- tbb-commits - lists.torproject.org

[torbutton/master] fixup! Bug 22542: Security Settings window too small on macOS 10.12
by gk＠torproject.org 01 Aug '17

01 Aug '17

commit 8fbc96cab7ed9816da68d070b7cb01548a19a25a Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Wed Jul 12 13:52:28 2017 -0400 fixup! Bug 22542: Security Settings window too small on macOS 10.12 Automatically adjust the height of the Security Settings window so that no scrollbar is needed. Also, add 100 pixels to the width and increase maxheight and maxwidth to give users more flexibility when they choose to manually resize the window. --- src/chrome/content/preferences.js | 46 ++++++++++++++++++++++++++++++++++---- src/chrome/content/preferences.xul | 10 ++++----- 2 files changed, 47 insertions(+), 9 deletions(-) diff --git a/src/chrome/content/preferences.js b/src/chrome/content/preferences.js index 1e47cad..a76dddb 100644 --- a/src/chrome/content/preferences.js +++ b/src/chrome/content/preferences.js @@ -42,10 +42,7 @@ function torbutton_init_security_ui() { getIntPref("extensions.torbutton.security_slider"))); torbutton_set_custom(getBoolPref("extensions.torbutton.security_custom")); - // Show a scrollbar for the description text if one is needed. - // To avoid bug 21330, we set the overflow=auto style here instead - // of directly in the XUL. - document.getElementById("descBox").style.overflow = "auto"; + setTimeout(adjustDialogSize, 0); }; // Write the two prefs from the current settings. @@ -54,3 +51,44 @@ function torbutton_save_security_settings() { sliderPositionToPrefSetting(state.slider)); setBoolPref("extensions.torbutton.security_custom", state.custom); }; + +// Increase the height of this window so that a vertical scrollbar is not +// needed on the description box. +function adjustDialogSize() { + try { + // Find the height required by the tallest description element. + let descHeight = 0; + let descs = descNames.map(name => document.getElementById(name)); + descs.forEach(elem => { + let origCollapsed = elem.collapsed; + elem.collapsed = false; + let h = elem.scrollHeight; + elem.collapsed = origCollapsed; + if (h > descHeight) + descHeight = h; + }); + + // Cap the height (just in case). + const kMaxDescriptionHeight = 550; + if (descHeight > kMaxDescriptionHeight) + descHeight = kMaxDescriptionHeight; + + // Increase the height of the description container if it is too short. + let boxElem = document.getElementById("descBox"); + if (boxElem.clientHeight < descHeight) { + boxElem.setAttribute("height", descHeight); + + // Resize the XUL window to account for the new description height. In + // order for sizeToContent() to work correctly, it seems that we must + // remove the height attribute from the dialog (that attribute is added + // after a user manually resizes the window). + document.documentElement.removeAttribute("height"); + sizeToContent(); + } + } catch (e) {} + + // Show a scrollbar for the description text if one is needed. + // To avoid bug 21330, we set the overflow=auto style here instead + // of directly in the XUL. + document.getElementById("descBox").style.overflow = "auto"; +} diff --git a/src/chrome/content/preferences.xul b/src/chrome/content/preferences.xul index 9bd8ae3..9ebc5d6 100644 --- a/src/chrome/content/preferences.xul +++ b/src/chrome/content/preferences.xul @@ -13,11 +13,11 @@ onload="torbutton_init_security_ui()" align="stretch" pack="center" - maxheight="350" + maxheight="600" minwidth="400" - maxwidth="600" + maxwidth="800" ondialogaccept="torbutton_save_security_settings()" - width="400" > + width="500" > <script type="application/x-javascript" src="torbutton_util.js"/> <script type="application/x-javascript" src="preferences.js"/> @@ -26,7 +26,7 @@ <caption label="&torbutton.prefs.sec_caption;"/> <hbox id="torbutton_slider_settings" flex="1" align="stretch" hidden="false"> <vbox> - <hbox height="220"> + <hbox flex="1" minheight="220"> <vbox> <scale id="torbutton_sec_slider" flex="1" min="1" max="3" movetoclick="true" orient="vertical" @@ -57,7 +57,7 @@ </vbox> </hbox> </vbox> - <vbox id="descBox" flex="1" width="400" style="overflow: hidden;"> + <vbox id="descBox" flex="1" style="overflow: hidden;"> <vbox id="desc_high" collapsed="true"> <description class="slider-text-size, slider-text-weight">

1 0

[tor-browser-build/master] README: Update Ubuntu required version to 16.04
by boklm＠torproject.org 01 Aug '17

01 Aug '17

commit b80b64eb626bf049eb1c2fdc886deef4772aea45 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Tue Aug 1 10:40:59 2017 +0200 README: Update Ubuntu required version to 16.04 There is no runc package available on Ubuntu 14.04. --- README | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README b/README index 2fcfadf..22fb90b 100644 --- a/README +++ b/README @@ -5,7 +5,7 @@ Installing build dependencies ----------------------------- To build Tor Browser, you need a Linux distribution that has support -for runc (such as Debian jessie, Ubuntu 14.04, Fedora 20, etc ...). +for runc (such as Debian jessie, Ubuntu 16.04, Fedora 20, etc ...). On Debian jessie, the runc package is available in backports. On Debian stretch, the runc package is available in the main repository. Version 0.1.1 of runc is required (which is the version available in

1 0

[tor-browser-build/master] Bug 20848: Deploy Selfrando in 32bit Linux builds
by gk＠torproject.org 31 Jul '17

31 Jul '17

commit 8db320a7a7f2f03ce516b33668ff4509e861fe8e Author: Nicolas Vigier <boklm(a)torproject.org> Date: Mon Jul 31 18:07:53 2017 +0200 Bug 20848: Deploy Selfrando in 32bit Linux builds tor-browser-bundle.git author: Georg Koppen <gk(a)torproject.org> --- projects/binutils/build | 3 +-- projects/binutils/config | 2 +- projects/firefox/build | 3 +-- projects/firefox/config | 3 +-- projects/selfrando/build | 4 ++-- projects/selfrando/config | 10 +++++++++- 6 files changed, 15 insertions(+), 10 deletions(-) diff --git a/projects/binutils/build b/projects/binutils/build index baef68f..b72c41c 100644 --- a/projects/binutils/build +++ b/projects/binutils/build @@ -26,10 +26,9 @@ cd [% project %]-[% c("version") %] # Zeroing timestamps in PE headers reliably, see bug 12753. patch -p1 < ../peXXigen.patch [% END -%] -[% IF c("var/linux-x86_64") -%] +[% IF c("var/linux") -%] # We need to work around a gold linker bug in 2.24 to get selfrando working, # see bug 20683. - # XXX: 64bits only for now :(, see #20683. patch -p1 < $rootdir/binutils-224-gold.patch [% END -%] ./configure --prefix=$distdir [% c('var/configure_opt') %] diff --git a/projects/binutils/config b/projects/binutils/config index 88640f8..f272c76 100644 --- a/projects/binutils/config +++ b/projects/binutils/config @@ -22,4 +22,4 @@ input_files: - filename: peXXigen.patch enable: '[% c("var/windows") %]' - filename: binutils-224-gold.patch - enable: '[% c("var/linux-x86_64") %]' + enable: '[% c("var/linux") %]' diff --git a/projects/firefox/build b/projects/firefox/build index fd9fee5..c35d629 100644 --- a/projects/firefox/build +++ b/projects/firefox/build @@ -27,8 +27,7 @@ mkdir -p /var/tmp/build export PATH="/var/tmp/dist/binutils/bin:$PATH" [% END -%] -[% IF c("var/linux-x86_64") -%] - # XXX: 64bits only for now :(, see #20683. +[% IF c("var/linux") -%] tar -C /var/tmp/dist -xf $rootdir/[% c('input_files_by_name/selfrando') %] # Selfrando wrapper export PATH="/var/tmp/dist/selfrando/Tools/TorBrowser/tc-wrapper/:$PATH" diff --git a/projects/firefox/config b/projects/firefox/config index 5db64ff..50d7a4e 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -73,8 +73,7 @@ input_files: enable: '[% c("var/linux") %]' - project: selfrando name: selfrando - # XXX: 64bits only for now :(, see #20683. - enable: '[% c("var/linux-x86_64") %]' + enable: '[% c("var/linux") %]' - filename: fix-info-plist.py enable: '[% c("var/osx") %]' - URL: https://people.torproject.org/~mikeperry/mirrors/sources/msvcr100.dll diff --git a/projects/selfrando/build b/projects/selfrando/build index 8bbd63e..18437b5 100644 --- a/projects/selfrando/build +++ b/projects/selfrando/build @@ -14,9 +14,9 @@ tar -C /var/tmp/dist -xf $rootdir/[% project %]-[% c("version") %].tar.gz cd /var/tmp/dist mv [% project %]-[% c("version") %] [% project %] cd [% project %] -scons -Q arch=x86_64 LIBELF_PATH="/var/tmp/dist/elfutils" FORCE_INPLACE=1 DEBUG_LEVEL=env WRITE_LAYOUTS=env LOG=console +scons -Q arch=[% c("var/selfrando_arch") %] LIBELF_PATH="/var/tmp/dist/elfutils" FORCE_INPLACE=1 DEBUG_LEVEL=env WRITE_LAYOUTS=env LOG=console # Fix the path where we install selfrando -sed -i 's|^SR_PATH=.*|SR_PATH=/var/tmp/dist/selfrando/out/x86_64/bin|' Tools/TorBrowser/tc-wrapper/ld +sed -i 's|^SR_PATH=.*|SR_PATH=/var/tmp/dist/selfrando/out/[% c("var/selfrando_arch") %]/bin|' Tools/TorBrowser/tc-wrapper/ld cd /var/tmp/dist [% c('tar', { diff --git a/projects/selfrando/config b/projects/selfrando/config index 8b73080..33e7272 100644 --- a/projects/selfrando/config +++ b/projects/selfrando/config @@ -1,6 +1,6 @@ # vim: filetype=yaml sw=2 filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' -version: 0.2 +version: 0.3.2 git_hash: 'tb-v[% c("version") %]' git_url: https://github.com/immunant/selfrando.git gpg_keyring: selfrando.gpg @@ -13,6 +13,14 @@ var: - scons - zlib1g-dev +targets: + linux-x86_64: + var: + selfrando_arch: x86_64 + linux-i686: + var: + selfrando_arch: x86 + input_files: - project: container-image - name: binutils

1 0

[tor-browser-bundle/master] Bug 20848: Deploy Selfrando in 32bit Linux builds
by gk＠torproject.org 31 Jul '17

31 Jul '17

commit 93661cb779aada9774ea3076f983dbb8d342f1a5 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Jul 21 08:14:04 2017 +0000 Bug 20848: Deploy Selfrando in 32bit Linux builds --- gitian/descriptors/linux/gitian-firefox.yml | 22 +++++---------- gitian/descriptors/linux/gitian-utils.yml | 44 +++++++++++------------------ gitian/mkbundle-linux.sh | 5 +++- gitian/versions.alpha | 2 +- gitian/versions.nightly | 2 +- 5 files changed, 30 insertions(+), 45 deletions(-) diff --git a/gitian/descriptors/linux/gitian-firefox.yml b/gitian/descriptors/linux/gitian-firefox.yml index 9edcb3a..5710c91 100644 --- a/gitian/descriptors/linux/gitian-firefox.yml +++ b/gitian/descriptors/linux/gitian-firefox.yml @@ -34,12 +34,12 @@ files: - "binutils-linux64-utils.zip" - "gcc-linux32-utils.zip" - "gcc-linux64-utils.zip" +- "selfrando-linux32-utils.zip" +- "selfrando-linux64-utils.zip" - "get-moz-build-date" - "re-dzip.sh" - "dzip.sh" - "versions" -# XXX: 64bits only for now :(, see #20683. -- "selfrando-linux64-utils.zip" script: | source versions INSTDIR="$HOME/install" @@ -57,11 +57,7 @@ script: | export DEB_BUILD_HARDENING_FORMAT=1 export DEB_BUILD_HARDENING_PIE=1 # - # XXX: 64bits only for now :(, see #20683. - if [ $GBUILD_BITS == "64" ]; - then - unzip -d $INSTDIR selfrando-linux64-utils.zip - fi + unzip -d $INSTDIR selfrando-linux$GBUILD_BITS-utils.zip # Preparing Binutils and GCC for Tor Browser unzip -d $INSTDIR binutils-linux$GBUILD_BITS-utils.zip unzip -d $INSTDIR gcc-linux$GBUILD_BITS-utils.zip @@ -86,14 +82,10 @@ script: | find -type f -print0 | xargs -0 touch --date="$REFERENCE_DATETIME" rm -f configure rm -f js/src/configure - # XXX: 64bits only for now :(, see #20683. - if [ $GBUILD_BITS == "64" ]; - then - # Selfrando wrapper - export PATH="$HOME/build/selfrando/Tools/TorBrowser/tc-wrapper/:$PATH" - # We need to avoid the shuffling while building as this breaks compilation - export SELFRANDO_skip_shuffle= - fi + # Selfrando wrapper + export PATH="$HOME/build/selfrando/Tools/TorBrowser/tc-wrapper/:$PATH" + # We need to avoid the shuffling while building as this breaks compilation + export SELFRANDO_skip_shuffle= make -f client.mk configure CONFIGURE_ARGS="--with-tor-browser-version=${TORBROWSER_VERSION} --with-distribution-id=org.torproject --enable-update-channel=${TORBROWSER_UPDATE_CHANNEL} --enable-bundled-fonts" find -type f -print0 | xargs -0 touch --date="$REFERENCE_DATETIME" make $MAKEOPTS -f client.mk build diff --git a/gitian/descriptors/linux/gitian-utils.yml b/gitian/descriptors/linux/gitian-utils.yml index 2680f1b..87f2a03 100644 --- a/gitian/descriptors/linux/gitian-utils.yml +++ b/gitian/descriptors/linux/gitian-utils.yml @@ -59,9 +59,11 @@ script: | export DEB_BUILD_HARDENING_PIE=1 ARCH="" + SR_ARCH="x86" if [ $GBUILD_BITS == "64" ]; then ARCH="64" + SR_ARCH="x86_64" fi # Building Binutils @@ -77,11 +79,7 @@ script: | cd binutils* # We need to work around a gold linker bug in 2.24 to get selfrando working, # see bug 20683. - # XXX: 64bits only for now :(, see #20683. - if [ $GBUILD_BITS == "64" ]; - then - patch -p1 < ../binutils-224-gold.patch - fi + patch -p1 < ../binutils-224-gold.patch # We want to use gold as the linker in our toolchain mainly as it is way # faster when linking Tor Browser code (especially libxul). But apart from # that it fixes #12103 and issues with ESR 31 and our Gitian setup as well @@ -129,24 +127,20 @@ script: | export PATH="$INSTDIR/binutils/bin:$INSTDIR/gcc/bin:$PATH" export LD_LIBRARY_PATH="$INSTDIR/gcc/lib$ARCH" - # XXX: 64bits only for now :(, see #20683. - if [ $GBUILD_BITS == "64" ]; - then - # Building Elfutils - tar xjf elfutils.tar.bz2 - cd elfutils*/ - ./configure --prefix=$INSTDIR/elfutils - make $MAKEOPTS - make install - cd .. + # Building Elfutils + tar xjf elfutils.tar.bz2 + cd elfutils*/ + ./configure --prefix=$INSTDIR/elfutils + make $MAKEOPTS + make install + cd .. - # Building Selfrando - cd selfrando - scons -Q arch=x86_64 LIBELF_PATH="$INSTDIR/elfutils" FORCE_INPLACE=1 DEBUG_LEVEL=env WRITE_LAYOUTS=env LOG=console - mkdir -p $INSTDIR/selfrando - cp out/x86_64/bin/* $INSTDIR/selfrando/ - cd .. - fi + # Building Selfrando + cd selfrando + scons -Q arch=$SR_ARCH LIBELF_PATH="$INSTDIR/elfutils" FORCE_INPLACE=1 DEBUG_LEVEL=env WRITE_LAYOUTS=env LOG=console + mkdir -p $INSTDIR/selfrando + cp out/$SR_ARCH/bin/* $INSTDIR/selfrando/ + cd .. # Building Libevent cd libevent @@ -221,9 +215,5 @@ script: | ~/build/dzip.sh libevent-${LIBEVENT_TAG#release-}-linux$GBUILD_BITS-utils.zip libevent ~/build/dzip.sh gmp-$GMP_VER-linux$GBUILD_BITS-utils.zip gmp ~/build/dzip.sh go-$GO_VER-linux$GBUILD_BITS-utils.zip go - # XXX: 64bits only for now :(, see #20683. - if [ $GBUILD_BITS == "64" ]; - then - ~/build/dzip.sh selfrando-$SELFRANDO_TAG-linux$GBUILD_BITS-utils.zip selfrando - fi + ~/build/dzip.sh selfrando-$SELFRANDO_TAG-linux$GBUILD_BITS-utils.zip selfrando cp *utils.zip $OUTDIR/ diff --git a/gitian/mkbundle-linux.sh b/gitian/mkbundle-linux.sh index 0a1613f..d348ca5 100755 --- a/gitian/mkbundle-linux.sh +++ b/gitian/mkbundle-linux.sh @@ -96,10 +96,10 @@ then PYPTLIB_TAG=refs/tags/$PYPTLIB_TAG OBFSPROXY_TAG=refs/tags/$OBFSPROXY_TAG OBFS4_TAG=refs/tags/$OBFS4_TAG + SELFRANDO_TAG=refs/tags/$SELFRANDO_TAG fi cd $GITIAN_DIR -# XXX: 64bits selfrando only for now :(, see #20683. if [ ! -f inputs/binutils-$BINUTILS_VER-linux32-utils.zip -o \ ! -f inputs/binutils-$BINUTILS_VER-linux64-utils.zip -o \ ! -f inputs/gcc-$GCC_VER-linux32-utils.zip -o \ @@ -112,6 +112,7 @@ if [ ! -f inputs/binutils-$BINUTILS_VER-linux32-utils.zip -o \ ! -f inputs/gmp-$GMP_VER-linux64-utils.zip -o \ ! -f inputs/go-$GO_VER-linux32-utils.zip -o \ ! -f inputs/go-$GO_VER-linux64-utils.zip -o \ + ! -f inputs/selfrando-$SELFRANDO_TAG-linux32-utils.zip -o \ ! -f inputs/selfrando-$SELFRANDO_TAG-linux64-utils.zip ]; then echo @@ -139,6 +140,7 @@ then ln -sf gmp-$GMP_VER-linux64-utils.zip gmp-linux64-utils.zip ln -sf go-$GO_VER-linux32-utils.zip go-linux32-utils.zip ln -sf go-$GO_VER-linux64-utils.zip go-linux64-utils.zip + ln -sf selfrando-$SELFRANDO_TAG-linux32-utils.zip selfrando-linux32-utils.zip ln -sf selfrando-$SELFRANDO_TAG-linux64-utils.zip selfrando-linux64-utils.zip cd .. #cp -a result/utils-linux-res.yml inputs/ @@ -161,6 +163,7 @@ else ln -sf gmp-$GMP_VER-linux64-utils.zip gmp-linux64-utils.zip ln -sf go-$GO_VER-linux32-utils.zip go-linux32-utils.zip ln -sf go-$GO_VER-linux64-utils.zip go-linux64-utils.zip + ln -sf selfrando-$SELFRANDO_TAG-linux32-utils.zip selfrando-linux32-utils.zip ln -sf selfrando-$SELFRANDO_TAG-linux64-utils.zip selfrando-linux64-utils.zip cd .. fi diff --git a/gitian/versions.alpha b/gitian/versions.alpha index 17d3849..c35c51b 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -47,7 +47,7 @@ WEBRTC_TAG=c279861207c5b15fc51069e96595782350e0ac12 # https://chromium.googlesou GO_WEBRTC_TAG=ab1b64862e0c4b4182010699911c2c5818f0a101 SNOWFLAKE_TAG=9f2e9a6ecb696149708716ca06ce842df03cf492 UNIURI_TAG=8902c56451e9b58ff940bbe5fec35d5f9c04584a -SELFRANDO_TAG=tb-v0.2 +SELFRANDO_TAG=tb-v0.3.2 GITIAN_TAG=tor-browser-builder-4-4 diff --git a/gitian/versions.nightly b/gitian/versions.nightly index 1f392c3..a2062bd 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -50,7 +50,7 @@ WEBRTC_TAG=c279861207c5b15fc51069e96595782350e0ac12 # https://chromium.googlesou GO_WEBRTC_TAG=master SNOWFLAKE_TAG=master UNIURI_TAG=master -SELFRANDO_TAG=tb-v0.2 +SELFRANDO_TAG=tb-v0.3.2 GITIAN_TAG=tor-browser-builder-4

1 0

[tor-browser-bundle/maint-7.0] Revert "Bug 22362: NoScript's XSS filter freezes the browser"
by gk＠torproject.org 31 Jul '17

31 Jul '17

commit b9e83cebe097c3c3ef7454ce26310ae672de2490 Author: Georg Koppen <gk(a)torproject.org> Date: Mon Jul 31 13:25:10 2017 +0000 Revert "Bug 22362: NoScript's XSS filter freezes the browser" This reverts commit e8178d1373d6ce2599ef58eca4d52d1b6817263f. That's properly fixed in NoScript >= 5.0.7.1, thus removing our workaround. --- .../Data/Browser/profile.default/preferences/extension-overrides.js | 4 ---- .../Data/Browser/profile.default/preferences/extension-overrides.js | 4 ---- .../Data/Browser/profile.default/preferences/extension-overrides.js | 4 ---- 3 files changed, 12 deletions(-) diff --git a/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js b/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js index a34fb36..6ef2c45 100644 --- a/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js @@ -55,7 +55,3 @@ pref("noscript.restrictSubdocScripting", true); pref("noscript.showVolatilePrivatePermissionsToggle", false); pref("noscript.volatilePrivatePermissions", true); pref("noscript.clearClick", 0); -// Workaround for bug 22362: Disable XSS filter for now as it freezes the -// browser in some circumstances. -pref("noscript.filterXGet", false); -pref("noscript.filterXPost", false); diff --git a/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js b/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js index a34fb36..6ef2c45 100644 --- a/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js @@ -55,7 +55,3 @@ pref("noscript.restrictSubdocScripting", true); pref("noscript.showVolatilePrivatePermissionsToggle", false); pref("noscript.volatilePrivatePermissions", true); pref("noscript.clearClick", 0); -// Workaround for bug 22362: Disable XSS filter for now as it freezes the -// browser in some circumstances. -pref("noscript.filterXGet", false); -pref("noscript.filterXPost", false); diff --git a/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js b/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js index a34fb36..6ef2c45 100644 --- a/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js @@ -55,7 +55,3 @@ pref("noscript.restrictSubdocScripting", true); pref("noscript.showVolatilePrivatePermissionsToggle", false); pref("noscript.volatilePrivatePermissions", true); pref("noscript.clearClick", 0); -// Workaround for bug 22362: Disable XSS filter for now as it freezes the -// browser in some circumstances. -pref("noscript.filterXGet", false); -pref("noscript.filterXPost", false);

1 0

[tor-browser-bundle/master] Revert "Bug 22362: NoScript's XSS filter freezes the browser"
by gk＠torproject.org 31 Jul '17

31 Jul '17

commit 47035611306843657a5847d31fd4b5600742127a Author: Georg Koppen <gk(a)torproject.org> Date: Mon Jul 31 13:25:10 2017 +0000 Revert "Bug 22362: NoScript's XSS filter freezes the browser" This reverts commit e8178d1373d6ce2599ef58eca4d52d1b6817263f. That's properly fixed in NoScript >= 5.0.7.1, thus removing our workaround. --- .../Data/Browser/profile.default/preferences/extension-overrides.js | 4 ---- .../Data/Browser/profile.default/preferences/extension-overrides.js | 4 ---- .../Data/Browser/profile.default/preferences/extension-overrides.js | 4 ---- 3 files changed, 12 deletions(-) diff --git a/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js b/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js index 164835a..d6e5546 100644 --- a/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js @@ -55,7 +55,3 @@ pref("noscript.restrictSubdocScripting", true); pref("noscript.showVolatilePrivatePermissionsToggle", false); pref("noscript.volatilePrivatePermissions", true); pref("noscript.clearClick", 0); -// Workaround for bug 22362: Disable XSS filter for now as it freezes the -// browser in some circumstances. -pref("noscript.filterXGet", false); -pref("noscript.filterXPost", false); diff --git a/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js b/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js index 164835a..d6e5546 100644 --- a/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js @@ -55,7 +55,3 @@ pref("noscript.restrictSubdocScripting", true); pref("noscript.showVolatilePrivatePermissionsToggle", false); pref("noscript.volatilePrivatePermissions", true); pref("noscript.clearClick", 0); -// Workaround for bug 22362: Disable XSS filter for now as it freezes the -// browser in some circumstances. -pref("noscript.filterXGet", false); -pref("noscript.filterXPost", false); diff --git a/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js b/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js index 164835a..d6e5546 100644 --- a/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js @@ -55,7 +55,3 @@ pref("noscript.restrictSubdocScripting", true); pref("noscript.showVolatilePrivatePermissionsToggle", false); pref("noscript.volatilePrivatePermissions", true); pref("noscript.clearClick", 0); -// Workaround for bug 22362: Disable XSS filter for now as it freezes the -// browser in some circumstances. -pref("noscript.filterXGet", false); -pref("noscript.filterXPost", false);

1 0

[tor-browser-build/master] Bug 22563: Update mingw-w64 to fix W^X violations
by boklm＠torproject.org 31 Jul '17

31 Jul '17

commit 373cf261bd190d69669d1545b2b99c5a09c66d15 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Tue Jul 11 18:44:48 2017 -0700 Bug 22563: Update mingw-w64 to fix W^X violations --- projects/mingw-w64/config | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/projects/mingw-w64/config b/projects/mingw-w64/config index 61a34bd..ac1caa9 100644 --- a/projects/mingw-w64/config +++ b/projects/mingw-w64/config @@ -1,7 +1,7 @@ # vim: filetype=yaml sw=2 filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz' git_url: http://git.code.sf.net/p/mingw-w64/mingw-w64 -git_hash: 98e5b4930a717eafddd8ca0f0dfeb7c57c6b026a +git_hash: 1259532ff8f5a7ac625b2f28d499ee93a0c0841e version: '[% c("abbrev") %]' var: container:

1 0

[tor-browser/tor-browser-52.2.0esr-7.5-1] Revert "Getting Tor Browser to build with accessibility enabled on Windows"
by gk＠torproject.org 31 Jul '17

31 Jul '17

commit 2e5a0f5570f5b2ba0bf9d84cd74b6553407a0435 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Wed Jul 12 11:47:39 2017 -0700 Revert "Getting Tor Browser to build with accessibility enabled on Windows" This reverts commit d890171dbb89ebb79df1522f6b37bda538ef7e32, because we have updated mingw-w64 to 1259532ff8f5a7ac625b2f28d499ee93a0c0841e --- ipc/mscom/Interceptor.h | 2 +- other-licenses/ia2/IA2TypeLibrary.idl | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/ipc/mscom/Interceptor.h b/ipc/mscom/Interceptor.h index 88acdf6650a8..ecddbddf5769 100644 --- a/ipc/mscom/Interceptor.h +++ b/ipc/mscom/Interceptor.h @@ -112,7 +112,7 @@ CreateInterceptor(STAUniquePtr<InterfaceT> aTargetInterface, return E_INVALIDARG; } - REFIID iidTarget = __uuidof(InterfaceT); + REFIID iidTarget = __uuidof(aTargetInterface); STAUniquePtr<IUnknown> targetUnknown(aTargetInterface.release()); return Interceptor::Create(Move(targetUnknown), aEventSink, iidTarget, diff --git a/other-licenses/ia2/IA2TypeLibrary.idl b/other-licenses/ia2/IA2TypeLibrary.idl index 97aa08b9a5f8..2519aca91e13 100644 --- a/other-licenses/ia2/IA2TypeLibrary.idl +++ b/other-licenses/ia2/IA2TypeLibrary.idl @@ -68,7 +68,7 @@ cpp_quote("") library IAccessible2Lib { importlib ("stdole2.tlb"); - //importlib ("oleacc.dll"); + importlib ("oleacc.dll"); interface IAccessible2; interface IAccessible2_2; interface IAccessible2_3;

1 0

[tor-browser/tor-browser-52.2.0esr-7.5-1] Don't break accessibility support for Windows
by gk＠torproject.org 31 Jul '17

31 Jul '17

commit 84d370aab03e45fbafef90b0fd99153e45a1b64a Author: Georg Koppen <gk(a)torproject.org> Date: Mon Jul 31 11:07:12 2017 +0000 Don't break accessibility support for Windows This fixes https://bugzilla.mozilla.org/show_bug.cgi?id=1372959 --- ipc/mscom/Interceptor.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ipc/mscom/Interceptor.h b/ipc/mscom/Interceptor.h index ecddbddf5769..88acdf6650a8 100644 --- a/ipc/mscom/Interceptor.h +++ b/ipc/mscom/Interceptor.h @@ -112,7 +112,7 @@ CreateInterceptor(STAUniquePtr<InterfaceT> aTargetInterface, return E_INVALIDARG; } - REFIID iidTarget = __uuidof(aTargetInterface); + REFIID iidTarget = __uuidof(InterfaceT); STAUniquePtr<IUnknown> targetUnknown(aTargetInterface.release()); return Interceptor::Create(Move(targetUnknown), aEventSink, iidTarget,

1 0

[tor-browser-bundle/master] Bug 22563: Update mingw-w64 to fix W^X violations
by gk＠torproject.org 31 Jul '17

31 Jul '17

commit b42927a08821f1e1d46267156c369e3b45379758 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Sun Jul 16 22:31:13 2017 -0700 Bug 22563: Update mingw-w64 to fix W^X violations --- gitian/versions.alpha | 2 +- gitian/versions.nightly | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/gitian/versions.alpha b/gitian/versions.alpha index a29572a..17d3849 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -23,7 +23,7 @@ NSIS_TAG=v0.3.1 ZLIB_TAG=v1.2.8 LIBEVENT_TAG=release-2.0.22-stable CMAKE_TAG=v2.8.12.2 -MINGW_TAG=98e5b4930a717eafddd8ca0f0dfeb7c57c6b026a +MINGW_TAG=1259532ff8f5a7ac625b2f28d499ee93a0c0841e PYPTLIB_TAG=pyptlib-0.0.6 OBFSPROXY_TAG=obfsproxy-0.2.12 LIBFTE_TAG=85ef8ae58dbf0d02ea26b627e343784b5574c428 # sketch master with fix diff --git a/gitian/versions.nightly b/gitian/versions.nightly index e050347..1f392c3 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -26,7 +26,7 @@ NSIS_TAG=v0.3.1 ZLIB_TAG=v1.2.8 LIBEVENT_TAG=release-2.0.22-stable CMAKE_TAG=v2.8.12.2 -MINGW_TAG=98e5b4930a717eafddd8ca0f0dfeb7c57c6b026a +MINGW_TAG=1259532ff8f5a7ac625b2f28d499ee93a0c0841e PYPTLIB_TAG=master OBFSPROXY_TAG=master LIBFTE_TAG=master

1 0

[tor-browser-build/master] Update noscript
by boklm＠torproject.org 28 Jul '17

28 Jul '17

commit 867ebd59598ae3a77d84c21d008b2c6debec372b Author: Nicolas Vigier <boklm(a)torproject.org> Date: Fri Jul 28 19:04:43 2017 +0200 Update noscript This fixes bug 22067. tor-browser-bundle.git author: Georg Koppen <gk(a)torproject.org> tor-browser-bundle.git commit: 0437834017c1c7ff168da868d9dcb2f2519fd122 --- projects/tor-browser/config | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/projects/tor-browser/config b/projects/tor-browser/config index 8e8398a..fef279b 100644 --- a/projects/tor-browser/config +++ b/projects/tor-browser/config @@ -54,9 +54,9 @@ input_files: name: snowflake enable: '[% c("var/snowflake") %]' - filename: Bundle-Data - - URL: https://addons.cdn.mozilla.net/user-media/addons/722/noscript_security_suit… + - URL: https://addons.cdn.mozilla.net/user-media/addons/722/noscript_security_suit… name: noscript - sha256sum: bf1dee39f6e5936df2b03b794c1efc9236b440536a05fafcff667e33903e6aed + sha256sum: fe85a4c72b5a763462f3b264f54a0ef1c6f6879eb95d903f2dfee337f768a50b - filename: RelativeLink enable: '[% c("var/linux") %]' - project: libdmg-hfsplus

1 0

[tor-browser-bundle/maint-7.0] Updating NoScript
by gk＠torproject.org 28 Jul '17

28 Jul '17

commit 12565f000a09b27b7dbd9ea864c5004b6d8324a9 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Jul 28 16:21:20 2017 +0000 Updating NoScript This fixes bug 22067. --- gitian/versions | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/gitian/versions b/gitian/versions index 108d085..873aa7f 100755 --- a/gitian/versions +++ b/gitian/versions @@ -67,7 +67,7 @@ YASM_VER=1.2.0 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz GMP_PACKAGE=gmp-${GMP_VER}.tar.bz2 -NOSCRIPT_PACKAGE=noscript_security_suite-5.0.5-fx+sm.xpi +NOSCRIPT_PACKAGE=noscript_security_suite-5.0.7.1-fx+sm.xpi CCTOOLS_PACKAGE=cctools.tar.gz OSXSDK_PACKAGE=MacOSX10.7.sdk.tar.gz MSVCR100_PACKAGE=msvcr100.dll @@ -102,7 +102,7 @@ YASM_PACKAGE=yasm-${YASM_VER}.tar.gz OPENSSL_HASH=6b3977c61f2aedf0f96367dcfb5c6e578cf37e7b8d913b4ecb6643c3cb88d8c0 GMP_HASH=752079520b4690531171d0f4532e40f08600215feefede70b24fabdc6f1ab160 OSXSDK_HASH=da77bb0003fcca5ea8c4e8cb2da8828ded750c54afdcac29ec6f3b46ad5e3adf -NOSCRIPT_HASH=bf1dee39f6e5936df2b03b794c1efc9236b440536a05fafcff667e33903e6aed +NOSCRIPT_HASH=fe85a4c72b5a763462f3b264f54a0ef1c6f6879eb95d903f2dfee337f768a50b CCTOOLS_HASH=e908fdebc2886ee5491ebfc7e7950af451b3c4e2439c2d7a923ed06ad05113e4 MSVCR100_HASH=1221a09484964a6f38af5e34ee292b9afefccb3dc6e55435fd3aaf7c235d9067 PYCRYPTO_HASH=f2ce1e989b272cfcb677616763e0a2e7ec659effa67a88aa92b3a65528f60a3c

1 0

[tor-browser-bundle/master] Updating Noscript
by gk＠torproject.org 28 Jul '17

28 Jul '17

commit 0437834017c1c7ff168da868d9dcb2f2519fd122 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Jul 28 16:19:01 2017 +0000 Updating Noscript This fixes bug 22067. --- gitian/versions.alpha | 4 ++-- gitian/versions.nightly | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/gitian/versions.alpha b/gitian/versions.alpha index ee7384c..a29572a 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -77,7 +77,7 @@ ELFUTILS_VER=0.166 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz GMP_PACKAGE=gmp-${GMP_VER}.tar.bz2 -NOSCRIPT_PACKAGE=noscript_security_suite-5.0.5-fx+sm.xpi +NOSCRIPT_PACKAGE=noscript_security_suite-5.0.7.1-fx+sm.xpi CCTOOLS_PACKAGE=cctools.tar.gz OSXSDK_PACKAGE=MacOSX10.7.sdk.tar.gz MSVCR100_PACKAGE=msvcr100.dll @@ -113,7 +113,7 @@ ELFUTILS_PACKAGE=elfutils-${ELFUTILS_VER}.tar.bz2 OPENSSL_HASH=6b3977c61f2aedf0f96367dcfb5c6e578cf37e7b8d913b4ecb6643c3cb88d8c0 GMP_HASH=752079520b4690531171d0f4532e40f08600215feefede70b24fabdc6f1ab160 OSXSDK_HASH=da77bb0003fcca5ea8c4e8cb2da8828ded750c54afdcac29ec6f3b46ad5e3adf -NOSCRIPT_HASH=bf1dee39f6e5936df2b03b794c1efc9236b440536a05fafcff667e33903e6aed +NOSCRIPT_HASH=fe85a4c72b5a763462f3b264f54a0ef1c6f6879eb95d903f2dfee337f768a50b CCTOOLS_HASH=e908fdebc2886ee5491ebfc7e7950af451b3c4e2439c2d7a923ed06ad05113e4 MSVCR100_HASH=1221a09484964a6f38af5e34ee292b9afefccb3dc6e55435fd3aaf7c235d9067 PYCRYPTO_HASH=f2ce1e989b272cfcb677616763e0a2e7ec659effa67a88aa92b3a65528f60a3c diff --git a/gitian/versions.nightly b/gitian/versions.nightly index 5fe2881..e050347 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -80,7 +80,7 @@ ELFUTILS_VER=0.166 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz GMP_PACKAGE=gmp-${GMP_VER}.tar.bz2 -NOSCRIPT_PACKAGE=noscript_security_suite-5.0.5-fx+sm.xpi +NOSCRIPT_PACKAGE=noscript_security_suite-5.0.7.1-fx+sm.xpi CCTOOLS_PACKAGE=cctools.tar.gz OSXSDK_PACKAGE=MacOSX10.7.sdk.tar.gz MSVCR100_PACKAGE=msvcr100.dll @@ -116,7 +116,7 @@ ELFUTILS_PACKAGE=elfutils-${ELFUTILS_VER}.tar.bz2 OPENSSL_HASH=ce07195b659e75f4e1db43552860070061f156a98bb37b672b101ba6e3ddf30c GMP_HASH=752079520b4690531171d0f4532e40f08600215feefede70b24fabdc6f1ab160 OSXSDK_HASH=da77bb0003fcca5ea8c4e8cb2da8828ded750c54afdcac29ec6f3b46ad5e3adf -NOSCRIPT_HASH=bf1dee39f6e5936df2b03b794c1efc9236b440536a05fafcff667e33903e6aed +NOSCRIPT_HASH=fe85a4c72b5a763462f3b264f54a0ef1c6f6879eb95d903f2dfee337f768a50b CCTOOLS_HASH=e908fdebc2886ee5491ebfc7e7950af451b3c4e2439c2d7a923ed06ad05113e4 MSVCR100_HASH=1221a09484964a6f38af5e34ee292b9afefccb3dc6e55435fd3aaf7c235d9067 PYCRYPTO_HASH=f2ce1e989b272cfcb677616763e0a2e7ec659effa67a88aa92b3a65528f60a3c

1 0

[tor-browser-bundle/maint-7.0] Apply patch for bug 23044
by gk＠torproject.org 27 Jul '17

27 Jul '17

commit a11a8b301950e1c25adcfd5bea07c773f5082533 Author: Georg Koppen <gk(a)torproject.org> Date: Thu Jul 27 08:10:20 2017 +0000 Apply patch for bug 23044 --- gitian/descriptors/linux/gitian-firefox.yml | 2 ++ gitian/patches/gio.patch | 48 +++++++++++++++++++++++++++++ 2 files changed, 50 insertions(+) diff --git a/gitian/descriptors/linux/gitian-firefox.yml b/gitian/descriptors/linux/gitian-firefox.yml index 1ff66a2..49c457c 100644 --- a/gitian/descriptors/linux/gitian-firefox.yml +++ b/gitian/descriptors/linux/gitian-firefox.yml @@ -33,6 +33,7 @@ files: - "gcc-linux32-utils.zip" - "gcc-linux64-utils.zip" - "get-moz-build-date" +- "gio.patch" - "re-dzip.sh" - "dzip.sh" - "versions" @@ -88,6 +89,7 @@ script: | mkdir -p $INSTDIR/Debug/Browser/ cd tor-browser + patch -p1 < ../gio.patch # run get-moz-build-date before removing .git, which is used to get the year chmod +x ~/build/get-moz-build-date eval $(~/build/get-moz-build-date $(cat browser/config/version.txt)) diff --git a/gitian/patches/gio.patch b/gitian/patches/gio.patch new file mode 100644 index 0000000..1edae4d --- /dev/null +++ b/gitian/patches/gio.patch @@ -0,0 +1,48 @@ +From a96f898e0da42de751a5e1367a9899cc96fadb1f Mon Sep 17 00:00:00 2001 +From: Georg Koppen <gk(a)torproject.org> +Date: Thu, 27 Jul 2017 07:31:38 +0000 +Subject: [PATCH] Bug 23044: Don't allow GIO supported protocols by default + + +diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js +index aaeba630422d..3edaad88f59e 100644 +--- a/browser/app/profile/000-tor-browser.js ++++ b/browser/app/profile/000-tor-browser.js +@@ -210,6 +210,9 @@ pref("network.protocol-handler.warn-external.mailto", true); + pref("network.protocol-handler.warn-external.news", true); + pref("network.protocol-handler.warn-external.nntp", true); + pref("network.protocol-handler.warn-external.snews", true); ++// Make sure we don't have any GIO supported protocols (defense in depth ++// measure) ++pref("network.gio.supported-protocols", ""); + pref("plugin.disable", true); // Disable to search plugins on first start + pref("plugins.click_to_play", true); + pref("plugin.state.flash", 1); +diff --git a/extensions/gio/nsGIOProtocolHandler.cpp b/extensions/gio/nsGIOProtocolHandler.cpp +index a378e8700821..5f6b2a0a2a57 100644 +--- a/extensions/gio/nsGIOProtocolHandler.cpp ++++ b/extensions/gio/nsGIOProtocolHandler.cpp +@@ -922,16 +922,16 @@ nsGIOProtocolHandler::InitSupportedProtocolsPref(nsIPrefBranch *prefs) + // Get user preferences to determine which protocol is supported. + // Gvfs/GIO has a set of supported protocols like obex, network, archive, + // computer, dav, cdda, gphoto2, trash, etc. Some of these seems to be +- // irrelevant to process by browser. By default accept only smb and sftp +- // protocols so far. ++ // irrelevant to process by browser. By default accept none. + nsresult rv = prefs->GetCharPref(MOZ_GIO_SUPPORTED_PROTOCOLS, + getter_Copies(mSupportedProtocols)); + if (NS_SUCCEEDED(rv)) { + mSupportedProtocols.StripWhitespace(); + ToLowerCase(mSupportedProtocols); + } +- else +- mSupportedProtocols.AssignLiteral("smb:,sftp:"); // use defaults ++ else { ++ mSupportedProtocols.AssignLiteral(""); // use none by default ++ } + + LOG(("gio: supported protocols \"%s\"\n", mSupportedProtocols.get())); + } +-- +2.13.2 +

1 0

[tor-browser-bundle/maint-7.0] Changelog update, and config.yml changes
by gk＠torproject.org 27 Jul '17

27 Jul '17

commit fb678ac1a95ed724f0edb8bc1f7c748d0ef8b8d1 Author: Georg Koppen <gk(a)torproject.org> Date: Thu Jul 27 08:06:44 2017 +0000 Changelog update, and config.yml changes --- Bundle-Data/Docs/ChangeLog.txt | 4 ++++ tools/update-responses/config.yml | 8 ++++---- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index c7cb8c2..d509505 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,7 @@ +Tor Browser 7.0.3 -- July 27 2017 + * Linux + * Bug 23044: Don't allow GIO supported protocols by default + Tor Browser 7.0.2 -- July 3 2017 * All Platforms * Update Tor to 0.3.0.9, fixing bug #22753 diff --git a/tools/update-responses/config.yml b/tools/update-responses/config.yml index 9ff92ce..1547dfd 100644 --- a/tools/update-responses/config.yml +++ b/tools/update-responses/config.yml @@ -20,13 +20,13 @@ build_targets: osx64: Darwin_x86_64-gcc3 channels: alpha: 7.0a4 - release: 7.0.2 + release: 7.0.3 versions: - 7.0.2: + 7.0.3: platformVersion: 52.2.0 - detailsURL: https://blog.torproject.org/blog/tor-browser-702-released + detailsURL: https://blog.torproject.org/blog/tor-browser-703-released incremental_from: - - 7.0.1 + - 7.0.2 migrate_archs: osx32: osx64 migrate_langs:

1 0

[tor-browser/tor-browser-52.2.0esr-7.5-1] Bug 23044: Don't allow GIO supported protocols by default
by gk＠torproject.org 27 Jul '17

27 Jul '17

commit a96f898e0da42de751a5e1367a9899cc96fadb1f Author: Georg Koppen <gk(a)torproject.org> Date: Thu Jul 27 07:31:38 2017 +0000 Bug 23044: Don't allow GIO supported protocols by default --- browser/app/profile/000-tor-browser.js | 3 +++ extensions/gio/nsGIOProtocolHandler.cpp | 8 ++++---- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index aaeba630422d..3edaad88f59e 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -210,6 +210,9 @@ pref("network.protocol-handler.warn-external.mailto", true); pref("network.protocol-handler.warn-external.news", true); pref("network.protocol-handler.warn-external.nntp", true); pref("network.protocol-handler.warn-external.snews", true); +// Make sure we don't have any GIO supported protocols (defense in depth +// measure) +pref("network.gio.supported-protocols", ""); pref("plugin.disable", true); // Disable to search plugins on first start pref("plugins.click_to_play", true); pref("plugin.state.flash", 1); diff --git a/extensions/gio/nsGIOProtocolHandler.cpp b/extensions/gio/nsGIOProtocolHandler.cpp index a378e8700821..5f6b2a0a2a57 100644 --- a/extensions/gio/nsGIOProtocolHandler.cpp +++ b/extensions/gio/nsGIOProtocolHandler.cpp @@ -922,16 +922,16 @@ nsGIOProtocolHandler::InitSupportedProtocolsPref(nsIPrefBranch *prefs) // Get user preferences to determine which protocol is supported. // Gvfs/GIO has a set of supported protocols like obex, network, archive, // computer, dav, cdda, gphoto2, trash, etc. Some of these seems to be - // irrelevant to process by browser. By default accept only smb and sftp - // protocols so far. + // irrelevant to process by browser. By default accept none. nsresult rv = prefs->GetCharPref(MOZ_GIO_SUPPORTED_PROTOCOLS, getter_Copies(mSupportedProtocols)); if (NS_SUCCEEDED(rv)) { mSupportedProtocols.StripWhitespace(); ToLowerCase(mSupportedProtocols); } - else - mSupportedProtocols.AssignLiteral("smb:,sftp:"); // use defaults + else { + mSupportedProtocols.AssignLiteral(""); // use none by default + } LOG(("gio: supported protocols \"%s\"\n", mSupportedProtocols.get())); }

1 0

[tor-browser/tor-browser-52.2.0esr-7.0-1] Bug 23044: Don't allow GIO supported protocols by default
by gk＠torproject.org 27 Jul '17

27 Jul '17

commit 720f9061496321aa978d2f022113c40e9aeb4847 Author: Georg Koppen <gk(a)torproject.org> Date: Thu Jul 27 07:31:38 2017 +0000 Bug 23044: Don't allow GIO supported protocols by default --- browser/app/profile/000-tor-browser.js | 3 +++ extensions/gio/nsGIOProtocolHandler.cpp | 8 ++++---- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index d2fb5e57378a..dc7e99701293 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -210,6 +210,9 @@ pref("network.protocol-handler.warn-external.mailto", true); pref("network.protocol-handler.warn-external.news", true); pref("network.protocol-handler.warn-external.nntp", true); pref("network.protocol-handler.warn-external.snews", true); +// Make sure we don't have any GIO supported protocols (defense in depth +// measure) +pref("network.gio.supported-protocols", ""); pref("plugin.disable", true); // Disable to search plugins on first start pref("plugins.click_to_play", true); pref("plugin.state.flash", 1); diff --git a/extensions/gio/nsGIOProtocolHandler.cpp b/extensions/gio/nsGIOProtocolHandler.cpp index a378e8700821..5f6b2a0a2a57 100644 --- a/extensions/gio/nsGIOProtocolHandler.cpp +++ b/extensions/gio/nsGIOProtocolHandler.cpp @@ -922,16 +922,16 @@ nsGIOProtocolHandler::InitSupportedProtocolsPref(nsIPrefBranch *prefs) // Get user preferences to determine which protocol is supported. // Gvfs/GIO has a set of supported protocols like obex, network, archive, // computer, dav, cdda, gphoto2, trash, etc. Some of these seems to be - // irrelevant to process by browser. By default accept only smb and sftp - // protocols so far. + // irrelevant to process by browser. By default accept none. nsresult rv = prefs->GetCharPref(MOZ_GIO_SUPPORTED_PROTOCOLS, getter_Copies(mSupportedProtocols)); if (NS_SUCCEEDED(rv)) { mSupportedProtocols.StripWhitespace(); ToLowerCase(mSupportedProtocols); } - else - mSupportedProtocols.AssignLiteral("smb:,sftp:"); // use defaults + else { + mSupportedProtocols.AssignLiteral(""); // use none by default + } LOG(("gio: supported protocols \"%s\"\n", mSupportedProtocols.get())); }

1 0

[tor-browser-build/master] Include uid in tmp containers directory
by boklm＠torproject.org 26 Jul '17

26 Jul '17

commit 9084d642cfc291df76b9fd4acecdce5aeb7f71b9 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Wed Jul 26 12:09:07 2017 +0200 Include uid in tmp containers directory This should allow multiple users to do builds on the same machine. --- rbm.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rbm.conf b/rbm.conf index ce444d4..4ef6b90 100644 --- a/rbm.conf +++ b/rbm.conf @@ -28,7 +28,7 @@ var: build: [% c("build", { filename => 'f', output_dir => '/out' }) %] container: - dir: '[% c("tmp_dir") %]/rbm-containers/[% sha256(c("build_id")) %]' + dir: '[% c("tmp_dir") %]/[% c("uid") %]/rbm-containers/[% sha256(c("build_id")) %]' user: rbm input_files_list: | [% FOREACH file IN c("input_files_by_name").keys.sort -%]

1 0

[tor-browser-build/master] README: mention which version of runc is needed
by boklm＠torproject.org 26 Jul '17

26 Jul '17

commit b386c5f8af06e605bdb84c5bae8bde3c8afbd485 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Wed Jul 26 12:10:54 2017 +0200 README: mention which version of runc is needed --- README | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/README b/README index fa968ff..2fcfadf 100644 --- a/README +++ b/README @@ -5,8 +5,12 @@ Installing build dependencies ----------------------------- To build Tor Browser, you need a Linux distribution that has support -for runC (such as Debian jessie, Ubuntu 14.04, Fedora 20, etc ...). -On Debian jessie, the runc package is available in backports. +for runc (such as Debian jessie, Ubuntu 14.04, Fedora 20, etc ...). +On Debian jessie, the runc package is available in backports. On Debian +stretch, the runc package is available in the main repository. +Version 0.1.1 of runc is required (which is the version available in +Debian stretch and jessie-backports). It is not yet working with runc +version 1.0.0: https://trac.torproject.org/projects/tor/ticket/23039 Your user account should have access sudo access, which is required to be able to extract container file systems, start containers and copy

1 0

[tor-browser-build/master] Remove some unused options
by boklm＠torproject.org 26 Jul '17

26 Jul '17

commit 0a9f7ef3459d4e19d22bc312cdaa5961eaa650da Author: Nicolas Vigier <boklm(a)torproject.org> Date: Wed Jul 26 11:40:54 2017 +0200 Remove some unused options --- projects/debootstrap-image/config | 3 --- 1 file changed, 3 deletions(-) diff --git a/projects/debootstrap-image/config b/projects/debootstrap-image/config index 15eec3b..ecb7f2d 100644 --- a/projects/debootstrap-image/config +++ b/projects/debootstrap-image/config @@ -5,9 +5,6 @@ pkg_type: build var: ubuntu_version: 17.04 - container_dir: '[% c("tmp_dir") %]/rbm-containers/[% sha256(c("build_id")) %]' - container_user: rbm - container: use_container: 1 # We need CAP_SYS_ADMIN for debootstrap to work

1 0

[tor-browser-bundle/maint-7.0] Bug 23028: update argparse URL
by gk＠torproject.org 25 Jul '17

25 Jul '17

1 0

[tor-browser-bundle/master] Bug 23028: update argparse URL
by gk＠torproject.org 25 Jul '17

25 Jul '17

1 0

[tor-browser-build/master] Bug 20929: Bump GCC version to 5.4.0
by gk＠torproject.org 25 Jul '17

25 Jul '17

commit 51ed356d2d4d411b7566987a7cc63d61c0ecd9d4 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Tue Jul 25 14:32:21 2017 +0200 Bug 20929: Bump GCC version to 5.4.0 We bump our GCC compiler to 5.4.0 as this fixes some bugs in previous versions. It allows us in particular to build debug builds for Windows with mingw-w64. tor-browser-bundle.git author: Georg Koppen <gk(a)torproject.org> --- projects/gcc/config | 4 ++-- projects/mingw-w64/config | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/projects/gcc/config b/projects/gcc/config index 6bf14ad..de4ecc5 100644 --- a/projects/gcc/config +++ b/projects/gcc/config @@ -1,6 +1,6 @@ # vim: filetype=yaml sw=2 filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz' -version: 5.1.0 +version: 5.4.0 var: container: use_container: 1 @@ -59,4 +59,4 @@ targets: input_files: - project: container-image - URL: 'https://ftp.gnu.org/gnu/gcc/gcc-[% c("version") %]/gcc-[% c("version") %].tar.bz2' - sha256sum: b7dafdf89cbb0e20333dbf5b5349319ae06e3d1a30bf3515b5488f7e89dca5ad + sha256sum: 608df76dec2d34de6558249d8af4cbee21eceddbcb580d666f7a5a583ca3303a diff --git a/projects/mingw-w64/config b/projects/mingw-w64/config index 5e2c748..61a34bd 100644 --- a/projects/mingw-w64/config +++ b/projects/mingw-w64/config @@ -6,7 +6,7 @@ version: '[% c("abbrev") %]' var: container: use_container: 1 - gcc_version: 5.1.0 + gcc_version: 5.4.0 deps: - automake - build-essential @@ -21,7 +21,7 @@ var: input_files: - project: container-image - URL: 'https://ftp.gnu.org/gnu/gcc/gcc-[% c("var/gcc_version") %]/gcc-[% c("var/gcc_version") %].tar.bz2' - sha256sum: b7dafdf89cbb0e20333dbf5b5349319ae06e3d1a30bf3515b5488f7e89dca5ad + sha256sum: 608df76dec2d34de6558249d8af4cbee21eceddbcb580d666f7a5a583ca3303a - name: binutils project: binutils - filename: i686-w64-mingw32-g++

1 0

[tor-browser-bundle/master] Bug 20929: Bump GCC version to 5.4.0
by gk＠torproject.org 25 Jul '17

25 Jul '17

commit f890b38fd0ffc2572edc0e4dafc8a3aa3d16faa0 Author: Georg Koppen <gk(a)torproject.org> Date: Tue Jul 11 15:27:58 2017 +0000 Bug 20929: Bump GCC version to 5.4.0 We bump our GCC compiler to 5.4.0 as this fixes some bugs in previous versions. It allows us in particular to build debug builds for Windows with mingw-w64. --- gitian/versions.alpha | 4 ++-- gitian/versions.nightly | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/gitian/versions.alpha b/gitian/versions.alpha index 6351f27..025e277 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -56,7 +56,7 @@ GMP_VER=5.1.3 FIREFOX_LANG_VER=$FIREFOX_VERSION FIREFOX_LANG_BUILD=build1 BINUTILS_VER=2.24 -GCC_VER=5.1.0 +GCC_VER=5.4.0 CLANG_VER=3.8.0 PYTHON_VER=2.7.5 PYCRYPTO_VER=2.6.1 @@ -128,7 +128,7 @@ GO14_HASH=9947fc705b0b841b5938c48b22dc33e9647ec0752bae66e50278df4f23f64959 GO_HASH=5f5dea2447e7dcfdc50fa6b94c512e58bfba5673c039259fd843f68829d99fa6 NSIS_HASH=43d4c9209847e35eb6e2c7cd5a7586e1445374c056c2c7899e40a080e17a1be7 NSIS_DEBIAN_HASH=1dee6957b4a4b8dfe69bcf28bc7f301a13b96b3fa5a394e36c8926ae781e774a -GCC_HASH=b7dafdf89cbb0e20333dbf5b5349319ae06e3d1a30bf3515b5488f7e89dca5ad +GCC_HASH=608df76dec2d34de6558249d8af4cbee21eceddbcb580d666f7a5a583ca3303a STIXMATHFONT_HASH=e3b0f712e2644438eee2d0dcd2b10b2d54f1b972039de95b2f8e800bae1adbd8 NOTOEMOJIFONT_HASH=415dc6290378574135b64c808dc640c1df7531973290c4970c51fdeb849cb0c5 NOTOJPFONT_HASH=3e8146c4ce0945f255cb9dbc12b392380af80bd117e0a60eae555c99c7e618da diff --git a/gitian/versions.nightly b/gitian/versions.nightly index b89befb..f0c4be7 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -59,7 +59,7 @@ GMP_VER=5.1.3 FIREFOX_LANG_VER=$FIREFOX_VERSION FIREFOX_LANG_BUILD=build1 BINUTILS_VER=2.24 -GCC_VER=5.1.0 +GCC_VER=5.4.0 CLANG_VER=3.8.0 PYTHON_VER=2.7.5 PYCRYPTO_VER=2.6.1 @@ -131,7 +131,7 @@ GO14_HASH=9947fc705b0b841b5938c48b22dc33e9647ec0752bae66e50278df4f23f64959 GO_HASH=5f5dea2447e7dcfdc50fa6b94c512e58bfba5673c039259fd843f68829d99fa6 NSIS_HASH=43d4c9209847e35eb6e2c7cd5a7586e1445374c056c2c7899e40a080e17a1be7 NSIS_DEBIAN_HASH=1dee6957b4a4b8dfe69bcf28bc7f301a13b96b3fa5a394e36c8926ae781e774a -GCC_HASH=b7dafdf89cbb0e20333dbf5b5349319ae06e3d1a30bf3515b5488f7e89dca5ad +GCC_HASH=608df76dec2d34de6558249d8af4cbee21eceddbcb580d666f7a5a583ca3303a STIXMATHFONT_HASH=e3b0f712e2644438eee2d0dcd2b10b2d54f1b972039de95b2f8e800bae1adbd8 NOTOEMOJIFONT_HASH=415dc6290378574135b64c808dc640c1df7531973290c4970c51fdeb849cb0c5 NOTOJPFONT_HASH=3e8146c4ce0945f255cb9dbc12b392380af80bd117e0a60eae555c99c7e618da

1 0

[tor-launcher/master] Bug 22592: Default bridge settings are not removed
by gk＠torproject.org 25 Jul '17

25 Jul '17

commit 2a938feb78b49098ead0599769835cbc2a7dc183 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Mon Jul 24 16:13:28 2017 -0400 Bug 22592: Default bridge settings are not removed When the user clicks on "Remove Settings and Connect", clear the preference `extensions.torlauncher.default_bridge_type` to ensure that default bridges are not used any more. --- src/chrome/content/network-settings.js | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/chrome/content/network-settings.js b/src/chrome/content/network-settings.js index 5df4e1e..830ef31 100644 --- a/src/chrome/content/network-settings.js +++ b/src/chrome/content/network-settings.js @@ -1493,6 +1493,9 @@ function applyBridgeSettings(aUseDefaults) if (!settings) return false; + if (aUseDefaults) + TorLauncherUtil.setCharPref(kPrefDefaultBridgeType, ""); + return setConfAndReportErrors(settings, "bridgeSettings"); }

1 0