- tbb-commits - lists.torproject.org

[tor-browser-bundle/maint-7.0] Bug 22429: Add IPv6 address for Lisbeth:443 obfs4 bridge.
by gk＠torproject.org 02 Jun '17

02 Jun '17

commit 94947a1c2333c4dcf0a0bf8af6228aceaf437ad2 Author: David Fifield <david(a)bamsoftware.com> Date: Thu Jun 1 12:55:15 2017 -0700 Bug 22429: Add IPv6 address for Lisbeth:443 obfs4 bridge. --- Bundle-Data/PTConfigs/bridge_prefs.js | 1 + 1 file changed, 1 insertion(+) diff --git a/Bundle-Data/PTConfigs/bridge_prefs.js b/Bundle-Data/PTConfigs/bridge_prefs.js index 48d3465..add6448 100644 --- a/Bundle-Data/PTConfigs/bridge_prefs.js +++ b/Bundle-Data/PTConfigs/bridge_prefs.js @@ -35,6 +35,7 @@ pref("extensions.torlauncher.default_bridge.obfs4.19", "obfs4 192.95.36.142:443 pref("extensions.torlauncher.default_bridge.obfs4.20", "obfs4 85.17.30.79:443 FC259A04A328A07FED1413E9FC6526530D9FD87A cert=RutxZlu8BtyP+y0NX7bAVD41+J/qXNhHUrKjFkRSdiBAhIHIQLhKQ2HxESAKZprn/lR3KA iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.21", "obfs4 38.229.1.78:80 C8CBDB2464FC9804A69531437BCF2BE31FDD2EE4 cert=Hmyfd2ev46gGY7NoVxA9ngrPF2zCZtzskRTzoWXbxNkzeVnGFPWmrTtILRyqCTjHR+s9dg iat-mode=1"); /**/pref/**/(/**/"extensions.torlauncher.default_bridge.obfs4.22"/**/, /**/"obfs4 38.229.33.83:80 0BAC39417268B96B9F514E7F63FA6FBA1A788955 cert=VwEFpk9F/UN9JED7XpG1XOjm/O8ZCXK80oPecgWnNDZDv5pdkhq1OpbAH0wNqOT6H6BmRQ iat-mode=1"); +pref("extensions.torlauncher.default_bridge.obfs4.23", "obfs4 [2001:470:b381:bfff:216:3eff:fe23:d6c3]:443 CDF2E852BF539B82BD10E27E9115A31734E378C2 cert=qUVQ0srL1JI/vO6V6m/24anYXiJD3QP2HgzUKQtQ7GRqqUvs7P+tG43RtAqdhLOALP7DJQ iat-mode=1"); pref("extensions.torlauncher.default_bridge.meek-amazon.1", "meek 0.0.2.0:2 B9E7141C594AF25699E0079C1F0146F409495296 url=https://d2cly7j4zqgua7.cloudfront.net/ front=a0.awsstatic.com"); pref("extensions.torlauncher.default_bridge.meek-azure.1", "meek 0.0.2.0:3 97700DFE9F483596DDA6264C4D7DF7641E1E39CE url=https://meek.azureedge.net/ front=ajax.aspnetcdn.com");

1 0

[tor-browser-bundle/master] Bug 22429: Add IPv6 address for Lisbeth:443 obfs4 bridge.
by gk＠torproject.org 02 Jun '17

02 Jun '17

commit 6dbe2e65a8d5822d024669e90d7f920b453adce4 Author: David Fifield <david(a)bamsoftware.com> Date: Thu Jun 1 12:55:15 2017 -0700 Bug 22429: Add IPv6 address for Lisbeth:443 obfs4 bridge. --- Bundle-Data/PTConfigs/bridge_prefs.js | 1 + 1 file changed, 1 insertion(+) diff --git a/Bundle-Data/PTConfigs/bridge_prefs.js b/Bundle-Data/PTConfigs/bridge_prefs.js index fea436d..9cbb326 100644 --- a/Bundle-Data/PTConfigs/bridge_prefs.js +++ b/Bundle-Data/PTConfigs/bridge_prefs.js @@ -35,6 +35,7 @@ pref("extensions.torlauncher.default_bridge.obfs4.19", "obfs4 192.95.36.142:443 pref("extensions.torlauncher.default_bridge.obfs4.20", "obfs4 85.17.30.79:443 FC259A04A328A07FED1413E9FC6526530D9FD87A cert=RutxZlu8BtyP+y0NX7bAVD41+J/qXNhHUrKjFkRSdiBAhIHIQLhKQ2HxESAKZprn/lR3KA iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.21", "obfs4 38.229.1.78:80 C8CBDB2464FC9804A69531437BCF2BE31FDD2EE4 cert=Hmyfd2ev46gGY7NoVxA9ngrPF2zCZtzskRTzoWXbxNkzeVnGFPWmrTtILRyqCTjHR+s9dg iat-mode=1"); /**/pref/**/(/**/"extensions.torlauncher.default_bridge.obfs4.22"/**/, /**/"obfs4 38.229.33.83:80 0BAC39417268B96B9F514E7F63FA6FBA1A788955 cert=VwEFpk9F/UN9JED7XpG1XOjm/O8ZCXK80oPecgWnNDZDv5pdkhq1OpbAH0wNqOT6H6BmRQ iat-mode=1"); +pref("extensions.torlauncher.default_bridge.obfs4.23", "obfs4 [2001:470:b381:bfff:216:3eff:fe23:d6c3]:443 CDF2E852BF539B82BD10E27E9115A31734E378C2 cert=qUVQ0srL1JI/vO6V6m/24anYXiJD3QP2HgzUKQtQ7GRqqUvs7P+tG43RtAqdhLOALP7DJQ iat-mode=1"); pref("extensions.torlauncher.default_bridge.meek-amazon.1", "meek 0.0.2.0:2 B9E7141C594AF25699E0079C1F0146F409495296 url=https://d2cly7j4zqgua7.cloudfront.net/ front=a0.awsstatic.com"); pref("extensions.torlauncher.default_bridge.meek-azure.1", "meek 0.0.2.0:3 97700DFE9F483596DDA6264C4D7DF7641E1E39CE url=https://meek.azureedge.net/ front=ajax.aspnetcdn.com");

1 0

[tor-browser/tor-browser-52.1.1esr-7.0-1] Bug 16485: Improve about:cache page
by gk＠torproject.org 02 Jun '17

02 Jun '17

commit e1f39122d16e5cd69dd11732d8fb2faf5087fdd2 Author: Georg Koppen <gk(a)torproject.org> Date: Wed May 31 08:58:30 2017 +0000 Bug 16485: Improve about:cache page Loading `about:cache` and selecting particular caches via the checkboxes results in a cryptic error ("Unrecognized storage name 'null' in about:cache URL) when updating the page. We avoid that by making sure the storage parameter is in fact empty if it is supposed to be `null`. --- toolkit/components/aboutcache/content/aboutCache.js | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/toolkit/components/aboutcache/content/aboutCache.js b/toolkit/components/aboutcache/content/aboutCache.js index 07067cc..425e570 100644 --- a/toolkit/components/aboutcache/content/aboutCache.js +++ b/toolkit/components/aboutcache/content/aboutCache.js @@ -40,5 +40,13 @@ function navigate() if ($('priv').checked) context += 'p,'; + // Checking any of the checkboxes and hitting "Update" after `about:cache` got + // loaded should not result in a cryptic error ("Unrecognized storage name + // 'null' in about:cache URL"). Rather, the related list of entries in all + // caches should be made visible. + if (storage == null) { + storage="" + } + window.location.href = 'about:cache?storage=' + storage + '&context=' + context; }

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] Bug 16485: Improve about:cache page
by gk＠torproject.org 02 Jun '17

02 Jun '17

commit 9607f989206d048c9905d1b19cedf9913750c6c7 Author: Georg Koppen <gk(a)torproject.org> Date: Wed May 31 08:58:30 2017 +0000 Bug 16485: Improve about:cache page Loading `about:cache` and selecting particular caches via the checkboxes results in a cryptic error ("Unrecognized storage name 'null' in about:cache URL) when updating the page. We avoid that by making sure the storage parameter is in fact empty if it is supposed to be `null`. --- toolkit/components/aboutcache/content/aboutCache.js | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/toolkit/components/aboutcache/content/aboutCache.js b/toolkit/components/aboutcache/content/aboutCache.js index 07067cc..425e570 100644 --- a/toolkit/components/aboutcache/content/aboutCache.js +++ b/toolkit/components/aboutcache/content/aboutCache.js @@ -40,5 +40,13 @@ function navigate() if ($('priv').checked) context += 'p,'; + // Checking any of the checkboxes and hitting "Update" after `about:cache` got + // loaded should not result in a cryptic error ("Unrecognized storage name + // 'null' in about:cache URL"). Rather, the related list of entries in all + // caches should be made visible. + if (storage == null) { + storage="" + } + window.location.href = 'about:cache?storage=' + storage + '&context=' + context; }

1 0

[torbutton/master] Bug 22457: Allow resources loaded by view-source://
by gk＠torproject.org 02 Jun '17

02 Jun '17

commit 137c0527b1d152c5999db53894badc54ab9e34c9 Author: Georg Koppen <gk(a)torproject.org> Date: Thu Jun 1 09:26:11 2017 +0000 Bug 22457: Allow resources loaded by view-source:// Instead of whitelisting single resources for view-source requests that might allow platform detection we allow all of those that are needed by requests with a view-source origin. This should be safe now that https://bugzilla.mozilla.org/show_bug.cgi?id=1172165 landed. --- src/components/content-policy.js | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/components/content-policy.js b/src/components/content-policy.js index a63919c..b2fdff7 100644 --- a/src/components/content-policy.js +++ b/src/components/content-policy.js @@ -83,8 +83,12 @@ ContentPolicy.prototype = { return Ci.nsIContentPolicy.ACCEPT; } - // Accept if no origin URI or if origin scheme is chrome/resource/about. - if (!aRequestOrigin || aRequestOrigin.schemeIs('resource') || aRequestOrigin.schemeIs('chrome') || aRequestOrigin.schemeIs('about')) + // Accept if no origin URI or if origin scheme is + // chrome/resource/about/view-source. + if (!aRequestOrigin || aRequestOrigin.schemeIs('resource') || + aRequestOrigin.schemeIs('chrome') || + aRequestOrigin.schemeIs('about') || + aRequestOrigin.schemeIs('view-source')) return Ci.nsIContentPolicy.ACCEPT; // Accept if resource directly loaded into a tab.

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] Bug 21862: Rip out potentially unsafe rust code
by gk＠torproject.org 02 Jun '17

02 Jun '17

commit 88c25c56d96f8fc0801359358d808f0d0e7d4b93 Author: Georg Koppen <gk(a)torproject.org> Date: Wed May 24 14:30:03 2017 +0000 Bug 21862: Rip out potentially unsafe rust code Just ripping out the problematic code leads to compile errors complaining about modified third party code. That's fine for now, though we need to think harder about this issue once we start building with Rust being mandatory. --- third_party/rust/url/src/host.rs | 22 +--------------------- third_party/rust/url/src/lib.rs | 11 +---------- 2 files changed, 2 insertions(+), 31 deletions(-) diff --git a/third_party/rust/url/src/host.rs b/third_party/rust/url/src/host.rs index 47b049a..f2de780 100644 --- a/third_party/rust/url/src/host.rs +++ b/third_party/rust/url/src/host.rs @@ -10,7 +10,7 @@ use std::cmp; use std::fmt::{self, Formatter}; use std::io; -use std::net::{Ipv4Addr, Ipv6Addr, SocketAddr, SocketAddrV4, SocketAddrV6, ToSocketAddrs}; +use std::net::{Ipv4Addr, Ipv6Addr, SocketAddr, SocketAddrV4, SocketAddrV6}; use std::vec; use parser::{ParseResult, ParseError}; use percent_encoding::percent_decode; @@ -135,26 +135,6 @@ impl<'a> HostAndPort<&'a str> { } } -impl<S: AsRef<str>> ToSocketAddrs for HostAndPort<S> { - type Iter = SocketAddrs; - - fn to_socket_addrs(&self) -> io::Result<Self::Iter> { - let port = self.port; - match self.host { - Host::Domain(ref domain) => Ok(SocketAddrs { - // FIXME: use std::net::lookup_host when it’s stable. - state: SocketAddrsState::Domain(try!((domain.as_ref(), port).to_socket_addrs())) - }), - Host::Ipv4(address) => Ok(SocketAddrs { - state: SocketAddrsState::One(SocketAddr::V4(SocketAddrV4::new(address, port))) - }), - Host::Ipv6(address) => Ok(SocketAddrs { - state: SocketAddrsState::One(SocketAddr::V6(SocketAddrV6::new(address, port, 0, 0))) - }), - } - } -} - /// Socket addresses for an URL. pub struct SocketAddrs { state: SocketAddrsState diff --git a/third_party/rust/url/src/lib.rs b/third_party/rust/url/src/lib.rs index 9378318..51607e4 100644 --- a/third_party/rust/url/src/lib.rs +++ b/third_party/rust/url/src/lib.rs @@ -130,7 +130,7 @@ use std::fmt::{self, Write}; use std::hash; use std::io; use std::mem; -use std::net::{ToSocketAddrs, IpAddr}; +use std::net::IpAddr; use std::ops::{Range, RangeFrom, RangeTo}; use std::path::{Path, PathBuf}; use std::str; @@ -1191,15 +1191,6 @@ impl Url { } } -/// Return an error if `Url::host` or `Url::port_or_known_default` return `None`. -impl ToSocketAddrs for Url { - type Iter = SocketAddrs; - - fn to_socket_addrs(&self) -> io::Result<Self::Iter> { - try!(self.with_default_port(|_| Err(()))).to_socket_addrs() - } -} - /// Parse a string as an URL, without a base URL or encoding override. impl str::FromStr for Url { type Err = ParseError;

1 0

[tor-browser/tor-browser-52.1.1esr-7.0-1] Bug 21862: Rip out potentially unsafe rust code
by gk＠torproject.org 02 Jun '17

02 Jun '17

commit 78aa6185cd8d1d11e09495f6e4dc5cbc19e80cba Author: Georg Koppen <gk(a)torproject.org> Date: Wed May 24 14:30:03 2017 +0000 Bug 21862: Rip out potentially unsafe rust code Just ripping out the problematic code leads to compile errors complaining about modified third party code. That's fine for now, though we need to think harder about this issue once we start building with Rust being mandatory. --- third_party/rust/url/src/host.rs | 22 +--------------------- third_party/rust/url/src/lib.rs | 11 +---------- 2 files changed, 2 insertions(+), 31 deletions(-) diff --git a/third_party/rust/url/src/host.rs b/third_party/rust/url/src/host.rs index 47b049a..f2de780 100644 --- a/third_party/rust/url/src/host.rs +++ b/third_party/rust/url/src/host.rs @@ -10,7 +10,7 @@ use std::cmp; use std::fmt::{self, Formatter}; use std::io; -use std::net::{Ipv4Addr, Ipv6Addr, SocketAddr, SocketAddrV4, SocketAddrV6, ToSocketAddrs}; +use std::net::{Ipv4Addr, Ipv6Addr, SocketAddr, SocketAddrV4, SocketAddrV6}; use std::vec; use parser::{ParseResult, ParseError}; use percent_encoding::percent_decode; @@ -135,26 +135,6 @@ impl<'a> HostAndPort<&'a str> { } } -impl<S: AsRef<str>> ToSocketAddrs for HostAndPort<S> { - type Iter = SocketAddrs; - - fn to_socket_addrs(&self) -> io::Result<Self::Iter> { - let port = self.port; - match self.host { - Host::Domain(ref domain) => Ok(SocketAddrs { - // FIXME: use std::net::lookup_host when it’s stable. - state: SocketAddrsState::Domain(try!((domain.as_ref(), port).to_socket_addrs())) - }), - Host::Ipv4(address) => Ok(SocketAddrs { - state: SocketAddrsState::One(SocketAddr::V4(SocketAddrV4::new(address, port))) - }), - Host::Ipv6(address) => Ok(SocketAddrs { - state: SocketAddrsState::One(SocketAddr::V6(SocketAddrV6::new(address, port, 0, 0))) - }), - } - } -} - /// Socket addresses for an URL. pub struct SocketAddrs { state: SocketAddrsState diff --git a/third_party/rust/url/src/lib.rs b/third_party/rust/url/src/lib.rs index 9378318..51607e4 100644 --- a/third_party/rust/url/src/lib.rs +++ b/third_party/rust/url/src/lib.rs @@ -130,7 +130,7 @@ use std::fmt::{self, Write}; use std::hash; use std::io; use std::mem; -use std::net::{ToSocketAddrs, IpAddr}; +use std::net::IpAddr; use std::ops::{Range, RangeFrom, RangeTo}; use std::path::{Path, PathBuf}; use std::str; @@ -1191,15 +1191,6 @@ impl Url { } } -/// Return an error if `Url::host` or `Url::port_or_known_default` return `None`. -impl ToSocketAddrs for Url { - type Iter = SocketAddrs; - - fn to_socket_addrs(&self) -> io::Result<Self::Iter> { - try!(self.with_default_port(|_| Err(()))).to_socket_addrs() - } -} - /// Parse a string as an URL, without a base URL or encoding override. impl str::FromStr for Url { type Err = ParseError;

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] Bug 1329521 - GetLoadContextInfo() should not compare originAttributes and privateBrowsing boolean when docShell is chrome type, r=smaug
by gk＠torproject.org 02 Jun '17

02 Jun '17

commit 3f5f0f7d0b7a3384f5b46d2abef6b1bbf631077e Author: Andrea Marchesini <amarchesini(a)mozilla.com> Date: Fri Jan 13 15:41:28 2017 +0100 Bug 1329521 - GetLoadContextInfo() should not compare originAttributes and privateBrowsing boolean when docShell is chrome type, r=smaug Backported to ESR52: https://bugs.torproject.org/22462 --- netwerk/base/LoadContextInfo.cpp | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/netwerk/base/LoadContextInfo.cpp b/netwerk/base/LoadContextInfo.cpp index 61b9394..77eeb79 100644 --- a/netwerk/base/LoadContextInfo.cpp +++ b/netwerk/base/LoadContextInfo.cpp @@ -5,6 +5,7 @@ #include "LoadContextInfo.h" #include "mozilla/dom/ToJSValue.h" +#include "nsDocShell.h" #include "nsIChannel.h" #include "nsILoadContext.h" #include "nsIWebNavigation.h" @@ -141,14 +142,19 @@ GetLoadContextInfo(nsILoadContext *aLoadContext, bool aIsAnonymous) NeckoOriginAttributes(nsILoadContextInfo::NO_APP_ID, false)); } - DebugOnly<bool> pb = aLoadContext->UsePrivateBrowsing(); DocShellOriginAttributes doa; aLoadContext->GetOriginAttributes(doa); - MOZ_ASSERT(pb == (doa.mPrivateBrowsingId > 0)); NeckoOriginAttributes noa; noa.InheritFromDocShellToNecko(doa); +#ifdef DEBUG + nsCOMPtr<nsIDocShellTreeItem> docShell = do_QueryInterface(aLoadContext); + if (!docShell || docShell->ItemType() != nsIDocShellTreeItem::typeChrome) { + MOZ_ASSERT(aLoadContext->UsePrivateBrowsing() == (doa.mPrivateBrowsingId > 0)); + } +#endif + return new LoadContextInfo(aIsAnonymous, noa); }

1 0

[tor-browser/tor-browser-52.1.1esr-7.0-1] Bug 1329521 - GetLoadContextInfo() should not compare originAttributes and privateBrowsing boolean when docShell is chrome type, r=smaug
by gk＠torproject.org 02 Jun '17

02 Jun '17

commit a63362cbdd952afdeed64c36ba21b6b94aa5d01b Author: Andrea Marchesini <amarchesini(a)mozilla.com> Date: Fri Jan 13 15:41:28 2017 +0100 Bug 1329521 - GetLoadContextInfo() should not compare originAttributes and privateBrowsing boolean when docShell is chrome type, r=smaug Backported to ESR52: https://bugs.torproject.org/22462 --- netwerk/base/LoadContextInfo.cpp | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/netwerk/base/LoadContextInfo.cpp b/netwerk/base/LoadContextInfo.cpp index 61b9394..77eeb79 100644 --- a/netwerk/base/LoadContextInfo.cpp +++ b/netwerk/base/LoadContextInfo.cpp @@ -5,6 +5,7 @@ #include "LoadContextInfo.h" #include "mozilla/dom/ToJSValue.h" +#include "nsDocShell.h" #include "nsIChannel.h" #include "nsILoadContext.h" #include "nsIWebNavigation.h" @@ -141,14 +142,19 @@ GetLoadContextInfo(nsILoadContext *aLoadContext, bool aIsAnonymous) NeckoOriginAttributes(nsILoadContextInfo::NO_APP_ID, false)); } - DebugOnly<bool> pb = aLoadContext->UsePrivateBrowsing(); DocShellOriginAttributes doa; aLoadContext->GetOriginAttributes(doa); - MOZ_ASSERT(pb == (doa.mPrivateBrowsingId > 0)); NeckoOriginAttributes noa; noa.InheritFromDocShellToNecko(doa); +#ifdef DEBUG + nsCOMPtr<nsIDocShellTreeItem> docShell = do_QueryInterface(aLoadContext); + if (!docShell || docShell->ItemType() != nsIDocShellTreeItem::typeChrome) { + MOZ_ASSERT(aLoadContext->UsePrivateBrowsing() == (doa.mPrivateBrowsingId > 0)); + } +#endif + return new LoadContextInfo(aIsAnonymous, noa); }

1 0

[tor-browser-bundle/maint-7.0] Bug 22458: Fix broken `about:cache` page on higher security levels
by gk＠torproject.org 01 Jun '17

01 Jun '17

commit 0cc98ba1bb0f3c15d00760a1ca05713489f5085a Author: Georg Koppen <gk(a)torproject.org> Date: Wed May 31 09:13:33 2017 +0000 Bug 22458: Fix broken `about:cache` page on higher security levels We need to allow JavaScript on `about:cache` explicitly. Otherwise it is broken on higher security levels. --- .../Data/Browser/profile.default/preferences/extension-overrides.js | 6 +++--- .../Data/Browser/profile.default/preferences/extension-overrides.js | 6 +++--- .../Data/Browser/profile.default/preferences/extension-overrides.js | 6 +++--- 3 files changed, 9 insertions(+), 9 deletions(-) diff --git a/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js b/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js index 1465e29..6ef2c45 100644 --- a/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js @@ -8,9 +8,9 @@ pref("extensions.https_everywhere.toolbar_hint_shown", true); # NoScript Preferences: pref("capability.policy.maonoscript.javascript.enabled", "allAccess"); -pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed"); -pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed"); -pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed"); +pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed about:cache"); +pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed about:cache"); +pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed about:cache"); pref("noscript.ABE.enabled", false); pref("noscript.ABE.notify", false); pref("noscript.ABE.wanIpAsLocal", false); diff --git a/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js b/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js index 1465e29..6ef2c45 100644 --- a/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js @@ -8,9 +8,9 @@ pref("extensions.https_everywhere.toolbar_hint_shown", true); # NoScript Preferences: pref("capability.policy.maonoscript.javascript.enabled", "allAccess"); -pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed"); -pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed"); -pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed"); +pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed about:cache"); +pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed about:cache"); +pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed about:cache"); pref("noscript.ABE.enabled", false); pref("noscript.ABE.notify", false); pref("noscript.ABE.wanIpAsLocal", false); diff --git a/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js b/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js index 1465e29..6ef2c45 100644 --- a/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js @@ -8,9 +8,9 @@ pref("extensions.https_everywhere.toolbar_hint_shown", true); # NoScript Preferences: pref("capability.policy.maonoscript.javascript.enabled", "allAccess"); -pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed"); -pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed"); -pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed"); +pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed about:cache"); +pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed about:cache"); +pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed about:cache"); pref("noscript.ABE.enabled", false); pref("noscript.ABE.notify", false); pref("noscript.ABE.wanIpAsLocal", false);

1 0

[tor-browser-bundle/master] Bug 22458: Fix broken `about:cache` page on higher security levels
by gk＠torproject.org 01 Jun '17

01 Jun '17

commit e385532fa600616740bf9a92cf8d3325c0507774 Author: Georg Koppen <gk(a)torproject.org> Date: Wed May 31 09:13:33 2017 +0000 Bug 22458: Fix broken `about:cache` page on higher security levels We need to allow JavaScript on `about:cache` explicitly. Otherwise it is broken on higher security levels. --- .../Data/Browser/profile.default/preferences/extension-overrides.js | 6 +++--- .../Data/Browser/profile.default/preferences/extension-overrides.js | 6 +++--- .../Data/Browser/profile.default/preferences/extension-overrides.js | 6 +++--- 3 files changed, 9 insertions(+), 9 deletions(-) diff --git a/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js b/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js index 1465e29..6ef2c45 100644 --- a/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js @@ -8,9 +8,9 @@ pref("extensions.https_everywhere.toolbar_hint_shown", true); # NoScript Preferences: pref("capability.policy.maonoscript.javascript.enabled", "allAccess"); -pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed"); -pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed"); -pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed"); +pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed about:cache"); +pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed about:cache"); +pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed about:cache"); pref("noscript.ABE.enabled", false); pref("noscript.ABE.notify", false); pref("noscript.ABE.wanIpAsLocal", false); diff --git a/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js b/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js index 1465e29..6ef2c45 100644 --- a/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js @@ -8,9 +8,9 @@ pref("extensions.https_everywhere.toolbar_hint_shown", true); # NoScript Preferences: pref("capability.policy.maonoscript.javascript.enabled", "allAccess"); -pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed"); -pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed"); -pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed"); +pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed about:cache"); +pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed about:cache"); +pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed about:cache"); pref("noscript.ABE.enabled", false); pref("noscript.ABE.notify", false); pref("noscript.ABE.wanIpAsLocal", false); diff --git a/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js b/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js index 1465e29..6ef2c45 100644 --- a/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js @@ -8,9 +8,9 @@ pref("extensions.https_everywhere.toolbar_hint_shown", true); # NoScript Preferences: pref("capability.policy.maonoscript.javascript.enabled", "allAccess"); -pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed"); -pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed"); -pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed"); +pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed about:cache"); +pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed about:cache"); +pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed about:cache"); pref("noscript.ABE.enabled", false); pref("noscript.ABE.notify", false); pref("noscript.ABE.wanIpAsLocal", false);

1 0

[tor-browser-bundle/maint-7.0] Bug 22398: Upgrade go to 1.8.3.
by gk＠torproject.org 01 Jun '17

01 Jun '17

commit 28c582f8aad09c2d2a8e166024841ac7014bb590 Author: David Fifield <david(a)bamsoftware.com> Date: Tue May 30 14:29:36 2017 -0700 Bug 22398: Upgrade go to 1.8.3. --- gitian/versions | 4 ++-- gitian/versions.alpha | 4 ++-- gitian/versions.beta | 4 ++-- gitian/versions.nightly | 4 ++-- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/gitian/versions b/gitian/versions index 12a47fc..95c4e26 100755 --- a/gitian/versions +++ b/gitian/versions @@ -60,7 +60,7 @@ SETUPTOOLS_VER=1.4 PARSLEY_VER=1.2 # We need a Go 1.4 to bootstrap later versions; see https://golang.org/doc/install/source#go14 GO14_VER=1.4.3 -GO_VER=1.8.1 +GO_VER=1.8.3 NSIS_VER=2.51 YASM_VER=1.2.0 @@ -114,7 +114,7 @@ PY2EXE_HASH=610a8800de3d973ed5ed4ac505ab42ad058add18a68609ac09e6cf3598ef056c SETUPTOOLS_HASH=75d288687066ed124311d6ca5f40ffa92a0e81adcd7fff318c6e84082713cf39 PARSLEY_HASH=50d30cee70770fd44db7cea421cb2fb75af247c3a1cd54885c06b30a7c85dd23 GO14_HASH=9947fc705b0b841b5938c48b22dc33e9647ec0752bae66e50278df4f23f64959 -GO_HASH=33daf4c03f86120fdfdc66bddf6bfff4661c7ca11c5da473e537f4d69b470e57 +GO_HASH=5f5dea2447e7dcfdc50fa6b94c512e58bfba5673c039259fd843f68829d99fa6 NSIS_HASH=43d4c9209847e35eb6e2c7cd5a7586e1445374c056c2c7899e40a080e17a1be7 NSIS_DEBIAN_HASH=1dee6957b4a4b8dfe69bcf28bc7f301a13b96b3fa5a394e36c8926ae781e774a GCC_HASH=b7dafdf89cbb0e20333dbf5b5349319ae06e3d1a30bf3515b5488f7e89dca5ad diff --git a/gitian/versions.alpha b/gitian/versions.alpha index 7363009..379fc49 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -63,7 +63,7 @@ SETUPTOOLS_VER=1.4 PARSLEY_VER=1.2 # We need a Go 1.4 to bootstrap later versions; see https://golang.org/doc/install/source#go14 GO14_VER=1.4.3 -GO_VER=1.8.1 +GO_VER=1.8.3 NSIS_VER=2.51 YASM_VER=1.2.0 @@ -117,7 +117,7 @@ PY2EXE_HASH=610a8800de3d973ed5ed4ac505ab42ad058add18a68609ac09e6cf3598ef056c SETUPTOOLS_HASH=75d288687066ed124311d6ca5f40ffa92a0e81adcd7fff318c6e84082713cf39 PARSLEY_HASH=50d30cee70770fd44db7cea421cb2fb75af247c3a1cd54885c06b30a7c85dd23 GO14_HASH=9947fc705b0b841b5938c48b22dc33e9647ec0752bae66e50278df4f23f64959 -GO_HASH=33daf4c03f86120fdfdc66bddf6bfff4661c7ca11c5da473e537f4d69b470e57 +GO_HASH=5f5dea2447e7dcfdc50fa6b94c512e58bfba5673c039259fd843f68829d99fa6 NSIS_HASH=43d4c9209847e35eb6e2c7cd5a7586e1445374c056c2c7899e40a080e17a1be7 NSIS_DEBIAN_HASH=1dee6957b4a4b8dfe69bcf28bc7f301a13b96b3fa5a394e36c8926ae781e774a GCC_HASH=b7dafdf89cbb0e20333dbf5b5349319ae06e3d1a30bf3515b5488f7e89dca5ad diff --git a/gitian/versions.beta b/gitian/versions.beta index 70ef2ee..7b759a8 100755 --- a/gitian/versions.beta +++ b/gitian/versions.beta @@ -49,7 +49,7 @@ SETUPTOOLS_VER=1.4 PARSLEY_VER=1.2 # We need a Go 1.4 to bootstrap later versions; see https://golang.org/doc/install/source#go14 GO14_VER=1.4.3 -GO_VER=1.8.1 +GO_VER=1.8.3 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz @@ -94,7 +94,7 @@ PY2EXE_HASH=610a8800de3d973ed5ed4ac505ab42ad058add18a68609ac09e6cf3598ef056c SETUPTOOLS_HASH=75d288687066ed124311d6ca5f40ffa92a0e81adcd7fff318c6e84082713cf39 PARSLEY_HASH=50d30cee70770fd44db7cea421cb2fb75af247c3a1cd54885c06b30a7c85dd23 GO14_HASH=9947fc705b0b841b5938c48b22dc33e9647ec0752bae66e50278df4f23f64959 -GO_HASH=33daf4c03f86120fdfdc66bddf6bfff4661c7ca11c5da473e537f4d69b470e57 +GO_HASH=5f5dea2447e7dcfdc50fa6b94c512e58bfba5673c039259fd843f68829d99fa6 STIXMATHFONT_HASH=e3b0f712e2644438eee2d0dcd2b10b2d54f1b972039de95b2f8e800bae1adbd8 NOTOEMOJIFONT_HASH=415dc6290378574135b64c808dc640c1df7531973290c4970c51fdeb849cb0c5 NOTOJPFONT_HASH=3e8146c4ce0945f255cb9dbc12b392380af80bd117e0a60eae555c99c7e618da diff --git a/gitian/versions.nightly b/gitian/versions.nightly index 32e7ac3..9820a92 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -63,7 +63,7 @@ SETUPTOOLS_VER=1.4 PARSLEY_VER=1.2 # We need a Go 1.4 to bootstrap later versions; see https://golang.org/doc/install/source#go14 GO14_VER=1.4.3 -GO_VER=1.8.1 +GO_VER=1.8.3 NSIS_VER=2.51 YASM_VER=1.2.0 @@ -117,7 +117,7 @@ PY2EXE_HASH=610a8800de3d973ed5ed4ac505ab42ad058add18a68609ac09e6cf3598ef056c SETUPTOOLS_HASH=75d288687066ed124311d6ca5f40ffa92a0e81adcd7fff318c6e84082713cf39 PARSLEY_HASH=50d30cee70770fd44db7cea421cb2fb75af247c3a1cd54885c06b30a7c85dd23 GO14_HASH=9947fc705b0b841b5938c48b22dc33e9647ec0752bae66e50278df4f23f64959 -GO_HASH=33daf4c03f86120fdfdc66bddf6bfff4661c7ca11c5da473e537f4d69b470e57 +GO_HASH=5f5dea2447e7dcfdc50fa6b94c512e58bfba5673c039259fd843f68829d99fa6 NSIS_HASH=43d4c9209847e35eb6e2c7cd5a7586e1445374c056c2c7899e40a080e17a1be7 NSIS_DEBIAN_HASH=1dee6957b4a4b8dfe69bcf28bc7f301a13b96b3fa5a394e36c8926ae781e774a GCC_HASH=b7dafdf89cbb0e20333dbf5b5349319ae06e3d1a30bf3515b5488f7e89dca5ad

1 0

[tor-browser-bundle/master] Bug 22398: Upgrade go to 1.8.3.
by gk＠torproject.org 01 Jun '17

01 Jun '17

commit fbe1263eb9601e5d435131aa3d96306b8bfdb465 Author: David Fifield <david(a)bamsoftware.com> Date: Tue May 30 14:29:36 2017 -0700 Bug 22398: Upgrade go to 1.8.3. --- gitian/versions | 4 ++-- gitian/versions.alpha | 4 ++-- gitian/versions.beta | 4 ++-- gitian/versions.nightly | 4 ++-- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/gitian/versions b/gitian/versions index 8cb2278..0c251ad 100755 --- a/gitian/versions +++ b/gitian/versions @@ -65,7 +65,7 @@ SETUPTOOLS_VER=1.4 PARSLEY_VER=1.2 # We need a Go 1.4 to bootstrap later versions; see https://golang.org/doc/install/source#go14 GO14_VER=1.4.3 -GO_VER=1.8.1 +GO_VER=1.8.3 NSIS_VER=2.51 YASM_VER=1.2.0 @@ -119,7 +119,7 @@ PY2EXE_HASH=610a8800de3d973ed5ed4ac505ab42ad058add18a68609ac09e6cf3598ef056c SETUPTOOLS_HASH=75d288687066ed124311d6ca5f40ffa92a0e81adcd7fff318c6e84082713cf39 PARSLEY_HASH=50d30cee70770fd44db7cea421cb2fb75af247c3a1cd54885c06b30a7c85dd23 GO14_HASH=9947fc705b0b841b5938c48b22dc33e9647ec0752bae66e50278df4f23f64959 -GO_HASH=33daf4c03f86120fdfdc66bddf6bfff4661c7ca11c5da473e537f4d69b470e57 +GO_HASH=5f5dea2447e7dcfdc50fa6b94c512e58bfba5673c039259fd843f68829d99fa6 NSIS_HASH=43d4c9209847e35eb6e2c7cd5a7586e1445374c056c2c7899e40a080e17a1be7 NSIS_DEBIAN_HASH=1dee6957b4a4b8dfe69bcf28bc7f301a13b96b3fa5a394e36c8926ae781e774a GCC_HASH=b7dafdf89cbb0e20333dbf5b5349319ae06e3d1a30bf3515b5488f7e89dca5ad diff --git a/gitian/versions.alpha b/gitian/versions.alpha index 99bc2d7..0a3e9c6 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -69,7 +69,7 @@ SETUPTOOLS_VER=1.4 PARSLEY_VER=1.2 # We need a Go 1.4 to bootstrap later versions; see https://golang.org/doc/install/source#go14 GO14_VER=1.4.3 -GO_VER=1.8.1 +GO_VER=1.8.3 NSIS_VER=2.51 YASM_VER=1.2.0 ELFUTILS_VER=0.166 @@ -125,7 +125,7 @@ PY2EXE_HASH=610a8800de3d973ed5ed4ac505ab42ad058add18a68609ac09e6cf3598ef056c SETUPTOOLS_HASH=75d288687066ed124311d6ca5f40ffa92a0e81adcd7fff318c6e84082713cf39 PARSLEY_HASH=50d30cee70770fd44db7cea421cb2fb75af247c3a1cd54885c06b30a7c85dd23 GO14_HASH=9947fc705b0b841b5938c48b22dc33e9647ec0752bae66e50278df4f23f64959 -GO_HASH=33daf4c03f86120fdfdc66bddf6bfff4661c7ca11c5da473e537f4d69b470e57 +GO_HASH=5f5dea2447e7dcfdc50fa6b94c512e58bfba5673c039259fd843f68829d99fa6 NSIS_HASH=43d4c9209847e35eb6e2c7cd5a7586e1445374c056c2c7899e40a080e17a1be7 NSIS_DEBIAN_HASH=1dee6957b4a4b8dfe69bcf28bc7f301a13b96b3fa5a394e36c8926ae781e774a GCC_HASH=b7dafdf89cbb0e20333dbf5b5349319ae06e3d1a30bf3515b5488f7e89dca5ad diff --git a/gitian/versions.beta b/gitian/versions.beta index 7d843c7..3abb22f 100755 --- a/gitian/versions.beta +++ b/gitian/versions.beta @@ -54,7 +54,7 @@ SETUPTOOLS_VER=1.4 PARSLEY_VER=1.2 # We need a Go 1.4 to bootstrap later versions; see https://golang.org/doc/install/source#go14 GO14_VER=1.4.3 -GO_VER=1.8.1 +GO_VER=1.8.3 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz @@ -99,7 +99,7 @@ PY2EXE_HASH=610a8800de3d973ed5ed4ac505ab42ad058add18a68609ac09e6cf3598ef056c SETUPTOOLS_HASH=75d288687066ed124311d6ca5f40ffa92a0e81adcd7fff318c6e84082713cf39 PARSLEY_HASH=50d30cee70770fd44db7cea421cb2fb75af247c3a1cd54885c06b30a7c85dd23 GO14_HASH=9947fc705b0b841b5938c48b22dc33e9647ec0752bae66e50278df4f23f64959 -GO_HASH=33daf4c03f86120fdfdc66bddf6bfff4661c7ca11c5da473e537f4d69b470e57 +GO_HASH=5f5dea2447e7dcfdc50fa6b94c512e58bfba5673c039259fd843f68829d99fa6 STIXMATHFONT_HASH=e3b0f712e2644438eee2d0dcd2b10b2d54f1b972039de95b2f8e800bae1adbd8 NOTOEMOJIFONT_HASH=415dc6290378574135b64c808dc640c1df7531973290c4970c51fdeb849cb0c5 NOTOJPFONT_HASH=3e8146c4ce0945f255cb9dbc12b392380af80bd117e0a60eae555c99c7e618da diff --git a/gitian/versions.nightly b/gitian/versions.nightly index c3a6545..03c543c 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -72,7 +72,7 @@ SETUPTOOLS_VER=1.4 PARSLEY_VER=1.2 # We need a Go 1.4 to bootstrap later versions; see https://golang.org/doc/install/source#go14 GO14_VER=1.4.3 -GO_VER=1.8.1 +GO_VER=1.8.3 NSIS_VER=2.51 YASM_VER=1.2.0 ELFUTILS_VER=0.166 @@ -128,7 +128,7 @@ PY2EXE_HASH=610a8800de3d973ed5ed4ac505ab42ad058add18a68609ac09e6cf3598ef056c SETUPTOOLS_HASH=75d288687066ed124311d6ca5f40ffa92a0e81adcd7fff318c6e84082713cf39 PARSLEY_HASH=50d30cee70770fd44db7cea421cb2fb75af247c3a1cd54885c06b30a7c85dd23 GO14_HASH=9947fc705b0b841b5938c48b22dc33e9647ec0752bae66e50278df4f23f64959 -GO_HASH=33daf4c03f86120fdfdc66bddf6bfff4661c7ca11c5da473e537f4d69b470e57 +GO_HASH=5f5dea2447e7dcfdc50fa6b94c512e58bfba5673c039259fd843f68829d99fa6 NSIS_HASH=43d4c9209847e35eb6e2c7cd5a7586e1445374c056c2c7899e40a080e17a1be7 NSIS_DEBIAN_HASH=1dee6957b4a4b8dfe69bcf28bc7f301a13b96b3fa5a394e36c8926ae781e774a GCC_HASH=b7dafdf89cbb0e20333dbf5b5349319ae06e3d1a30bf3515b5488f7e89dca5ad

1 0

[torbutton/master] Bug 21627: Ignore HTTP 304 responses when checking redirects.
by gk＠torproject.org 01 Jun '17

01 Jun '17

commit ad937183266423425e166b417659b1db14aaeced Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Thu Jun 1 11:06:09 2017 -0400 Bug 21627: Ignore HTTP 304 responses when checking redirects. Avoid noise on the error console when a page is reloaded. Since 304 responses do not have Location headers, it is safe to ignore such responses inside our http-on-examine-response observer. --- src/components/content-policy.js | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/components/content-policy.js b/src/components/content-policy.js index 365a5e5..a63919c 100644 --- a/src/components/content-policy.js +++ b/src/components/content-policy.js @@ -128,9 +128,9 @@ var requestObserver = { // If this is a redirect... // - // Note: Technically `304 Not Modifed` isn't a redirect, but receiving that - // to the proscribed schemes is nonsensical. - if (aStatus >= 300 && aStatus < 400) { + // Note: `304 Not Modifed` isn't a redirect, so there is no Location header to check + // in that case. + if (aStatus >= 300 && aStatus < 400 && aStatus != 304) { let location = aChannel.getResponseHeader("Location"); let aUri = this.ioService.newURI(location, null, null);

1 0

[torbutton/master] Bug 22459: Adapt our use of the nsIContentPolicy to e10s mode
by gk＠torproject.org 01 Jun '17

01 Jun '17

commit 2e301c0a5bbc62fd5f8e66ac973c71f0bc10c81b Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Thu Jun 1 10:48:56 2017 -0400 Bug 22459: Adapt our use of the nsIContentPolicy to e10s mode Load our content policy module as a process script instead of as a component so that our nsIContentPolicy filter runs in content processes. Our http-on-examine-response code that blocks redirects to internal URLs must continue to run in the chrome process only. --- src/chrome.manifest | 4 ---- src/components/content-policy.js | 34 +++++++++++++++++++++++++++++----- src/components/startup-observer.js | 7 +++++++ 3 files changed, 36 insertions(+), 9 deletions(-) diff --git a/src/chrome.manifest b/src/chrome.manifest index ed3f5cf..75bef4e 100644 --- a/src/chrome.manifest +++ b/src/chrome.manifest @@ -166,10 +166,6 @@ contract @torproject.org/domain-isolator;1 {e33fd6d4-270f-475f-a96f-ff3140279f68 category profile-after-change CookieJarSelector @torproject.org/cookie-jar-selector;1 -component {4c03be7d-492f-990e-f0da-f3689e564898} components/content-policy.js -contract @torproject.org/content-policy;1 {4c03be7d-492f-990e-f0da-f3689e564898} -category content-policy ContentPolicy @torproject.org/content-policy;1 - category profile-after-change StartupObserver @torproject.org/startup-observer;1 category profile-after-change DomainIsolator @torproject.org/domain-isolator;1 category profile-after-change ExtAppBlockerService @torproject.org/torbutton-extAppBlockerService;1 diff --git a/src/components/content-policy.js b/src/components/content-policy.js index 096827b..365a5e5 100644 --- a/src/components/content-policy.js +++ b/src/components/content-policy.js @@ -22,13 +22,22 @@ function ContentPolicy() { function (enabled) { that.uriFingerprinting = enabled; }); + + // Register as an nsIContentPolicy filter. + let registrar = Components.manager.QueryInterface(Ci.nsIComponentRegistrar); + registrar.registerFactory(this.classID, this.classDescription, + this.contractID, this); + + let catMan = Cc["@mozilla.org/categorymanager;1"] + .getService(Ci.nsICategoryManager); + catMan.addCategoryEntry("content-policy", this.contractID, this.contractID, + false, true); } ContentPolicy.prototype = { classDescription: "ContentPolicy", classID: Components.ID("{4c03be7d-492f-990e-f0da-f3689e564898}"), contractID: "@torproject.org/content-policy;1", - QueryInterface: XPCOMUtils.generateQI([Ci.nsIContentPolicy]), uriWhitelist: { // Video playback. @@ -51,6 +60,19 @@ ContentPolicy.prototype = { "chrome://global/skin/dirListing/dirListing.css": Ci.nsIContentPolicy.TYPE_STYLESHEET, }, + // nsISupports + QueryInterface: XPCOMUtils.generateQI([Ci.nsIContentPolicy, Ci.nsIFactory, + Ci.nsISupportsWeakReference]), + + // nsIFactory + createInstance: function(outer, iid) + { + if (outer) + throw Cr.NS_ERROR_NO_AGGREGATION; + return this.QueryInterface(iid); + }, + + // nsIContentPolicy shouldLoad: function(aContentType, aContentLocation, aRequestOrigin, aContext, aMimeTypeGuess, aExtra) { // Accept if the user does not care, no content URI is available or scheme @@ -121,8 +143,10 @@ var requestObserver = { }, }; -// Firefox >= 4.0 (Old versions are extremely irrelevant). -var NSGetFactory = XPCOMUtils.generateNSGetFactory([ContentPolicy]); +// Create a content policy object; initialization is done in the contructor. +var cp = new ContentPolicy(); -// Register the request observer to handle redirects. -requestObserver.start(); +// In the chrome process, register the request observer to handle redirects. +if (Services.appinfo.processType == Services.appinfo.PROCESS_TYPE_DEFAULT) { + requestObserver.start(); +} diff --git a/src/components/startup-observer.js b/src/components/startup-observer.js index 6698b0b..65ca659 100644 --- a/src/components/startup-observer.js +++ b/src/components/startup-observer.js @@ -60,6 +60,13 @@ function StartupObserver() { } catch(e) { this.logger.log(4, "Early proxy change failed. Will try again at profile load. Error: "+e); } + + // Arrange for our nsIContentPolicy filter to be loaded in the + // default (chrome) process as well as in each content process. + let ppmm = Cc["@mozilla.org/parentprocessmessagemanager;1"] + .getService(Ci.nsIProcessScriptLoader); + ppmm.loadProcessScript("resource://torbutton/components/content-policy.js", + true); } StartupObserver.prototype = {

1 0

[tor-launcher/master] Version bump
by gk＠torproject.org 01 Jun '17

01 Jun '17

commit 529f2711c9a3cb5a652c2d52c549fd6d095f7949 Author: Georg Koppen <gk(a)torproject.org> Date: Thu Jun 1 14:38:20 2017 +0000 Version bump --- src/install.rdf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/install.rdf b/src/install.rdf index c0a6e20..14b29ce 100644 --- a/src/install.rdf +++ b/src/install.rdf @@ -7,7 +7,7 @@ <em:creator>The Tor Project, Inc.</em:creator> <em:contributor>Pearl Crescent, LLC</em:contributor> <em:id>tor-launcher(a)torproject.org</em:id> - <em:version>0.2.12.1</em:version> + <em:version>0.2.12.2</em:version> <em:multiprocessCompatible>true</em:multiprocessCompatible> <em:homepageURL>https://www.torproject.org/projects/torbrowser.html</em:homepageURL> <em:updateURL>data:text/plain,</em:updateURL>

1 0

[tor-launcher/master] Translations update
by gk＠torproject.org 01 Jun '17

01 Jun '17

commit 16e8d4f1b7d43bdd3921c1cc44a40338ebc38c36 Author: Georg Koppen <gk(a)torproject.org> Date: Thu Jun 1 14:37:12 2017 +0000 Translations update --- src/chrome/locale/fa/network-settings.dtd | 2 +- src/chrome/locale/fa/progress.dtd | 2 +- src/chrome/locale/fa/torlauncher.properties | 6 +++--- src/chrome/locale/nb/torlauncher.properties | 2 +- 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/src/chrome/locale/fa/network-settings.dtd b/src/chrome/locale/fa/network-settings.dtd index 939cc7c..490a77b 100644 --- a/src/chrome/locale/fa/network-settings.dtd +++ b/src/chrome/locale/fa/network-settings.dtd @@ -25,7 +25,7 @@ <!ENTITY torSettings.proxyExplanation1 "در بیشتر موارد نیازی به پروکسی محلی نمی باشد. با این حال ممکن است برای اتصال از طریق شبکه شرکت، مدرسه، یا دانشگاه مورد نیاز باشد."> <!ENTITY torSettings.proxyExplanation2 "اگر مطمئن نیستید چگونه به این سوال پاسخ دهید، به تنظیمات اینترنت خود در مرورگر دیگری و یا تنظیمات شبکه کامپیوتر خود رجوع کنید تا ببینید آیا به پروکسی محلی نیاز دارید یا خیر."> <!ENTITY torSettings.enterProxy "تنظیمات پراکسی را وارد کنید."> -<!ENTITY torSettings.bridgePageTitle "پیکربندی پل تٌر"> +<!ENTITY torSettings.bridgePageTitle "پیکربندی پل تور"> <!ENTITY torSettings.bridgeQuestion "آیا شرکتی که از آن اینترنت گرفته اید (ISP)، دسترسی به شبکه تور را فیلتر، سانسور و یا مسدود می کند؟"> <!ENTITY torSettings.bridgeExplanation1 "اگر مطمئن نیستید چگونه به این سوال پاسخ دهید، گزینه 'نه' را انتخاب کنید (در صورتی که نتوانستید بدون استفاده از یک bridge به شبکه تٌر متصل شویدِ، می توانید در هر زمان یک bridge اضافه کنید)."> <!ENTITY torSettings.bridgeExplanation2 "در صورتی که 'بله' را انتخاب کنید، از شما درخواست خواهد شد که bridge های تٌر را تنظیم کنید. bridge ها رله هایی هستند که در هیچ کجا لیست نشده و به همین جهت مسدود کردن ارتباط با شبکه تٌر را سخت تر می کنند."> diff --git a/src/chrome/locale/fa/progress.dtd b/src/chrome/locale/fa/progress.dtd index f7d9e02..8646caa 100644 --- a/src/chrome/locale/fa/progress.dtd +++ b/src/chrome/locale/fa/progress.dtd @@ -1,4 +1,4 @@ -<!ENTITY torprogress.dialog.title "وضعیت تٌر"> +<!ENTITY torprogress.dialog.title "وضعیت تور"> <!ENTITY torprogress.openSettings "تنظیمات‌را باز کنید"> <!ENTITY torprogress.heading "درحال اتصال به شبکه تُر"> <!ENTITY torprogress.pleaseWait "لطفا صبر کنید. در حال برقراری ارتباط با شبکه تٌر.&160; این پروسه ممکن است چند دقیقه به طول بینجامد."> diff --git a/src/chrome/locale/fa/torlauncher.properties b/src/chrome/locale/fa/torlauncher.properties index ad5ef5e..8a827b5 100644 --- a/src/chrome/locale/fa/torlauncher.properties +++ b/src/chrome/locale/fa/torlauncher.properties @@ -31,7 +31,7 @@ torlauncher.error_bridge_bad_default_type=هیچ پلی از نوع %S موجو torlauncher.recommended_bridge=(توصیه شده) torlauncher.connect=اتصال -torlauncher.restart_tor=تور را دوباره شوروع کنید. +torlauncher.restart_tor=تور را ریستارت کنید. torlauncher.quit=خروج torlauncher.quit_win=خروج torlauncher.done=انجام شد @@ -50,10 +50,10 @@ torlauncher.bootstrapStatus.requesting_descriptors=درخواست اطلاعات torlauncher.bootstrapStatus.loading_descriptors=بارگذاری اطلاعات بازپخش torlauncher.bootstrapStatus.conn_or=درحال اتصال به شبکه تُر torlauncher.bootstrapStatus.handshake_or=برپایی یک جریان تُر -torlauncher.bootstrapStatus.done=متصل شده به شبکه تُر +torlauncher.bootstrapStatus.done=به شبکه تور متصل شد! torlauncher.bootstrapWarning.done=انجام شد -torlauncher.bootstrapWarning.connectrefused=اتصال ردشد +torlauncher.bootstrapWarning.connectrefused=اتصال رد شد torlauncher.bootstrapWarning.misc=گوناگون torlauncher.bootstrapWarning.resourcelimit=منابع ناکافی torlauncher.bootstrapWarning.identity=عدم تطبیق هویت diff --git a/src/chrome/locale/nb/torlauncher.properties b/src/chrome/locale/nb/torlauncher.properties index a7c890e..8e7a3f4 100644 --- a/src/chrome/locale/nb/torlauncher.properties +++ b/src/chrome/locale/nb/torlauncher.properties @@ -1,7 +1,7 @@ ### Copyright (c) 2016, The Tor Project, Inc. ### See LICENSE for licensing information. -torlauncher.error_title=Tor Launcher +torlauncher.error_title=Tor-oppstarteren torlauncher.tor_exited_during_startup=Tor ble avsluttet under oppstart. Dette kan ha sin årsak i en feil i din torrc-fil, en feil i Tor eller et annet program på din maskin, eller feilaktig maskinvare. Tor-nettleseren vil ikke starte før det bakenforliggende problemet er ordnet og du har startet det på ny. torlauncher.tor_exited=Tor avsluttet uventet. Dette kan være forårsaket av en feil i Tor, eller et annet program på ditt system, alternativt ødelagt maskinvare. Før omstart av Tor er gjennomført vil du ikke kunne nå noen nettsider. Hvis problemet vedvarer, send en kopi av din Tor-logg til brukerstøtte.

1 0

[tor-browser-bundle/master] Bug 22361: fix hardening of libraries built in linux/gitian-utils.yml
by gk＠torproject.org 01 Jun '17

01 Jun '17

commit 095845a8bc96997b50c5208d831ae32272ca6f85 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Thu Jun 1 01:35:24 2017 +0200 Bug 22361: fix hardening of libraries built in linux/gitian-utils.yml With the changes to integrate Selfrando (#20683), we are using our build of gcc and binutils to build other libraries in the linux/gitian-utils.yml descriptor, which removed the use of the hardening wrappers. We fix that by adding the hardening wrappers to our builds of gcc and binutils. Because we add the wrappers to gcc and binutils zip files, we don't need to add them anymore in the other descriptors where they are used. --- gitian/descriptors/linux/gitian-firefox.yml | 19 --------------- .../linux/gitian-pluggable-transports.yml | 17 -------------- gitian/descriptors/linux/gitian-tor.yml | 17 -------------- gitian/descriptors/linux/gitian-utils.yml | 27 ++++++++++++++++++++-- gitian/descriptors/linux/gitian-webrtc.yml | 17 -------------- 5 files changed, 25 insertions(+), 72 deletions(-) diff --git a/gitian/descriptors/linux/gitian-firefox.yml b/gitian/descriptors/linux/gitian-firefox.yml index ae0d14f..9edcb3a 100644 --- a/gitian/descriptors/linux/gitian-firefox.yml +++ b/gitian/descriptors/linux/gitian-firefox.yml @@ -64,26 +64,7 @@ script: | fi # Preparing Binutils and GCC for Tor Browser unzip -d $INSTDIR binutils-linux$GBUILD_BITS-utils.zip - # Make sure gold is used with the hardening wrapper for full RELRO, see - # #13031. - cd $INSTDIR/binutils/bin - rm ld - cp /usr/bin/hardened-ld ./ - mv ld.gold ld.gold.real - ln -sf hardened-ld ld.gold - ln -sf ld.gold ld - cd ~/build unzip -d $INSTDIR gcc-linux$GBUILD_BITS-utils.zip - # Make sure we use the hardening wrapper when compiling Tor Browser. - cd $INSTDIR/gcc/bin - cp /usr/bin/hardened-cc ./ - mv gcc gcc.real - mv c++ c++.real - mv g++ g++.real - ln -sf hardened-cc gcc - ln -sf hardened-cc c++ - ln -sf hardened-cc g++ - cd ~/build export PATH=$INSTDIR/gcc/bin:$INSTDIR/binutils/bin:$PATH ARCH="" if [ $GBUILD_BITS == "64" ]; diff --git a/gitian/descriptors/linux/gitian-pluggable-transports.yml b/gitian/descriptors/linux/gitian-pluggable-transports.yml index cd936d5..207a7e5 100644 --- a/gitian/descriptors/linux/gitian-pluggable-transports.yml +++ b/gitian/descriptors/linux/gitian-pluggable-transports.yml @@ -94,24 +94,7 @@ script: | # Preparing Binutils and GCC for webrtc unzip -d $INSTDIR binutils-linux$GBUILD_BITS-utils.zip - # Make sure gold is used with the hardening wrapper for full RELRO, see - # #13031. - cd $INSTDIR/binutils/bin - rm ld - cp /usr/bin/hardened-ld ./ - mv ld.gold ld.gold.real - ln -sf hardened-ld ld.gold - ln -sf ld.gold ld - cd ~/build unzip -d $INSTDIR gcc-linux$GBUILD_BITS-utils.zip - # Make sure we use the hardening wrapper when compiling Tor Browser. - cd $INSTDIR/gcc/bin - cp /usr/bin/hardened-cc ./ - mv gcc gcc.real - mv c++ c++.real - ln -sf hardened-cc gcc - ln -sf hardened-cc c++ - cd ~/build export PATH=$INSTDIR/gcc/bin:$INSTDIR/binutils/bin:$PATH # GN needs libatomic.so.1 here. export LD_LIBRARY_PATH=$INSTDIR/gcc/lib diff --git a/gitian/descriptors/linux/gitian-tor.yml b/gitian/descriptors/linux/gitian-tor.yml index c00b4e7..116dd84 100644 --- a/gitian/descriptors/linux/gitian-tor.yml +++ b/gitian/descriptors/linux/gitian-tor.yml @@ -49,24 +49,7 @@ script: | # Preparing Binutils and GCC for tor unzip -d $INSTDIR binutils-linux$GBUILD_BITS-utils.zip - # Make sure gold is used with the hardening wrapper for full RELRO, see - # #13031. - cd $INSTDIR/binutils/bin - rm ld - cp /usr/bin/hardened-ld ./ - mv ld.gold ld.gold.real - ln -sf hardened-ld ld.gold - ln -sf ld.gold ld - cd ~/build unzip -d $INSTDIR gcc-linux$GBUILD_BITS-utils.zip - # Make sure we use the hardening wrapper when compiling tor. - cd $INSTDIR/gcc/bin - cp /usr/bin/hardened-cc ./ - mv gcc gcc.real - mv c++ c++.real - ln -sf hardened-cc gcc - ln -sf hardened-cc c++ - cd ~/build export PATH=$INSTDIR/gcc/bin:$INSTDIR/binutils/bin:$PATH ARCH="" if [ $GBUILD_BITS == "64" ]; diff --git a/gitian/descriptors/linux/gitian-utils.yml b/gitian/descriptors/linux/gitian-utils.yml index eb340b8..2680f1b 100644 --- a/gitian/descriptors/linux/gitian-utils.yml +++ b/gitian/descriptors/linux/gitian-utils.yml @@ -104,6 +104,27 @@ script: | make install cd .. + # Make sure we use the hardening wrapper + pushd $INSTDIR/gcc/bin + cp /usr/bin/hardened-cc ./ + mv gcc gcc.real + mv c++ c++.real + mv g++ g++.real + ln -sf hardened-cc gcc + ln -sf hardened-cc c++ + ln -sf hardened-cc g++ + popd + + # Make sure gold is used with the hardening wrapper for full RELRO, see + # #13031. + pushd $INSTDIR/binutils/bin + rm ld + cp /usr/bin/hardened-ld ./ + mv ld.gold ld.gold.real + ln -sf hardened-ld ld.gold + ln -sf ld.gold ld + popd + export DEB_BUILD_HARDENING_FORMAT=1 export PATH="$INSTDIR/binutils/bin:$INSTDIR/gcc/bin:$PATH" export LD_LIBRARY_PATH="$INSTDIR/gcc/lib$ARCH" @@ -191,9 +212,11 @@ script: | # libevent archives are no longer reproducible. The main reason # is that they include some .a archives which include timestamps. # Those files are however not part of the files we ship. + # We use the --symlinks zip option for binutils and gcc for the + # hardening wrappers symlinks cd $INSTDIR - ~/build/dzip.sh binutils-$BINUTILS_VER-linux$GBUILD_BITS-utils.zip binutils - ~/build/dzip.sh gcc-$GCC_VER-linux$GBUILD_BITS-utils.zip gcc + ZIPOPTS='--symlinks' ~/build/dzip.sh binutils-$BINUTILS_VER-linux$GBUILD_BITS-utils.zip binutils + ZIPOPTS='--symlinks' ~/build/dzip.sh gcc-$GCC_VER-linux$GBUILD_BITS-utils.zip gcc ~/build/dzip.sh openssl-$OPENSSL_VER-linux$GBUILD_BITS-utils.zip openssl ~/build/dzip.sh libevent-${LIBEVENT_TAG#release-}-linux$GBUILD_BITS-utils.zip libevent ~/build/dzip.sh gmp-$GMP_VER-linux$GBUILD_BITS-utils.zip gmp diff --git a/gitian/descriptors/linux/gitian-webrtc.yml b/gitian/descriptors/linux/gitian-webrtc.yml index ccf2d4a..9e7808c 100644 --- a/gitian/descriptors/linux/gitian-webrtc.yml +++ b/gitian/descriptors/linux/gitian-webrtc.yml @@ -49,24 +49,7 @@ script: | # Preparing Binutils and GCC for webrtc unzip -d $INSTDIR binutils-linux$GBUILD_BITS-utils.zip - # Make sure gold is used with the hardening wrapper for full RELRO, see - # #13031. - cd $INSTDIR/binutils/bin - rm ld - cp /usr/bin/hardened-ld ./ - mv ld.gold ld.gold.real - ln -sf hardened-ld ld.gold - ln -sf ld.gold ld - cd ~/build unzip -d $INSTDIR gcc-linux$GBUILD_BITS-utils.zip - # Make sure we use the hardening wrapper when compiling Tor Browser. - cd $INSTDIR/gcc/bin - cp /usr/bin/hardened-cc ./ - mv gcc gcc.real - mv c++ c++.real - ln -sf hardened-cc gcc - ln -sf hardened-cc c++ - cd ~/build export PATH=$INSTDIR/gcc/bin:$INSTDIR/binutils/bin:$PATH # GN needs libatomic.so.1 here. export LD_LIBRARY_PATH=$INSTDIR/gcc/lib

1 0

[tor-browser/tor-browser-52.1.1esr-7.0-1] Bug 22452: Isolate tab list menuitem favicons to content first party
by gk＠torproject.org 31 May '17

31 May '17

commit 93469df805f4001dc837299bc3076855d7bff6ae Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Tue May 30 00:43:48 2017 -0700 Bug 22452: Isolate tab list menuitem favicons to content first party --- browser/base/content/tabbrowser.xml | 1 + toolkit/content/widgets/menu.xml | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/browser/base/content/tabbrowser.xml b/browser/base/content/tabbrowser.xml index 2b3ac67..f82dd5a 100644 --- a/browser/base/content/tabbrowser.xml +++ b/browser/base/content/tabbrowser.xml @@ -7068,6 +7068,7 @@ aMenuitem.setAttribute("busy", aTab.getAttribute("busy")); aMenuitem.removeAttribute("image"); } else { + aMenuitem.setAttribute("iconLoadingPrincipal", aTab.getAttribute("iconLoadingPrincipal")); aMenuitem.setAttribute("image", aTab.getAttribute("image")); aMenuitem.removeAttribute("busy"); } diff --git a/toolkit/content/widgets/menu.xml b/toolkit/content/widgets/menu.xml index 26dcad4..6b0886c 100644 --- a/toolkit/content/widgets/menu.xml +++ b/toolkit/content/widgets/menu.xml @@ -214,7 +214,7 @@ <content> <xul:hbox class="menu-iconic-left" align="center" pack="center" xbl:inherits="selected,_moz-menuactive,disabled,checked"> - <xul:image class="menu-iconic-icon" xbl:inherits="src=image,validate,src"/> + <xul:image class="menu-iconic-icon" xbl:inherits="src=image,loadingprincipal=iconLoadingPrincipal,validate,src"/> </xul:hbox> <xul:label class="menu-iconic-text" flex="1" xbl:inherits="value=label,accesskey,crop" crop="right"/> <children/>

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] Bug 22452: Isolate tab list menuitem favicons to content first party
by gk＠torproject.org 31 May '17

31 May '17

commit 1cb4d06b54d26e35c78b398abdd456444b26acd7 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Tue May 30 00:43:48 2017 -0700 Bug 22452: Isolate tab list menuitem favicons to content first party --- browser/base/content/tabbrowser.xml | 1 + toolkit/content/widgets/menu.xml | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/browser/base/content/tabbrowser.xml b/browser/base/content/tabbrowser.xml index 2b3ac67..f82dd5a 100644 --- a/browser/base/content/tabbrowser.xml +++ b/browser/base/content/tabbrowser.xml @@ -7068,6 +7068,7 @@ aMenuitem.setAttribute("busy", aTab.getAttribute("busy")); aMenuitem.removeAttribute("image"); } else { + aMenuitem.setAttribute("iconLoadingPrincipal", aTab.getAttribute("iconLoadingPrincipal")); aMenuitem.setAttribute("image", aTab.getAttribute("image")); aMenuitem.removeAttribute("busy"); } diff --git a/toolkit/content/widgets/menu.xml b/toolkit/content/widgets/menu.xml index 26dcad4..6b0886c 100644 --- a/toolkit/content/widgets/menu.xml +++ b/toolkit/content/widgets/menu.xml @@ -214,7 +214,7 @@ <content> <xul:hbox class="menu-iconic-left" align="center" pack="center" xbl:inherits="selected,_moz-menuactive,disabled,checked"> - <xul:image class="menu-iconic-icon" xbl:inherits="src=image,validate,src"/> + <xul:image class="menu-iconic-icon" xbl:inherits="src=image,loadingprincipal=iconLoadingPrincipal,validate,src"/> </xul:hbox> <xul:label class="menu-iconic-text" flex="1" xbl:inherits="value=label,accesskey,crop" crop="right"/> <children/>

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] Bug 22327: Isolate Page Info media previews to content first party
by gk＠torproject.org 31 May '17

31 May '17

commit af4e5af7cfa3cfd73ff53fd6ec1be4e97e43f630 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Wed May 10 17:10:23 2017 -0700 Bug 22327: Isolate Page Info media previews to content first party --- browser/base/content/pageinfo/pageInfo.js | 9 +++++ dom/base/nsContentUtils.cpp | 63 ++++++++++++++++++++++--------- dom/base/nsContentUtils.h | 7 ++++ dom/html/HTMLMediaElement.cpp | 2 + dom/media/MediaResource.cpp | 2 + 5 files changed, 66 insertions(+), 17 deletions(-) diff --git a/browser/base/content/pageinfo/pageInfo.js b/browser/base/content/pageinfo/pageInfo.js index 7a6d0a0..fc3e3bb 100644 --- a/browser/base/content/pageinfo/pageInfo.js +++ b/browser/base/content/pageinfo/pageInfo.js @@ -4,6 +4,11 @@ Components.utils.import("resource://gre/modules/LoadContextInfo.jsm"); Components.utils.import("resource://gre/modules/Services.jsm"); +Components.utils.import("resource://gre/modules/XPCOMUtils.jsm"); + +XPCOMUtils.defineLazyServiceGetter(this, "gSerializationHelper", + "@mozilla.org/network/serialization-helper;1", + "nsISerializationHelper"); // define a js object to implement nsITreeView function pageInfoTreeView(treeid, copycol) @@ -881,6 +886,8 @@ function makePreview(row) var newImage = new Image; newImage.id = "thepreviewimage"; + let loadingPrincipalString = gSerializationHelper.serializeToString(gDocInfo.principal); + newImage.setAttribute("loadingprincipal", loadingPrincipalString); var physWidth = 0, physHeight = 0; var width = 0, height = 0; @@ -928,6 +935,7 @@ function makePreview(row) else if (item.HTMLVideoElement && isProtocolAllowed) { newImage = document.createElementNS("http://www.w3.org/1999/xhtml", "video"); newImage.id = "thepreviewimage"; + newImage.setAttribute("loadingprincipal", loadingPrincipalString); newImage.src = url; newImage.controls = true; width = physWidth = item.videoWidth; @@ -939,6 +947,7 @@ function makePreview(row) else if (item.HTMLAudioElement && isProtocolAllowed) { newImage = new Audio; newImage.id = "thepreviewimage"; + newImage.setAttribute("loadingprincipal", loadingPrincipalString); newImage.src = url; newImage.controls = true; isAudio = true; diff --git a/dom/base/nsContentUtils.cpp b/dom/base/nsContentUtils.cpp index 48f7991..f932742 100644 --- a/dom/base/nsContentUtils.cpp +++ b/dom/base/nsContentUtils.cpp @@ -3367,6 +3367,15 @@ nsContentUtils::LoadImage(nsIURI* aURI, nsINode* aContext, NS_PRECONDITION(aLoadingPrincipal, "Must have a principal"); NS_PRECONDITION(aRequest, "Null out param"); + // If the image is in a chrome document and the image node has been assigned a + // "loadingprincipal" attribute, we should use that principal instead. + if (IsSystemPrincipal(aLoadingPrincipal) && aContext->IsContent()) { + nsContentPolicyType contentPolicyType; + GetContentPolicyTypeForUIImageLoading(aContext->AsContent(), + &aLoadingPrincipal, contentPolicyType); + aContentPolicyType = (int32_t) contentPolicyType; + } + imgLoader* imgLoader = GetImgLoaderForDocument(aLoadingDocument); if (!imgLoader) { // nothing we can do here @@ -9879,25 +9888,45 @@ nsContentUtils::GetContentPolicyTypeForUIImageLoading(nsIContent* aLoadingNode, { // Use the serialized loadingPrincipal from the image element. Fall back // to mContent's principal (SystemPrincipal) if not available. - aContentPolicyType = nsIContentPolicy::TYPE_INTERNAL_IMAGE; nsCOMPtr<nsIPrincipal> loadingPrincipal = aLoadingNode->NodePrincipal(); - nsAutoString imageLoadingPrincipal; - aLoadingNode->GetAttr(kNameSpaceID_None, nsGkAtoms::loadingprincipal, - imageLoadingPrincipal); - if (!imageLoadingPrincipal.IsEmpty()) { - nsCOMPtr<nsISupports> serializedPrincipal; - NS_DeserializeObject(NS_ConvertUTF16toUTF8(imageLoadingPrincipal), - getter_AddRefs(serializedPrincipal)); - loadingPrincipal = do_QueryInterface(serializedPrincipal); - - if (loadingPrincipal) { - // Set the content policy type to TYPE_INTERNAL_IMAGE_FAVICON for - // indicating it's a favicon loading. - aContentPolicyType = nsIContentPolicy::TYPE_INTERNAL_IMAGE_FAVICON; - } else { - // Fallback if the deserialization is failed. - loadingPrincipal = aLoadingNode->NodePrincipal(); + if (IsSystemPrincipal(loadingPrincipal)) { + aContentPolicyType = nsIContentPolicy::TYPE_INTERNAL_IMAGE; + nsAutoString imageLoadingPrincipal; + aLoadingNode->GetAttr(kNameSpaceID_None, nsGkAtoms::loadingprincipal, + imageLoadingPrincipal); + if (!imageLoadingPrincipal.IsEmpty()) { + nsCOMPtr<nsISupports> serializedPrincipal; + NS_DeserializeObject(NS_ConvertUTF16toUTF8(imageLoadingPrincipal), + getter_AddRefs(serializedPrincipal)); + loadingPrincipal = do_QueryInterface(serializedPrincipal); + + if (loadingPrincipal) { + // Set the content policy type to TYPE_INTERNAL_IMAGE_FAVICON for + // indicating it's a favicon loading. + aContentPolicyType = nsIContentPolicy::TYPE_INTERNAL_IMAGE_FAVICON; + } else { + // Fallback if the deserialization is failed. + loadingPrincipal = aLoadingNode->NodePrincipal(); + } } } loadingPrincipal.forget(aLoadingPrincipal); } + +/* static */ void +nsContentUtils::ApplyCustomLoadPrincipalToChannel(Element* aElement, nsIChannel* aChannel) +{ + nsCOMPtr<nsIPrincipal> loadingPrincipal = aElement->NodePrincipal(); + if (loadingPrincipal && nsContentUtils::IsSystemPrincipal(loadingPrincipal)) { + nsContentPolicyType dummyContentPolicyType; + nsContentUtils::GetContentPolicyTypeForUIImageLoading( + aElement, getter_AddRefs(loadingPrincipal), dummyContentPolicyType); + NeckoOriginAttributes neckoAttrs; + neckoAttrs.InheritFromDocToNecko( + BasePrincipal::Cast(loadingPrincipal)->OriginAttributesRef()); + nsCOMPtr<nsILoadInfo> loadInfo = aChannel->GetLoadInfo(); + if (loadInfo) { + Unused << loadInfo->SetOriginAttributes(neckoAttrs); + } + } +} diff --git a/dom/base/nsContentUtils.h b/dom/base/nsContentUtils.h index 3c7d9eb..08c5cbf 100644 --- a/dom/base/nsContentUtils.h +++ b/dom/base/nsContentUtils.h @@ -2746,6 +2746,13 @@ public: nsIPrincipal** aLoadingPrincipal, nsContentPolicyType& aContentPolicyType); + /** + * If aElement has a "loadprincipal" attribute, apply the origin attributes + * to the loadInfo belonging to aChannel. + */ + static void + ApplyCustomLoadPrincipalToChannel(Element* aElement, nsIChannel* aChannel); + private: static bool InitializeEventTable(); diff --git a/dom/html/HTMLMediaElement.cpp b/dom/html/HTMLMediaElement.cpp index 2f4f73f..37deffc 100644 --- a/dom/html/HTMLMediaElement.cpp +++ b/dom/html/HTMLMediaElement.cpp @@ -586,6 +586,8 @@ public: return; } + nsContentUtils::ApplyCustomLoadPrincipalToChannel(aElement, channel); + // The listener holds a strong reference to us. This creates a // reference cycle, once we've set mChannel, which is manually broken // in the listener's OnStartRequest method after it is finished with diff --git a/dom/media/MediaResource.cpp b/dom/media/MediaResource.cpp index d36783b..a8f600f 100644 --- a/dom/media/MediaResource.cpp +++ b/dom/media/MediaResource.cpp @@ -833,6 +833,8 @@ ChannelMediaResource::RecreateChannel() loadFlags); NS_ENSURE_SUCCESS(rv, rv); + nsContentUtils::ApplyCustomLoadPrincipalToChannel(element, mChannel); + // We have cached the Content-Type, which should not change. Give a hint to // the channel to avoid a sniffing failure, which would be expected because we // are probably seeking in the middle of the bitstream, and sniffing relies

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] Bug 1319908 - Load the menu icons for the bookmarks menu with the correct content type and principal on OSX; r=baku
by gk＠torproject.org 31 May '17

31 May '17

commit ef0f9d150d4210bed5b517763cf8872e7f729649 Author: Ehsan Akhgari <ehsan(a)mozilla.com> Date: Wed Dec 14 15:52:57 2016 -0500 Bug 1319908 - Load the menu icons for the bookmarks menu with the correct content type and principal on OSX; r=baku This patch makes nsMenuItemIconX also participate in the setup introduced in bug 1277803. --- browser/base/content/browser-places.js | 5 +++++ dom/base/nsContentUtils.cpp | 31 +++++++++++++++++++++++++++++++ dom/base/nsContentUtils.h | 10 ++++++++++ layout/xul/nsImageBoxFrame.cpp | 28 +++++----------------------- widget/cocoa/nsMenuItemIconX.h | 3 +++ widget/cocoa/nsMenuItemIconX.mm | 14 ++++++++++---- 6 files changed, 64 insertions(+), 27 deletions(-) diff --git a/browser/base/content/browser-places.js b/browser/base/content/browser-places.js index 14e90cd..3998b5b 100644 --- a/browser/base/content/browser-places.js +++ b/browser/base/content/browser-places.js @@ -1509,6 +1509,10 @@ var BookmarkingUI = { options.maxResults = kMaxResults; let query = PlacesUtils.history.getNewQuery(); + let sh = Cc["@mozilla.org/network/serialization-helper;1"] + .getService(Ci.nsISerializationHelper); + let loadingPrincipal = sh.serializeToString(document.nodePrincipal); + let fragment = document.createDocumentFragment(); let root = PlacesUtils.history.executeQuery(query, options).root; root.containerOpen = true; @@ -1528,6 +1532,7 @@ var BookmarkingUI = { aExtraCSSClass); if (icon) { item.setAttribute("image", icon); + item.setAttribute("loadingprincipal", loadingPrincipal); } item._placesNode = node; fragment.appendChild(item); diff --git a/dom/base/nsContentUtils.cpp b/dom/base/nsContentUtils.cpp index 539d189..48f7991 100644 --- a/dom/base/nsContentUtils.cpp +++ b/dom/base/nsContentUtils.cpp @@ -189,6 +189,7 @@ #include "nsReferencedElement.h" #include "nsSandboxFlags.h" #include "nsScriptSecurityManager.h" +#include "nsSerializationHelper.h" #include "nsStreamUtils.h" #include "nsTextEditorState.h" #include "nsTextFragment.h" @@ -9870,3 +9871,33 @@ nsContentUtils::AttemptLargeAllocationLoad(nsIHttpChannel* aChannel) return reloadSucceeded; } + +/* static */ void +nsContentUtils::GetContentPolicyTypeForUIImageLoading(nsIContent* aLoadingNode, + nsIPrincipal** aLoadingPrincipal, + nsContentPolicyType& aContentPolicyType) +{ + // Use the serialized loadingPrincipal from the image element. Fall back + // to mContent's principal (SystemPrincipal) if not available. + aContentPolicyType = nsIContentPolicy::TYPE_INTERNAL_IMAGE; + nsCOMPtr<nsIPrincipal> loadingPrincipal = aLoadingNode->NodePrincipal(); + nsAutoString imageLoadingPrincipal; + aLoadingNode->GetAttr(kNameSpaceID_None, nsGkAtoms::loadingprincipal, + imageLoadingPrincipal); + if (!imageLoadingPrincipal.IsEmpty()) { + nsCOMPtr<nsISupports> serializedPrincipal; + NS_DeserializeObject(NS_ConvertUTF16toUTF8(imageLoadingPrincipal), + getter_AddRefs(serializedPrincipal)); + loadingPrincipal = do_QueryInterface(serializedPrincipal); + + if (loadingPrincipal) { + // Set the content policy type to TYPE_INTERNAL_IMAGE_FAVICON for + // indicating it's a favicon loading. + aContentPolicyType = nsIContentPolicy::TYPE_INTERNAL_IMAGE_FAVICON; + } else { + // Fallback if the deserialization is failed. + loadingPrincipal = aLoadingNode->NodePrincipal(); + } + } + loadingPrincipal.forget(aLoadingPrincipal); +} diff --git a/dom/base/nsContentUtils.h b/dom/base/nsContentUtils.h index e991fb7..3c7d9eb 100644 --- a/dom/base/nsContentUtils.h +++ b/dom/base/nsContentUtils.h @@ -2736,6 +2736,16 @@ public: static bool AttemptLargeAllocationLoad(nsIHttpChannel* aChannel); + /** + * Returns the content policy type that should be used for loading images + * for displaying in the UI. The sources of such images can be <xul:image>, + * <xul:menuitem> on OSX where we load the image through nsMenuItemIconX, etc. + */ + static void + GetContentPolicyTypeForUIImageLoading(nsIContent* aLoadingNode, + nsIPrincipal** aLoadingPrincipal, + nsContentPolicyType& aContentPolicyType); + private: static bool InitializeEventTable(); diff --git a/layout/xul/nsImageBoxFrame.cpp b/layout/xul/nsImageBoxFrame.cpp index fd7c7be..89b583c 100644 --- a/layout/xul/nsImageBoxFrame.cpp +++ b/layout/xul/nsImageBoxFrame.cpp @@ -48,7 +48,6 @@ #include "nsIContent.h" #include "nsContentUtils.h" -#include "nsSerializationHelper.h" #include "mozilla/BasicEvents.h" #include "mozilla/EventDispatcher.h" @@ -227,28 +226,11 @@ nsImageBoxFrame::UpdateImage() if (mUseSrcAttr) { nsIDocument* doc = mContent->GetComposedDoc(); if (doc) { - // Use the serialized loadingPrincipal from the image element. Fall back - // to mContent's principal (SystemPrincipal) if not available. - nsContentPolicyType contentPolicyType = nsIContentPolicy::TYPE_INTERNAL_IMAGE; - nsCOMPtr<nsIPrincipal> loadingPrincipal = mContent->NodePrincipal(); - nsAutoString imageLoadingPrincipal; - mContent->GetAttr(kNameSpaceID_None, nsGkAtoms::loadingprincipal, - imageLoadingPrincipal); - if (!imageLoadingPrincipal.IsEmpty()) { - nsCOMPtr<nsISupports> serializedPrincipal; - NS_DeserializeObject(NS_ConvertUTF16toUTF8(imageLoadingPrincipal), - getter_AddRefs(serializedPrincipal)); - loadingPrincipal = do_QueryInterface(serializedPrincipal); - - if (loadingPrincipal) { - // Set the content policy type to TYPE_INTERNAL_IMAGE_FAVICON for - // indicating it's a favicon loading. - contentPolicyType = nsIContentPolicy::TYPE_INTERNAL_IMAGE_FAVICON; - } else { - // Fallback if the deserialization is failed. - loadingPrincipal = mContent->NodePrincipal(); - } - } + nsContentPolicyType contentPolicyType; + nsCOMPtr<nsIPrincipal> loadingPrincipal; + nsContentUtils::GetContentPolicyTypeForUIImageLoading(mContent, + getter_AddRefs(loadingPrincipal), + contentPolicyType); nsCOMPtr<nsIURI> baseURI = mContent->GetBaseURI(); nsCOMPtr<nsIURI> uri; diff --git a/widget/cocoa/nsMenuItemIconX.h b/widget/cocoa/nsMenuItemIconX.h index 7352a94..3bbe5d9 100644 --- a/widget/cocoa/nsMenuItemIconX.h +++ b/widget/cocoa/nsMenuItemIconX.h @@ -13,6 +13,7 @@ #include "mozilla/RefPtr.h" #include "nsCOMPtr.h" #include "imgINotificationObserver.h" +#include "nsIContentPolicy.h" class nsIURI; class nsIContent; @@ -55,6 +56,8 @@ protected: nsresult OnFrameComplete(imgIRequest* aRequest); nsCOMPtr<nsIContent> mContent; + nsCOMPtr<nsIPrincipal> mLoadingPrincipal; + nsContentPolicyType mContentType; RefPtr<imgRequestProxy> mIconRequest; nsMenuObjectX* mMenuObject; // [weak] nsIntRect mImageRegionRect; diff --git a/widget/cocoa/nsMenuItemIconX.mm b/widget/cocoa/nsMenuItemIconX.mm index 7589c27..261e63b 100644 --- a/widget/cocoa/nsMenuItemIconX.mm +++ b/widget/cocoa/nsMenuItemIconX.mm @@ -59,6 +59,8 @@ nsMenuItemIconX::nsMenuItemIconX(nsMenuObjectX* aMenuItem, nsIContent* aContent, NSMenuItem* aNativeMenuItem) : mContent(aContent) +, mLoadingPrincipal(aContent->NodePrincipal()) +, mContentType(nsIContentPolicy::TYPE_INTERNAL_IMAGE) , mMenuObject(aMenuItem) , mLoadedIcon(false) , mSetIcon(false) @@ -209,6 +211,10 @@ nsMenuItemIconX::GetIconURI(nsIURI** aIconURI) rv = primitiveValue->GetStringValue(imageURIString); if (NS_FAILED(rv)) return rv; + } else { + nsContentUtils::GetContentPolicyTypeForUIImageLoading(mContent, + getter_AddRefs(mLoadingPrincipal), + mContentType); } // Empty the mImageRegionRect initially as the image region CSS could @@ -310,10 +316,10 @@ nsMenuItemIconX::LoadIcon(nsIURI* aIconURI) } nsresult rv = loader->LoadImage(aIconURI, nullptr, nullptr, - mozilla::net::RP_Default, - nullptr, loadGroup, this, - nullptr, nullptr, nsIRequest::LOAD_NORMAL, nullptr, - nsIContentPolicy::TYPE_INTERNAL_IMAGE, EmptyString(), + mozilla::net::RP_Unset, + mLoadingPrincipal, loadGroup, this, + mContent, document, nsIRequest::LOAD_NORMAL, nullptr, + mContentType, EmptyString(), getter_AddRefs(mIconRequest)); if (NS_FAILED(rv)) return rv;

1 0

[tor-browser/tor-browser-52.1.1esr-7.0-1] Bug 22327: Isolate Page Info media previews to content first party
by gk＠torproject.org 31 May '17

31 May '17

commit 2d4d11e1e6bad5f384c409fa0391e97a9c202439 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Wed May 10 17:10:23 2017 -0700 Bug 22327: Isolate Page Info media previews to content first party --- browser/base/content/pageinfo/pageInfo.js | 9 +++++ dom/base/nsContentUtils.cpp | 63 ++++++++++++++++++++++--------- dom/base/nsContentUtils.h | 7 ++++ dom/html/HTMLMediaElement.cpp | 2 + dom/media/MediaResource.cpp | 2 + 5 files changed, 66 insertions(+), 17 deletions(-) diff --git a/browser/base/content/pageinfo/pageInfo.js b/browser/base/content/pageinfo/pageInfo.js index 7a6d0a0..fc3e3bb 100644 --- a/browser/base/content/pageinfo/pageInfo.js +++ b/browser/base/content/pageinfo/pageInfo.js @@ -4,6 +4,11 @@ Components.utils.import("resource://gre/modules/LoadContextInfo.jsm"); Components.utils.import("resource://gre/modules/Services.jsm"); +Components.utils.import("resource://gre/modules/XPCOMUtils.jsm"); + +XPCOMUtils.defineLazyServiceGetter(this, "gSerializationHelper", + "@mozilla.org/network/serialization-helper;1", + "nsISerializationHelper"); // define a js object to implement nsITreeView function pageInfoTreeView(treeid, copycol) @@ -881,6 +886,8 @@ function makePreview(row) var newImage = new Image; newImage.id = "thepreviewimage"; + let loadingPrincipalString = gSerializationHelper.serializeToString(gDocInfo.principal); + newImage.setAttribute("loadingprincipal", loadingPrincipalString); var physWidth = 0, physHeight = 0; var width = 0, height = 0; @@ -928,6 +935,7 @@ function makePreview(row) else if (item.HTMLVideoElement && isProtocolAllowed) { newImage = document.createElementNS("http://www.w3.org/1999/xhtml", "video"); newImage.id = "thepreviewimage"; + newImage.setAttribute("loadingprincipal", loadingPrincipalString); newImage.src = url; newImage.controls = true; width = physWidth = item.videoWidth; @@ -939,6 +947,7 @@ function makePreview(row) else if (item.HTMLAudioElement && isProtocolAllowed) { newImage = new Audio; newImage.id = "thepreviewimage"; + newImage.setAttribute("loadingprincipal", loadingPrincipalString); newImage.src = url; newImage.controls = true; isAudio = true; diff --git a/dom/base/nsContentUtils.cpp b/dom/base/nsContentUtils.cpp index 48f7991..f932742 100644 --- a/dom/base/nsContentUtils.cpp +++ b/dom/base/nsContentUtils.cpp @@ -3367,6 +3367,15 @@ nsContentUtils::LoadImage(nsIURI* aURI, nsINode* aContext, NS_PRECONDITION(aLoadingPrincipal, "Must have a principal"); NS_PRECONDITION(aRequest, "Null out param"); + // If the image is in a chrome document and the image node has been assigned a + // "loadingprincipal" attribute, we should use that principal instead. + if (IsSystemPrincipal(aLoadingPrincipal) && aContext->IsContent()) { + nsContentPolicyType contentPolicyType; + GetContentPolicyTypeForUIImageLoading(aContext->AsContent(), + &aLoadingPrincipal, contentPolicyType); + aContentPolicyType = (int32_t) contentPolicyType; + } + imgLoader* imgLoader = GetImgLoaderForDocument(aLoadingDocument); if (!imgLoader) { // nothing we can do here @@ -9879,25 +9888,45 @@ nsContentUtils::GetContentPolicyTypeForUIImageLoading(nsIContent* aLoadingNode, { // Use the serialized loadingPrincipal from the image element. Fall back // to mContent's principal (SystemPrincipal) if not available. - aContentPolicyType = nsIContentPolicy::TYPE_INTERNAL_IMAGE; nsCOMPtr<nsIPrincipal> loadingPrincipal = aLoadingNode->NodePrincipal(); - nsAutoString imageLoadingPrincipal; - aLoadingNode->GetAttr(kNameSpaceID_None, nsGkAtoms::loadingprincipal, - imageLoadingPrincipal); - if (!imageLoadingPrincipal.IsEmpty()) { - nsCOMPtr<nsISupports> serializedPrincipal; - NS_DeserializeObject(NS_ConvertUTF16toUTF8(imageLoadingPrincipal), - getter_AddRefs(serializedPrincipal)); - loadingPrincipal = do_QueryInterface(serializedPrincipal); - - if (loadingPrincipal) { - // Set the content policy type to TYPE_INTERNAL_IMAGE_FAVICON for - // indicating it's a favicon loading. - aContentPolicyType = nsIContentPolicy::TYPE_INTERNAL_IMAGE_FAVICON; - } else { - // Fallback if the deserialization is failed. - loadingPrincipal = aLoadingNode->NodePrincipal(); + if (IsSystemPrincipal(loadingPrincipal)) { + aContentPolicyType = nsIContentPolicy::TYPE_INTERNAL_IMAGE; + nsAutoString imageLoadingPrincipal; + aLoadingNode->GetAttr(kNameSpaceID_None, nsGkAtoms::loadingprincipal, + imageLoadingPrincipal); + if (!imageLoadingPrincipal.IsEmpty()) { + nsCOMPtr<nsISupports> serializedPrincipal; + NS_DeserializeObject(NS_ConvertUTF16toUTF8(imageLoadingPrincipal), + getter_AddRefs(serializedPrincipal)); + loadingPrincipal = do_QueryInterface(serializedPrincipal); + + if (loadingPrincipal) { + // Set the content policy type to TYPE_INTERNAL_IMAGE_FAVICON for + // indicating it's a favicon loading. + aContentPolicyType = nsIContentPolicy::TYPE_INTERNAL_IMAGE_FAVICON; + } else { + // Fallback if the deserialization is failed. + loadingPrincipal = aLoadingNode->NodePrincipal(); + } } } loadingPrincipal.forget(aLoadingPrincipal); } + +/* static */ void +nsContentUtils::ApplyCustomLoadPrincipalToChannel(Element* aElement, nsIChannel* aChannel) +{ + nsCOMPtr<nsIPrincipal> loadingPrincipal = aElement->NodePrincipal(); + if (loadingPrincipal && nsContentUtils::IsSystemPrincipal(loadingPrincipal)) { + nsContentPolicyType dummyContentPolicyType; + nsContentUtils::GetContentPolicyTypeForUIImageLoading( + aElement, getter_AddRefs(loadingPrincipal), dummyContentPolicyType); + NeckoOriginAttributes neckoAttrs; + neckoAttrs.InheritFromDocToNecko( + BasePrincipal::Cast(loadingPrincipal)->OriginAttributesRef()); + nsCOMPtr<nsILoadInfo> loadInfo = aChannel->GetLoadInfo(); + if (loadInfo) { + Unused << loadInfo->SetOriginAttributes(neckoAttrs); + } + } +} diff --git a/dom/base/nsContentUtils.h b/dom/base/nsContentUtils.h index 3c7d9eb..08c5cbf 100644 --- a/dom/base/nsContentUtils.h +++ b/dom/base/nsContentUtils.h @@ -2746,6 +2746,13 @@ public: nsIPrincipal** aLoadingPrincipal, nsContentPolicyType& aContentPolicyType); + /** + * If aElement has a "loadprincipal" attribute, apply the origin attributes + * to the loadInfo belonging to aChannel. + */ + static void + ApplyCustomLoadPrincipalToChannel(Element* aElement, nsIChannel* aChannel); + private: static bool InitializeEventTable(); diff --git a/dom/html/HTMLMediaElement.cpp b/dom/html/HTMLMediaElement.cpp index 2f4f73f..37deffc 100644 --- a/dom/html/HTMLMediaElement.cpp +++ b/dom/html/HTMLMediaElement.cpp @@ -586,6 +586,8 @@ public: return; } + nsContentUtils::ApplyCustomLoadPrincipalToChannel(aElement, channel); + // The listener holds a strong reference to us. This creates a // reference cycle, once we've set mChannel, which is manually broken // in the listener's OnStartRequest method after it is finished with diff --git a/dom/media/MediaResource.cpp b/dom/media/MediaResource.cpp index d36783b..a8f600f 100644 --- a/dom/media/MediaResource.cpp +++ b/dom/media/MediaResource.cpp @@ -833,6 +833,8 @@ ChannelMediaResource::RecreateChannel() loadFlags); NS_ENSURE_SUCCESS(rv, rv); + nsContentUtils::ApplyCustomLoadPrincipalToChannel(element, mChannel); + // We have cached the Content-Type, which should not change. Give a hint to // the channel to avoid a sniffing failure, which would be expected because we // are probably seeking in the middle of the bitstream, and sniffing relies

1 0

[tor-browser/tor-browser-52.1.1esr-7.0-1] Bug 1319908 - Load the menu icons for the bookmarks menu with the correct content type and principal on OSX; r=baku
by gk＠torproject.org 31 May '17

31 May '17

commit 24862c15f6f719cd05a42d784ed7a7b7bb05c567 Author: Ehsan Akhgari <ehsan(a)mozilla.com> Date: Wed Dec 14 15:52:57 2016 -0500 Bug 1319908 - Load the menu icons for the bookmarks menu with the correct content type and principal on OSX; r=baku This patch makes nsMenuItemIconX also participate in the setup introduced in bug 1277803. --- browser/base/content/browser-places.js | 5 +++++ dom/base/nsContentUtils.cpp | 31 +++++++++++++++++++++++++++++++ dom/base/nsContentUtils.h | 10 ++++++++++ layout/xul/nsImageBoxFrame.cpp | 28 +++++----------------------- widget/cocoa/nsMenuItemIconX.h | 3 +++ widget/cocoa/nsMenuItemIconX.mm | 14 ++++++++++---- 6 files changed, 64 insertions(+), 27 deletions(-) diff --git a/browser/base/content/browser-places.js b/browser/base/content/browser-places.js index 14e90cd..3998b5b 100644 --- a/browser/base/content/browser-places.js +++ b/browser/base/content/browser-places.js @@ -1509,6 +1509,10 @@ var BookmarkingUI = { options.maxResults = kMaxResults; let query = PlacesUtils.history.getNewQuery(); + let sh = Cc["@mozilla.org/network/serialization-helper;1"] + .getService(Ci.nsISerializationHelper); + let loadingPrincipal = sh.serializeToString(document.nodePrincipal); + let fragment = document.createDocumentFragment(); let root = PlacesUtils.history.executeQuery(query, options).root; root.containerOpen = true; @@ -1528,6 +1532,7 @@ var BookmarkingUI = { aExtraCSSClass); if (icon) { item.setAttribute("image", icon); + item.setAttribute("loadingprincipal", loadingPrincipal); } item._placesNode = node; fragment.appendChild(item); diff --git a/dom/base/nsContentUtils.cpp b/dom/base/nsContentUtils.cpp index 539d189..48f7991 100644 --- a/dom/base/nsContentUtils.cpp +++ b/dom/base/nsContentUtils.cpp @@ -189,6 +189,7 @@ #include "nsReferencedElement.h" #include "nsSandboxFlags.h" #include "nsScriptSecurityManager.h" +#include "nsSerializationHelper.h" #include "nsStreamUtils.h" #include "nsTextEditorState.h" #include "nsTextFragment.h" @@ -9870,3 +9871,33 @@ nsContentUtils::AttemptLargeAllocationLoad(nsIHttpChannel* aChannel) return reloadSucceeded; } + +/* static */ void +nsContentUtils::GetContentPolicyTypeForUIImageLoading(nsIContent* aLoadingNode, + nsIPrincipal** aLoadingPrincipal, + nsContentPolicyType& aContentPolicyType) +{ + // Use the serialized loadingPrincipal from the image element. Fall back + // to mContent's principal (SystemPrincipal) if not available. + aContentPolicyType = nsIContentPolicy::TYPE_INTERNAL_IMAGE; + nsCOMPtr<nsIPrincipal> loadingPrincipal = aLoadingNode->NodePrincipal(); + nsAutoString imageLoadingPrincipal; + aLoadingNode->GetAttr(kNameSpaceID_None, nsGkAtoms::loadingprincipal, + imageLoadingPrincipal); + if (!imageLoadingPrincipal.IsEmpty()) { + nsCOMPtr<nsISupports> serializedPrincipal; + NS_DeserializeObject(NS_ConvertUTF16toUTF8(imageLoadingPrincipal), + getter_AddRefs(serializedPrincipal)); + loadingPrincipal = do_QueryInterface(serializedPrincipal); + + if (loadingPrincipal) { + // Set the content policy type to TYPE_INTERNAL_IMAGE_FAVICON for + // indicating it's a favicon loading. + aContentPolicyType = nsIContentPolicy::TYPE_INTERNAL_IMAGE_FAVICON; + } else { + // Fallback if the deserialization is failed. + loadingPrincipal = aLoadingNode->NodePrincipal(); + } + } + loadingPrincipal.forget(aLoadingPrincipal); +} diff --git a/dom/base/nsContentUtils.h b/dom/base/nsContentUtils.h index e991fb7..3c7d9eb 100644 --- a/dom/base/nsContentUtils.h +++ b/dom/base/nsContentUtils.h @@ -2736,6 +2736,16 @@ public: static bool AttemptLargeAllocationLoad(nsIHttpChannel* aChannel); + /** + * Returns the content policy type that should be used for loading images + * for displaying in the UI. The sources of such images can be <xul:image>, + * <xul:menuitem> on OSX where we load the image through nsMenuItemIconX, etc. + */ + static void + GetContentPolicyTypeForUIImageLoading(nsIContent* aLoadingNode, + nsIPrincipal** aLoadingPrincipal, + nsContentPolicyType& aContentPolicyType); + private: static bool InitializeEventTable(); diff --git a/layout/xul/nsImageBoxFrame.cpp b/layout/xul/nsImageBoxFrame.cpp index fd7c7be..89b583c 100644 --- a/layout/xul/nsImageBoxFrame.cpp +++ b/layout/xul/nsImageBoxFrame.cpp @@ -48,7 +48,6 @@ #include "nsIContent.h" #include "nsContentUtils.h" -#include "nsSerializationHelper.h" #include "mozilla/BasicEvents.h" #include "mozilla/EventDispatcher.h" @@ -227,28 +226,11 @@ nsImageBoxFrame::UpdateImage() if (mUseSrcAttr) { nsIDocument* doc = mContent->GetComposedDoc(); if (doc) { - // Use the serialized loadingPrincipal from the image element. Fall back - // to mContent's principal (SystemPrincipal) if not available. - nsContentPolicyType contentPolicyType = nsIContentPolicy::TYPE_INTERNAL_IMAGE; - nsCOMPtr<nsIPrincipal> loadingPrincipal = mContent->NodePrincipal(); - nsAutoString imageLoadingPrincipal; - mContent->GetAttr(kNameSpaceID_None, nsGkAtoms::loadingprincipal, - imageLoadingPrincipal); - if (!imageLoadingPrincipal.IsEmpty()) { - nsCOMPtr<nsISupports> serializedPrincipal; - NS_DeserializeObject(NS_ConvertUTF16toUTF8(imageLoadingPrincipal), - getter_AddRefs(serializedPrincipal)); - loadingPrincipal = do_QueryInterface(serializedPrincipal); - - if (loadingPrincipal) { - // Set the content policy type to TYPE_INTERNAL_IMAGE_FAVICON for - // indicating it's a favicon loading. - contentPolicyType = nsIContentPolicy::TYPE_INTERNAL_IMAGE_FAVICON; - } else { - // Fallback if the deserialization is failed. - loadingPrincipal = mContent->NodePrincipal(); - } - } + nsContentPolicyType contentPolicyType; + nsCOMPtr<nsIPrincipal> loadingPrincipal; + nsContentUtils::GetContentPolicyTypeForUIImageLoading(mContent, + getter_AddRefs(loadingPrincipal), + contentPolicyType); nsCOMPtr<nsIURI> baseURI = mContent->GetBaseURI(); nsCOMPtr<nsIURI> uri; diff --git a/widget/cocoa/nsMenuItemIconX.h b/widget/cocoa/nsMenuItemIconX.h index 7352a94..3bbe5d9 100644 --- a/widget/cocoa/nsMenuItemIconX.h +++ b/widget/cocoa/nsMenuItemIconX.h @@ -13,6 +13,7 @@ #include "mozilla/RefPtr.h" #include "nsCOMPtr.h" #include "imgINotificationObserver.h" +#include "nsIContentPolicy.h" class nsIURI; class nsIContent; @@ -55,6 +56,8 @@ protected: nsresult OnFrameComplete(imgIRequest* aRequest); nsCOMPtr<nsIContent> mContent; + nsCOMPtr<nsIPrincipal> mLoadingPrincipal; + nsContentPolicyType mContentType; RefPtr<imgRequestProxy> mIconRequest; nsMenuObjectX* mMenuObject; // [weak] nsIntRect mImageRegionRect; diff --git a/widget/cocoa/nsMenuItemIconX.mm b/widget/cocoa/nsMenuItemIconX.mm index 7589c27..261e63b 100644 --- a/widget/cocoa/nsMenuItemIconX.mm +++ b/widget/cocoa/nsMenuItemIconX.mm @@ -59,6 +59,8 @@ nsMenuItemIconX::nsMenuItemIconX(nsMenuObjectX* aMenuItem, nsIContent* aContent, NSMenuItem* aNativeMenuItem) : mContent(aContent) +, mLoadingPrincipal(aContent->NodePrincipal()) +, mContentType(nsIContentPolicy::TYPE_INTERNAL_IMAGE) , mMenuObject(aMenuItem) , mLoadedIcon(false) , mSetIcon(false) @@ -209,6 +211,10 @@ nsMenuItemIconX::GetIconURI(nsIURI** aIconURI) rv = primitiveValue->GetStringValue(imageURIString); if (NS_FAILED(rv)) return rv; + } else { + nsContentUtils::GetContentPolicyTypeForUIImageLoading(mContent, + getter_AddRefs(mLoadingPrincipal), + mContentType); } // Empty the mImageRegionRect initially as the image region CSS could @@ -310,10 +316,10 @@ nsMenuItemIconX::LoadIcon(nsIURI* aIconURI) } nsresult rv = loader->LoadImage(aIconURI, nullptr, nullptr, - mozilla::net::RP_Default, - nullptr, loadGroup, this, - nullptr, nullptr, nsIRequest::LOAD_NORMAL, nullptr, - nsIContentPolicy::TYPE_INTERNAL_IMAGE, EmptyString(), + mozilla::net::RP_Unset, + mLoadingPrincipal, loadGroup, this, + mContent, document, nsIRequest::LOAD_NORMAL, nullptr, + mContentType, EmptyString(), getter_AddRefs(mIconRequest)); if (NS_FAILED(rv)) return rv;

1 0

[tor-browser-build/master] Bug 22444: use hardening-wrapper when building gcc for the Linux build
by boklm＠torproject.org 30 May '17

30 May '17

commit 6378afdeb4e15607bedebe5270137657c7961be7 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Tue May 30 14:51:46 2017 +0200 Bug 22444: use hardening-wrapper when building gcc for the Linux build --- projects/gcc/build | 11 +++++++++++ projects/gcc/config | 2 ++ 2 files changed, 13 insertions(+) diff --git a/projects/gcc/build b/projects/gcc/build index e509aac..e2902ad 100644 --- a/projects/gcc/build +++ b/projects/gcc/build @@ -1,6 +1,17 @@ #!/bin/sh [% c("var/set_default_env") -%] [% c("var/setarch") -%] +[% IF c("var/linux") -%] + # Config options for hardening-wrapper + export DEB_BUILD_HARDENING=1 + export DEB_BUILD_HARDENING_STACKPROTECTOR=1 + export DEB_BUILD_HARDENING_FORTIFY=1 + export DEB_BUILD_HARDENING_PIE=1 + # We need to disable `-Werror=format-security` as GCC does not build with it + # anymore. It seems it got audited for those problems already: + # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=48817. + export DEB_BUILD_HARDENING_FORMAT=0 +[% END -%] distdir=/var/tmp/dist/[% project %] mkdir /var/tmp/build tar -C /var/tmp/build -xf [% project %]-[% c("version") %].tar.bz2 diff --git a/projects/gcc/config b/projects/gcc/config index 3871455..d97afbf 100644 --- a/projects/gcc/config +++ b/projects/gcc/config @@ -47,12 +47,14 @@ targets: var: configure_opt: --enable-multilib --enable-languages=c,c++ --with-system-zlib arch_deps: + - hardening-wrapper - libc6-dev - zlib1g-dev linux-x86_64: var: configure_opt: --enable-multilib --enable-languages=c,c++ --with-arch_32=i686 arch_deps: + - hardening-wrapper - libc6-dev-i386 input_files: - project: container-image

1 0