +++ b/devtools/client/shared/curl.js @@ -80,14 +80,14 @@ const Curl = { postDataText = data.postDataText; postData.push("--data"); postData.push(escapeString(utils.writePostDataTextParams(postDataText))); - ignoredHeaders.add("Content-Length"); + ignoredHeaders.add("content-length"); } else if (multipartRequest) { postDataText = data.postDataText; postData.push("--data-binary"); let boundary = utils.getMultipartBoundary(data); let text = utils.removeBinaryDataFromMultipartText(postDataText, boundary); postData.push(escapeString(text)); - ignoredHeaders.add("Content-Length"); + ignoredHeaders.add("content-length"); } // Add method. @@ -118,11 +118,11 @@ const Curl = { } for (let i = 0; i < headers.length; i++) { let header = headers[i]; - if (header.name === "Accept-Encoding") { + if (header.name.toLowerCase() === "accept-encoding") { command.push("--compressed"); continue; } - if (ignoredHeaders.has(header.name)) { + if (ignoredHeaders.has(header.name.toLowerCase())) { continue; } command.push("-H"); diff --git a/devtools/client/webconsole/net/test/mochitest/browser_net_headers.js b/devtools/client/webconsole/net/test/mochitest/browser_net_headers.js index 4a47074ee194..14cde846c20c 100644 --- a/devtools/client/webconsole/net/test/mochitest/browser_net_headers.js +++ b/devtools/client/webconsole/net/test/mochitest/browser_net_headers.js @@ -26,11 +26,11 @@ add_task(function* () { // Select "Headers" tab let tabBody = yield selectNetInfoTab(hud, netInfoBody, "headers"); let paramName = tabBody.querySelector( - ".netInfoParamName > span[title='Content-Type']"); + ".netInfoParamName > span[title='content-type']"); // Verify "Content-Type" header (name and value) ok(paramName, "Header name must exist"); - is(paramName.textContent, "Content-Type", + is(paramName.textContent, "content-type", "The header name must have proper value"); let paramValue = paramName.parentNode.nextSibling; diff --git a/devtools/client/webconsole/test/browser_webconsole_bug_630733_response_redirect_headers.js b/devtools/client/webconsole/test/browser_webconsole_bug_630733_response_redirect_headers.js index 5097499538c9..da4bdcf122ec 100644 --- a/devtools/client/webconsole/test/browser_webconsole_bug_630733_response_redirect_headers.js +++ b/devtools/client/webconsole/test/browser_webconsole_bug_630733_response_redirect_headers.js @@ -87,7 +87,7 @@ function getContent() { function performTest() { function readHeader(name) { for (let header of headers) { - if (header.name == name) { + if (header.name.toLowerCase() == name.toLowerCase()) { return header.value; } } diff --git a/devtools/shared/webconsole/test/test_network_get.html b/devtools/shared/webconsole/test/test_network_get.html index 710c9b0d7516..c2313be12a30 100644 --- a/devtools/shared/webconsole/test/test_network_get.html +++ b/devtools/shared/webconsole/test/test_network_get.html @@ -196,13 +196,13 @@ function onResponseHeaders(aState, aResponse) ok(!!aResponse.rawHeaders, "response rawHeaders available"); checkHeadersOrCookies(aResponse.headers, { - "Content-Type": /^application\/(json|octet-stream)$/, - "Content-Length": /^\d+$/, + "content-type": /^application\/(json|octet-stream)$/, + "content-length": /^\d+$/, }); checkRawHeaders(aResponse.rawHeaders, { - "Content-Type": /^application\/(json|octet-stream)$/, - "Content-Length": /^\d+$/, + "content-type": /^application\/(json|octet-stream)$/, + "content-length": /^\d+$/, }); onResponseCookies = onResponseCookies.bind(null, aState); diff --git a/devtools/shared/webconsole/test/test_network_longstring.html b/devtools/shared/webconsole/test/test_network_longstring.html index d55136896917..9e6ea7771b63 100644 --- a/devtools/shared/webconsole/test/test_network_longstring.html +++ b/devtools/shared/webconsole/test/test_network_longstring.html @@ -212,8 +212,8 @@ function onResponseHeaders(aState, aResponse) ok(aResponse.headersSize > 0, "response headersSize > 0"); checkHeadersOrCookies(aResponse.headers, { - "Content-Type": /^application\/(json|octet-stream)$/, - "Content-Length": /^\d+$/, + "content-type": /^application\/(json|octet-stream)$/, + "content-length": /^\d+$/, "x-very-short": "hello world", "x-very-long": { "type": "longString", diff --git a/devtools/shared/webconsole/test/test_network_post.html b/devtools/shared/webconsole/test/test_network_post.html index d96b9b0b7c24..a0b8edb648f8 100644 --- a/devtools/shared/webconsole/test/test_network_post.html +++ b/devtools/shared/webconsole/test/test_network_post.html @@ -204,13 +204,13 @@ function onResponseHeaders(aState, aResponse) ok(!!aResponse.rawHeaders, "response rawHeaders available"); checkHeadersOrCookies(aResponse.headers, { - "Content-Type": /^application\/(json|octet-stream)$/, - "Content-Length": /^\d+$/, + "content-type": /^application\/(json|octet-stream)$/, + "content-length": /^\d+$/, }); checkRawHeaders(aResponse.rawHeaders, { - "Content-Type": /^application\/(json|octet-stream)$/, - "Content-Length": /^\d+$/, + "content-type": /^application\/(json|octet-stream)$/, + "content-length": /^\d+$/, }); onResponseCookies = onResponseCookies.bind(null, aState);

1 0

[tor-browser/tor-browser-52.7.3esr-8.0-1] Bug 1356893 - Reject opening intents with file data schemes. r=sebastian, r=nalexander
by gk＠torproject.org 30 Apr '18

30 Apr '18

commit e53935623c1da11a7b327542667dba32ddd95017 Author: Eugen Sawin <esawin(a)mozilla.com> Date: Tue Apr 24 19:09:24 2018 -0300 Bug 1356893 - Reject opening intents with file data schemes. r=sebastian, r=nalexander --HG-- extra : rebase_source : 1f764df3309b3641f124915b1a1204afbbd8354a --- mobile/android/base/java/org/mozilla/gecko/IntentHelper.java | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/mobile/android/base/java/org/mozilla/gecko/IntentHelper.java b/mobile/android/base/java/org/mozilla/gecko/IntentHelper.java index efe9576d7d19..e2f34f926b72 100644 --- a/mobile/android/base/java/org/mozilla/gecko/IntentHelper.java +++ b/mobile/android/base/java/org/mozilla/gecko/IntentHelper.java @@ -287,6 +287,12 @@ public final class IntentHelper implements GeckoEventListener, return null; } + final Uri data = intent.getData(); + if (data != null && "file".equals(data.normalizeScheme().getScheme())) { + Log.w(LOGTAG, "Blocked intent with \"file://\" data scheme."); + return null; + } + // Only open applications which can accept arbitrary data from a browser. intent.addCategory(Intent.CATEGORY_BROWSABLE);

1 0

[tor-browser/tor-browser-52.7.3esr-8.0-1] Bug 1416940; r=snorp
by gk＠torproject.org 30 Apr '18

30 Apr '18

commit 5bdd0416f089ddaab4d14e63b7cd35bf51a2035b Author: Jim Chen <nchen(a)mozilla.com> Date: Tue Nov 28 23:07:52 2017 -0500 Bug 1416940; r=snorp MozReview-Commit-ID: 7izmybLFG6i --- mozglue/android/NSSBridge.cpp | 114 +++++++++++++++++++----------------------- mozglue/android/NSSBridge.h | 4 -- 2 files changed, 52 insertions(+), 66 deletions(-) diff --git a/mozglue/android/NSSBridge.cpp b/mozglue/android/NSSBridge.cpp index 2a9b5771df0d..3343ad1b2472 100644 --- a/mozglue/android/NSSBridge.cpp +++ b/mozglue/android/NSSBridge.cpp @@ -37,6 +37,10 @@ NSS_WRAPPER_INT(PL_Base64Encode) NSS_WRAPPER_INT(PL_Base64Decode) NSS_WRAPPER_INT(PL_strfree) +SECStatus doCrypto(JNIEnv* jenv, const char *path, const char *value, char** result, bool doEncrypt); +SECStatus encode(const uint8_t* data, uint32_t srclen, char** result); +SECStatus decode(const char* data, uint8_t** result, uint32_t* length); + int setup_nss_functions(void *nss_handle, void *nspr_handle, @@ -189,41 +193,40 @@ doCrypto(JNIEnv* jenv, const char *path, const char *value, char** result, bool keyid.len = 0; rv = f_PK11SDR_Encrypt(&keyid, &request, &reply, nullptr); - if (rv != SECSuccess) { + if (rv == SECSuccess) { + rv = encode(reply.data, reply.len, result); + if (rv == SECSuccess) { + LOG("Encrypted: %s\n", *result); + } else { + throwError(jenv, "encode"); + } + } else { throwError(jenv, "PK11SDR_Encrypt"); - goto done; } - rv = encode(reply.data, reply.len, result); - if (rv != SECSuccess) { - throwError(jenv, "encode"); - goto done; - } - LOG("Encrypted: %s\n", *result); } else { LOG("Decoding: %s\n", value); - rv = decode(value, &request.data, (int32_t*)&request.len); + rv = decode(value, &request.data, &request.len); if (rv != SECSuccess) { throwError(jenv, "decode"); return rv; } rv = f_PK11SDR_Decrypt(&request, &reply, nullptr); - if (rv != SECSuccess) { - throwError(jenv, "PK11SDR_Decrypt"); - goto done; - } - *result = (char *)malloc(reply.len+1); - strncpy(*result, (char *)reply.data, reply.len); - (*result)[reply.len] = '\0'; + if (rv == SECSuccess) { + *result = static_cast<char*>(malloc(reply.len + 1)); + strncpy(*result, reinterpret_cast<char*>(reply.data), reply.len); + (*result)[reply.len] = '\0'; - // This can print sensitive data. Uncomment if you need it. - // LOG("Decoded %i letters: %s\n", reply.len, *result); + // This can print sensitive data. Uncomment if you need it. + // LOG("Decoded %i letters: %s\n", reply.len, *result); + } else { + throwError(jenv, "PK11SDR_Decrypt"); + } free(request.data); } -done: f_SECITEM_ZfreeItem(&reply, false); return rv; } @@ -232,64 +235,51 @@ done: * Base64 encodes the data passed in. The caller must deallocate _retval using free(); */ SECStatus -encode(const unsigned char *data, int32_t dataLen, char **_retval) +encode(const uint8_t* data, uint32_t srclen, char** result) { - SECStatus rv = SECSuccess; - char *encoded = f_PL_Base64Encode((const char *)data, dataLen, nullptr); - if (!encoded) - rv = SECFailure; - if (!*encoded) - rv = SECFailure; - - if (rv == SECSuccess) { - *_retval = (char *)malloc(strlen(encoded)+1); - strcpy(*_retval, encoded); + if (srclen > (PR_UINT32_MAX / 4) * 3) { + return SECFailure; } - if (encoded) { - f_PR_Free(encoded); + const uint32_t dstlen = ((srclen + 2) / 3) * 4; + char* const buffer = static_cast<char*>(malloc(dstlen + 1)); + + if (!buffer || !f_PL_Base64Encode(reinterpret_cast<const char*>(data), srclen, buffer)) { + free(buffer); + *result = nullptr; + return SECFailure; } - return rv; + buffer[dstlen] = '\0'; + *result = buffer; + return SECSuccess; } /* * Base64 decodes the data passed in. The caller must deallocate result using free(); */ SECStatus -decode(const char *data, unsigned char **result, int32_t *length) +decode(const char* data, uint8_t** result, uint32_t* length) { - SECStatus rv = SECSuccess; - uint32_t len = strlen(data); - int adjust = 0; - - /* Compute length adjustment */ - if (len > 0 && data[len-1] == '=') { - adjust++; - if (data[len-2] == '=') adjust++; + uint32_t srclen = strlen(data); + while (srclen && data[srclen - 1] == '=') { + srclen--; } - char *decoded; - decoded = f_PL_Base64Decode(data, len, nullptr); - if (!decoded) { - return SECFailure; - } - if (!*decoded) { + // Avoid overflow when calculating result length. + const uint32_t dstlen = (srclen / 4) * 3 + ((srclen % 4) * 3) / 4; + // At most 2 extra bytes due to padding in input. + uint8_t* const buffer = static_cast<uint8_t*>(malloc(dstlen + 2)); + + if (!buffer || !f_PL_Base64Decode(data, srclen, reinterpret_cast<char*>(buffer))) { + free(buffer); + *result = nullptr; + *length = 0; return SECFailure; } - *length = (len*3)/4 - adjust; - LOG("Decoded %i chars into %i chars\n", len, *length); - - *result = (unsigned char*)malloc((size_t)len); - - if (!*result) { - rv = SECFailure; - } else { - memcpy((char*)*result, decoded, len); - } - f_PR_Free(decoded); - return rv; + buffer[dstlen] = '\0'; + *result = buffer; + *length = dstlen; + return SECSuccess; } - - diff --git a/mozglue/android/NSSBridge.h b/mozglue/android/NSSBridge.h index 77bcd1172459..83ec8d7494c2 100644 --- a/mozglue/android/NSSBridge.h +++ b/mozglue/android/NSSBridge.h @@ -39,8 +39,4 @@ NSS_WRAPPER(PK11_GetInternalKeySlot, PK11SlotInfo *, void) NSS_WRAPPER(PK11_NeedUserInit, PRBool, PK11SlotInfo *) NSS_WRAPPER(PK11_InitPin, SECStatus, PK11SlotInfo*, const char*, const char*) -bool setPassword(PK11SlotInfo *slot); -SECStatus doCrypto(JNIEnv* jenv, const char *path, const char *value, char** result, bool doEncrypt); -SECStatus encode(const unsigned char *data, int32_t dataLen, char **_retval); -SECStatus decode(const char *data, unsigned char **result, int32_t * _retval); #endif /* NSS_h */

1 0

[tor-browser/tor-browser-52.7.3esr-8.0-1] Bug 25458: UI customization half-broken in Tor Browser 8.0a3
by gk＠torproject.org 25 Apr '18

25 Apr '18

commit 12847934f5c7baf4e94945ec433f1b2fdcf33625 Author: Richard Pospesel <richard(a)torproject.org> Date: Fri Apr 20 16:03:41 2018 -0700 Bug 25458: UI customization half-broken in Tor Browser 8.0a3 Fixed fallout from #25147. Some of the functionality of the UI Customize screen is dependent on setting innerHTML on divs. Since the code runs in the System context, the HTML was being sanitized and broke page functionality. The offending statements have been switched to the unsafeSetInnerHTML() method which bypasses sanitization in System context. --- browser/components/customizableui/CustomizeMode.jsm | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/browser/components/customizableui/CustomizeMode.jsm b/browser/components/customizableui/CustomizeMode.jsm index 49868cdbd4a0..4c32fd867c09 100644 --- a/browser/components/customizableui/CustomizeMode.jsm +++ b/browser/components/customizableui/CustomizeMode.jsm @@ -690,13 +690,13 @@ CustomizeMode.prototype = { // Put the tip contents in the popup. let bundle = this.document.getElementById("bundle_browser"); const kLabelClass = "customization-tipPanel-link"; - messageNode.innerHTML = bundle.getFormattedString("customizeTips.tip0", [ + messageNode.unsafeSetInnerHTML(bundle.getFormattedString("customizeTips.tip0", [ "<label class=\"customization-tipPanel-em\" value=\"" + bundle.getString("customizeTips.tip0.hint") + "\"/>", this.document.getElementById("bundle_brand").getString("brandShortName"), "<label class=\"" + kLabelClass + " text-link\" value=\"" + bundle.getString("customizeTips.tip0.learnMore") + "\"/>" - ]); + ])); messageNode.querySelector("." + kLabelClass).addEventListener("click", () => { let url = Services.urlFormatter.formatURLPref("browser.customizemode.tip0.learnMoreUrl");

1 0

[tor-browser/tor-browser-52.7.3esr-8.0-1] fixup! fix #17 from https://github.com/amoghbl1/tor-browser/issues don't restore tabs by default
by gk＠torproject.org 25 Apr '18

25 Apr '18

commit 7814f97385daa7b5056bfaabe6ca56206acd6b58 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Apr 25 08:04:39 2018 +0000 fixup! fix #17 from https://github.com/amoghbl1/tor-browser/issues don't restore tabs by default This fixes #25898 on our side --- modules/libpref/init/all.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/libpref/init/all.js b/modules/libpref/init/all.js index 766e665c074a..198028eeb96c 100644 --- a/modules/libpref/init/all.js +++ b/modules/libpref/init/all.js @@ -591,7 +591,7 @@ pref("media.encoder.webm.enabled", true); #endif // Whether to autostart a media element with an |autoplay| attribute -pref("media.autoplay.enabled", false); +pref("media.autoplay.enabled", true); // The default number of decoded video frames that are enqueued in // MediaDecoderReader's mVideoQueue.

1 0

[tor-browser/tor-browser-52.7.3esr-7.5-1] Bug 25331: Fix failing test from #18192
by gk＠torproject.org 18 Apr '18

18 Apr '18

commit 8592446c194092c93c854611fc7dadd1fd3f3917 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Apr 18 07:31:48 2018 +0000 Bug 25331: Fix failing test from #18192 This patch was written by mcs and brade --- .../tests/chrome/test_0790_check_certPinning_noUpdate.xul | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/toolkit/mozapps/update/tests/chrome/test_0790_check_certPinning_noUpdate.xul b/toolkit/mozapps/update/tests/chrome/test_0790_check_certPinning_noUpdate.xul index f5a97cf204ac..fcb571a4ddc6 100644 --- a/toolkit/mozapps/update/tests/chrome/test_0790_check_certPinning_noUpdate.xul +++ b/toolkit/mozapps/update/tests/chrome/test_0790_check_certPinning_noUpdate.xul @@ -27,9 +27,13 @@ const TESTS = [ { buttonClick: "finish" } ]; +const kCertPinningEnforcementLevelPref = "security.cert_pinning.enforcement_level"; + function runTest() { debugDump("entering"); + SpecialPowers.setIntPref(kCertPinningEnforcementLevelPref, 2); // strict + // Set the update URL. // https://badchain.include-subdomains.pinning.example.com is preconfigured // by the test framework for use in key pinning tests. @@ -43,6 +47,12 @@ function runTest() { gUP.checkForUpdates(); } +function finishTest() +{ + SpecialPowers.clearUserPref(kCertPinningEnforcementLevelPref); + finishTestDefault(); +} + function checkErrorCode() { // From security/manager/ssl/tests/unit/head_psm.js: const MOZILLA_PKIX_ERROR_BASE = Ci.nsINSSErrorsService.MOZILLA_PKIX_ERROR_BASE;

1 0

[tor-browser/tor-browser-52.7.3esr-8.0-1] Bug 25331: Fix failing test from #18192
by gk＠torproject.org 18 Apr '18

18 Apr '18

commit 292456846d8420e88b19664e36562cb4d6169776 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Apr 18 07:31:48 2018 +0000 Bug 25331: Fix failing test from #18192 This patch was written by mcs and brade --- .../tests/chrome/test_0790_check_certPinning_noUpdate.xul | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/toolkit/mozapps/update/tests/chrome/test_0790_check_certPinning_noUpdate.xul b/toolkit/mozapps/update/tests/chrome/test_0790_check_certPinning_noUpdate.xul index f5a97cf204ac..fcb571a4ddc6 100644 --- a/toolkit/mozapps/update/tests/chrome/test_0790_check_certPinning_noUpdate.xul +++ b/toolkit/mozapps/update/tests/chrome/test_0790_check_certPinning_noUpdate.xul @@ -27,9 +27,13 @@ const TESTS = [ { buttonClick: "finish" } ]; +const kCertPinningEnforcementLevelPref = "security.cert_pinning.enforcement_level"; + function runTest() { debugDump("entering"); + SpecialPowers.setIntPref(kCertPinningEnforcementLevelPref, 2); // strict + // Set the update URL. // https://badchain.include-subdomains.pinning.example.com is preconfigured // by the test framework for use in key pinning tests. @@ -43,6 +47,12 @@ function runTest() { gUP.checkForUpdates(); } +function finishTest() +{ + SpecialPowers.clearUserPref(kCertPinningEnforcementLevelPref); + finishTestDefault(); +} + function checkErrorCode() { // From security/manager/ssl/tests/unit/head_psm.js: const MOZILLA_PKIX_ERROR_BASE = Ci.nsINSSErrorsService.MOZILLA_PKIX_ERROR_BASE;

1 0

[tor-browser-build/master] Release preparations for 8.0a6
by gk＠torproject.org 16 Apr '18

16 Apr '18

commit 12a0d42d620256023640578b8bb7a23520710056 Author: Georg Koppen <gk(a)torproject.org> Date: Mon Apr 16 18:41:32 2018 +0000 Release preparations for 8.0a6 Changelog update, versions bump --- projects/firefox/config | 2 +- projects/https-everywhere/config | 2 +- projects/openssl/config | 4 ++-- .../tor-browser/Bundle-Data/Docs/ChangeLog.txt | 23 ++++++++++++++++++++++ projects/tor/config | 2 +- projects/torbutton/config | 2 +- rbm.conf | 7 +++---- 7 files changed, 32 insertions(+), 10 deletions(-) diff --git a/projects/firefox/config b/projects/firefox/config index 8412c2c..ee79a15 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -1,7 +1,7 @@ # vim: filetype=yaml sw=2 version: '[% c("abbrev") %]' filename: 'firefox-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %]' -git_hash: 'tor-browser-[% c("var/firefox_version") %]-[% c("var/torbrowser_branch") %]-1-build1' +git_hash: 'tor-browser-[% c("var/firefox_version") %]-[% c("var/torbrowser_branch") %]-1-build2' tag_gpg_id: 1 git_url: https://git.torproject.org/tor-browser.git gpg_keyring: torbutton.gpg diff --git a/projects/https-everywhere/config b/projects/https-everywhere/config index 38eb2be..cfa0a78 100644 --- a/projects/https-everywhere/config +++ b/projects/https-everywhere/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 2018.3.13 +version: 2018.4.11 git_url: https://git.torproject.org/https-everywhere.git git_hash: '[% c("version") %]' git_submodule: 1 diff --git a/projects/openssl/config b/projects/openssl/config index 378ee53..9ab54c6 100644 --- a/projects/openssl/config +++ b/projects/openssl/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 1.0.2n +version: 1.0.2o filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' var: @@ -25,4 +25,4 @@ input_files: - name: '[% c("var/compiler") %]' project: '[% c("var/compiler") %]' - URL: 'https://www.openssl.org/source/openssl-[% c("version") %].tar.gz' - sha256sum: 370babb75f278c39e0c50e8c4e7493bc0f18db6867478341a832a982fd15a8fe + sha256sum: ec3f5c9714ba0fd45cb4e087301eb1336c317e0d20b575a125050470e8089e4d diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index aeb0cac..b9d3941 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,26 @@ +Tor Browser 8.0a6 -- April 19 2018 + * All platforms + * Update Tor to 0.3.3.5-rc + * Update OpenSSL to 1.0.2o + * Update Torbutton to 1.9.9.1 + * Bug 25126: Make about:tor layout responsive + * Translations update + * Update HTTPS Everywhere to 2018.4.11 + * Update NoScript to 5.1.8.5 + * Bug 21537: Mark .onion cookies as secure + * Bug 21850: Update about:tbupdate handling for e10s + * Bug 25721: Backport patches from Mozilla's bug 1448771 + * Linux + * Bug 20283: Tor Browser should run without a `/proc` filesystem. + * Windows + * Bug 13893: Make EMET compatible with Tor Browser + * Build System + * Windows + * Bug 25420: Update GCC to 6.4.0 + * Bug 20302: Fix FTE compilation for Windows with GCC 6.4.0 + * Linux + * Bug 25304: Update GCC to 6.4.0 + Tor Browser 8.0a5 -- March 27 2018 * All platforms * Update Firefox to 52.7.3esr diff --git a/projects/tor/config b/projects/tor/config index 7029880..78d834f 100644 --- a/projects/tor/config +++ b/projects/tor/config @@ -1,6 +1,6 @@ # vim: filetype=yaml sw=2 filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %]' -version: 0.3.3.3-alpha +version: 0.3.3.5-rc git_hash: 'tor-[% c("version") %]' git_url: https://git.torproject.org/tor.git git_submodule: 1 diff --git a/projects/torbutton/config b/projects/torbutton/config index de7691a..93bef30 100644 --- a/projects/torbutton/config +++ b/projects/torbutton/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 1.9.9 +version: 1.9.9.1 git_url: https://git.torproject.org/torbutton.git git_hash: '[% c("version") %]' gpg_keyring: torbutton.gpg diff --git a/rbm.conf b/rbm.conf index 2654371..87ab109 100644 --- a/rbm.conf +++ b/rbm.conf @@ -15,11 +15,10 @@ buildconf: git_signtag_opt: '-s' var: - torbrowser_version: '8.0a5' - torbrowser_build: 'build2' + torbrowser_version: '8.0a6' + torbrowser_build: 'build1' torbrowser_incremental_from: - - 8.0a3 - - 8.0a4 + - 8.0a5 project_name: tor-browser multi_lingual: 0 build_mar: 1

1 0

[tor-browser/tor-browser-52.7.3esr-8.0-1] Bug 20283: Tor Browser should run without a `/proc` filesystem.
by gk＠torproject.org 16 Apr '18

16 Apr '18

commit 90e16dd25b6eb199c016fc8b5e9478a3454d36e1 Author: Richard Pospesel <richard(a)torproject.org> Date: Mon Apr 9 11:40:32 2018 -0700 Bug 20283: Tor Browser should run without a `/proc` filesystem. Firefox uses the current stack frame address and the stack size as a sort of heuristic for various things in the javascript engine. The js::GetNativeStackBaseImpl() function is used to get the base stack address (ie the address from which the stack grows, so this can be either the first or last memory address of the stack memory space depending on the CPU architecture). On Linux, this function is implemented using the pthreads APIs. For non-main threads, the queried thread info is stored in memory. The main thread does not have this information on hand, so it gets the stack memory range via the /proc/self/maps file ( see glibc's pthread_get_attr_np.c ). Fortunately (per discussions with the firefox devs in #jsapi) the base address only needs to be approximation. In reality, environment variables, args, and other things are stored in space between the end/beginning of the mapped stack memory and the 'top' of the stack space used by stack frames. We can get the top of this usable stack from __libc_stack_end, which is a void* set by glibc during program initialization. Non-main threads still get their stack-base through the usual pthreads APIs. This patch integrates the latest jsnativestack.cpp from mozilla- central, and creates a specific implementation of js::GetNativeStackBaseImpl() for non-android Linux using the described __libc_stack_end read. --- js/src/jsnativestack.cpp | 88 +++++++++++++++++++++++++++++------------------- 1 file changed, 54 insertions(+), 34 deletions(-) diff --git a/js/src/jsnativestack.cpp b/js/src/jsnativestack.cpp index 05928ea3dff3..0f4dae156c2b 100644 --- a/js/src/jsnativestack.cpp +++ b/js/src/jsnativestack.cpp @@ -8,22 +8,17 @@ #ifdef XP_WIN # include "jswin.h" - #elif defined(XP_DARWIN) || defined(DARWIN) || defined(XP_UNIX) # include <pthread.h> - # if defined(__FreeBSD__) || defined(__OpenBSD__) || defined(__DragonFly__) # include <pthread_np.h> # endif - -# if defined(ANDROID) +# if defined(ANDROID) && !defined(__aarch64__) # include <sys/types.h> # include <unistd.h> # endif - #else # error "Unsupported platform" - #endif #if defined(XP_WIN) @@ -31,32 +26,8 @@ void* js::GetNativeStackBaseImpl() { -# if defined(_M_IX86) && defined(_MSC_VER) - /* - * offset 0x18 from the FS segment register gives a pointer to - * the thread information block for the current thread - */ - NT_TIB* pTib; - __asm { - MOV EAX, FS:[18h] - MOV pTib, EAX - } - return static_cast<void*>(pTib->StackBase); - -# elif defined(_M_X64) - PNT_TIB64 pTib = reinterpret_cast<PNT_TIB64>(NtCurrentTeb()); - return reinterpret_cast<void*>(pTib->StackBase); - -# elif defined(_M_ARM) PNT_TIB pTib = reinterpret_cast<PNT_TIB>(NtCurrentTeb()); return static_cast<void*>(pTib->StackBase); - -# elif defined(_WIN32) && defined(__GNUC__) - NT_TIB* pTib; - asm ("movl %%fs:0x18, %0\n" : "=r" (pTib)); - return static_cast<void*>(pTib->StackBase); - -# endif } #elif defined(SOLARIS) @@ -88,6 +59,55 @@ js::GetNativeStackBaseImpl() context.uc_stack.ss_size; } +#elif defined(XP_LINUX) && !defined(ANDROID) + +# include <dlfcn.h> +# include <sys/syscall.h> +static pid_t +gettid() +{ + return syscall(__NR_gettid); +} + +void* +js::GetNativeStackBaseImpl() +{ + // main thread, get stack base from __libc_stack_end rather than pthread APIs + // to avoid filesystem calls /proc/self/maps + if(gettid() == getpid()) { + void** pLibcStackEnd = (void**)dlsym(RTLD_DEFAULT, "__libc_stack_end"); + // if __libc_stack_end is not found, architecture specific frame pointer hopping will need + // to be implemented + MOZ_ASSERT(pLibcStackEnd); + void* stackBase = *pLibcStackEnd; + MOZ_ASSERT(stackBase); + // we don't need to fix stackBase, as it already roughly points to beginning of the stack + return stackBase; + } + // non-main threads have the required info stored in memory, no filesystem calls are made + else { + pthread_t thread = pthread_self(); + pthread_attr_t sattr; + pthread_attr_init(&sattr); + pthread_getattr_np(thread, &sattr); + // stackBase will be the lowest address on all architectures + void* stackBase = nullptr; + size_t stackSize = 0; + int rc = pthread_attr_getstack(&sattr, &stackBase, &stackSize); + if(rc) { + MOZ_CRASH(); + } + MOZ_ASSERT(stackBase); + pthread_attr_destroy(&sattr); + +# if JS_STACK_GROWTH_DIRECTION > 0 + return stackBase; +# else + return static_cast<char*>(stackBase) + stackSize; +# endif + } +} + #else /* XP_UNIX */ void* @@ -120,11 +140,11 @@ js::GetNativeStackBaseImpl() rc = pthread_stackseg_np(pthread_self(), &ss); stackBase = (void*)((size_t) ss.ss_sp - ss.ss_size); stackSize = ss.ss_size; -# elif defined(ANDROID) +# elif defined(ANDROID) && !defined(__aarch64__) if (gettid() == getpid()) { - // bionic's pthread_attr_getstack doesn't tell the truth for the main - // thread (see bug 846670). So we scan /proc/self/maps to find the - // segment which contains the stack. + // bionic's pthread_attr_getstack prior to API 21 doesn't tell the truth + // for the main thread (see bug 846670). So we scan /proc/self/maps to + // find the segment which contains the stack. rc = -1; // Put the string on the stack, otherwise there is the danger that it

1 0

[tor-browser/tor-browser-52.7.3esr-8.0-1] Bug 21537: Mark .onion cookies as secure
by gk＠torproject.org 13 Apr '18

13 Apr '18

commit c70454fd10efeb9f4cabc69f94a9a7a633c10174 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Apr 13 16:59:24 2018 +0000 Bug 21537: Mark .onion cookies as secure --- netwerk/cookie/nsCookieService.cpp | 60 ++++++++++++++++++++------------------ 1 file changed, 32 insertions(+), 28 deletions(-) diff --git a/netwerk/cookie/nsCookieService.cpp b/netwerk/cookie/nsCookieService.cpp index cf1d91e2df36..f9390d7ef093 100644 --- a/netwerk/cookie/nsCookieService.cpp +++ b/netwerk/cookie/nsCookieService.cpp @@ -3112,6 +3112,26 @@ PathMatches(nsCookie* aCookie, const nsACString& aPath) { return true; } +static bool +IsSecureHost(nsIURI *aHostURI) { + bool isSecure = true; + // If SchemeIs fails, assume an insecure connection, to be on the safe side. + if (aHostURI && NS_FAILED(aHostURI->SchemeIs("https", &isSecure))) { + isSecure = false; + } + // In case HTTPS is not used check whether we have a .onion host in which + // case the cookie is secure, too. + if (aHostURI && !isSecure) { + nsresult rv; + nsAutoCString hostFromURI; + rv = aHostURI->GetAsciiHost(hostFromURI); + if (NS_SUCCEEDED(rv)) { + isSecure = StringEndsWith(hostFromURI, NS_LITERAL_CSTRING(".onion")); + } + } + return isSecure; +} + void nsCookieService::GetCookieStringInternal(nsIURI *aHostURI, bool aIsForeign, @@ -3164,13 +3184,10 @@ nsCookieService::GetCookieStringInternal(nsIURI *aHostURI, // If it changes, please update that function, or file a bug for someone // else to do so. - // check if aHostURI is using an https secure protocol. - // if it isn't, then we can't send a secure cookie over the connection. - // if SchemeIs fails, assume an insecure connection, to be on the safe side - bool isSecure; - if (NS_FAILED(aHostURI->SchemeIs("https", &isSecure))) { - isSecure = false; - } + // Check if aHostURI is using the HTTPS protocol or if the domain is a + // .onion. If it isn't, then we can't send a secure cookie over the + // connection. + bool isSecure = IsSecureHost(aHostURI); nsCookie *cookie; AutoTArray<nsCookie*, 8> foundCookieList; @@ -3316,20 +3333,10 @@ nsCookieService::SetCookieInternal(nsIURI *aHostURI, // so we can handle them separately. bool newCookie = ParseAttributes(aCookieHeader, cookieAttributes); - // Collect telemetry on how often secure cookies are set from non-secure - // origins, and vice-versa. - // - // 0 = nonsecure and "http:" - // 1 = nonsecure and "https:" - // 2 = secure and "http:" - // 3 = secure and "https:" - bool isHTTPS; - nsresult rv = aHostURI->SchemeIs("https", &isHTTPS); - if (NS_SUCCEEDED(rv)) { - Telemetry::Accumulate(Telemetry::COOKIE_SCHEME_SECURITY, - ((cookieAttributes.isSecure)? 0x02 : 0x00) | - ((isHTTPS)? 0x01 : 0x00)); - } + // Check if aHostURI is using the HTTPS protocol or if the domain is a + // .onion. If it isn't, then we can't send a secure cookie over the + // connection. + bool isSecure = IsSecureHost(aHostURI); int64_t currentTimeInUsec = PR_Now(); @@ -3369,7 +3376,7 @@ nsCookieService::SetCookieInternal(nsIURI *aHostURI, return newCookie; } // magic prefix checks. MUST be run after CheckDomain() and CheckPath() - if (!CheckPrefixes(cookieAttributes, isHTTPS)) { + if (!CheckPrefixes(cookieAttributes, isSecure)) { COOKIE_LOGFAILURE(SET_COOKIE, aHostURI, savedCookieHeader, "failed the prefix tests"); return newCookie; } @@ -3457,13 +3464,10 @@ nsCookieService::AddInternal(const nsCookieKey &aKey, return; } - bool isSecure = true; - if (aHostURI && NS_FAILED(aHostURI->SchemeIs("https", &isSecure))) { - isSecure = false; - } + bool isSecure = IsSecureHost(aHostURI); - // If the new cookie is non-https and wants to set secure flag, - // browser have to ignore this new cookie. + // If the new cookie is non-https or not set by a .onion domain, and wants to + // set secure flag, browser have to ignore this new cookie. // (draft-ietf-httpbis-cookie-alone section 3.1) if (mLeaveSecureAlone && aCookie->IsSecure() && !isSecure) { COOKIE_LOGFAILURE(SET_COOKIE, aHostURI, aCookieHeader,

1 0

[tor-browser/tor-browser-52.7.3esr-8.0-1] Bug 21537: Tests for secure .onion cookies
by gk＠torproject.org 13 Apr '18

13 Apr '18

commit 82cd8ae9a5de7c9f9fde591c29b0ccfa8b59d42f Author: Georg Koppen <gk(a)torproject.org> Date: Fri Apr 13 17:00:11 2018 +0000 Bug 21537: Tests for secure .onion cookies --- netwerk/test/TestCookie.cpp | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/netwerk/test/TestCookie.cpp b/netwerk/test/TestCookie.cpp index 68c7ff1b3ef1..c382c33c7e3c 100644 --- a/netwerk/test/TestCookie.cpp +++ b/netwerk/test/TestCookie.cpp @@ -729,8 +729,18 @@ main(int32_t argc, char *argv[]) SetACookie(cookieService, "http://www.security.test/", nullptr, "test=non-security2; domain=security.test", nullptr); GetACookieNoHttp(cookieService, "http://www.security.test/", getter_Copies(cookie)); rv[8] = CheckResult(cookie.get(), MUST_CONTAIN, "test=non-security2"); - - allTestsPassed = PrintResult(rv, 9) && allTestsPassed; + // .onion secure cookie tests + SetACookie(cookieService, "http://123456789abcdef.onion/", nullptr, "test=onion-security; secure", nullptr); + GetACookieNoHttp(cookieService, "https://123456789abcdef.onion/", getter_Copies(cookie)); + rv[9] = CheckResult(cookie.get(), MUST_EQUAL, "test=onion-security"); + SetACookie(cookieService, "http://123456789abcdef.onion/", nullptr, "test=onion-security2; secure", nullptr); + GetACookieNoHttp(cookieService, "http://123456789abcdef.onion/", getter_Copies(cookie)); + rv[10] = CheckResult(cookie.get(), MUST_EQUAL, "test=onion-security2"); + SetACookie(cookieService, "https://123456789abcdef.onion/", nullptr, "test=onion-security3; secure", nullptr); + GetACookieNoHttp(cookieService, "http://123456789abcdef.onion/", getter_Copies(cookie)); + rv[11] = CheckResult(cookie.get(), MUST_EQUAL, "test=onion-security3"); + + allTestsPassed = PrintResult(rv, 12) && allTestsPassed; // *** nsICookieManager{2} interface tests sBuffer = PR_sprintf_append(sBuffer, "*** Beginning nsICookieManager{2} interface tests...\n");

1 0

[tor-browser-build/master] Bug 25481: Enable rust support in Linux nightlies
by boklm＠torproject.org 13 Apr '18

13 Apr '18

commit 5be41831b52795ee87c57cdbd18da68bf73fe1cc Author: Georg Koppen <gk(a)torproject.org> Date: Fri Apr 13 14:29:20 2018 +0000 Bug 25481: Enable rust support in Linux nightlies We enable Rust support for tor in our Linux nightly builds as a first step to enabling it on all supported platforms. --- keyring/rust.gpg | Bin 0 -> 5311 bytes projects/cmake/config | 2 +- projects/rust/binaryen.patch | 22 +++++++++++++++ projects/rust/build | 38 ++++++++++++++++++++++++++ projects/rust/config | 62 +++++++++++++++++++++++++++++++++++++++++++ projects/tor/build | 8 ++++-- projects/tor/config | 4 +++ 7 files changed, 133 insertions(+), 3 deletions(-) diff --git a/keyring/rust.gpg b/keyring/rust.gpg new file mode 100644 index 0000000..e81f452 Binary files /dev/null and b/keyring/rust.gpg differ diff --git a/projects/cmake/config b/projects/cmake/config index 357370d..492b99c 100644 --- a/projects/cmake/config +++ b/projects/cmake/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 2.8.12.2 +version: 3.4.3 git_url: https://cmake.org/cmake.git git_hash: 'v[% c("version") %]' tag_gpg_id: 1 diff --git a/projects/rust/binaryen.patch b/projects/rust/binaryen.patch new file mode 100644 index 0000000..fee9b6a --- /dev/null +++ b/projects/rust/binaryen.patch @@ -0,0 +1,22 @@ +From 820f26810baf35c1961763f6b0013e4f7e7380da Mon Sep 17 00:00:00 2001 +From: Georg Koppen <gk(a)torproject.org> +Date: Thu, 12 Apr 2018 13:10:13 +0000 +Subject: [PATCH] Use our gcc/c++ + + +diff --git a/src/librustc_binaryen/build.rs b/src/librustc_binaryen/build.rs +index f23ff3cee5..2496dd1be9 100644 +--- a/src/librustc_binaryen/build.rs ++++ b/src/librustc_binaryen/build.rs +@@ -26,6 +26,8 @@ fn main() { + + Config::new("../binaryen") + .define("BUILD_STATIC_LIB", "ON") ++ .define("CMAKE_C_COMPILER", "gcc") ++ .define("CMAKE_CXX_COMPILER", "c++") + .build_target("binaryen") + .build(); + +-- +2.16.3 + diff --git a/projects/rust/build b/projects/rust/build new file mode 100644 index 0000000..e20df55 --- /dev/null +++ b/projects/rust/build @@ -0,0 +1,38 @@ +#!/bin/bash +[% c('var/setarch') %] +[% c("var/set_default_env") -%] +distdir=/var/tmp/dist/[% project %] +mkdir -p /var/tmp/dist +tar -C /var/tmp/dist -xf [% c('input_files_by_name/cmake') %] +export PATH="/var/tmp/dist/cmake/bin:$PATH" +tar -C /var/tmp/dist -xf [% c('input_files_by_name/prev_rust') %] +cd /var/tmp/dist/rust-[% c('var/prev_version') %]-[% c('arch') %]-unknown-linux-gnu +./install.sh --prefix=$distdir-rust-old +export PATH="$distdir-rust-old/bin:$PATH" + +[% IF c("var/linux") %] + [% pc('gcc', 'var/setup', { compiler_tarfile => c('input_files_by_name/gcc') }) %] +[% END -%] + +cd $rootdir +mkdir /var/tmp/build +tar -C /var/tmp/build -xf [% c('input_files_by_name/rust') %] +cd /var/tmp/build/rustc-[% c('version') %]-src + +[% IF c("var/linux") %] + # binaryen hardcodes /usr/bin/cc and /usr/bin/c++ as the C and C++ compiler. + # But that is too old on Debian Wheezy which is why we need to patch it, so + # we can use our own GCC instead. + patch -p1 < $rootdir/binaryen.patch +[% END %] + +mkdir build +cd build +../configure --prefix=$distdir [% c("var/configure_opt") %] +make -j[% c("buildconf/num_procs") %] +make install +cd /var/tmp/dist +[% c('tar', { + tar_src => [ project ], + tar_args => '-czf ' _ dest_dir _ '/' _ c('filename'), + }) %] diff --git a/projects/rust/config b/projects/rust/config new file mode 100644 index 0000000..49fc3ab --- /dev/null +++ b/projects/rust/config @@ -0,0 +1,62 @@ +# vim: filetype=yaml sw=2 +filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' +version: 1.25.0 +var: + prev_version: 1.24.1 + container: + use_container: 1 + +targets: + linux: + var: + arch_deps: + - hardening-wrapper + - libssl-dev + - pkg-config + # We use + # `--enable-local-rust` to avoid downloading the required compiler during + # build time + # + # `--enable-vendor` to avoid downloading crates during build time and just + # use the ones which are shipped with the source + # + # `--enable-extended` to build not only rustc but cargo as well + # + # `--release-channel=stable` to just include stable features in the + # compiler + # + # `--sysconfdir=etc` to avoid install failures as |make install| wants to + # write to /etc otherwise + # + # the `target` triple to explicitly specify the architecture and platform + # for the compiler/std lib. Ideally, it should not be needed unless one is + # cross-compiling, but compiling `alloc_jemalloc` fails without that in a + # 32bit container. "--host=x86_64-unknown-linux-gnu" is used in its + # configure script in this case. + # `--set=` to explicitly specify the C compiler. We need to compile the + # bundled LLVM and it wants to use `cc`. However, we don't have that in + # our compiled GCC resulting in weird errors due to C and C++ compiler + # version mismatch. We avoid that with this configure option. We need to + # build our own GCC in the first place as 4.7.2 is too old to get all the + # Rust pieces compiled. + configure_opt: --enable-local-rust --enable-vendor --enable-extended --release-channel=stable --sysconfdir=etc --target=[% c("arch") %]-unknown-linux-gnu --set=target.[% c("arch") %]-unknown-linux-gnu.cc=gcc + +input_files: + - project: container-image + - project: cmake + name: cmake + - project: gcc + name: gcc + enable: '[% c("var/linux") %]' + - URL: 'https://static.rust-lang.org/dist/rustc-[% c("version") %]-src.tar.gz' + name: rust + sig_ext: asc + file_gpg_id: 1 + gpg_keyring: rust.gpg + - URL: 'https://static.rust-lang.org/dist/rust-[% c("var/prev_version") %]-[% c("arch") %]-unknown-linux-gnu.tar.xz' + name: prev_rust + sig_ext: asc + file_gpg_id: 1 + gpg_keyring: rust.gpg + - filename: binaryen.patch + enable: '[% c("var/linux") %]' diff --git a/projects/tor/build b/projects/tor/build index e52e43b..bf7db83 100644 --- a/projects/tor/build +++ b/projects/tor/build @@ -20,6 +20,10 @@ mkdir -p /var/tmp/build tar -C /var/tmp/dist -xf [% c('input_files_by_name/openssl') %] tar -C /var/tmp/dist -xf [% c('input_files_by_name/libevent') %] +[% IF c("var/linux") && c("var/nightly") %] + tar -C /var/tmp/dist -xf [% c('input_files_by_name/rust') %] + export PATH=/var/tmp/dist/rust/bin:$PATH +[% END %] tar -C /var/tmp/build -xf [% project %]-[% c('version') %].tar.gz libeventdir=/var/tmp/dist/libevent openssldir=/var/tmp/dist/openssl @@ -31,7 +35,6 @@ openssldir=/var/tmp/dist/openssl $gcclibs/*.dll $distdir/Tor/ [% END %] - [% IF c("var/linux") %] mkdir -p "$distdir/Debug/Tor" cp $openssldir/lib/libssl.so.1.0.0 "$distdir/Tor/" @@ -62,10 +65,11 @@ cd /var/tmp/build/[% project %]-[% c('version') %] echo '"[% c("abbrev", { abbrev_length => 16 }) %]"' > micro-revision.i ./autogen.sh find -type f -print0 | xargs -0 [% c("var/touch") %] -./configure --disable-asciidoc --with-libevent-dir="$libeventdir" --with-openssl-dir="$openssldir" \ +[% IF c("var/linux") && c("var/nightly") %]TOR_RUST_DEPENDENCIES=`pwd`/src/ext/rust/crates[% END %] ./configure --disable-asciidoc --with-libevent-dir="$libeventdir" --with-openssl-dir="$openssldir" \ [% IF c("var/asan") %]--enable-fragile-hardening[% END %] \ [% IF c("var/windows") %]--with-zlib-dir="$zlibdir"[% END %] \ [% IF c("var/osx") %]--enable-static-openssl[% END %] \ + [% IF c("var/linux") && c("var/nightly") %]--enable-rust[% END %] \ --prefix="$distdir" [% c("var/configure_opt") %] [% IF c("var/osx") || c("var/windows") -%] export LD_PRELOAD=[% c("var/faketime_path") %] diff --git a/projects/tor/config b/projects/tor/config index e650b6e..7029880 100644 --- a/projects/tor/config +++ b/projects/tor/config @@ -3,6 +3,7 @@ filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/buil version: 0.3.3.3-alpha git_hash: 'tor-[% c("version") %]' git_url: https://git.torproject.org/tor.git +git_submodule: 1 gpg_keyring: tor.gpg tag_gpg_id: 1 @@ -57,3 +58,6 @@ input_files: enable: '[% c("var/windows") %]' - name: '[% c("var/compiler") %]' project: '[% c("var/compiler") %]' + - name: rust + project: rust + enable: '[% c("var/linux") && c("var/nightly") %]'

1 0