- tbb-commits - lists.torproject.org

[tor-browser-bundle/master] Release preparations for 7.5a2
by boklm＠torproject.org 04 Jul '17

04 Jul '17

commit e2f067395d180d2ef484375e9025b6c958d504dc Author: Nicolas Vigier <boklm(a)torproject.org> Date: Tue Jul 4 02:56:23 2017 +0200 Release preparations for 7.5a2 --- Bundle-Data/Docs/ChangeLog.txt | 7 +++++++ gitian/versions.alpha | 6 +++--- tools/update-responses/config.yml | 8 ++++---- 3 files changed, 14 insertions(+), 7 deletions(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index 94e967f..c73f9ac 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,10 @@ +Tor Browser 7.5a2 -- July 6 2014 + * All Platforms + * Update Tor to 0.3.1.4-alpha + * Update HTTPS-Everywhere to 5.2.19 + * Linux + * Update sandboxed-tor-browser to 0.0.9 + Tor Browser 7.5a1 -- June 14 2017 * All Platforms * Update Firefox to 52.2.0esr diff --git a/gitian/versions.alpha b/gitian/versions.alpha index 7ce2e5a..6351f27 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -15,10 +15,10 @@ FIREFOX_VERSION=52.2.0esr TORBROWSER_UPDATE_CHANNEL=alpha TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-7.5-1-build2 -TOR_TAG=tor-0.3.1.3-alpha +TOR_TAG=tor-0.3.1.4-alpha TORLAUNCHER_TAG=0.2.12.2 TORBUTTON_TAG=1.9.7.4 -HTTPSE_TAG=5.2.18 +HTTPSE_TAG=5.2.19 NSIS_TAG=v0.3.1 ZLIB_TAG=v1.2.8 LIBEVENT_TAG=release-2.0.22-stable @@ -41,7 +41,7 @@ OBFS4_TAG=obfs4proxy-0.0.5 NOTOFONTS_TAG=720e34851382ee3c1ef024d8dffb68ffbfb234c2 ERRORS_TAG=248dadf4e9068a0b3e79f02ed0a610d935de5302 GB_TAG=06cc925cce6592e922dcc4839a8b44feb384e71e -SANDBOX_TAG=sandboxed-tor-browser-0.0.7 +SANDBOX_TAG=sandboxed-tor-browser-0.0.9 DEPOT_TOOLS_TAG=28216cd14b44716db5c83634afbdc6e90492652b WEBRTC_TAG=c279861207c5b15fc51069e96595782350e0ac12 # https://chromium.googlesource.com/external/webrtc.git/+/refs/branch-heads/58 GO_WEBRTC_TAG=ab1b64862e0c4b4182010699911c2c5818f0a101 diff --git a/tools/update-responses/config.yml b/tools/update-responses/config.yml index d12ef1c..a4f1f91 100644 --- a/tools/update-responses/config.yml +++ b/tools/update-responses/config.yml @@ -19,14 +19,14 @@ build_targets: osx32: Darwin_x86-gcc3 osx64: Darwin_x86_64-gcc3 channels: - alpha: 7.5a1 + alpha: 7.5a2 release: 6.0.1 versions: - 7.5a1: + 7.5a2: platformVersion: 52.2.0 - detailsURL: https://blog.torproject.org/blog/tor-browser-75a1-released + detailsURL: https://blog.torproject.org/blog/tor-browser-75a2-released incremental_from: - - 7.0a4 + - 7.5a1 migrate_archs: osx32: osx64 migrate_langs:

1 0

[tor-browser-bundle/maint-7.0] Release preparations for 7.0.2
by boklm＠torproject.org 29 Jun '17

29 Jun '17

commit 3b5c0fdc4061d9b8568002d829f03c0e8a01d742 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Fri Jun 30 00:55:43 2017 +0200 Release preparations for 7.0.2 Version bumps, changelog update, and config.yml update --- Bundle-Data/Docs/ChangeLog.txt | 5 +++++ gitian/versions | 4 ++-- tools/update-responses/config.yml | 9 ++++----- 3 files changed, 11 insertions(+), 7 deletions(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index d0c95b2..c7cb8c2 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,8 @@ +Tor Browser 7.0.2 -- July 3 2017 + * All Platforms + * Update Tor to 0.3.0.9, fixing bug #22753 + * Update HTTPS-Everywhere to 5.2.19 + Tor Browser 7.0.1 -- June 13 2017 * All Platforms * Update Firefox to 52.2.0esr diff --git a/gitian/versions b/gitian/versions index ae21121..b8670f5 100755 --- a/gitian/versions +++ b/gitian/versions @@ -15,10 +15,10 @@ FIREFOX_VERSION=52.2.0esr TORBROWSER_UPDATE_CHANNEL=release TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-7.0-1-build1 -TOR_TAG=tor-0.3.0.8 +TOR_TAG=tor-0.3.0.9 TORLAUNCHER_TAG=0.2.12.2 TORBUTTON_TAG=1.9.7.4 -HTTPSE_TAG=5.2.18 +HTTPSE_TAG=5.2.19 NSIS_TAG=v0.3.1 ZLIB_TAG=v1.2.8 LIBEVENT_TAG=release-2.0.22-stable diff --git a/tools/update-responses/config.yml b/tools/update-responses/config.yml index d5151bc..9ff92ce 100644 --- a/tools/update-responses/config.yml +++ b/tools/update-responses/config.yml @@ -20,14 +20,13 @@ build_targets: osx64: Darwin_x86_64-gcc3 channels: alpha: 7.0a4 - release: 7.0.1 + release: 7.0.2 versions: - 7.0.1: + 7.0.2: platformVersion: 52.2.0 - detailsURL: https://blog.torproject.org/blog/tor-browser-701-released + detailsURL: https://blog.torproject.org/blog/tor-browser-702-released incremental_from: - - 6.5.2 - - 7.0 + - 7.0.1 migrate_archs: osx32: osx64 migrate_langs:

1 0

[torbutton/master] Bug 22560: Update privacy.thirdparty.isolate preference
by gk＠torproject.org 16 Jun '17

16 Jun '17

commit b917b2024bb71b2be832439df793ae5ec91d8082 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Jun 16 11:36:06 2017 +0000 Bug 22560: Update privacy.thirdparty.isolate preference In commit 2978978e64fbc9164185564a19d56d5fea0b25d8 we hinted at updating `privacy.thirdparty.isolate` once we switch to ESR 52. We forgot that while migrating but replace it now with `privacy.firstparty.isolate` as expected. We remove `dom.workers.sharedWorkers.enabled` as this preference is long gone. --- src/chrome/content/torbutton.js | 25 ++++++++++++------------- 1 file changed, 12 insertions(+), 13 deletions(-) diff --git a/src/chrome/content/torbutton.js b/src/chrome/content/torbutton.js index 2d69b0c..ae705a3 100644 --- a/src/chrome/content/torbutton.js +++ b/src/chrome/content/torbutton.js @@ -86,7 +86,7 @@ var torbutton_unique_pref_observer = m_tb_prefs.addObserver("javascript", this, false); m_tb_prefs.addObserver("noscript", this, false); m_tb_prefs.addObserver("plugin.disable", this, false); - m_tb_prefs.addObserver("privacy.thirdparty.isolate", this, false); + m_tb_prefs.addObserver("privacy.firstparty.isolate", this, false); m_tb_prefs.addObserver("privacy.resistFingerprinting", this, false); // We observe xpcom-category-entry-added for plugins w/ Gecko-Content-Viewers @@ -103,7 +103,7 @@ var torbutton_unique_pref_observer = m_tb_prefs.removeObserver("javascript", this); m_tb_prefs.removeObserver("noscript", this); m_tb_prefs.removeObserver("plugin.disable", this); - m_tb_prefs.removeObserver("privacy.thirdparty.isolate", this); + m_tb_prefs.removeObserver("privacy.firstparty.isolate", this); m_tb_prefs.removeObserver("privacy.resistFingerprinting", this); var observerService = Cc["@mozilla.org/observer-service;1"]. @@ -151,12 +151,12 @@ var torbutton_unique_pref_observer = } switch (data) { case "network.cookie.cookieBehavior": - var val = m_tb_prefs.getIntPref("network.cookie.cookieBehavior"); - var block_thirdparty = m_tb_prefs.getIntPref("privacy.thirdparty.isolate") !== 0; - if (val == 0 && block_thirdparty) // Allow all cookies - m_tb_prefs.setIntPref("privacy.thirdparty.isolate", 0); - else if (val == 1 && !block_thirdparty) // Block third party cookies - m_tb_prefs.setIntPref("privacy.thirdparty.isolate", 2); + let val = m_tb_prefs.getIntPref("network.cookie.cookieBehavior"); + let firstparty_isolate = m_tb_prefs.getBoolPref("privacy.firstparty.isolate"); + if (val == 0 && firstparty_isolate) // Allow all cookies + m_tb_prefs.setBoolPref("privacy.firstparty.isolate", false); + else if (val == 1 && !firstparty_isolate) // Block third party cookies + m_tb_prefs.setBoolPref("privacy.firstparty.isolate", true); break; case "plugin.disable": @@ -173,8 +173,8 @@ var torbutton_unique_pref_observer = case "extensions.torbutton.spoof_english": torbutton_update_fingerprinting_prefs(); break; - case "privacy.thirdparty.isolate": - torbutton_update_thirdparty_prefs(); + case "privacy.firstparty.isolate": + torbutton_update_isolation_prefs(); break; case "extensions.torbutton.hide_sync_ui": torbutton_update_sync_ui(); @@ -1743,8 +1743,8 @@ function torbutton_update_fingerprinting_prefs() { m_tb_prefs.savePrefFile(null); } -function torbutton_update_thirdparty_prefs() { - let isolate = m_tb_prefs.getIntPref("privacy.thirdparty.isolate") !== 0; +function torbutton_update_isolation_prefs() { + let isolate = m_tb_prefs.getBoolPref("privacy.firstparty.isolate"); if (isolate) { m_tb_prefs.setIntPref("network.cookie.cookieBehavior", 1); @@ -1752,7 +1752,6 @@ function torbutton_update_thirdparty_prefs() { m_tb_prefs.setIntPref("network.cookie.cookieBehavior", 0); } - m_tb_prefs.setBoolPref("dom.workers.sharedWorkers.enabled", !isolate); m_tb_prefs.setBoolPref("security.enable_tls_session_tickets", !isolate); // Force prefs to be synced to disk

1 0

[tor-browser-build/master] Update versions and ChangeLog for 7.5a1
by boklm＠torproject.org 13 Jun '17

13 Jun '17

commit 48e45a9a60d3987e8c9726d009db54912246ed34 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Tue Jun 13 13:09:36 2017 +0200 Update versions and ChangeLog for 7.5a1 tor-browser-bundle.git author: Georg Koppen <gk(a)torproject.org> tor-browser-bundle.git commit: 321ad6021df0b3d55625c5bd88dcfc5acdf112f8 tor-browser-bundle.git commit: ade53c43e1230a05e0b138b3ade92914e9d9a279 tor-browser-bundle.git commit: 638da360d67407b2866f0747a5df40d8ae36af78 --- projects/firefox/config | 4 +- projects/https-everywhere/config | 2 +- projects/sandbox/config | 2 +- .../tor-browser/Bundle-Data/Docs/ChangeLog.txt | 55 +++++++++++++++++++++- projects/tor-browser/config | 4 +- projects/tor-launcher/config | 2 +- projects/tor/config | 2 +- projects/torbutton/config | 2 +- rbm.conf | 2 +- 9 files changed, 64 insertions(+), 11 deletions(-) diff --git a/projects/firefox/config b/projects/firefox/config index 1cd986f..5db64ff 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -7,8 +7,8 @@ git_url: https://git.torproject.org/tor-browser.git gpg_keyring: torbutton.gpg var: - firefox_version: 52.1.1esr - torbrowser_branch: 7.0 + firefox_version: 52.2.0esr + torbrowser_branch: 7.5 torbrowser_update_channel: alpha copyright_year: '[% exec("git show -s --format=%ci").remove("-.*") %]' deps: diff --git a/projects/https-everywhere/config b/projects/https-everywhere/config index 23c4e1e..3652aaa 100644 --- a/projects/https-everywhere/config +++ b/projects/https-everywhere/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 5.2.16 +version: 5.2.18 git_url: https://git.torproject.org/https-everywhere.git git_hash: '[% c("version") %]' git_submodule: 1 diff --git a/projects/sandbox/config b/projects/sandbox/config index 3970322..017d78d 100644 --- a/projects/sandbox/config +++ b/projects/sandbox/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 0.0.6 +version: 0.0.7 git_url: https://git.torproject.org/tor-browser/sandboxed-tor-browser git_hash: 'sandboxed-tor-browser-[% c("version") %]' tag_gpg_id: 1 diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index 9f00100..94e967f 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,56 @@ +Tor Browser 7.5a1 -- June 14 2017 + * All Platforms + * Update Firefox to 52.2.0esr + * Update Tor to 0.3.1.3-alpha + * Update Torbutton to 1.9.7.4 + * Bug 22542: Security Settings window too small on macOS 10.12 + * Bug 22104: Adjust our content policy whitelist for ff52-esr + * Bug 22457: Allow resources loaded by view-source:// + * Bug 21627: Ignore HTTP 304 responses when checking redirects + * Bug 22459: Adapt our use of the nsIContentPolicy to e10s mode + * Translations update + * Update Tor Launcher to 0.2.12.2 + * Bug 22283: Linux 7.0a4 is broken after update due to unix: lines in torrc + * Translations update + * Update HTTPS-Everywhere to 5.2.18 + * Update NoScript to 5.0.5 + * Update sandboxed-tor-browser to 0.0.7 + * Bug 22362: NoScript's XSS filter freezes the browser + * Bug 21766: Fix crash when the external application helper dialog is invoked + * Bug 21886: Download is stalled in non-e10s mode + * Bug 22333: Disable WebGL2 API for now + * Bug 21861: Disable additional mDNS code to avoid proxy bypasses + * Bug 21684: Don't expose navigator.AddonManager to content + * Bug 21431: Clean-up system extensions shipped in Firefox 52 + * Bug 22320: Use preference name 'referer.hideOnionSource' everywhere + * Bug 16285: Don't ship ClearKey EME system and update EME preferences + * Bug 21972: about:support is partially broken + * Bug 21323: Enable Mixed Content Blocking + * Bug 22415: Fix format error in our pipeline patch + * Bug 21862: Rip out potentially unsafe Rust code + * Bug 16485: Improve about:cache page + * Bug 22462: Backport of patch for bug 1329521 to fix assertion failure + * Bug 22458: Fix broken `about:cache` page on higher security levels + * Bug 18531: Uncaught exception when opening ip-check.info + * Bug 18574: Uncaught exception when clicking items in Library + * Bug 22327: Isolate Page Info media previews to first party domain + * Bug 22452: Isolate tab list menuitem favicons to first party domain + * Bug 15555: View-source requests are not isolated by first party domain + * Bug 5293: Neuter fingerprinting with Battery API + * Bug 22429: Add IPv6 address for Lisbeth:443 obfs4 bridge + * Bug 22468: Add default obfs4 bridges frosty and dragon + * Windows + * Bug 22419: Prevent access to file:// + * Bug 21617: Fix single RWX page on Windows + * OS X + * Bug 22558: Don't update OS X 10.7.x and 10.8.x users to Tor Browser 7.0 + + * Linux + * Bug 16285: Remove ClearKey related library stripping + * Bug 21852: Don't use jemalloc4 anymore + * Android + * Bug 19078: Disable RtspMediaResource stuff in Orfox + Tor Browser 7.0a4 -- May 15 2017 * All Platforms * Update Firefox to 52.1.1esr @@ -84,7 +137,7 @@ Tor Browser 7.0a3 -- April 20 2017 * Bug 17334: Hide Referer when leaving a .onion domain (improved patch) * Bug 3246: Double-key cookies * Bug 8842: Fix XML parsing error - * Bug 16886: 16886: "Add-on compatibility check dialog" contains Firefox logo + * Bug 16886: "Add-on compatibility check dialog" contains Firefox logo * Bug 19192: Untrust Blue Coat CA * Bug 19955: Avoid confusing warning that favicon load request got cancelled * Bug 20005: Backport fixes for memory leaks investigation diff --git a/projects/tor-browser/config b/projects/tor-browser/config index a2c21ed..8e8398a 100644 --- a/projects/tor-browser/config +++ b/projects/tor-browser/config @@ -54,9 +54,9 @@ input_files: name: snowflake enable: '[% c("var/snowflake") %]' - filename: Bundle-Data - - URL: https://addons.cdn.mozilla.net/user-media/addons/722/noscript_security_suit… + - URL: https://addons.cdn.mozilla.net/user-media/addons/722/noscript_security_suit… name: noscript - sha256sum: cd8e5561bdd7331d9fdd510fb1bd1cb6460d64f351076b523d31361ff9853c76 + sha256sum: bf1dee39f6e5936df2b03b794c1efc9236b440536a05fafcff667e33903e6aed - filename: RelativeLink enable: '[% c("var/linux") %]' - project: libdmg-hfsplus diff --git a/projects/tor-launcher/config b/projects/tor-launcher/config index a164ef3..2995d08 100644 --- a/projects/tor-launcher/config +++ b/projects/tor-launcher/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 0.2.12.1 +version: 0.2.12.2 git_url: https://git.torproject.org/tor-launcher.git git_hash: '[% c("version") %]' gpg_keyring: torbutton.gpg diff --git a/projects/tor/config b/projects/tor/config index b92fb4f..74ae828 100644 --- a/projects/tor/config +++ b/projects/tor/config @@ -1,6 +1,6 @@ # vim: filetype=yaml sw=2 filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %]' -version: 0.3.0.6 +version: 0.3.1.3-alpha git_hash: 'tor-[% c("version") %]' git_url: https://git.torproject.org/tor.git gpg_keyring: tor.gpg diff --git a/projects/torbutton/config b/projects/torbutton/config index 41d4d69..7864a38 100644 --- a/projects/torbutton/config +++ b/projects/torbutton/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 1.9.7.2 +version: 1.9.7.4 git_url: https://git.torproject.org/torbutton.git git_hash: '[% c("version") %]' gpg_keyring: torbutton.gpg diff --git a/rbm.conf b/rbm.conf index 7b58503..8941ba9 100644 --- a/rbm.conf +++ b/rbm.conf @@ -7,7 +7,7 @@ build_log: '[% GET ENV.RBM_LOGS_DIR ? ENV.RBM_LOGS_DIR : "logs" %]/[% project %] pkg_type: build var: - torbrowser_version: '7.0a4' + torbrowser_version: '7.5a1' project_name: tor-browser multi_lingual: 0 build_mar: 1

1 0

[tor-browser-build/master] Bump OpenSSL version for nightly builds
by boklm＠torproject.org 13 Jun '17

13 Jun '17

commit 8d3c245def1e9047715266953fe83df560da0328 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Tue Jun 13 13:12:46 2017 +0200 Bump OpenSSL version for nightly builds tor-browser-bundle.git author: Georg Koppen <gk(a)torproject.org> tor-browser-bundle.git commit: 515f9581b36e87d8180d2e74d57a9aed11d7c1e2 --- projects/openssl/config | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/projects/openssl/config b/projects/openssl/config index 8b4ea4f..4cb9eea 100644 --- a/projects/openssl/config +++ b/projects/openssl/config @@ -7,6 +7,8 @@ var: use_container: 1 targets: + nightly: + version: 1.0.2l linux-x86_64: var: configure_opts: -shared enable-ec_nistp_64_gcc_128 linux-generic64 @@ -26,3 +28,6 @@ input_files: project: '[% c("var/compiler") %]' - URL: 'https://www.openssl.org/source/openssl-[% c("version") %].tar.gz' sha256sum: 6b3977c61f2aedf0f96367dcfb5c6e578cf37e7b8d913b4ecb6643c3cb88d8c0 + targets: + nightly: + sha256sum: ce07195b659e75f4e1db43552860070061f156a98bb37b672b101ba6e3ddf30c

1 0

[tor-browser-build/master] Bug 22362: NoScript's XSS filter freezes the browser
by boklm＠torproject.org 13 Jun '17

13 Jun '17

commit cec0a1d787b90f1b27c92ba83bd8f12b5a3b0fb1 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Jun 7 11:58:21 2017 +0000 Bug 22362: NoScript's XSS filter freezes the browser Due to a bug in NoScript's XSS filter Tor Browser freezes on some websites. We disable that filter for now while waiting on a NoScript update. --- .../Data/Browser/profile.default/preferences/extension-overrides.js | 4 ++++ .../Data/Browser/profile.default/preferences/extension-overrides.js | 4 ++++ .../Data/Browser/profile.default/preferences/extension-overrides.js | 4 ++++ 3 files changed, 12 insertions(+) diff --git a/projects/tor-browser/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js b/projects/tor-browser/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js index 6ef2c45..a34fb36 100644 --- a/projects/tor-browser/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/projects/tor-browser/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js @@ -55,3 +55,7 @@ pref("noscript.restrictSubdocScripting", true); pref("noscript.showVolatilePrivatePermissionsToggle", false); pref("noscript.volatilePrivatePermissions", true); pref("noscript.clearClick", 0); +// Workaround for bug 22362: Disable XSS filter for now as it freezes the +// browser in some circumstances. +pref("noscript.filterXGet", false); +pref("noscript.filterXPost", false); diff --git a/projects/tor-browser/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js b/projects/tor-browser/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js index 6ef2c45..a34fb36 100644 --- a/projects/tor-browser/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/projects/tor-browser/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js @@ -55,3 +55,7 @@ pref("noscript.restrictSubdocScripting", true); pref("noscript.showVolatilePrivatePermissionsToggle", false); pref("noscript.volatilePrivatePermissions", true); pref("noscript.clearClick", 0); +// Workaround for bug 22362: Disable XSS filter for now as it freezes the +// browser in some circumstances. +pref("noscript.filterXGet", false); +pref("noscript.filterXPost", false); diff --git a/projects/tor-browser/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js b/projects/tor-browser/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js index 6ef2c45..a34fb36 100644 --- a/projects/tor-browser/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/projects/tor-browser/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js @@ -55,3 +55,7 @@ pref("noscript.restrictSubdocScripting", true); pref("noscript.showVolatilePrivatePermissionsToggle", false); pref("noscript.volatilePrivatePermissions", true); pref("noscript.clearClick", 0); +// Workaround for bug 22362: Disable XSS filter for now as it freezes the +// browser in some circumstances. +pref("noscript.filterXGet", false); +pref("noscript.filterXPost", false);

1 0

[tor-browser-bundle/master] Bump OpenSSL version for nightly builds
by gk＠torproject.org 13 Jun '17

13 Jun '17

commit 515f9581b36e87d8180d2e74d57a9aed11d7c1e2 Author: Georg Koppen <gk(a)torproject.org> Date: Tue Jun 13 09:44:37 2017 +0000 Bump OpenSSL version for nightly builds --- gitian/versions.nightly | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/gitian/versions.nightly b/gitian/versions.nightly index 5a504d0..b89befb 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -54,7 +54,7 @@ SELFRANDO_TAG=tb-v0.2 GITIAN_TAG=tor-browser-builder-4 -OPENSSL_VER=1.0.2k +OPENSSL_VER=1.0.2l GMP_VER=5.1.3 FIREFOX_LANG_VER=$FIREFOX_VERSION FIREFOX_LANG_BUILD=build1 @@ -113,7 +113,7 @@ YASM_PACKAGE=yasm-${YASM_VER}.tar.gz ELFUTILS_PACKAGE=elfutils-${ELFUTILS_VER}.tar.bz2 # Hashes for packages with weak sigs or no sigs -OPENSSL_HASH=6b3977c61f2aedf0f96367dcfb5c6e578cf37e7b8d913b4ecb6643c3cb88d8c0 +OPENSSL_HASH=ce07195b659e75f4e1db43552860070061f156a98bb37b672b101ba6e3ddf30c GMP_HASH=752079520b4690531171d0f4532e40f08600215feefede70b24fabdc6f1ab160 OSXSDK_HASH=da77bb0003fcca5ea8c4e8cb2da8828ded750c54afdcac29ec6f3b46ad5e3adf NOSCRIPT_HASH=bf1dee39f6e5936df2b03b794c1efc9236b440536a05fafcff667e33903e6aed

1 0

[tor-browser-bundle/master] Bumping tor browser branch for nightly builds
by gk＠torproject.org 12 Jun '17

12 Jun '17

commit 5bb561cc765dabbd1ecbdee9c33dfe3df3a94cf3 Author: Georg Koppen <gk(a)torproject.org> Date: Mon Jun 12 12:46:09 2017 +0000 Bumping tor browser branch for nightly builds --- gitian/versions.nightly | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/gitian/versions.nightly b/gitian/versions.nightly index 03c543c..df05fbd 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -13,11 +13,11 @@ DATA_OUTSIDE_APP_DIR=1 VERIFY_TAGS=0 -FIREFOX_VERSION=52.1.1esr +FIREFOX_VERSION=52.2.0esr TORBROWSER_UPDATE_CHANNEL=default -TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-7.0-1 +TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-7.5-1 TOR_TAG=master TORLAUNCHER_TAG=master TORBUTTON_TAG=master

1 0

[tor-browser-bundle/master] NoScript version bump for nightly
by gk＠torproject.org 12 Jun '17

12 Jun '17

commit d943f29a601d16abbaddbd7fa40448d019bf6d97 Author: Georg Koppen <gk(a)torproject.org> Date: Mon Jun 12 12:48:49 2017 +0000 NoScript version bump for nightly --- gitian/versions.nightly | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/gitian/versions.nightly b/gitian/versions.nightly index df05fbd..5a504d0 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -80,7 +80,7 @@ ELFUTILS_VER=0.166 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz GMP_PACKAGE=gmp-${GMP_VER}.tar.bz2 -NOSCRIPT_PACKAGE=noscript_security_suite-5.0.4-fx+sm.xpi +NOSCRIPT_PACKAGE=noscript_security_suite-5.0.5-fx+sm.xpi CCTOOLS_PACKAGE=cctools.tar.gz OSXSDK_PACKAGE=MacOSX10.7.sdk.tar.gz MSVCR100_PACKAGE=msvcr100.dll @@ -116,7 +116,7 @@ ELFUTILS_PACKAGE=elfutils-${ELFUTILS_VER}.tar.bz2 OPENSSL_HASH=6b3977c61f2aedf0f96367dcfb5c6e578cf37e7b8d913b4ecb6643c3cb88d8c0 GMP_HASH=752079520b4690531171d0f4532e40f08600215feefede70b24fabdc6f1ab160 OSXSDK_HASH=da77bb0003fcca5ea8c4e8cb2da8828ded750c54afdcac29ec6f3b46ad5e3adf -NOSCRIPT_HASH=cd8e5561bdd7331d9fdd510fb1bd1cb6460d64f351076b523d31361ff9853c76 +NOSCRIPT_HASH=bf1dee39f6e5936df2b03b794c1efc9236b440536a05fafcff667e33903e6aed CCTOOLS_HASH=e908fdebc2886ee5491ebfc7e7950af451b3c4e2439c2d7a923ed06ad05113e4 MSVCR100_HASH=1221a09484964a6f38af5e34ee292b9afefccb3dc6e55435fd3aaf7c235d9067 PYCRYPTO_HASH=f2ce1e989b272cfcb677616763e0a2e7ec659effa67a88aa92b3a65528f60a3c

1 0

[torbutton/master] Bug 22554: Don't set Battery API pref anymore
by gk＠torproject.org 12 Jun '17

12 Jun '17

commit f28c1252c7a84b034b35d987fdddfc39a6cf45ba Author: Georg Koppen <gk(a)torproject.org> Date: Fri Jun 9 14:23:08 2017 +0000 Bug 22554: Don't set Battery API pref anymore Mozilla made the Battery API chrome-only (https://bugzilla.mozilla.org/show_bug.cgi?id=1313580) We therefore don't need to take care of it anymore in Torbutton. --- src/chrome/content/torbutton.js | 1 - src/chrome/locale/en/torbutton.dtd | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/src/chrome/content/torbutton.js b/src/chrome/content/torbutton.js index 9af7c57..2d69b0c 100644 --- a/src/chrome/content/torbutton.js +++ b/src/chrome/content/torbutton.js @@ -1732,7 +1732,6 @@ function torbutton_update_fingerprinting_prefs() { m_tb_prefs.setBoolPref("webgl.min_capability_mode", mode); m_tb_prefs.setBoolPref("webgl.disable-extensions", mode); - m_tb_prefs.setBoolPref("dom.battery.enabled", !mode); m_tb_prefs.setBoolPref("dom.network.enabled", !mode); m_tb_prefs.setBoolPref("dom.enable_performance", !mode); m_tb_prefs.setBoolPref("plugin.expose_full_path", !mode); diff --git a/src/chrome/locale/en/torbutton.dtd b/src/chrome/locale/en/torbutton.dtd index 6bc7141..608947c 100644 --- a/src/chrome/locale/en/torbutton.dtd +++ b/src/chrome/locale/en/torbutton.dtd @@ -30,7 +30,7 @@ <!ENTITY torbutton.prefs.restrict_thirdparty_tooltip "Keep this box checked to prevent various browser features from being abused to track you as you browse the web. Modified features include blob URLs, broadcast channels, the browser cache, cookies, favicons, HTTP Auth headers, link preconnects, localStorage, mediaSource URLs, OCSP requests, SharedWorkers, and TLS session tickets."> <!ENTITY torbutton.prefs.resist_fingerprinting "Change details that distinguish you from other Tor Browser users"> <!ENTITY torbutton.prefs.resist_fingerprinting.accesskey "F"> -<!ENTITY torbutton.prefs.resist_fingerprinting_tooltip "Keep this box checked to hide things from websites that could be unique about you, including your battery status, computer performance, keyboard layout, locale, the location of installed plugins, the list of installed plugins, your network status, screen orientation, screen size, site-specific zoom levels, supported file types, system colors, and WebGL capabilities."> +<!ENTITY torbutton.prefs.resist_fingerprinting_tooltip "Keep this box checked to hide things from websites that could be unique about you, including your computer performance, keyboard layout, locale, the location of installed plugins, the list of installed plugins, your network status, screen orientation, screen size, site-specific zoom levels, supported file types, system colors, and WebGL capabilities."> <!ENTITY torbutton.prefs.sec_caption "Security Level"> <!ENTITY torbutton.prefs.sec_caption_tooltip "The Security Slider lets you disable certain browser features that may make your browser more vulnerable to hacking attempts."> <!ENTITY torbutton.prefs.sec_low "Low (default)">

1 0

[tor-browser-bundle/master] Bug 22578: Reorder versions entries in config.yml file
by gk＠torproject.org 12 Jun '17

12 Jun '17

commit 2a1052df903df3c0cd80ec59783e94aca68333fc Author: Georg Koppen <gk(a)torproject.org> Date: Mon Jun 12 10:41:55 2017 +0000 Bug 22578: Reorder versions entries in config.yml file --- tools/update-responses/config.yml | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/tools/update-responses/config.yml b/tools/update-responses/config.yml index b0017db..d12ef1c 100644 --- a/tools/update-responses/config.yml +++ b/tools/update-responses/config.yml @@ -22,12 +22,11 @@ channels: alpha: 7.5a1 release: 6.0.1 versions: - 6.0.1: - platformVersion: 45.2.0 - detailsURL: https://blog.torproject.org/blog/tor-browser-601-released + 7.5a1: + platformVersion: 52.2.0 + detailsURL: https://blog.torproject.org/blog/tor-browser-75a1-released incremental_from: - - 5.5.5 - - 6.0 + - 7.0a4 migrate_archs: osx32: osx64 migrate_langs: @@ -38,11 +37,12 @@ versions: minSupportedOSVersion: 13.0.0 osx64: minSupportedOSVersion: 13.0.0 - 7.5a1: - platformVersion: 52.2.0 - detailsURL: https://blog.torproject.org/blog/tor-browser-75a1-released + 6.0.1: + platformVersion: 45.2.0 + detailsURL: https://blog.torproject.org/blog/tor-browser-601-released incremental_from: - - 7.0a4 + - 5.5.5 + - 6.0 migrate_archs: osx32: osx64 migrate_langs:

1 0

[tor-browser-bundle/master] Make config.yml less error-prone
by gk＠torproject.org 11 Jun '17

11 Jun '17

commit 36808fe250f4c1de115fc200e1eb9294cbcdc2c0 Author: Georg Koppen <gk(a)torproject.org> Date: Sun Jun 11 19:00:42 2017 +0000 Make config.yml less error-prone --- tools/update-responses/config.yml | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/tools/update-responses/config.yml b/tools/update-responses/config.yml index f3f3e26..b0017db 100644 --- a/tools/update-responses/config.yml +++ b/tools/update-responses/config.yml @@ -30,9 +30,14 @@ versions: - 6.0 migrate_archs: osx32: osx64 + migrate_langs: + pt-PT: pt-BR + win32: + minSupportedInstructionSet: SSE2 osx32: - minSupportedOSVersion: 10.8 - detailsURL: https://blog.torproject.org/blog/end-life-plan-tor-browser-32-bit-macs#upda… + minSupportedOSVersion: 13.0.0 + osx64: + minSupportedOSVersion: 13.0.0 7.5a1: platformVersion: 52.2.0 detailsURL: https://blog.torproject.org/blog/tor-browser-75a1-released

1 0

[tor-browser-bundle/master] Version bump, and changelog update
by gk＠torproject.org 11 Jun '17

11 Jun '17

commit 638da360d67407b2866f0747a5df40d8ae36af78 Author: Georg Koppen <gk(a)torproject.org> Date: Sun Jun 11 13:41:39 2017 +0000 Version bump, and changelog update --- Bundle-Data/Docs/ChangeLog.txt | 4 ++++ gitian/versions.alpha | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index 10a1268..94e967f 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -41,6 +41,10 @@ Tor Browser 7.5a1 -- June 14 2017 * Bug 22468: Add default obfs4 bridges frosty and dragon * Windows * Bug 22419: Prevent access to file:// + * Bug 21617: Fix single RWX page on Windows + * OS X + * Bug 22558: Don't update OS X 10.7.x and 10.8.x users to Tor Browser 7.0 + * Linux * Bug 16285: Remove ClearKey related library stripping * Bug 21852: Don't use jemalloc4 anymore diff --git a/gitian/versions.alpha b/gitian/versions.alpha index f6ded37..7ce2e5a 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -14,7 +14,7 @@ FIREFOX_VERSION=52.2.0esr TORBROWSER_UPDATE_CHANNEL=alpha -TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-7.5-1-build1 +TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-7.5-1-build2 TOR_TAG=tor-0.3.1.3-alpha TORLAUNCHER_TAG=0.2.12.2 TORBUTTON_TAG=1.9.7.4

1 0

[tor-browser-bundle/maint-7.0] Really fix minSupportedOSVersion for the stable series
by gk＠torproject.org 11 Jun '17

11 Jun '17

commit 23de6c6eaec91d4acfad764072dde2b6e58b0c6e Author: Georg Koppen <gk(a)torproject.org> Date: Sun Jun 11 13:44:10 2017 +0000 Really fix minSupportedOSVersion for the stable series --- tools/update-responses/config.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tools/update-responses/config.yml b/tools/update-responses/config.yml index 4028f71..d5151bc 100644 --- a/tools/update-responses/config.yml +++ b/tools/update-responses/config.yml @@ -35,9 +35,9 @@ versions: win32: minSupportedInstructionSet: SSE2 osx32: - minSupportedOSVersion: 10.9 + minSupportedOSVersion: 13.0.0 osx64: - minSupportedOSVersion: 10.9 + minSupportedOSVersion: 13.0.0 7.0a4: platformVersion: 52.1.1 detailsURL: https://blog.torproject.org/blog/tor-browser-70a4-released

1 0

[tor-browser-bundle/maint-7.0] Bug 22558: Don't update OS X 10.7.x and 10.8.x users to Tor Browser 7.0
by gk＠torproject.org 10 Jun '17

10 Jun '17

commit 0f9bbf102c8fc9f137ec00a106e89d439d6e022b Author: Georg Koppen <gk(a)torproject.org> Date: Sat Jun 10 18:41:24 2017 +0000 Bug 22558: Don't update OS X 10.7.x and 10.8.x users to Tor Browser 7.0 "10.9" was the wrong `minSupportedOSVersion` for preventing OS X 10.7.x and 10.8.x users from getting updated to Tor Browser 7. That it worked for OS X 10.6.x was only by chance according to the release history table (https://en.wikipedia.org/wiki/Darwin_(operating_system)#Release_history) We fix that by choosing "13.0.0" (for OS X 10.9 as minimum). --- tools/update-responses/config.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tools/update-responses/config.yml b/tools/update-responses/config.yml index 9dfedd3..4028f71 100644 --- a/tools/update-responses/config.yml +++ b/tools/update-responses/config.yml @@ -50,6 +50,6 @@ versions: win32: minSupportedInstructionSet: SSE2 osx32: - minSupportedOSVersion: 10.9 + minSupportedOSVersion: 13.0.0 osx64: - minSupportedOSVersion: 10.9 + minSupportedOSVersion: 13.0.0

1 0

[tor-browser-bundle/maint-7.0] Update changelog
by gk＠torproject.org 10 Jun '17

10 Jun '17

commit 9a09a732fc94397ae176fec6e46f4c23047e3519 Author: Georg Koppen <gk(a)torproject.org> Date: Sat Jun 10 18:48:02 2017 +0000 Update changelog --- Bundle-Data/Docs/ChangeLog.txt | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index 09497e7..d0c95b2 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -6,6 +6,8 @@ Tor Browser 7.0.1 -- June 13 2017 * Bug 22542: Security Settings window too small on macOS 10.12 * Update HTTPS-Everywhere to 5.2.18 * Bug 22362: NoScript's XSS filter freezes the browser + * OS X + * Bug 22558: Don't update OS X 10.7.x and 10.8.x users to Tor Browser 7.0 Tor Browser 7.0 -- June 7 2017 * All Platforms

1 0

[tor-browser-bundle/master] Bug 22558: Don't update OS X 10.7.x and 10.8.x to Tor Browser 7.0
by gk＠torproject.org 10 Jun '17

10 Jun '17

commit d7a6bc035327a2d92e8b4194e4c89363dede443b Author: Georg Koppen <gk(a)torproject.org> Date: Sat Jun 10 18:41:24 2017 +0000 Bug 22558: Don't update OS X 10.7.x and 10.8.x to Tor Browser 7.0 "10.9" was the wrong `minSupportedOSVersion` for preventing OS X 10.7.x and 10.8.x users from getting updated to Tor Browser 7. That it worked for OS X 10.6.x was only by chance according to the release history table (https://en.wikipedia.org/wiki/Darwin_(operating_system)#Release_history) We fix that by choosing "13.0.0" (for OS X 10.9 as minimum). --- tools/update-responses/config.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tools/update-responses/config.yml b/tools/update-responses/config.yml index 4234bcc..f3f3e26 100644 --- a/tools/update-responses/config.yml +++ b/tools/update-responses/config.yml @@ -45,6 +45,6 @@ versions: win32: minSupportedInstructionSet: SSE2 osx32: - minSupportedOSVersion: 10.9 + minSupportedOSVersion: 13.0.0 osx64: - minSupportedOSVersion: 10.9 + minSupportedOSVersion: 13.0.0

1 0

[tor-browser/tor-browser-52.2.0esr-7.5-1] Bug 1344034 - Auto-enforce W^X for WindowsDllInterceptor hook pages. r=dmajor
by gk＠torproject.org 10 Jun '17

10 Jun '17

commit dda0385cc49240f8bd115476c870d61863741f4c Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Thu Jun 8 09:25:54 2017 -0700 Bug 1344034 - Auto-enforce W^X for WindowsDllInterceptor hook pages. r=dmajor --- xpcom/build/nsWindowsDllInterceptor.h | 35 ++++++++++------------------------- 1 file changed, 10 insertions(+), 25 deletions(-) diff --git a/xpcom/build/nsWindowsDllInterceptor.h b/xpcom/build/nsWindowsDllInterceptor.h index 21a8f05..397fabc 100644 --- a/xpcom/build/nsWindowsDllInterceptor.h +++ b/xpcom/build/nsWindowsDllInterceptor.h @@ -93,6 +93,9 @@ public: { mSuccess = !!VirtualProtectEx(GetCurrentProcess(), mFunc, mSize, mNewProtect, &mOldProtect); + if (!mSuccess) { + // printf("VirtualProtectEx failed! %d\n", GetLastError()); + } return mSuccess; } @@ -132,7 +135,6 @@ public: // Ensure we can write to the code. AutoVirtualProtect protect(fn, 2, PAGE_EXECUTE_READWRITE); if (!protect.Protect()) { - // printf("VirtualProtectEx failed! %d\n", GetLastError()); continue; } @@ -268,7 +270,6 @@ public: AutoVirtualProtect protectBefore(fn - 5, 5, PAGE_EXECUTE_READWRITE); AutoVirtualProtect protectAfter(fn, 2, PAGE_EXECUTE_READWRITE); if (!protectBefore.Protect() || !protectAfter.Protect()) { - //printf ("VirtualProtectEx failed! %d\n", GetLastError()); return false; } @@ -377,7 +378,6 @@ public: // ensure we can modify the original code AutoVirtualProtect protect(origBytes, nBytes, PAGE_EXECUTE_READWRITE); if (!protect.Protect()) { - //printf ("VirtualProtectEx failed! %d\n", GetLastError()); continue; } @@ -417,7 +417,7 @@ public: mHookPage = (byteptr_t)VirtualAllocEx(GetCurrentProcess(), nullptr, mMaxHooks * kHookSize, MEM_COMMIT | MEM_RESERVE, - PAGE_EXECUTE_READWRITE); + PAGE_EXECUTE_READ); if (!mHookPage) { mModule = 0; return; @@ -426,19 +426,6 @@ public: bool Initialized() { return !!mModule; } - void LockHooks() - { - if (!mModule) { - return; - } - - DWORD op; - VirtualProtectEx(GetCurrentProcess(), mHookPage, mMaxHooks * kHookSize, - PAGE_EXECUTE_READ, &op); - - mModule = 0; - } - bool AddHook(const char* aName, intptr_t aHookDest, void** aOrigFunc) { if (!mModule) { @@ -670,6 +657,12 @@ protected: { *aOutTramp = nullptr; + AutoVirtualProtect protectHookPage(mHookPage, mMaxHooks * kHookSize, + PAGE_EXECUTE_READWRITE); + if (!protectHookPage.Protect()) { + return; + } + byteptr_t tramp = FindTrampolineSpace(); if (!tramp) { return; @@ -1005,7 +998,6 @@ protected: // ensure we can modify the original code AutoVirtualProtect protect(aOrigFunction, nBytes, PAGE_EXECUTE_READWRITE); if (!protect.Protect()) { - //printf ("VirtualProtectEx failed! %d\n", GetLastError()); return; } @@ -1091,13 +1083,6 @@ public: // not need it. } - void LockHooks() - { - if (mDetourPatcher.Initialized()) { - mDetourPatcher.LockHooks(); - } - } - bool AddHook(const char* aName, intptr_t aHookDest, void** aOrigFunc) { // Use a nop space patch if possible, otherwise fall back to a detour.

1 0

[tor-browser-bundle/master] Fix bug in changelog
by gk＠torproject.org 09 Jun '17

09 Jun '17

commit ade53c43e1230a05e0b138b3ade92914e9d9a279 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Jun 9 19:23:47 2017 +0000 Fix bug in changelog --- Bundle-Data/Docs/ChangeLog.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index fdc5c39..10a1268 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -133,7 +133,7 @@ Tor Browser 7.0a3 -- April 20 2017 * Bug 17334: Hide Referer when leaving a .onion domain (improved patch) * Bug 3246: Double-key cookies * Bug 8842: Fix XML parsing error - * Bug 16886: 16886: "Add-on compatibility check dialog" contains Firefox logo + * Bug 16886: "Add-on compatibility check dialog" contains Firefox logo * Bug 19192: Untrust Blue Coat CA * Bug 19955: Avoid confusing warning that favicon load request got cancelled * Bug 20005: Backport fixes for memory leaks investigation

1 0

[tor-browser-bundle/master] Release preparations for 7.5a1
by gk＠torproject.org 09 Jun '17

09 Jun '17

commit 321ad6021df0b3d55625c5bd88dcfc5acdf112f8 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Jun 9 19:14:09 2017 +0000 Release preparations for 7.5a1 Changelog update, version bumps, and config.yml update --- Bundle-Data/Docs/ChangeLog.txt | 49 +++++++++++++++++++++++++++++++++++++++ gitian/versions.alpha | 18 +++++++------- tools/update-responses/config.yml | 10 ++++---- 3 files changed, 63 insertions(+), 14 deletions(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index 9f00100..fdc5c39 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,52 @@ +Tor Browser 7.5a1 -- June 14 2017 + * All Platforms + * Update Firefox to 52.2.0esr + * Update Tor to 0.3.1.3-alpha + * Update Torbutton to 1.9.7.4 + * Bug 22542: Security Settings window too small on macOS 10.12 + * Bug 22104: Adjust our content policy whitelist for ff52-esr + * Bug 22457: Allow resources loaded by view-source:// + * Bug 21627: Ignore HTTP 304 responses when checking redirects + * Bug 22459: Adapt our use of the nsIContentPolicy to e10s mode + * Translations update + * Update Tor Launcher to 0.2.12.2 + * Bug 22283: Linux 7.0a4 is broken after update due to unix: lines in torrc + * Translations update + * Update HTTPS-Everywhere to 5.2.18 + * Update NoScript to 5.0.5 + * Update sandboxed-tor-browser to 0.0.7 + * Bug 22362: NoScript's XSS filter freezes the browser + * Bug 21766: Fix crash when the external application helper dialog is invoked + * Bug 21886: Download is stalled in non-e10s mode + * Bug 22333: Disable WebGL2 API for now + * Bug 21861: Disable additional mDNS code to avoid proxy bypasses + * Bug 21684: Don't expose navigator.AddonManager to content + * Bug 21431: Clean-up system extensions shipped in Firefox 52 + * Bug 22320: Use preference name 'referer.hideOnionSource' everywhere + * Bug 16285: Don't ship ClearKey EME system and update EME preferences + * Bug 21972: about:support is partially broken + * Bug 21323: Enable Mixed Content Blocking + * Bug 22415: Fix format error in our pipeline patch + * Bug 21862: Rip out potentially unsafe Rust code + * Bug 16485: Improve about:cache page + * Bug 22462: Backport of patch for bug 1329521 to fix assertion failure + * Bug 22458: Fix broken `about:cache` page on higher security levels + * Bug 18531: Uncaught exception when opening ip-check.info + * Bug 18574: Uncaught exception when clicking items in Library + * Bug 22327: Isolate Page Info media previews to first party domain + * Bug 22452: Isolate tab list menuitem favicons to first party domain + * Bug 15555: View-source requests are not isolated by first party domain + * Bug 5293: Neuter fingerprinting with Battery API + * Bug 22429: Add IPv6 address for Lisbeth:443 obfs4 bridge + * Bug 22468: Add default obfs4 bridges frosty and dragon + * Windows + * Bug 22419: Prevent access to file:// + * Linux + * Bug 16285: Remove ClearKey related library stripping + * Bug 21852: Don't use jemalloc4 anymore + * Android + * Bug 19078: Disable RtspMediaResource stuff in Orfox + Tor Browser 7.0a4 -- May 15 2017 * All Platforms * Update Firefox to 52.1.1esr diff --git a/gitian/versions.alpha b/gitian/versions.alpha index 0a3e9c6..f6ded37 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -10,15 +10,15 @@ DATA_OUTSIDE_APP_DIR=1 VERIFY_TAGS=1 -FIREFOX_VERSION=52.1.1esr +FIREFOX_VERSION=52.2.0esr TORBROWSER_UPDATE_CHANNEL=alpha -TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-7.0-1-build2 -TOR_TAG=tor-0.3.0.6 -TORLAUNCHER_TAG=0.2.12.1 -TORBUTTON_TAG=1.9.7.2 -HTTPSE_TAG=5.2.16 +TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-7.5-1-build1 +TOR_TAG=tor-0.3.1.3-alpha +TORLAUNCHER_TAG=0.2.12.2 +TORBUTTON_TAG=1.9.7.4 +HTTPSE_TAG=5.2.18 NSIS_TAG=v0.3.1 ZLIB_TAG=v1.2.8 LIBEVENT_TAG=release-2.0.22-stable @@ -41,7 +41,7 @@ OBFS4_TAG=obfs4proxy-0.0.5 NOTOFONTS_TAG=720e34851382ee3c1ef024d8dffb68ffbfb234c2 ERRORS_TAG=248dadf4e9068a0b3e79f02ed0a610d935de5302 GB_TAG=06cc925cce6592e922dcc4839a8b44feb384e71e -SANDBOX_TAG=sandboxed-tor-browser-0.0.6 +SANDBOX_TAG=sandboxed-tor-browser-0.0.7 DEPOT_TOOLS_TAG=28216cd14b44716db5c83634afbdc6e90492652b WEBRTC_TAG=c279861207c5b15fc51069e96595782350e0ac12 # https://chromium.googlesource.com/external/webrtc.git/+/refs/branch-heads/58 GO_WEBRTC_TAG=ab1b64862e0c4b4182010699911c2c5818f0a101 @@ -77,7 +77,7 @@ ELFUTILS_VER=0.166 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz GMP_PACKAGE=gmp-${GMP_VER}.tar.bz2 -NOSCRIPT_PACKAGE=noscript_security_suite-5.0.4-fx+sm.xpi +NOSCRIPT_PACKAGE=noscript_security_suite-5.0.5-fx+sm.xpi CCTOOLS_PACKAGE=cctools.tar.gz OSXSDK_PACKAGE=MacOSX10.7.sdk.tar.gz MSVCR100_PACKAGE=msvcr100.dll @@ -113,7 +113,7 @@ ELFUTILS_PACKAGE=elfutils-${ELFUTILS_VER}.tar.bz2 OPENSSL_HASH=6b3977c61f2aedf0f96367dcfb5c6e578cf37e7b8d913b4ecb6643c3cb88d8c0 GMP_HASH=752079520b4690531171d0f4532e40f08600215feefede70b24fabdc6f1ab160 OSXSDK_HASH=da77bb0003fcca5ea8c4e8cb2da8828ded750c54afdcac29ec6f3b46ad5e3adf -NOSCRIPT_HASH=cd8e5561bdd7331d9fdd510fb1bd1cb6460d64f351076b523d31361ff9853c76 +NOSCRIPT_HASH=bf1dee39f6e5936df2b03b794c1efc9236b440536a05fafcff667e33903e6aed CCTOOLS_HASH=e908fdebc2886ee5491ebfc7e7950af451b3c4e2439c2d7a923ed06ad05113e4 MSVCR100_HASH=1221a09484964a6f38af5e34ee292b9afefccb3dc6e55435fd3aaf7c235d9067 PYCRYPTO_HASH=f2ce1e989b272cfcb677616763e0a2e7ec659effa67a88aa92b3a65528f60a3c diff --git a/tools/update-responses/config.yml b/tools/update-responses/config.yml index 6a9a142..4234bcc 100644 --- a/tools/update-responses/config.yml +++ b/tools/update-responses/config.yml @@ -19,7 +19,7 @@ build_targets: osx32: Darwin_x86-gcc3 osx64: Darwin_x86_64-gcc3 channels: - alpha: 7.0a4 + alpha: 7.5a1 release: 6.0.1 versions: 6.0.1: @@ -33,11 +33,11 @@ versions: osx32: minSupportedOSVersion: 10.8 detailsURL: https://blog.torproject.org/blog/end-life-plan-tor-browser-32-bit-macs#upda… - 7.0a4: - platformVersion: 52.1.1 - detailsURL: https://blog.torproject.org/blog/tor-browser-70a4-released + 7.5a1: + platformVersion: 52.2.0 + detailsURL: https://blog.torproject.org/blog/tor-browser-75a1-released incremental_from: - - 7.0a3 + - 7.0a4 migrate_archs: osx32: osx64 migrate_langs:

1 0

[tor-browser-bundle/maint-7.0] Release preparations for 7.0.1
by gk＠torproject.org 09 Jun '17

09 Jun '17

commit 2a8b3159e9cda30e63e4e333aee20c604dbe3956 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Jun 9 07:14:39 2017 +0000 Release preparations for 7.0.1 Version bumps, changelog update, and config.yml update --- Bundle-Data/Docs/ChangeLog.txt | 9 +++++++++ gitian/versions | 10 +++++----- tools/update-responses/config.yml | 9 +++++---- 3 files changed, 19 insertions(+), 9 deletions(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index 9a830c3..09497e7 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,12 @@ +Tor Browser 7.0.1 -- June 13 2017 + * All Platforms + * Update Firefox to 52.2.0esr + * Update Tor to 0.3.0.8 + * Update Torbutton to 1.9.7.4 + * Bug 22542: Security Settings window too small on macOS 10.12 + * Update HTTPS-Everywhere to 5.2.18 + * Bug 22362: NoScript's XSS filter freezes the browser + Tor Browser 7.0 -- June 7 2017 * All Platforms * Update Firefox to 52.1.2esr diff --git a/gitian/versions b/gitian/versions index 86156ea..ae21121 100755 --- a/gitian/versions +++ b/gitian/versions @@ -10,15 +10,15 @@ DATA_OUTSIDE_APP_DIR=1 VERIFY_TAGS=1 -FIREFOX_VERSION=52.1.2esr +FIREFOX_VERSION=52.2.0esr TORBROWSER_UPDATE_CHANNEL=release -TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-7.0-1-build2 -TOR_TAG=tor-0.3.0.7 +TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-7.0-1-build1 +TOR_TAG=tor-0.3.0.8 TORLAUNCHER_TAG=0.2.12.2 -TORBUTTON_TAG=1.9.7.3 -HTTPSE_TAG=5.2.17 +TORBUTTON_TAG=1.9.7.4 +HTTPSE_TAG=5.2.18 NSIS_TAG=v0.3.1 ZLIB_TAG=v1.2.8 LIBEVENT_TAG=release-2.0.22-stable diff --git a/tools/update-responses/config.yml b/tools/update-responses/config.yml index 8b98b8e..9dfedd3 100644 --- a/tools/update-responses/config.yml +++ b/tools/update-responses/config.yml @@ -20,13 +20,14 @@ build_targets: osx64: Darwin_x86_64-gcc3 channels: alpha: 7.0a4 - release: 7.0 + release: 7.0.1 versions: - 7.0: - platformVersion: 52.1.2 - detailsURL: https://blog.torproject.org/blog/tor-browser-70-released + 7.0.1: + platformVersion: 52.2.0 + detailsURL: https://blog.torproject.org/blog/tor-browser-701-released incremental_from: - 6.5.2 + - 7.0 migrate_archs: osx32: osx64 migrate_langs:

1 0

[torbutton/master] Version bump and CHANGELOG update
by gk＠torproject.org 09 Jun '17

09 Jun '17

commit 52a33a0d7cec4117464ae502ef2bd0a4e0d1c4fa Author: Georg Koppen <gk(a)torproject.org> Date: Fri Jun 9 06:52:37 2017 +0000 Version bump and CHANGELOG update --- src/CHANGELOG | 3 +++ src/install.rdf | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/src/CHANGELOG b/src/CHANGELOG index 1dce5c2..775884c 100644 --- a/src/CHANGELOG +++ b/src/CHANGELOG @@ -1,3 +1,6 @@ +1.9.7.4 + * Bug 22542: Security Settings window too small on macOS 10.12 + 1.9.7.3 * Bug 22104: Adjust our content policy whitelist for ff52-esr * Bug 22457: Allow resources loaded by view-source:// diff --git a/src/install.rdf b/src/install.rdf index 8c28f40..868faea 100644 --- a/src/install.rdf +++ b/src/install.rdf @@ -6,7 +6,7 @@ <em:name>Torbutton</em:name> <em:creator>Mike Perry</em:creator> <em:id>torbutton(a)torproject.org</em:id> - <em:version>1.9.7.3</em:version> + <em:version>1.9.7.4</em:version> <em:multiprocessCompatible>true</em:multiprocessCompatible> <em:homepageURL>https://www.torproject.org/projects/torbrowser.html.en</em:homepageURL> <em:optionsURL>chrome://torbutton/content/preferences.xul</em:optionsURL>

1 0

[torbutton/master] Bug 22542: Security Settings window too small on macOS 10.12
by gk＠torproject.org 08 Jun '17

08 Jun '17

commit 6febc86aaca26984131b541e185323070de88ea7 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Thu Jun 8 10:29:10 2017 -0400 Bug 22542: Security Settings window too small on macOS 10.12 Increase the height of the security slider description area to avoid a scrollbar on macOS 10.12 (previously, the text associated with the "High" level required a scrollbar). --- src/chrome/content/preferences.xul | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/chrome/content/preferences.xul b/src/chrome/content/preferences.xul index 554312c..9bd8ae3 100644 --- a/src/chrome/content/preferences.xul +++ b/src/chrome/content/preferences.xul @@ -26,7 +26,7 @@ <caption label="&torbutton.prefs.sec_caption;"/> <hbox id="torbutton_slider_settings" flex="1" align="stretch" hidden="false"> <vbox> - <hbox height="200"> + <hbox height="220"> <vbox> <scale id="torbutton_sec_slider" flex="1" min="1" max="3" movetoclick="true" orient="vertical"

1 0

[tor-browser-bundle/maint-7.0] Bug 22362: NoScript's XSS filter freezes the browser
by gk＠torproject.org 08 Jun '17

08 Jun '17

commit f0584bcbec0f5c15ad510368df5088ce64ec48b6 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Jun 7 11:58:21 2017 +0000 Bug 22362: NoScript's XSS filter freezes the browser Due to a bug in NoScript's XSS filter Tor Browser freezes on some websites. We disable that filter for now while waiting on a NoScript update. --- .../Data/Browser/profile.default/preferences/extension-overrides.js | 4 ++++ .../Data/Browser/profile.default/preferences/extension-overrides.js | 4 ++++ .../Data/Browser/profile.default/preferences/extension-overrides.js | 4 ++++ 3 files changed, 12 insertions(+) diff --git a/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js b/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js index 6ef2c45..a34fb36 100644 --- a/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js @@ -55,3 +55,7 @@ pref("noscript.restrictSubdocScripting", true); pref("noscript.showVolatilePrivatePermissionsToggle", false); pref("noscript.volatilePrivatePermissions", true); pref("noscript.clearClick", 0); +// Workaround for bug 22362: Disable XSS filter for now as it freezes the +// browser in some circumstances. +pref("noscript.filterXGet", false); +pref("noscript.filterXPost", false); diff --git a/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js b/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js index 6ef2c45..a34fb36 100644 --- a/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js @@ -55,3 +55,7 @@ pref("noscript.restrictSubdocScripting", true); pref("noscript.showVolatilePrivatePermissionsToggle", false); pref("noscript.volatilePrivatePermissions", true); pref("noscript.clearClick", 0); +// Workaround for bug 22362: Disable XSS filter for now as it freezes the +// browser in some circumstances. +pref("noscript.filterXGet", false); +pref("noscript.filterXPost", false); diff --git a/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js b/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js index 6ef2c45..a34fb36 100644 --- a/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js @@ -55,3 +55,7 @@ pref("noscript.restrictSubdocScripting", true); pref("noscript.showVolatilePrivatePermissionsToggle", false); pref("noscript.volatilePrivatePermissions", true); pref("noscript.clearClick", 0); +// Workaround for bug 22362: Disable XSS filter for now as it freezes the +// browser in some circumstances. +pref("noscript.filterXGet", false); +pref("noscript.filterXPost", false);

1 0

[tor-browser-bundle/master] Bug 22362: NoScript's XSS filter freezes the browser
by gk＠torproject.org 08 Jun '17

08 Jun '17

commit e8178d1373d6ce2599ef58eca4d52d1b6817263f Author: Georg Koppen <gk(a)torproject.org> Date: Wed Jun 7 11:58:21 2017 +0000 Bug 22362: NoScript's XSS filter freezes the browser Due to a bug in NoScript's XSS filter Tor Browser freezes on some websites. We disable that filter for now while waiting on a NoScript update. --- .../Data/Browser/profile.default/preferences/extension-overrides.js | 4 ++++ .../Data/Browser/profile.default/preferences/extension-overrides.js | 4 ++++ .../Data/Browser/profile.default/preferences/extension-overrides.js | 4 ++++ 3 files changed, 12 insertions(+) diff --git a/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js b/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js index 6ef2c45..a34fb36 100644 --- a/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js @@ -55,3 +55,7 @@ pref("noscript.restrictSubdocScripting", true); pref("noscript.showVolatilePrivatePermissionsToggle", false); pref("noscript.volatilePrivatePermissions", true); pref("noscript.clearClick", 0); +// Workaround for bug 22362: Disable XSS filter for now as it freezes the +// browser in some circumstances. +pref("noscript.filterXGet", false); +pref("noscript.filterXPost", false); diff --git a/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js b/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js index 6ef2c45..a34fb36 100644 --- a/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js @@ -55,3 +55,7 @@ pref("noscript.restrictSubdocScripting", true); pref("noscript.showVolatilePrivatePermissionsToggle", false); pref("noscript.volatilePrivatePermissions", true); pref("noscript.clearClick", 0); +// Workaround for bug 22362: Disable XSS filter for now as it freezes the +// browser in some circumstances. +pref("noscript.filterXGet", false); +pref("noscript.filterXPost", false); diff --git a/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js b/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js index 6ef2c45..a34fb36 100644 --- a/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js @@ -55,3 +55,7 @@ pref("noscript.restrictSubdocScripting", true); pref("noscript.showVolatilePrivatePermissionsToggle", false); pref("noscript.volatilePrivatePermissions", true); pref("noscript.clearClick", 0); +// Workaround for bug 22362: Disable XSS filter for now as it freezes the +// browser in some circumstances. +pref("noscript.filterXGet", false); +pref("noscript.filterXPost", false);

1 0