- tbb-commits - lists.torproject.org

[tor-browser-bundle/maint-3.6] Add missing subticket for Tor Launcher to 3.6.4 changelog.
by mikeperry＠torproject.org 28 Aug '14

28 Aug '14

commit 7838ffa0f401822048c420fbfb08598524af29e6 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Wed Aug 27 19:15:20 2014 -0700 Add missing subticket for Tor Launcher to 3.6.4 changelog. --- Bundle-Data/Docs/ChangeLog.txt | 1 + 1 file changed, 1 insertion(+) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index fe69179..b0d8eee 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -20,6 +20,7 @@ Tor Browser Bundle 3.6.4 -- Aug 8 2014 * All Platforms * Update Tor to 0.2.4.23 * Update Tor launcher to 0.2.5.6 + * Bug 9516: Show Tor log in TorBrowser's Browser Console * Update OpenSSL to 1.0.1i * Backported Tor Patches: * Bug 11654: Properly apply the fix for malformed bug11156 log message

1 0

[torbutton/master] Bug 8940: Move RecommendedTBBVersions file to www.torproject.org.
by mikeperry＠torproject.org 28 Aug '14

28 Aug '14

commit cdd220ec835705a68aa06c047b235ad172b6fe40 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Wed Aug 27 19:05:24 2014 -0700 Bug 8940: Move RecommendedTBBVersions file to www.torproject.org. --- src/defaults/preferences/preferences.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/defaults/preferences/preferences.js b/src/defaults/preferences/preferences.js index d2945c0..af9838a 100644 --- a/src/defaults/preferences/preferences.js +++ b/src/defaults/preferences/preferences.js @@ -29,7 +29,7 @@ pref("extensions.torbutton.test_url_interactive", "https://check.torproject.org/ pref("extensions.torbutton.local_tor_check",true); pref("extensions.torbutton.test_failed",false); pref("extensions.torbutton.no_proxies_on",""); -pref("extensions.torbutton.versioncheck_url","https://check.torproject.org/RecommendedTBBVersions"); +pref("extensions.torbutton.versioncheck_url","https://www.torproject.org/projects/torbrowser/RecommendedTBBVersions"); pref("extensions.torbutton.versioncheck_enabled",true); // XXX: wtf prefs? These seem not actually connected, but govern

1 0

[tor-browser-bundle/master] Changelog draft for 4.0-alpha-2.
by mikeperry＠torproject.org 28 Aug '14

28 Aug '14

commit a0ce2c3ade02b29c155508639724fe72f5b4b740 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Wed Aug 27 18:31:36 2014 -0700 Changelog draft for 4.0-alpha-2. --- Bundle-Data/Docs/ChangeLog.txt | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index 8eb4284..0aa0e7a 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,25 @@ +Tor Browser Bundle 4.0-alpha-2 -- Sep 2 2014 + * All Platforms + * Update Firefox to 24.8.0esr + * Update Tor Launcher to 0.2.7.0 + * Bug 11405: Remove firewall prompt from wizard. + * Bug 12895: Mention @riseup.net as a valid bridge request email address + * Bug 12444: Provide feedback when “Copy Tor Log” is clicked. + * Bug 11199: Improve error messages if Tor exits unexpectedly + * Update Torbutton to 1.6.12.1 + * Bug 12684: New strings for canvas image extraction message + * Bug 12684: Improve Canvas image extraction permissions prompt + * Bug 7265: Only prompt for first party canvas access. Log all scripts + that attempt to extract canvas images to Browser console. + * Bug 12974: Disable NTLM and Negotiate HTTP Auth + * Bug 2874: Remove Components.* from content access (regression) + * Bug 4234: Automatic Update support (off by default) + * Bug 9881: Open popups in new tabs by default + * Meek Pluggable Transport: + * Use TLSv1.0 in meek-http-helper to blend in with Firefox 24 + * Windows: + * Bug 10065: Enable DEP, ASLR, and SSP hardening options + Tor Browser Bundle 4.0-alpha-1 -- Aug 8 2014 * All Platforms * Ticket 10935: Include the Meek Pluggable Transport (version 0.10)

1 0

[tor-browser/tor-browser-24.7.0esr-4.x-2] fixup! TB4: Tor Browser's Firefox preference overrides.
by mikeperry＠torproject.org 28 Aug '14

28 Aug '14

commit 88d511942b3efba809e70e4709360130ca91c09a Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Wed Aug 27 18:26:22 2014 -0700 fixup! TB4: Tor Browser's Firefox preference overrides. Open popups in new tabs to avoid full screen popups. --- browser/app/profile/000-tor-browser.js | 1 + 1 file changed, 1 insertion(+) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index a6ff777..a58ce4a 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -73,6 +73,7 @@ pref("dom.enable_performance", false); pref("plugin.expose_full_path", false); pref("browser.zoom.siteSpecific", false); pref("intl.charset.default", "windows-1252"); +pref("browser.link.open_newwindow.restriction", 0); // Bug 9881: Open popups in new tabs (to avoid fullscreen popups) // pref("intl.accept_languages", "en-us, en"); // Set by Torbutton // pref("intl.accept_charsets", "iso-8859-1,*,utf-8"); // Set by Torbutton // pref("intl.charsetmenu.browser.cache", "UTF-8"); // Set by Torbutton

1 0

[tor-browser/tor-browser-24.7.0esr-3.x-1] fixup! Tor Browser's Firefox preference overrides.
by mikeperry＠torproject.org 28 Aug '14

28 Aug '14

commit 3b4d010889e1ab571698a3b6294e0bef348ed044 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Wed Aug 27 18:27:06 2014 -0700 fixup! Tor Browser's Firefox preference overrides. Open popups in new tabs to avoid full screen popups. --- browser/app/profile/000-tor-browser.js | 1 + 1 file changed, 1 insertion(+) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index a6ff777..a58ce4a 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -73,6 +73,7 @@ pref("dom.enable_performance", false); pref("plugin.expose_full_path", false); pref("browser.zoom.siteSpecific", false); pref("intl.charset.default", "windows-1252"); +pref("browser.link.open_newwindow.restriction", 0); // Bug 9881: Open popups in new tabs (to avoid fullscreen popups) // pref("intl.accept_languages", "en-us, en"); // Set by Torbutton // pref("intl.accept_charsets", "iso-8859-1,*,utf-8"); // Set by Torbutton // pref("intl.charsetmenu.browser.cache", "UTF-8"); // Set by Torbutton

1 0

[tor-browser-bundle/master] Stop checking HTTPS-Everywhere's tag. We use the xpi.
by mikeperry＠torproject.org 28 Aug '14

28 Aug '14

commit b923c68ede1199ad492cfae7045c5dd98ef017ba Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Wed Aug 27 16:07:53 2014 -0700 Stop checking HTTPS-Everywhere's tag. We use the xpi. --- gitian/record-inputs.sh | 2 +- gitian/verify-tags.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/gitian/record-inputs.sh b/gitian/record-inputs.sh index 7ca4416..afcd70d 100755 --- a/gitian/record-inputs.sh +++ b/gitian/record-inputs.sh @@ -50,7 +50,7 @@ echo "`cd tor && git log --format=%H -1 $TOR_TAG` tor.git" >> bundle.inputs echo "`cd tor-browser && git log --format=%H -1 $TORBROWSER_TAG` tor-browser.git" >> bundle.inputs echo "`cd torbutton && git log --format=%H -1 $TORBUTTON_TAG` torbutton.git" >> bundle.inputs echo "`cd tor-launcher && git log --format=%H -1 $TORLAUNCHER_TAG` tor-launcher.git" >> bundle.inputs -echo "`cd https-everywhere && git log --format=%H -1 $HTTPSE_TAG` https-everywhere.git" >> bundle.inputs +#echo "`cd https-everywhere && git log --format=%H -1 $HTTPSE_TAG` https-everywhere.git" >> bundle.inputs echo "`cd tbb-windows-installer && git log --format=%H -1 $NSIS_TAG` tbb-windows-installer.git" >> bundle.inputs echo "`cd mingw-w64-git && git log --format=%H -1 $MINGW_TAG` mingw-w64.git" >> bundle.inputs echo "`cd $INPUTS_DIR && git log --format=%H -1` gitian-builder.git" >> bundle.inputs diff --git a/gitian/verify-tags.sh b/gitian/verify-tags.sh index a664b52..a4f6ca1 100755 --- a/gitian/verify-tags.sh +++ b/gitian/verify-tags.sh @@ -96,13 +96,13 @@ torbutton torbutton.gpg $TORBUTTON_TAG zlib zlib.gpg $ZLIB_TAG libevent libevent.gpg $LIBEVENT_TAG tor tor.gpg $TOR_TAG -https-everywhere https-everywhere.gpg $HTTPSE_TAG pyptlib pyptlib.gpg $PYPTLIB_TAG obfsproxy obfsproxy.gpg $OBFSPROXY_TAG flashproxy flashproxy.gpg $FLASHPROXY_TAG goptlib goptlib.gpg $GOPTLIB_TAG meek meek.gpg $MEEK_TAG EOF +#https-everywhere https-everywhere.gpg $HTTPSE_TAG while read dir commit; do check_git_hash "$dir" "$commit"

1 0

[tor-browser-bundle/maint-3.6] Stop checking HTTPS-Everywhere's tag. We use the xpi.
by mikeperry＠torproject.org 28 Aug '14

28 Aug '14

commit a5ccfbc333008607dee27d6d5a2d6c10e3720cb4 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Wed Aug 27 16:05:02 2014 -0700 Stop checking HTTPS-Everywhere's tag. We use the xpi. --- gitian/record-inputs.sh | 2 +- gitian/verify-tags.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/gitian/record-inputs.sh b/gitian/record-inputs.sh index bbae06f..7531589 100755 --- a/gitian/record-inputs.sh +++ b/gitian/record-inputs.sh @@ -51,7 +51,7 @@ echo "`cd tor && git log --format=%H -1 $TOR_TAG` tor.git" >> bundle.inputs echo "`cd tor-browser && git log --format=%H -1 $TORBROWSER_TAG` tor-browser.git" >> bundle.inputs echo "`cd torbutton && git log --format=%H -1 $TORBUTTON_TAG` torbutton.git" >> bundle.inputs echo "`cd tor-launcher && git log --format=%H -1 $TORLAUNCHER_TAG` tor-launcher.git" >> bundle.inputs -echo "`cd https-everywhere && git log --format=%H -1 $HTTPSE_TAG` https-everywhere.git" >> bundle.inputs +#echo "`cd https-everywhere && git log --format=%H -1 $HTTPSE_TAG` https-everywhere.git" >> bundle.inputs echo "`cd tbb-windows-installer && git log --format=%H -1 $NSIS_TAG` tbb-windows-installer.git" >> bundle.inputs echo "`cd $INPUTS_DIR && git log --format=%H -1` gitian-builder.git" >> bundle.inputs echo "`cd $WRAPPER_DIR && git log --format=%H -1` tor-browser-bundle.git" >> bundle.inputs diff --git a/gitian/verify-tags.sh b/gitian/verify-tags.sh index 324a27a..9814440 100755 --- a/gitian/verify-tags.sh +++ b/gitian/verify-tags.sh @@ -96,11 +96,11 @@ torbutton torbutton.gpg $TORBUTTON_TAG zlib zlib.gpg $ZLIB_TAG libevent libevent.gpg $LIBEVENT_TAG tor tor.gpg $TOR_TAG -https-everywhere https-everywhere.gpg $HTTPSE_TAG pyptlib pyptlib.gpg $PYPTLIB_TAG obfsproxy obfsproxy.gpg $OBFSPROXY_TAG flashproxy flashproxy.gpg $FLASHPROXY_TAG EOF +#https-everywhere https-everywhere.gpg $HTTPSE_TAG while read dir commit; do check_git_hash "$dir" "$commit"

1 0

[tor-browser-bundle/maint-3.6] Switch to build candidates directory for fetching Firefox langpacks.
by mikeperry＠torproject.org 28 Aug '14

28 Aug '14

commit b139e04c388230ba3aef98376b3d69b7aa3f30e0 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Wed Aug 27 15:55:40 2014 -0700 Switch to build candidates directory for fetching Firefox langpacks. This will allow us to build earlier, and also make our build hashes reproducible in the event of a minor langpack hash change we decide to ignore. --- gitian/fetch-inputs.sh | 6 +++--- gitian/versions | 1 + gitian/versions.alpha | 1 + gitian/versions.beta | 1 + gitian/versions.nightly | 1 + 5 files changed, 7 insertions(+), 3 deletions(-) diff --git a/gitian/fetch-inputs.sh b/gitian/fetch-inputs.sh index be5c9d9..32c4139 100755 --- a/gitian/fetch-inputs.sh +++ b/gitian/fetch-inputs.sh @@ -248,13 +248,13 @@ cd langpacks-$FIREFOX_LANG_VER for i in $BUNDLE_LOCALES do cd linux-langpacks - wget -U "" -N "https://ftp.mozilla.org/pub/mozilla.org/firefox/releases/$FIREFOX_LANG_VER/…" + wget -U "" -N "https://ftp.mozilla.org/pub/mozilla.org/firefox/candidates/${FIREFOX_LANG_V…" cd .. cd win32-langpacks - wget -U "" -N "https://ftp.mozilla.org/pub/mozilla.org/firefox/releases/$FIREFOX_LANG_VER/…" + wget -U "" -N "https://ftp.mozilla.org/pub/mozilla.org/firefox/candidates/${FIREFOX_LANG_V…" cd .. cd mac-langpacks - wget -U "" -N "https://ftp.mozilla.org/pub/mozilla.org/firefox/releases/$FIREFOX_LANG_VER/…" + wget -U "" -N "https://ftp.mozilla.org/pub/mozilla.org/firefox/candidates/${FIREFOX_LANG_V…" cd .. done diff --git a/gitian/versions b/gitian/versions index e700ad3..25bafb0 100755 --- a/gitian/versions +++ b/gitian/versions @@ -28,6 +28,7 @@ GITIAN_TAG=tor-browser-builder-3.x-6 OPENSSL_VER=1.0.1i GMP_VER=5.1.3 FIREFOX_LANG_VER=$FIREFOX_VERSION +FIREFOX_LANG_BUILD=build1 BINUTILS_VER=2.22 GCC_VER=4.6.3 PYTHON_VER=2.7.5 diff --git a/gitian/versions.alpha b/gitian/versions.alpha index 4906e1c..d7d3dc7 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -27,6 +27,7 @@ GITIAN_TAG=tor-browser-builder-3.x-6 OPENSSL_VER=1.0.1g GMP_VER=5.1.3 FIREFOX_LANG_VER=$FIREFOX_VERSION +FIREFOX_LANG_BUILD=build1 BINUTILS_VER=2.22 GCC_VER=4.6.3 PYTHON_VER=2.7.5 diff --git a/gitian/versions.beta b/gitian/versions.beta index c76acde..346a5d1 100755 --- a/gitian/versions.beta +++ b/gitian/versions.beta @@ -28,6 +28,7 @@ GITIAN_TAG=tor-browser-builder-3.x-6 OPENSSL_VER=1.0.1g GMP_VER=5.1.3 FIREFOX_LANG_VER=$FIREFOX_VERSION +FIREFOX_LANG_BUILD=build1 BINUTILS_VER=2.22 GCC_VER=4.6.3 PYTHON_VER=2.7.5 diff --git a/gitian/versions.nightly b/gitian/versions.nightly index e19ebdc..335000b 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -28,6 +28,7 @@ GITIAN_TAG=tor-browser-builder-3.x-6 OPENSSL_VER=1.0.1g GMP_VER=5.1.3 FIREFOX_LANG_VER=$FIREFOX_VERSION +FIREFOX_LANG_BUILD=build1 BINUTILS_VER=2.22 GCC_VER=4.6.3 PYTHON_VER=2.7.5

1 0

[tor-browser-bundle/master] Switch to build candidates directory for fetching Firefox langpacks.
by mikeperry＠torproject.org 28 Aug '14

28 Aug '14

commit 2da330af506d344e97b8d192a512c4c7df4a663e Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Wed Aug 27 15:52:08 2014 -0700 Switch to build candidates directory for fetching Firefox langpacks. This will allow us to build earlier, and also make our build hashes reproducible in the event of a minor langpack hash change we decide to ignore. --- gitian/fetch-inputs.sh | 6 +++--- gitian/versions | 1 + gitian/versions.alpha | 1 + gitian/versions.beta | 1 + gitian/versions.nightly | 1 + 5 files changed, 7 insertions(+), 3 deletions(-) diff --git a/gitian/fetch-inputs.sh b/gitian/fetch-inputs.sh index 086085c..ad82ddf 100755 --- a/gitian/fetch-inputs.sh +++ b/gitian/fetch-inputs.sh @@ -227,13 +227,13 @@ cd langpacks-$FIREFOX_LANG_VER for i in $BUNDLE_LOCALES do cd linux-langpacks - wget -U "" -N "https://ftp.mozilla.org/pub/mozilla.org/firefox/releases/$FIREFOX_LANG_VER/…" + wget -U "" -N "https://ftp.mozilla.org/pub/mozilla.org/firefox/candidates/${FIREFOX_LANG_V…" cd .. cd win32-langpacks - wget -U "" -N "https://ftp.mozilla.org/pub/mozilla.org/firefox/releases/$FIREFOX_LANG_VER/…" + wget -U "" -N "https://ftp.mozilla.org/pub/mozilla.org/firefox/candidates/${FIREFOX_LANG_V…" cd .. cd mac-langpacks - wget -U "" -N "https://ftp.mozilla.org/pub/mozilla.org/firefox/releases/$FIREFOX_LANG_VER/…" + wget -U "" -N "https://ftp.mozilla.org/pub/mozilla.org/firefox/candidates/${FIREFOX_LANG_V…" cd .. done diff --git a/gitian/versions b/gitian/versions index 20c7e73..9be200c 100755 --- a/gitian/versions +++ b/gitian/versions @@ -30,6 +30,7 @@ GITIAN_TAG=tor-browser-builder-3.x-6 OPENSSL_VER=1.0.1g GMP_VER=5.1.3 FIREFOX_LANG_VER=$FIREFOX_VERSION +FIREFOX_LANG_BUILD=build1 BINUTILS_VER=2.24 GCC_VER=4.8.3 PYTHON_VER=2.7.5 diff --git a/gitian/versions.alpha b/gitian/versions.alpha index 52d0b9b..ec52a45 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -30,6 +30,7 @@ GITIAN_TAG=tor-browser-builder-3.x-6 OPENSSL_VER=1.0.1i GMP_VER=5.1.3 FIREFOX_LANG_VER=$FIREFOX_VERSION +FIREFOX_LANG_BUILD=build1 BINUTILS_VER=2.24 GCC_VER=4.8.3 PYTHON_VER=2.7.5 diff --git a/gitian/versions.beta b/gitian/versions.beta index dbb50d8..c35ad6c 100755 --- a/gitian/versions.beta +++ b/gitian/versions.beta @@ -30,6 +30,7 @@ GITIAN_TAG=tor-browser-builder-3.x-6 OPENSSL_VER=1.0.1g GMP_VER=5.1.3 FIREFOX_LANG_VER=$FIREFOX_VERSION +FIREFOX_LANG_BUILD=build1 BINUTILS_VER=2.22 GCC_VER=4.6.3 PYTHON_VER=2.7.5 diff --git a/gitian/versions.nightly b/gitian/versions.nightly index f2ef57c..0cf5d0b 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -30,6 +30,7 @@ GITIAN_TAG=tor-browser-builder-3.x-6 OPENSSL_VER=1.0.1i GMP_VER=5.1.3 FIREFOX_LANG_VER=$FIREFOX_VERSION +FIREFOX_LANG_BUILD=build1 BINUTILS_VER=2.24 GCC_VER=4.8.3 PYTHON_VER=2.7.5

1 0

[tor-browser/tor-browser-24.7.0esr-4.x-2] Bug #12974: Disable NTLM and Negotiate HTTP Auth
by mikeperry＠torproject.org 28 Aug '14

28 Aug '14

commit 4825026471678728d5aa085717e301fc6551fe2b Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Wed Aug 27 15:19:10 2014 -0700 Bug #12974: Disable NTLM and Negotiate HTTP Auth This is technically an embargoed Mozilla bug, so I probably shouldn't provide too many details. Suffice to say that NTLM and Negotiate auth are bad for Tor users, and I doubt very many (or any of them) actually need it. The Mozilla bug is https://bugzilla.mozilla.org/show_bug.cgi?id=1046421 --- extensions/auth/nsHttpNegotiateAuth.cpp | 4 ++++ netwerk/protocol/http/nsHttpNTLMAuth.cpp | 3 +++ 2 files changed, 7 insertions(+) diff --git a/extensions/auth/nsHttpNegotiateAuth.cpp b/extensions/auth/nsHttpNegotiateAuth.cpp index 5248730..3e5580d 100644 --- a/extensions/auth/nsHttpNegotiateAuth.cpp +++ b/extensions/auth/nsHttpNegotiateAuth.cpp @@ -85,6 +85,10 @@ nsHttpNegotiateAuth::ChallengeReceived(nsIHttpAuthenticableChannel *authChannel, nsIAuthModule *module = (nsIAuthModule *) *continuationState; *identityInvalid = false; + + /* Always fail Negotiate auth for Tor Browser. We don't need it. */ + return NS_ERROR_ABORT; + if (module) return NS_OK; diff --git a/netwerk/protocol/http/nsHttpNTLMAuth.cpp b/netwerk/protocol/http/nsHttpNTLMAuth.cpp index d25c1de..6882803 100644 --- a/netwerk/protocol/http/nsHttpNTLMAuth.cpp +++ b/netwerk/protocol/http/nsHttpNTLMAuth.cpp @@ -239,6 +239,9 @@ nsHttpNTLMAuth::ChallengeReceived(nsIHttpAuthenticableChannel *channel, *identityInvalid = false; + /* Always fail Negotiate auth for Tor Browser. We don't need it. */ + return NS_ERROR_ABORT; + // Start a new auth sequence if the challenge is exactly "NTLM". // If native NTLM auth apis are available and enabled through prefs, // try to use them.

1 0

[tor-browser/tor-browser-24.7.0esr-3.x-1] Bug #12974: Disable NTLM and Negotiate HTTP Auth
by mikeperry＠torproject.org 28 Aug '14

28 Aug '14

commit 9f4106c53e432599c084d38b7509692ccf42c5e3 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Wed Aug 27 15:19:10 2014 -0700 Bug #12974: Disable NTLM and Negotiate HTTP Auth This is technically an embargoed Mozilla bug, so I probably shouldn't provide too many details. Suffice to say that NTLM and Negotiate auth are bad for Tor users, and I doubt very many (or any of them) actually need it. The Mozilla bug is https://bugzilla.mozilla.org/show_bug.cgi?id=1046421 --- extensions/auth/nsHttpNegotiateAuth.cpp | 4 ++++ netwerk/protocol/http/nsHttpNTLMAuth.cpp | 3 +++ 2 files changed, 7 insertions(+) diff --git a/extensions/auth/nsHttpNegotiateAuth.cpp b/extensions/auth/nsHttpNegotiateAuth.cpp index 5248730..3e5580d 100644 --- a/extensions/auth/nsHttpNegotiateAuth.cpp +++ b/extensions/auth/nsHttpNegotiateAuth.cpp @@ -85,6 +85,10 @@ nsHttpNegotiateAuth::ChallengeReceived(nsIHttpAuthenticableChannel *authChannel, nsIAuthModule *module = (nsIAuthModule *) *continuationState; *identityInvalid = false; + + /* Always fail Negotiate auth for Tor Browser. We don't need it. */ + return NS_ERROR_ABORT; + if (module) return NS_OK; diff --git a/netwerk/protocol/http/nsHttpNTLMAuth.cpp b/netwerk/protocol/http/nsHttpNTLMAuth.cpp index d25c1de..6882803 100644 --- a/netwerk/protocol/http/nsHttpNTLMAuth.cpp +++ b/netwerk/protocol/http/nsHttpNTLMAuth.cpp @@ -239,6 +239,9 @@ nsHttpNTLMAuth::ChallengeReceived(nsIHttpAuthenticableChannel *channel, *identityInvalid = false; + /* Always fail Negotiate auth for Tor Browser. We don't need it. */ + return NS_ERROR_ABORT; + // Start a new auth sequence if the challenge is exactly "NTLM". // If native NTLM auth apis are available and enabled through prefs, // try to use them.

1 0

[tor-launcher/master] Bug 12444 fixup: use "Tor" instead of "tor" in feedback message.
by brade＠torproject.org 26 Aug '14

26 Aug '14

commit 4510c8e6057c17424313afe3077a5f7be4bc1085 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Tue Aug 26 10:40:11 2014 -0400 Bug 12444 fixup: use "Tor" instead of "tor" in feedback message. --- src/chrome/locale/en/torlauncher.properties | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/chrome/locale/en/torlauncher.properties b/src/chrome/locale/en/torlauncher.properties index 20f6db2..02be756 100644 --- a/src/chrome/locale/en/torlauncher.properties +++ b/src/chrome/locale/en/torlauncher.properties @@ -37,7 +37,7 @@ torlauncher.done=Done torlauncher.forAssistance=For assistance, contact %S -torlauncher.copiedNLogMessages=Copy complete. %S tor log messages are ready to be pasted into a text editor or an email message. +torlauncher.copiedNLogMessages=Copy complete. %S Tor log messages are ready to be pasted into a text editor or an email message. torlauncher.bootstrapStatus.conn_dir=Connecting to a relay directory torlauncher.bootstrapStatus.handshake_dir=Establishing an encrypted directory connection

1 0

[tor-launcher/master] Bug 11405: Remove firewall prompt from wizard.
by brade＠torproject.org 26 Aug '14

26 Aug '14

commit 11467241203a65e71de97d91a24b15ffa5b976da Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Tue Aug 26 10:25:11 2014 -0400 Bug 11405: Remove firewall prompt from wizard. If the user sets a proxy but doesn't set a bridge, set ReachableAddresses to include only ports 80 and 443. --- src/chrome/content/network-settings-wizard.xul | 36 +-------- src/chrome/content/network-settings.js | 101 ++++++++++++++++-------- src/chrome/locale/en/network-settings.dtd | 7 +- 3 files changed, 72 insertions(+), 72 deletions(-) diff --git a/src/chrome/content/network-settings-wizard.xul b/src/chrome/content/network-settings-wizard.xul index 6682fdd..04251f9 100644 --- a/src/chrome/content/network-settings-wizard.xul +++ b/src/chrome/content/network-settings-wizard.xul @@ -54,7 +54,7 @@ </vbox> </wizardpage> - <wizardpage label=" " pageid="proxy" next="firewall" onextra2="onCopyLog();" + <wizardpage label=" " pageid="proxy" next="bridges" onextra2="onCopyLog();" onpageshow="showWizardNavButtons(true);" onpageadvanced="return onWizardProxyNext(this);"> <vbox class="tbb-logo-box" align="start"> @@ -74,7 +74,7 @@ </hbox> </wizardpage> - <wizardpage pageid="proxyYES" next="firewall" onextra2="onCopyLog();" + <wizardpage pageid="proxyYES" next="bridges" onextra2="onCopyLog();" onpageadvanced="return (getAndValidateProxySettings() != null)"> <vbox class="tbb-logo-box" align="start"> <image class="tbb-logo" /> @@ -84,38 +84,6 @@ <groupbox id="proxySpecificSettings" /> </wizardpage> - <wizardpage pageid="firewall" next="bridges" onextra2="onCopyLog();" - onpageshow="showOrHideButton('next', true, true)" - onpageadvanced="return onWizardFirewallNext(this);"> - <vbox class="tbb-logo-box" align="start"> - <image class="tbb-logo" /> - </vbox> - <separator /> - <hbox> - <vbox flex="1"> - <label class="question">&torSettings.firewallQuestion;</label> - <radiogroup id="firewallRadioGroup"> - <radio id="firewallRadioYes" label="&torSettings.yes;" /> - <radio id="firewallRadioNo" label="&torSettings.no;" selected="true" /> - </radiogroup> - <description class="questionHelp">&torSettings.firewallHelp; - </description> - </vbox> - </hbox> - </wizardpage> - - <wizardpage pageid="firewallYES" next="bridges" onextra2="onCopyLog();" - onpageadvanced="return (getAndValidateFirewallSettings() != null)"> - <vbox class="tbb-logo-box" align="start"> - <image class="tbb-logo" /> - </vbox> - <separator /> - <vbox> - <label class="instructions">&torSettings.enterFirewall;</label> - <groupbox id="firewallSpecificSettings" /> - </vbox> - </wizardpage> - <wizardpage pageid="bridges" onextra2="onCopyLog();" onpageshow="onWizardUseBridgesRadioChange(this)"> <vbox class="tbb-logo-box" align="start"> diff --git a/src/chrome/content/network-settings.js b/src/chrome/content/network-settings.js index 518d16d..908e711 100644 --- a/src/chrome/content/network-settings.js +++ b/src/chrome/content/network-settings.js @@ -29,7 +29,6 @@ const kTorBootstrapErrorTopic = "TorBootstrapError"; const kTorLogHasWarnOrErrTopic = "TorLogHasWarnOrErr"; const kWizardProxyRadioGroup = "proxyRadioGroup"; -const kWizardFirewallRadioGroup = "firewallRadioGroup"; const kWizardUseBridgesRadioGroup = "useBridgesRadioGroup"; const kUseProxyCheckbox = "useProxy"; @@ -251,19 +250,7 @@ function onWizardProxyNext(aWizPage) if (aWizPage) { var hasProxy = getElemValue("proxyRadioYes", false); - aWizPage.next = (hasProxy) ? "proxyYES" : "firewall"; - } - - return true; -} - - -function onWizardFirewallNext(aWizPage) -{ - if (aWizPage) - { - var hasFirewall = getElemValue("firewallRadioYes", false); - aWizPage.next = (hasFirewall) ? "firewallYES" : "bridges"; + aWizPage.next = (hasProxy) ? "proxyYES" : "bridges"; } return true; @@ -877,6 +864,9 @@ function initProxySettings() // Returns true if successful. function initFirewallSettings() { + if (getWizard()) + return true; // The wizard does not directly expose firewall settings. + var allowedPorts; var reply = gProtocolSvc.TorGetConfStr(kTorConfKeyReachableAddresses, null); if (!gProtocolSvc.TorCommandSucceeded(reply)) @@ -899,7 +889,6 @@ function initFirewallSettings() } var haveFirewall = (allowedPorts != undefined); - setYesNoRadioValue(kWizardFirewallRadioGroup, haveFirewall); setElemValue(kUseFirewallPortsCheckbox, haveFirewall); if (allowedPorts) setElemValue(kFirewallAllowedPorts, allowedPorts); @@ -991,7 +980,7 @@ function useSettings() { var settings = {}; settings[kTorConfKeyDisableNetwork] = false; - this.setConfAndReportErrors(settings, null); + setConfAndReportErrors(settings, null); gProtocolSvc.TorSendCommand("SAVECONF"); gTorProcessService.TorClearBootstrapError(); @@ -1026,7 +1015,7 @@ function applyProxySettings() if (!settings) return false; - return this.setConfAndReportErrors(settings, "proxyYES"); + return setConfAndReportErrors(settings, "proxyYES"); } @@ -1044,9 +1033,7 @@ function getAndValidateProxySettings() settings[kTorConfKeyHTTPSProxyAuthenticator] = null; var proxyType, proxyAddrPort, proxyUsername, proxyPassword; - var useProxy = (getWizard()) ? getYesNoRadioValue(kWizardProxyRadioGroup) - : getElemValue(kUseProxyCheckbox, false); - if (useProxy) + if (isProxyConfigured()) { proxyAddrPort = createColonStr(getElemValue(kProxyAddr, null), getElemValue(kProxyPort, null)); @@ -1089,7 +1076,14 @@ function getAndValidateProxySettings() } return settings; -} // applyProxySettings +} // getAndValidateProxySettings + + +function isProxyConfigured() +{ + return (getWizard()) ? getYesNoRadioValue(kWizardProxyRadioGroup) + : getElemValue(kUseProxyCheckbox, false); +} function reportValidationError(aStrKey) @@ -1101,15 +1095,17 @@ function reportValidationError(aStrKey) // Returns true if settings were successfully applied. function applyFirewallSettings() { - var settings = getAndValidateFirewallSettings(); + var settings = (getWizard()) ? getAutoFirewallSettings() + : getAndValidateFirewallSettings(); if (!settings) return false; - return this.setConfAndReportErrors(settings, "firewallYES"); + return setConfAndReportErrors(settings, null); } // Return a settings object if successful and null if not. +// Not used for the wizard. function getAndValidateFirewallSettings() { // TODO: validate user-entered data. See Vidalia's NetworkPage::save() @@ -1117,14 +1113,47 @@ function getAndValidateFirewallSettings() var settings = {}; settings[kTorConfKeyReachableAddresses] = null; - var useFirewallPorts = (getWizard()) - ? getYesNoRadioValue(kWizardFirewallRadioGroup) - : getElemValue(kUseFirewallPortsCheckbox, false); - var allowedPorts = getElemValue(kFirewallAllowedPorts, null); - if (useFirewallPorts && allowedPorts) + var allowedPorts = null; + if (getElemValue(kUseFirewallPortsCheckbox, false)) + allowedPorts = getElemValue(kFirewallAllowedPorts, null); + + return constructFirewallSettings(allowedPorts); +} + + +// Return a settings object if successful and null if not. +// Only used for the wizard. +function getAutoFirewallSettings() +{ + // In the wizard, we automatically set firewall ports (ReachableAddresses) to + // 80 and 443 if and only if the user has configured a proxy but no bridges. + // Rationale (from ticket #11405): + // - Many proxies restrict which ports they will proxy for, so we want to + // use a small set of ports in that case. + // + // - In most other situations, tor will quickly find a bridge or guard on + // port 443, so there is no need to limit which port may be used. + // + // - People whose set of reachable ports are really esoteric will need to + // be very patient or they will need to edit torrc manually... but that + // is OK since we expect that situation to be very rare. + var allowedPorts = null; + if (isProxyConfigured() && !isBridgeConfigured()) + allowedPorts = "80,443"; + + return constructFirewallSettings(allowedPorts); +} + + +function constructFirewallSettings(aAllowedPorts) +{ + var settings = {}; + settings[kTorConfKeyReachableAddresses] = null; + + if (aAllowedPorts) { var portsConfStr; - var portsArray = allowedPorts.split(','); + var portsArray = aAllowedPorts.split(','); for (var i = 0; i < portsArray.length; ++i) { var s = portsArray[i].trim(); @@ -1188,7 +1217,7 @@ function applyBridgeSettings() if (!settings) return false; - return this.setConfAndReportErrors(settings, "bridgeSettings"); + return setConfAndReportErrors(settings, "bridgeSettings"); } @@ -1199,9 +1228,7 @@ function getAndValidateBridgeSettings() settings[kTorConfKeyUseBridges] = null; settings[kTorConfKeyBridgeList] = null; - var useBridges = (getWizard()) ? getElemValue("bridgesRadioYes", false) - : getElemValue(kUseBridgesCheckbox, false); - + var useBridges = isBridgeConfigured(); var defaultBridgeType; var bridgeList; if (useBridges) @@ -1246,6 +1273,13 @@ function getAndValidateBridgeSettings() } +function isBridgeConfigured() +{ + return (getWizard()) ? getElemValue("bridgesRadioYes", false) + : getElemValue(kUseBridgesCheckbox, false); +} + + // Returns an array or null. function parseAndValidateBridges(aStr) { @@ -1271,6 +1305,7 @@ function parseAndValidateBridges(aStr) // Returns true if successful. +// aShowOnErrorPanelID is only used when displaying the wizard. function setConfAndReportErrors(aSettingsObj, aShowOnErrorPanelID) { var errObj = {}; diff --git a/src/chrome/locale/en/network-settings.dtd b/src/chrome/locale/en/network-settings.dtd index aa54f3e..3661088 100644 --- a/src/chrome/locale/en/network-settings.dtd +++ b/src/chrome/locale/en/network-settings.dtd @@ -8,8 +8,8 @@ <!ENTITY torSettings.no "No"> <!ENTITY torSettings.firstQuestion "Which of the following best describes your situation?"> -<!ENTITY torSettings.configurePrompt1 "This computer's Internet connection is censored, filtered, or proxied."> -<!ENTITY torSettings.configurePrompt2 "I need to configure bridge, firewall, or proxy settings."> +<!ENTITY torSettings.configurePrompt1 "This computer's Internet connection is censored or proxied."> +<!ENTITY torSettings.configurePrompt2 "I need to configure bridge or proxy settings."> <!ENTITY torSettings.configure "Configure"> <!ENTITY torSettings.connectPrompt2 "I would like to connect directly to the Tor network."> <!ENTITY torSettings.connectPrompt3 "This will work in most situations."> @@ -19,9 +19,6 @@  <!ENTITY torSettings.proxyHelp "If you are not sure how to answer this question, look at the Internet settings in another browser to see whether it is configured to use a proxy."> <!ENTITY torSettings.enterProxy "Enter the proxy settings."> -<!ENTITY torSettings.firewallQuestion "Does this computer's Internet connection go through a firewall that only allows connections to certain ports?"> -<!ENTITY torSettings.firewallHelp "If you are not sure how to answer this question, choose No. If you encounter problems connecting to the Tor network, change this setting."> -<!ENTITY torSettings.enterFirewall "Enter a comma-separated list of ports that are allowed by the firewall."> <!ENTITY torSettings.bridgeQuestion "Does your Internet Service Provider (ISP) block or otherwise censor connections to the Tor Network?"> <!ENTITY torSettings.bridgeHelp "If you are not sure how to answer this question, choose No.  If you choose Yes, you will be asked to configure Tor Bridges, which are unlisted relays that make it more difficult to block connections to the Tor Network."> <!ENTITY torSettings.bridgeSettingsPrompt "You may use the provided set of bridges or you may obtain and enter a custom set of bridges.">

1 0

[tor-browser-bundle/master] Bug 12920: Don't apply patch for #11200 to master.
by gk＠torproject.org 25 Aug '14

25 Aug '14

commit 8a552ff03c226c3d1f5fa3ae0b4950cc03c0f678 Author: Georg Koppen <gk(a)torproject.org> Date: Mon Aug 25 15:28:14 2014 +0000 Bug 12920: Don't apply patch for #11200 to master. On the tor master branch #11200 is already fixed. Applying the patch again breaks the nightly builds. --- gitian/descriptors/linux/gitian-tor.yml | 5 ++++- gitian/descriptors/mac/gitian-tor.yml | 5 ++++- gitian/descriptors/windows/gitian-tor.yml | 5 ++++- 3 files changed, 12 insertions(+), 3 deletions(-) diff --git a/gitian/descriptors/linux/gitian-tor.yml b/gitian/descriptors/linux/gitian-tor.yml index c741cf2..277a8e4 100644 --- a/gitian/descriptors/linux/gitian-tor.yml +++ b/gitian/descriptors/linux/gitian-tor.yml @@ -81,9 +81,12 @@ script: | git am ~/build/bug9665.patch git am ~/build/bug11200.patch git am ~/build/bug8402.patch - else + elif [ ${TOR_TAG::9} == "tor-0.2.5" ]; + then git am ~/build/bug8402-master.patch git am ~/build/bug11200-hang-0.2.5.patch + else + git am ~/build/bug8402-master.patch fi fi mkdir -p $OUTDIR/src diff --git a/gitian/descriptors/mac/gitian-tor.yml b/gitian/descriptors/mac/gitian-tor.yml index e708ef8..7a75287 100644 --- a/gitian/descriptors/mac/gitian-tor.yml +++ b/gitian/descriptors/mac/gitian-tor.yml @@ -78,9 +78,12 @@ script: | git am ~/build/bug9665.patch git am ~/build/bug11200.patch git am ~/build/bug8402.patch - else + elif [ ${TOR_TAG::9} == "tor-0.2.5" ]; + then git am ~/build/bug8402-master.patch git am ~/build/bug11200-hang-0.2.5.patch + else + git am ~/build/bug8402-master.patch fi fi mkdir -p $OUTDIR/src diff --git a/gitian/descriptors/windows/gitian-tor.yml b/gitian/descriptors/windows/gitian-tor.yml index f1b9d7d..bc70839 100644 --- a/gitian/descriptors/windows/gitian-tor.yml +++ b/gitian/descriptors/windows/gitian-tor.yml @@ -78,9 +78,12 @@ script: | git am ~/build/bug9665.patch git am ~/build/bug11200.patch git am ~/build/bug8402.patch - else + elif [ ${TOR_TAG::9} == "tor-0.2.5" ]; + then git am ~/build/bug8402-master.patch git am ~/build/bug11200-hang-0.2.5.patch + else + git am ~/build/bug8402-master.patch fi fi mkdir -p $OUTDIR/src

1 0

[tor-browser-bundle/master] Bumping OpenSSL without its hash does not fly.
by gk＠torproject.org 22 Aug '14

22 Aug '14

commit b7d6214618b62f59bc943b6c62e4b65d84e31342 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Aug 22 20:34:09 2014 +0000 Bumping OpenSSL without its hash does not fly. --- gitian/versions.nightly | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gitian/versions.nightly b/gitian/versions.nightly index c65cf22..f2ef57c 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -72,7 +72,7 @@ PARSLEY_PACKAGE=Parsley-${PARSLEY_VER}.tar.gz GO_PACKAGE=go${GO_VER}.src.tar.gz # Hashes for packages with weak sigs or no sigs -OPENSSL_HASH=9d1c8a9836aa63e2c6adb684186cbd4371c9e9dcc01d6e3bb447abf2d4d3d093 +OPENSSL_HASH=3c179f46ca77069a6a0bac70212a9b3b838b2f66129cb52d568837fc79d8fcc7 GMP_HASH=752079520b4690531171d0f4532e40f08600215feefede70b24fabdc6f1ab160 OSXSDK_HASH=6602d8d5ddb371fbc02e2a5967d9bd0cd7358d46f9417753c8234b923f2ea6fc TOOLCHAIN4_HASH=7b71bfe02820409b994c5c33a7eab81a81c72550f5da85ff7af70da3da244645

1 0

[tor-launcher/master] Bug 12895: add @riseup.net to Bridge Relay Help
by brade＠torproject.org 22 Aug '14

22 Aug '14

commit c1a09372770adb8a3f7085f69eca2fecae7c1107 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Fri Aug 22 10:33:02 2014 -0400 Bug 12895: add @riseup.net to Bridge Relay Help --- src/chrome/content/network-settings-overlay.xul | 3 ++- src/chrome/locale/en/network-settings.dtd | 3 ++- src/chrome/skin/network-settings.css | 8 ++++---- 3 files changed, 8 insertions(+), 6 deletions(-) diff --git a/src/chrome/content/network-settings-overlay.xul b/src/chrome/content/network-settings-overlay.xul index c9a6a82..03171ec 100644 --- a/src/chrome/content/network-settings-overlay.xul +++ b/src/chrome/content/network-settings-overlay.xul @@ -116,7 +116,8 @@ </html:li> <html:li> <html:div class="heading">&torsettings.bridgeHelp3Heading;</html:div> - <html:div>&torsettings.bridgeHelp3;</html:div> + <html:div>&torsettings.bridgeHelp3.emailDesc;</html:div> + <html:div>&torsettings.bridgeHelp3.emailList;</html:div> </html:li> <html:li> <html:div class="heading">&torsettings.bridgeHelp4Heading;</html:div> diff --git a/src/chrome/locale/en/network-settings.dtd b/src/chrome/locale/en/network-settings.dtd index f46473e..aa54f3e 100644 --- a/src/chrome/locale/en/network-settings.dtd +++ b/src/chrome/locale/en/network-settings.dtd @@ -59,6 +59,7 @@ <!ENTITY torsettings.bridgeHelp2Heading "Through the Web"> <!ENTITY torsettings.bridgeHelp2 "Use a web browser to visit https://bridges.torproject.org"> <!ENTITY torsettings.bridgeHelp3Heading "Through the Email Autoresponder"> -<!ENTITY torsettings.bridgeHelp3 "Send email to bridges(a)torproject.org with the line 'get bridges' by itself in the body of the message.  However, to make it harder for an attacker to learn a lot of bridge addresses, you must send this request from a gmail.com or yahoo.com email address."> +<!ENTITY torsettings.bridgeHelp3.emailDesc "Send email to bridges(a)torproject.org with the line 'get bridges' by itself in the body of the message.  However, to make it harder for an attacker to learn a lot of bridge addresses, you must send this request from one of the following email providers (listed in order of preference):"> +<!ENTITY torsettings.bridgeHelp3.emailList "https://www.riseup.net, https://mail.google.com, or https://mail.yahoo.com"> <!ENTITY torsettings.bridgeHelp4Heading "Through the Help Desk"> <!ENTITY torsettings.bridgeHelp4 "As a last resort, you can request bridge addresses by sending a polite email message to help(a)rt.torproject.org.  Please note that a person will need to respond to each request."> diff --git a/src/chrome/skin/network-settings.css b/src/chrome/skin/network-settings.css index 60f1ef2..e4142d4 100644 --- a/src/chrome/skin/network-settings.css +++ b/src/chrome/skin/network-settings.css @@ -17,15 +17,15 @@ dialog.os-windows { } wizard { - width: 43em; - height: 34em; + width: 45em; + height: 35em; font: -moz-dialog; padding-top: 0px; } wizard.os-windows { - width: 45em; - height: 39em; + width: 46em; + height: 41em; } .wizard-page-box {

1 0

[tor-browser-bundle/master] Set security.tls.version.max=1 in meek-http-helper.
by gk＠torproject.org 21 Aug '14

21 Aug '14

commit 3c581f8426f4fd477eb26d2893dbdec42d76e23d Author: David Fifield <david(a)bamsoftware.com> Date: Fri Aug 15 18:02:53 2014 -0700 Set security.tls.version.max=1 in meek-http-helper. #11253 set security.tls.version.max=3 (i.e., TLSv1.2). We need to set it back to 1 (TLSv1.0) in the helper, or else we look unlike an ordinary installation of Firefox 24. https://trac.torproject.org/projects/tor/ticket/12766 --- Bundle-Data/PTConfigs/meek-http-helper-user.js | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/Bundle-Data/PTConfigs/meek-http-helper-user.js b/Bundle-Data/PTConfigs/meek-http-helper-user.js index cddc237..26fd819 100644 --- a/Bundle-Data/PTConfigs/meek-http-helper-user.js +++ b/Bundle-Data/PTConfigs/meek-http-helper-user.js @@ -4,6 +4,14 @@ // to stdout. user_pref("browser.dom.window.dump.enabled", true); +// Make TLSv1.0 the maximum TLS version, as in stock Firefox 24. Since #11253, +// Tor Browser overrides the maximum to TLSv1.2, which would cause us to look +// unlike ordinary Firefox 24. +// https://trac.torproject.org/projects/tor/ticket/11253 +// https://trac.torproject.org/projects/tor/ticket/12766 +// http://kb.mozillazine.org/Security.tls.version.* +user_pref("security.tls.version.max", 1); + // Enable TLS session tickets (disabled by default in Tor Browser). Otherwise // there is a missing TLS extension. // https://trac.torproject.org/projects/tor/ticket/11183#comment:9

1 0

[tor-launcher/master] Bug 12444: Feedback when “Copy Tor Log” is clicked.
by brade＠torproject.org 20 Aug '14

20 Aug '14

commit 561440e8d64ca9b60f09d2b6869c4d07c5d06834 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Wed Aug 20 08:21:45 2014 -0400 Bug 12444: Feedback when “Copy Tor Log” is clicked. Show a transient popup near the "Copy Tor Log To Clipboard" button after is is clicked. The popup panel fades away after 4 seconds and can also be dismissed by clicking anywhere. --- src/chrome/content/network-settings-overlay.xul | 4 ++++ src/chrome/content/network-settings-wizard.xul | 1 + src/chrome/content/network-settings.js | 23 ++++++++++++++++++++++- src/chrome/content/network-settings.xul | 1 + src/chrome/locale/en/torlauncher.properties | 2 ++ src/chrome/skin/network-settings.css | 5 +++++ src/components/tl-protocol.js | 8 ++++++-- 7 files changed, 41 insertions(+), 3 deletions(-) diff --git a/src/chrome/content/network-settings-overlay.xul b/src/chrome/content/network-settings-overlay.xul index 6422802..c9a6a82 100644 --- a/src/chrome/content/network-settings-overlay.xul +++ b/src/chrome/content/network-settings-overlay.xul @@ -124,5 +124,9 @@ </html:li> </html:ol> </vbox> + <panel id="copyLogFeedbackPanel" type="arrow" fade="slow" + onclick="closeCopyLogFeedbackPanel()"> + <description flex="1" /> + </panel> </overlay> diff --git a/src/chrome/content/network-settings-wizard.xul b/src/chrome/content/network-settings-wizard.xul index 70d1bcf..6682fdd 100644 --- a/src/chrome/content/network-settings-wizard.xul +++ b/src/chrome/content/network-settings-wizard.xul @@ -189,4 +189,5 @@ <hbox pack="start"> <label id="forAssistance" /> </hbox> + <panel id="copyLogFeedbackPanel" /> </wizard> diff --git a/src/chrome/content/network-settings.js b/src/chrome/content/network-settings.js index 5f3f698..518d16d 100644 --- a/src/chrome/content/network-settings.js +++ b/src/chrome/content/network-settings.js @@ -713,9 +713,30 @@ function onCancel() function onCopyLog() { + // Copy tor log messages to the system clipboard. var chSvc = Cc["@mozilla.org/widget/clipboardhelper;1"] .getService(Ci.nsIClipboardHelper); - chSvc.copyString(gProtocolSvc.TorGetLog()); + let countObj = { value: 0 }; + chSvc.copyString(gProtocolSvc.TorGetLog(countObj)); + + // Display a feedback popup that fades away after a few seconds. + let forAssistance = document.getElementById("forAssistance"); + let panel = document.getElementById("copyLogFeedbackPanel"); + if (forAssistance && panel) + { + panel.firstChild.textContent = TorLauncherUtil.getFormattedLocalizedString( + "copiedNLogMessages", [countObj.value], 1); + let rectObj = forAssistance.getBoundingClientRect(); + panel.openPopup(null, null, rectObj.left, rectObj.top, false, false); + } +} + + +function closeCopyLogFeedbackPanel() +{ + let panel = document.getElementById("copyLogFeedbackPanel"); + if (panel && (panel.state =="open")) + panel.hidePopup(); } diff --git a/src/chrome/content/network-settings.xul b/src/chrome/content/network-settings.xul index a81a5f0..4f98559 100644 --- a/src/chrome/content/network-settings.xul +++ b/src/chrome/content/network-settings.xul @@ -85,4 +85,5 @@ </deck> <spring flex="1" /> <label id="forAssistance" /> + <panel id="copyLogFeedbackPanel" /> </dialog> diff --git a/src/chrome/locale/en/torlauncher.properties b/src/chrome/locale/en/torlauncher.properties index 816d831..20f6db2 100644 --- a/src/chrome/locale/en/torlauncher.properties +++ b/src/chrome/locale/en/torlauncher.properties @@ -37,6 +37,8 @@ torlauncher.done=Done torlauncher.forAssistance=For assistance, contact %S +torlauncher.copiedNLogMessages=Copy complete. %S tor log messages are ready to be pasted into a text editor or an email message. + torlauncher.bootstrapStatus.conn_dir=Connecting to a relay directory torlauncher.bootstrapStatus.handshake_dir=Establishing an encrypted directory connection torlauncher.bootstrapStatus.requesting_status=Retrieving network status diff --git a/src/chrome/skin/network-settings.css b/src/chrome/skin/network-settings.css index 03f84d7..60f1ef2 100644 --- a/src/chrome/skin/network-settings.css +++ b/src/chrome/skin/network-settings.css @@ -148,6 +148,11 @@ dialog .help { margin-bottom: 8px; } +#copyLogFeedbackPanel { + margin: -15px 0px 0px 0px; + max-width: 34em; +} + /* Increase font size on Windows for readability */ .os-windows div, .os-windows label, diff --git a/src/components/tl-protocol.js b/src/components/tl-protocol.js index 9c4d957..09ec468 100644 --- a/src/components/tl-protocol.js +++ b/src/components/tl-protocol.js @@ -458,7 +458,8 @@ TorProtocolService.prototype = }, // Returns captured log message as a text string (one message per line). - TorGetLog: function() + // If aCountObj is passed, aCountObj.value is set to the message count. + TorGetLog: function(aCountObj) { let s = ""; if (this.mTorLog) @@ -468,7 +469,10 @@ TorProtocolService.prototype = let dateFormat = dateFmtSvc.dateFormatShort; let timeFormat = dateFmtSvc.timeFormatSecondsForce24Hour; let eol = (TorLauncherUtil.isWindows) ? "\r\n" : "\n"; - for (let i = 0; i < this.mTorLog.length; ++i) + let count = this.mTorLog.length; + if (aCountObj) + aCountObj.value = count; + for (let i = 0; i < count; ++i) { let logObj = this.mTorLog[i]; let secs = logObj.date.getSeconds();

1 0

[tor-browser-bundle/master] We want to have nightlies with the new OpenSSL.
by gk＠torproject.org 20 Aug '14

20 Aug '14

commit 81d698cab574c6fa2788362222b695b79752bf94 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Aug 20 11:27:35 2014 +0000 We want to have nightlies with the new OpenSSL. --- gitian/versions.nightly | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gitian/versions.nightly b/gitian/versions.nightly index 0462eae..c65cf22 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -27,7 +27,7 @@ MEEK_TAG=master GITIAN_TAG=tor-browser-builder-3.x-6 -OPENSSL_VER=1.0.1h +OPENSSL_VER=1.0.1i GMP_VER=5.1.3 FIREFOX_LANG_VER=$FIREFOX_VERSION BINUTILS_VER=2.24

1 0

[tor-browser/tor-browser-24.7.0esr-3.x-1] fixup! Add canvas image extraction prompt.
by mikeperry＠torproject.org 20 Aug '14

20 Aug '14

commit 5c54c75b5ea3ab1373a530d05f8fc40211d9065e Author: Isis Lovecruft <isis(a)torproject.org> Date: Tue Jul 29 06:04:57 2014 +0000 fixup! Add canvas image extraction prompt. Bug #12684: Make "Not now" default for HTML5 canvas permission dialogue. This alters the `PopupNotification`s [0] which notify users that a website has attempted to access an HTML5 canvas. The new default ordering for buttons is: Not Now Never for this site (recommended) Allow in the future * FIXES #12684 [1] by making "Not Now" the default in the HTML5 canvas fingerprinting permissions dialogue. * ADDS palette icons for HTML5 canvas permissions PopupNotification UI. The image is freely licensed and obtainable from: https://openclipart.org/image/300px/svg_to_png/21620/ben_palette.png * ADDS a CSS whitespace hack from Pearl Crescent to the `CanvasPermissionPromptHelper_init()` function in `browser/base/content/browser.js` for causing the newlines in the `canvas.siteprompt` string (in torbutton.git, in `chrome/locale/en/torbutton.properties`) to render correctly in PopupNotification XUL <description> elements. [2] NOTE: Applying this patch requires an additional patch to TorButton, to store the additional UI strings before localisation. [3] [0]: https://mxr.mozilla.org/mozilla-esr24/source/toolkit/modules/PopupNotificat… [1]: https://bugs.torproject.org/12684 [2]: https://trac.torproject.org/projects/tor/ticket/12684#comment:21 [3]: https://github.com/isislovecruft/torbutton/commit/368e74d62df349b27cf578525… --- browser/base/content/browser.js | 19 ++++++++++++++++--- browser/themes/linux/browser.css | 10 ++++++++-- browser/themes/linux/canvas-popup.svg | 19 +++++++++++++++++++ browser/themes/linux/jar.mn | 1 + browser/themes/osx/browser.css | 10 ++++++++-- browser/themes/osx/canvas-popup.svg | 19 +++++++++++++++++++ browser/themes/osx/jar.mn | 1 + browser/themes/windows/browser.css | 10 ++++++++-- browser/themes/windows/canvas-popup.svg | 19 +++++++++++++++++++ browser/themes/windows/jar.mn | 1 + 10 files changed, 100 insertions(+), 9 deletions(-) diff --git a/browser/base/content/browser.js b/browser/base/content/browser.js index 1df295a..b4da3f6 100644 --- a/browser/base/content/browser.js +++ b/browser/base/content/browser.js @@ -6034,6 +6034,12 @@ var CanvasPermissionPromptHelper = { init: function CanvasPermissionPromptHelper_init() { + if (document.styleSheets && (document.styleSheets.length > 0)) try { + let ruleText = "panel[popupid=canvas-permissions-prompt] description { white-space: pre-wrap; }"; + let sheet = document.styleSheets[0]; + sheet.insertRule(ruleText, sheet.cssRules.length); + } catch (e) {}; + Services.obs.addObserver(this, this._permissionsPrompt, false); }, @@ -6077,10 +6083,10 @@ var CanvasPermissionPromptHelper = { var message = getLocalizedString("canvas.siteprompt", [ uri.asciiHost ]); var mainAction = { - label: getLocalizedString("canvas.allow"), - accessKey: getLocalizedString("canvas.allowAccessKey"), + label: getLocalizedString("canvas.notNow"), + accessKey: getLocalizedString("canvas.notNowAccessKey"), callback: function() { - setCanvasPermission(uri, Ci.nsIPermissionManager.ALLOW_ACTION); + return null; } }; @@ -6091,6 +6097,13 @@ var CanvasPermissionPromptHelper = { callback: function() { setCanvasPermission(uri, Ci.nsIPermissionManager.DENY_ACTION); } + }, + { + label: getLocalizedString("canvas.allow"), + accessKey: getLocalizedString("canvas.allowAccessKey"), + callback: function() { + setCanvasPermission(uri, Ci.nsIPermissionManager.ALLOW_ACTION); + } } ]; diff --git a/browser/themes/linux/browser.css b/browser/themes/linux/browser.css index 9395669..a47ea4e 100644 --- a/browser/themes/linux/browser.css +++ b/browser/themes/linux/browser.css @@ -1207,7 +1207,10 @@ toolbar[iconsize="small"] #webrtc-status-button { list-style-image: url("moz-icon://stock/gtk-cancel?size=menu"); } -.popup-notification-icon[popupid="canvas-permissions-prompt"], +.popup-notification-icon[popupid="canvas-permissions-prompt"] { + list-style-image: url(chrome://browser/skin/canvas-popup.svg); +} + .popup-notification-icon[popupid="indexedDB-permissions-prompt"], .popup-notification-icon[popupid="indexedDB-quota-prompt"], .popup-notification-icon[popupid*="offline-app-requested"], @@ -1291,7 +1294,10 @@ toolbar[iconsize="small"] #webrtc-status-button { list-style-image: url(chrome://mozapps/skin/extensions/extensionGeneric-16.png); } -#canvas-notification-icon, +#canvas-notification-icon { + list-style-image: url(chrome://browser/skin/canvas-popup.svg); +} + .indexedDB-notification-icon, #indexedDB-notification-icon { list-style-image: url(chrome://global/skin/icons/question-16.png); diff --git a/browser/themes/linux/canvas-popup.svg b/browser/themes/linux/canvas-popup.svg new file mode 100644 index 0000000..f99eac3 --- /dev/null +++ b/browser/themes/linux/canvas-popup.svg @@ -0,0 +1,19 @@ +<?xml version="1.0" encoding="UTF-8"?> +<svg width="200" height="200" xmlns="http://www.w3.org/2000/svg"> + + <metadata>image/svg+xmlOpen Clip Art Librarypalette2009-02-17T21:15:25http://openclipart.org/detail/21620/palett… artclipartcolorcoloriconiconimagemediapaintpaintpalettepalettepngpublic domainsvg</metadata> + <g> + <title>Layer 1</title> + <g id="layer1"> + <rect fill="#000000" stroke-width="2" stroke-miterlimit="4" stroke-dashoffset="0" ry="23.587006" rx="26.785715" y="0" x="0" height="200" width="200" id="rect6786"/> + <g transform="matrix(4.65116, 0, 0, 4.65116, -1717.85, -314.201)" id="g6820"> + <path fill="#ffffff" stroke-width="1.924773" stroke-miterlimit="4" stroke-dasharray="3.84954572, 3.84954572" stroke-dashoffset="3.657068" d="m388.618042,70.128563c-4.746887,0 -18.367279,0.849472 -18.34375,12.3125c0.001312,0.644249 1.226776,2.886879 2.25,3.125c7.5755,1.762962 7.986664,7.834511 7.53125,12.625c-0.03479,0.362747 0.589233,2.891006 1.125,3.53125c4.344635,5.191872 5.822723,7.468742 11.6875,7.46875c11.729614,0 18.3125,-5.93206 18.3125,-17.8125c0,-11.880463 -10.832916,-21.25 -22.5625,-21.25zm-11.875,8.1875c0.986481,0.058029 2.139893,0.464394 3.21875,1.1875c2.157715,1.44622 3.225708,3.668251 2.375,4.9375c-0.850739,1.269257 -3.311005,1.10247 -5.46875,-0.34375c-2.157745,-1.446228 -3.194458,-3.637001 -2.34375,-4.90625c0.425354,-0.634628 1.232269,-0.933029 2.21875,-0.875z" id="path6822"/> + <path fill="#ff7a00" stroke-width="1.924773" stroke-miterlimit="4" stroke-dasharray="3.84954572, 3.84954572" stroke-dashoffset="3.657068" id="path6824" d="m392.586761,76.615746a3.5,3.5 0 1 1 -7,0a3.5,3.5 0 1 1 7,0z"/> + <path fill="#95d300" stroke-width="1.924773" stroke-miterlimit="4" stroke-dasharray="3.84954572, 3.84954572" stroke-dashoffset="3.657068" id="path6826" d="m402.524292,81.553246a3.5,3.5 0 1 1 -7,0a3.5,3.5 0 1 1 7,0z"/> + <path fill="#00a6e4" stroke-width="1.924773" stroke-miterlimit="4" stroke-dasharray="3.84954572, 3.84954572" stroke-dashoffset="3.657068" id="path6828" d="m408.461792,90.615746a3.5,3.5 0 1 1 -7,0a3.5,3.5 0 1 1 7,0z"/> + <path fill="#f9de00" stroke-width="1.924773" stroke-miterlimit="4" stroke-dasharray="3.84954572, 3.84954572" stroke-dashoffset="3.657068" id="path6830" d="m403.643463,99.60791a3.5,3.5 0 1 1 -7,0a3.5,3.5 0 1 1 7,0z"/> + <path fill="#e600ad" stroke-width="1.924773" stroke-miterlimit="4" stroke-dasharray="3.84954572, 3.84954572" stroke-dashoffset="3.657068" id="path6832" d="m393.518463,100.60791a3.5,3.5 0 1 1 -7,0a3.5,3.5 0 1 1 7,0z"/> + </g> + </g> + </g> +</svg> \ No newline at end of file diff --git a/browser/themes/linux/jar.mn b/browser/themes/linux/jar.mn index b4eaf14..4d1892d 100644 --- a/browser/themes/linux/jar.mn +++ b/browser/themes/linux/jar.mn @@ -231,6 +231,7 @@ browser.jar: skin/classic/browser/syncQuota.css skin/classic/browser/syncProgress.css #endif + skin/classic/browser/canvas-popup.svg skin/classic/browser/webapps-16.png skin/classic/browser/webapps-64.png skin/classic/browser/notification-pluginNormal.png (../shared/plugins/notification-pluginNormal.png) diff --git a/browser/themes/osx/browser.css b/browser/themes/osx/browser.css index 4166ed0..085a1da 100644 --- a/browser/themes/osx/browser.css +++ b/browser/themes/osx/browser.css @@ -3103,7 +3103,10 @@ toolbarbutton.chevron > .toolbarbutton-menu-dropmarker { -moz-margin-start: 0; /* override default label margin to match description margin */ } -#canvas-notification-icon, +#canvas-notification-icon { + list-style-image: url(chrome://browser/skin/canvas-popup.svg); +} + .indexedDB-notification-icon, #indexedDB-notification-icon { list-style-image: url(chrome://global/skin/icons/question-16.png); @@ -3375,7 +3378,10 @@ toolbarbutton.chevron > .toolbarbutton-menu-dropmarker { -moz-image-region: rect(0px, 48px, 16px, 32px); } -.popup-notification-icon[popupid="canvas-permissions-prompt"], +.popup-notification-icon[popupid="canvas-permissions-prompt"] { + list-style-image: url(chrome://browser/skin/canvas-popup.svg); +} + .popup-notification-icon[popupid="indexedDB-permissions-prompt"], .popup-notification-icon[popupid="indexedDB-quota-prompt"], .popup-notification-icon[popupid*="offline-app-requested"], diff --git a/browser/themes/osx/canvas-popup.svg b/browser/themes/osx/canvas-popup.svg new file mode 100644 index 0000000..f99eac3 --- /dev/null +++ b/browser/themes/osx/canvas-popup.svg @@ -0,0 +1,19 @@ +<?xml version="1.0" encoding="UTF-8"?> +<svg width="200" height="200" xmlns="http://www.w3.org/2000/svg"> + + <metadata>image/svg+xmlOpen Clip Art Librarypalette2009-02-17T21:15:25http://openclipart.org/detail/21620/palett… artclipartcolorcoloriconiconimagemediapaintpaintpalettepalettepngpublic domainsvg</metadata> + <g> + <title>Layer 1</title> + <g id="layer1"> + <rect fill="#000000" stroke-width="2" stroke-miterlimit="4" stroke-dashoffset="0" ry="23.587006" rx="26.785715" y="0" x="0" height="200" width="200" id="rect6786"/> + <g transform="matrix(4.65116, 0, 0, 4.65116, -1717.85, -314.201)" id="g6820"> + <path fill="#ffffff" stroke-width="1.924773" stroke-miterlimit="4" stroke-dasharray="3.84954572, 3.84954572" stroke-dashoffset="3.657068" d="m388.618042,70.128563c-4.746887,0 -18.367279,0.849472 -18.34375,12.3125c0.001312,0.644249 1.226776,2.886879 2.25,3.125c7.5755,1.762962 7.986664,7.834511 7.53125,12.625c-0.03479,0.362747 0.589233,2.891006 1.125,3.53125c4.344635,5.191872 5.822723,7.468742 11.6875,7.46875c11.729614,0 18.3125,-5.93206 18.3125,-17.8125c0,-11.880463 -10.832916,-21.25 -22.5625,-21.25zm-11.875,8.1875c0.986481,0.058029 2.139893,0.464394 3.21875,1.1875c2.157715,1.44622 3.225708,3.668251 2.375,4.9375c-0.850739,1.269257 -3.311005,1.10247 -5.46875,-0.34375c-2.157745,-1.446228 -3.194458,-3.637001 -2.34375,-4.90625c0.425354,-0.634628 1.232269,-0.933029 2.21875,-0.875z" id="path6822"/> + <path fill="#ff7a00" stroke-width="1.924773" stroke-miterlimit="4" stroke-dasharray="3.84954572, 3.84954572" stroke-dashoffset="3.657068" id="path6824" d="m392.586761,76.615746a3.5,3.5 0 1 1 -7,0a3.5,3.5 0 1 1 7,0z"/> + <path fill="#95d300" stroke-width="1.924773" stroke-miterlimit="4" stroke-dasharray="3.84954572, 3.84954572" stroke-dashoffset="3.657068" id="path6826" d="m402.524292,81.553246a3.5,3.5 0 1 1 -7,0a3.5,3.5 0 1 1 7,0z"/> + <path fill="#00a6e4" stroke-width="1.924773" stroke-miterlimit="4" stroke-dasharray="3.84954572, 3.84954572" stroke-dashoffset="3.657068" id="path6828" d="m408.461792,90.615746a3.5,3.5 0 1 1 -7,0a3.5,3.5 0 1 1 7,0z"/> + <path fill="#f9de00" stroke-width="1.924773" stroke-miterlimit="4" stroke-dasharray="3.84954572, 3.84954572" stroke-dashoffset="3.657068" id="path6830" d="m403.643463,99.60791a3.5,3.5 0 1 1 -7,0a3.5,3.5 0 1 1 7,0z"/> + <path fill="#e600ad" stroke-width="1.924773" stroke-miterlimit="4" stroke-dasharray="3.84954572, 3.84954572" stroke-dashoffset="3.657068" id="path6832" d="m393.518463,100.60791a3.5,3.5 0 1 1 -7,0a3.5,3.5 0 1 1 7,0z"/> + </g> + </g> + </g> +</svg> \ No newline at end of file diff --git a/browser/themes/osx/jar.mn b/browser/themes/osx/jar.mn index 8295008..de119b1 100644 --- a/browser/themes/osx/jar.mn +++ b/browser/themes/osx/jar.mn @@ -329,6 +329,7 @@ browser.jar: skin/classic/browser/tabbrowser/alltabs-box-bkgnd-icon(a)2x.png (tabbrowser/alltabs-box-bkgnd-icon-lion(a)2x.png) skin/classic/browser/lion/tabview/tabview.png (tabview/tabview-lion.png) skin/classic/browser/lion/places/toolbar.png (places/toolbar-lion.png) + skin/classic/browser/canvas-popup.svg skin/classic/browser/webapps-16.png skin/classic/browser/webapps-16(a)2x.png skin/classic/browser/webapps-64.png diff --git a/browser/themes/windows/browser.css b/browser/themes/windows/browser.css index edb064c..7012c41 100644 --- a/browser/themes/windows/browser.css +++ b/browser/themes/windows/browser.css @@ -2449,7 +2449,10 @@ toolbarbutton.bookmark-item[dragover="true"][open="true"] { -moz-image-region: rect(32px, 32px, 48px, 16px); } -.popup-notification-icon[popupid="canvas-permissions-prompt"], +.popup-notification-icon[popupid="canvas-permissions-prompt"] { + list-style-image: url(chrome://browser/skin/canvas-popup.svg); +} + .popup-notification-icon[popupid="indexedDB-permissions-prompt"], .popup-notification-icon[popupid="indexedDB-quota-prompt"], .popup-notification-icon[popupid*="offline-app-requested"], @@ -2531,7 +2534,10 @@ toolbarbutton.bookmark-item[dragover="true"][open="true"] { list-style-image: url(chrome://mozapps/skin/extensions/extensionGeneric-16.png); } -#canvas-notification-icon, +#canvas-notification-icon { + list-style-image: url(chrome://browser/skin/canvas-popup.svg); +} + .indexedDB-notification-icon, #indexedDB-notification-icon { list-style-image: url(chrome://global/skin/icons/question-16.png); diff --git a/browser/themes/windows/canvas-popup.svg b/browser/themes/windows/canvas-popup.svg new file mode 100644 index 0000000..f99eac3 --- /dev/null +++ b/browser/themes/windows/canvas-popup.svg @@ -0,0 +1,19 @@ +<?xml version="1.0" encoding="UTF-8"?> +<svg width="200" height="200" xmlns="http://www.w3.org/2000/svg"> + + <metadata>image/svg+xmlOpen Clip Art Librarypalette2009-02-17T21:15:25http://openclipart.org/detail/21620/palett… artclipartcolorcoloriconiconimagemediapaintpaintpalettepalettepngpublic domainsvg</metadata> + <g> + <title>Layer 1</title> + <g id="layer1"> + <rect fill="#000000" stroke-width="2" stroke-miterlimit="4" stroke-dashoffset="0" ry="23.587006" rx="26.785715" y="0" x="0" height="200" width="200" id="rect6786"/> + <g transform="matrix(4.65116, 0, 0, 4.65116, -1717.85, -314.201)" id="g6820"> + <path fill="#ffffff" stroke-width="1.924773" stroke-miterlimit="4" stroke-dasharray="3.84954572, 3.84954572" stroke-dashoffset="3.657068" d="m388.618042,70.128563c-4.746887,0 -18.367279,0.849472 -18.34375,12.3125c0.001312,0.644249 1.226776,2.886879 2.25,3.125c7.5755,1.762962 7.986664,7.834511 7.53125,12.625c-0.03479,0.362747 0.589233,2.891006 1.125,3.53125c4.344635,5.191872 5.822723,7.468742 11.6875,7.46875c11.729614,0 18.3125,-5.93206 18.3125,-17.8125c0,-11.880463 -10.832916,-21.25 -22.5625,-21.25zm-11.875,8.1875c0.986481,0.058029 2.139893,0.464394 3.21875,1.1875c2.157715,1.44622 3.225708,3.668251 2.375,4.9375c-0.850739,1.269257 -3.311005,1.10247 -5.46875,-0.34375c-2.157745,-1.446228 -3.194458,-3.637001 -2.34375,-4.90625c0.425354,-0.634628 1.232269,-0.933029 2.21875,-0.875z" id="path6822"/> + <path fill="#ff7a00" stroke-width="1.924773" stroke-miterlimit="4" stroke-dasharray="3.84954572, 3.84954572" stroke-dashoffset="3.657068" id="path6824" d="m392.586761,76.615746a3.5,3.5 0 1 1 -7,0a3.5,3.5 0 1 1 7,0z"/> + <path fill="#95d300" stroke-width="1.924773" stroke-miterlimit="4" stroke-dasharray="3.84954572, 3.84954572" stroke-dashoffset="3.657068" id="path6826" d="m402.524292,81.553246a3.5,3.5 0 1 1 -7,0a3.5,3.5 0 1 1 7,0z"/> + <path fill="#00a6e4" stroke-width="1.924773" stroke-miterlimit="4" stroke-dasharray="3.84954572, 3.84954572" stroke-dashoffset="3.657068" id="path6828" d="m408.461792,90.615746a3.5,3.5 0 1 1 -7,0a3.5,3.5 0 1 1 7,0z"/> + <path fill="#f9de00" stroke-width="1.924773" stroke-miterlimit="4" stroke-dasharray="3.84954572, 3.84954572" stroke-dashoffset="3.657068" id="path6830" d="m403.643463,99.60791a3.5,3.5 0 1 1 -7,0a3.5,3.5 0 1 1 7,0z"/> + <path fill="#e600ad" stroke-width="1.924773" stroke-miterlimit="4" stroke-dasharray="3.84954572, 3.84954572" stroke-dashoffset="3.657068" id="path6832" d="m393.518463,100.60791a3.5,3.5 0 1 1 -7,0a3.5,3.5 0 1 1 7,0z"/> + </g> + </g> + </g> +</svg> \ No newline at end of file diff --git a/browser/themes/windows/jar.mn b/browser/themes/windows/jar.mn index eff2220..b9cf33a 100644 --- a/browser/themes/windows/jar.mn +++ b/browser/themes/windows/jar.mn @@ -69,6 +69,7 @@ browser.jar: skin/classic/browser/urlbar-arrow.png skin/classic/browser/urlbar-popup-blocked.png skin/classic/browser/urlbar-history-dropmarker.png + skin/classic/browser/canvas-popup.svg skin/classic/browser/webapps-16.png skin/classic/browser/webapps-64.png skin/classic/browser/notification-pluginNormal.png (../shared/plugins/notification-pluginNormal.png)

1 0

[tor-browser/tor-browser-24.7.0esr-3.x-1] fixup! Add canvas image extraction prompt.
by mikeperry＠torproject.org 20 Aug '14

20 Aug '14

commit 6048d4da85bd89f810f102517102ca27821bab21 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Tue Aug 19 20:34:23 2014 -0700 fixup! Add canvas image extraction prompt. Use JSContext to get URL information for HTML5 canvas access. --- content/canvas/src/CanvasRenderingContext2D.cpp | 2 +- content/canvas/src/CanvasUtils.cpp | 18 +++++++++++++----- content/canvas/src/CanvasUtils.h | 2 +- content/html/content/src/HTMLCanvasElement.cpp | 9 +++++---- 4 files changed, 20 insertions(+), 11 deletions(-) diff --git a/content/canvas/src/CanvasRenderingContext2D.cpp b/content/canvas/src/CanvasRenderingContext2D.cpp index 9be4ced..c53ac07 100644 --- a/content/canvas/src/CanvasRenderingContext2D.cpp +++ b/content/canvas/src/CanvasRenderingContext2D.cpp @@ -3506,7 +3506,7 @@ CanvasRenderingContext2D::GetImageDataArray(JSContext* aCx, if (mCanvasElement) { nsCOMPtr<nsIDocument> ownerDoc = mCanvasElement->OwnerDoc(); usePlaceholder = !ownerDoc || - !CanvasUtils::IsImageExtractionAllowed(ownerDoc); + !CanvasUtils::IsImageExtractionAllowed(ownerDoc, aCx); } if (usePlaceholder) { diff --git a/content/canvas/src/CanvasUtils.cpp b/content/canvas/src/CanvasUtils.cpp index f2f4536..591650a 100644 --- a/content/canvas/src/CanvasUtils.cpp +++ b/content/canvas/src/CanvasUtils.cpp @@ -35,6 +35,7 @@ using namespace mozilla::gfx; #include "nsUnicharUtils.h" #include "nsPrintfCString.h" #include "nsIConsoleService.h" +#include "jsdbgapi.h" #define TOPIC_CANVAS_PERMISSIONS_PROMPT "canvas-permissions-prompt" #define PERMISSION_CANVAS_EXTRACT_DATA "canvas/extractData" @@ -43,10 +44,9 @@ namespace mozilla { namespace CanvasUtils { // Check site-specific permission and display prompt if appropriate. -bool -IsImageExtractionAllowed(nsIDocument *aDocument) +bool IsImageExtractionAllowed(nsIDocument *aDocument, JSContext *aCx) { - if (!aDocument) + if (!aDocument || !aCx) return false; nsPIDOMWindow *win = aDocument->GetWindow(); @@ -87,13 +87,21 @@ IsImageExtractionAllowed(nsIDocument *aDocument) rv = thirdPartyUtil->IsThirdPartyURI(uri, docURI, &isThirdParty); NS_ENSURE_SUCCESS(rv, false); + nsCString scriptFile("unknown"); + unsigned scriptLine = 0; + JSScript *script; + if (JS_DescribeScriptedCaller(aCx, &script, &scriptLine)) { + scriptFile = JS_GetScriptFilename(aCx, script); + } + nsCString firstPartySpec; rv = uri->GetSpec(firstPartySpec); nsCString docSpec; docURI->GetSpec(docSpec); nsPrintfCString msg("On %s: blocked access to canvas image data" - " from %s ", // L10n - firstPartySpec.get(), docSpec.get()); + " from document %s, script from %s:%u ", // L10n + firstPartySpec.get(), docSpec.get(), + scriptFile.get(), scriptLine); nsCOMPtr<nsIConsoleService> console (do_GetService(NS_CONSOLESERVICE_CONTRACTID)); diff --git a/content/canvas/src/CanvasUtils.h b/content/canvas/src/CanvasUtils.h index d7aae4d..1e7f726 100644 --- a/content/canvas/src/CanvasUtils.h +++ b/content/canvas/src/CanvasUtils.h @@ -45,7 +45,7 @@ void DoDrawImageSecurityCheck(dom::HTMLCanvasElement *aCanvasElement, bool forceWriteOnly, bool CORSUsed); -bool IsImageExtractionAllowed(nsIDocument *aDocument); +bool IsImageExtractionAllowed(nsIDocument *aDocument, JSContext *aCx); // Make a double out of |v|, treating undefined values as 0.0 (for // the sake of sparse arrays). Return true iff coercion diff --git a/content/html/content/src/HTMLCanvasElement.cpp b/content/html/content/src/HTMLCanvasElement.cpp index e229e1c..d6cb88a 100644 --- a/content/html/content/src/HTMLCanvasElement.cpp +++ b/content/html/content/src/HTMLCanvasElement.cpp @@ -355,7 +355,7 @@ HTMLCanvasElement::ToDataURL(const nsAString& aType, const JS::Value& aParams, // Check site-specific permission and display prompt if appropriate. // If no permission, return all-white, opaque image data. - bool usePlaceholder = !CanvasUtils::IsImageExtractionAllowed(OwnerDoc()); + bool usePlaceholder = !CanvasUtils::IsImageExtractionAllowed(OwnerDoc(), aCx); return ToDataURLImpl(aCx, aType, aParams, usePlaceholder, aDataURL); } @@ -590,10 +590,11 @@ HTMLCanvasElement::ToBlob(nsIFileCallback* aCallback, } bool fallbackToPNG = false; + JSContext* cx = nsContentUtils::GetCurrentJSContext(); // Check site-specific permission and display prompt if appropriate. // If no permission, return all-white, opaque image data. - bool usePlaceholder = !CanvasUtils::IsImageExtractionAllowed(OwnerDoc()); + bool usePlaceholder = !CanvasUtils::IsImageExtractionAllowed(OwnerDoc(), cx); nsCOMPtr<nsIInputStream> stream; rv = ExtractData(type, EmptyString(), usePlaceholder, getter_AddRefs(stream), fallbackToPNG); @@ -616,7 +617,6 @@ HTMLCanvasElement::ToBlob(nsIFileCallback* aCallback, nsRefPtr<nsDOMMemoryFile> blob = new nsDOMMemoryFile(imgData, imgSize, type); - JSContext* cx = nsContentUtils::GetCurrentJSContext(); if (cx) { JS_updateMallocCounter(cx, imgSize); } @@ -648,7 +648,8 @@ HTMLCanvasElement::MozGetAsFile(const nsAString& aName, // Check site-speciifc permission and display prompt if appropriate. // If no permission, return all-white, opaque image data. - bool usePlaceholder = !CanvasUtils::IsImageExtractionAllowed(OwnerDoc()); + bool usePlaceholder = !CanvasUtils::IsImageExtractionAllowed(OwnerDoc(), + nsContentUtils::GetCurrentJSContext()); return MozGetAsFileImpl(aName, aType, usePlaceholder, aResult); }

1 0

[tor-browser/tor-browser-24.7.0esr-3.x-1] fixup! Add canvas image extraction prompt.
by mikeperry＠torproject.org 20 Aug '14

20 Aug '14

commit e3d04fb74ac49a2e3f4d074d0e3ea6edec77b8c3 Author: Isis Lovecruft <isis(a)torproject.org> Date: Sun Aug 17 01:31:03 2014 +0000 fixup! Add canvas image extraction prompt. Modify Pearl Crescent's #7265 patch to log all HTML5 canvas access attempts. --- content/canvas/src/CanvasUtils.cpp | 42 ++++++++++++++++++++++++++++++------ 1 file changed, 35 insertions(+), 7 deletions(-) diff --git a/content/canvas/src/CanvasUtils.cpp b/content/canvas/src/CanvasUtils.cpp index 203dd92..f2f4536 100644 --- a/content/canvas/src/CanvasUtils.cpp +++ b/content/canvas/src/CanvasUtils.cpp @@ -33,6 +33,8 @@ using namespace mozilla::gfx; #include "mozIThirdPartyUtil.h" #include "nsContentUtils.h" #include "nsUnicharUtils.h" +#include "nsPrintfCString.h" +#include "nsIConsoleService.h" #define TOPIC_CANVAS_PERMISSIONS_PROMPT "canvas-permissions-prompt" #define PERMISSION_CANVAS_EXTRACT_DATA "canvas/extractData" @@ -79,14 +81,40 @@ IsImageExtractionAllowed(nsIDocument *aDocument) isAllowed = (permission == nsIPermissionManager::ALLOW_ACTION); if (!isAllowed && (permission != nsIPermissionManager::DENY_ACTION)) { - // Send notification so that a prompt is displayed. - nsCString spec; - rv = uri->GetSpec(spec); + // Log all attempted canvas access and block access by third parties. + bool isThirdParty = true; + nsIURI *docURI = aDocument->GetDocumentURI(); + rv = thirdPartyUtil->IsThirdPartyURI(uri, docURI, &isThirdParty); + NS_ENSURE_SUCCESS(rv, false); + + nsCString firstPartySpec; + rv = uri->GetSpec(firstPartySpec); + nsCString docSpec; + docURI->GetSpec(docSpec); + nsPrintfCString msg("On %s: blocked access to canvas image data" + " from %s ", // L10n + firstPartySpec.get(), docSpec.get()); + + nsCOMPtr<nsIConsoleService> console + (do_GetService(NS_CONSOLESERVICE_CONTRACTID)); + if (console) + console->LogStringMessage(NS_ConvertUTF8toUTF16(msg).get()); + + // Log every canvas access attempt to stdout if debugging: +#ifdef DEBUG + printf("%s\n", msg.get()); +#endif + // Ensure URI is valid after logging, but before trying to notify the + // user: NS_ENSURE_SUCCESS(rv, false); - nsCOMPtr<nsIObserverService> obs = - mozilla::services::GetObserverService(); - obs->NotifyObservers(win, TOPIC_CANVAS_PERMISSIONS_PROMPT, - NS_ConvertUTF8toUTF16(spec).get()); + + if (!isThirdParty) { + // Send notification so that a prompt is displayed. + nsCOMPtr<nsIObserverService> obs = + mozilla::services::GetObserverService(); + obs->NotifyObservers(win, TOPIC_CANVAS_PERMISSIONS_PROMPT, + NS_ConvertUTF8toUTF16(firstPartySpec).get()); + } } } }

1 0

[tor-browser/tor-browser-24.7.0esr-3.x-1] fixup! Remove the Components shim introduced by Mozilla Bug #790732.
by mikeperry＠torproject.org 20 Aug '14

20 Aug '14

commit 1cd9a584a5a77089b3d03324e87451e28c09a58e Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Tue Aug 12 15:14:39 2014 -0700 fixup! Remove the Components shim introduced by Mozilla Bug #790732. Includes a regression test to ensure the window.Components object is not exposed to untrusted content. --- dom/base/nsDOMClassInfo.cpp | 98 -------------------- js/xpconnect/tests/mochitest/Makefile.in | 3 +- js/xpconnect/tests/mochitest/file_bug790732.html | 56 ----------- js/xpconnect/tests/mochitest/test_bug790732.html | 46 --------- js/xpconnect/tests/mochitest/test_tor_bug2874.html | 25 +++++ toolkit/components/telemetry/Histograms.json | 4 - 6 files changed, 26 insertions(+), 206 deletions(-) diff --git a/dom/base/nsDOMClassInfo.cpp b/dom/base/nsDOMClassInfo.cpp index e5fcebf..2a9d5a8 100644 --- a/dom/base/nsDOMClassInfo.cpp +++ b/dom/base/nsDOMClassInfo.cpp @@ -4282,98 +4282,6 @@ LocationSetterUnwrapper(JSContext *cx, JS::Handle<JSObject*> obj_, JS::Handle<js return LocationSetter<nsIDOMWindow>(cx, obj, id, strict, vp); } -struct InterfaceShimEntry { - const char *geckoName; - const char *domName; -}; - -// We add shims from Components.interfaces.nsIDOMFoo to window.Foo for each -// interface that has interface constants that sites might be getting off -// of Ci. -const InterfaceShimEntry kInterfaceShimMap[] = -{ { "nsIDOMFileReader", "FileReader" }, - { "nsIXMLHttpRequest", "XMLHttpRequest" }, - { "nsIDOMDOMException", "DOMException" }, - { "nsIDOMNode", "Node" }, - { "nsIDOMUserDataHandler", "UserDataHandler" }, - { "nsIDOMCSSPrimitiveValue", "CSSPrimitiveValue" }, - { "nsIDOMCSSRule", "CSSRule" }, - { "nsIDOMCSSValue", "CSSValue" }, - { "nsIDOMEvent", "Event" }, - { "nsIDOMNSEvent", "Event" }, - { "nsIDOMKeyEvent", "KeyEvent" }, - { "nsIDOMMouseEvent", "MouseEvent" }, - { "nsIDOMMouseScrollEvent", "MouseScrollEvent" }, - { "nsIDOMMutationEvent", "MutationEvent" }, - { "nsIDOMSimpleGestureEvent", "SimpleGestureEvent" }, - { "nsIDOMUIEvent", "UIEvent" }, - { "nsIDOMGeoPositionError", "GeoPositionError" }, - { "nsIDOMHTMLMediaElement", "HTMLMediaElement" }, - { "nsIDOMMediaError", "MediaError" }, - { "nsIDOMLoadStatus", "LoadStatus" }, - { "nsIDOMOfflineResourceList", "OfflineResourceList" }, - { "nsIDOMRange", "Range" }, - { "nsIDOMSVGFETurbulenceElement", "SVGFETurbulenceElement" }, - { "nsIDOMSVGFEMorphologyElement", "SVGFEMorphologyElement" }, - { "nsIDOMSVGFEConvolveMatrixElement", "SVGFEConvolveMatrixElement" }, - { "nsIDOMSVGFEDisplacementMapElement", "SVGFEDisplacementMapElement" }, - { "nsIDOMSVGLength", "SVGLength" }, - { "nsIDOMSVGUnitTypes", "SVGUnitTypes" }, - { "nsIDOMNodeFilter", "NodeFilter" }, - { "nsIDOMXPathNamespace", "XPathNamespace" }, - { "nsIDOMXPathResult", "XPathResult" }, - { "nsIDOMXULButtonElement", "XULButtonElement" }, - { "nsIDOMXULCheckboxElement", "XULCheckboxElement" }, - { "nsIDOMXULPopupElement", "XULPopupElement" } }; - -static nsresult -DefineComponentsShim(JSContext *cx, JS::HandleObject global) -{ - // Keep track of how often this happens. - Telemetry::Accumulate(Telemetry::COMPONENTS_SHIM_ACCESSED_BY_CONTENT, true); - - // Create a fake Components object. - JS::Rooted<JSObject*> components(cx, JS_NewObject(cx, nullptr, nullptr, global)); - NS_ENSURE_TRUE(components, NS_ERROR_OUT_OF_MEMORY); - bool ok = JS_DefineProperty(cx, global, "Components", JS::ObjectValue(*components), - JS_PropertyStub, JS_StrictPropertyStub, JSPROP_ENUMERATE); - NS_ENSURE_TRUE(ok, NS_ERROR_OUT_OF_MEMORY); - - // Create a fake interfaces object. - JS::Rooted<JSObject*> interfaces(cx, JS_NewObject(cx, nullptr, nullptr, global)); - NS_ENSURE_TRUE(interfaces, NS_ERROR_OUT_OF_MEMORY); - ok = JS_DefineProperty(cx, components, "interfaces", JS::ObjectValue(*interfaces), - JS_PropertyStub, JS_StrictPropertyStub, - JSPROP_ENUMERATE | JSPROP_PERMANENT | JSPROP_READONLY); - NS_ENSURE_TRUE(ok, NS_ERROR_OUT_OF_MEMORY); - - // Define a bunch of shims from the Ci.nsIDOMFoo to window.Foo for DOM - // interfaces with constants. - for (uint32_t i = 0; i < ArrayLength(kInterfaceShimMap); ++i) { - - // Grab the names from the table. - const char *geckoName = kInterfaceShimMap[i].geckoName; - const char *domName = kInterfaceShimMap[i].domName; - - // Look up the appopriate interface object on the global. - JS::Rooted<JS::Value> v(cx, JS::UndefinedValue()); - ok = JS_GetProperty(cx, global, domName, v.address()); - NS_ENSURE_TRUE(ok, NS_ERROR_OUT_OF_MEMORY); - if (!v.isObject()) { - NS_WARNING("Unable to find interface object on global"); - continue; - } - - // Define the shim on the interfaces object. - ok = JS_DefineProperty(cx, interfaces, geckoName, v, - JS_PropertyStub, JS_StrictPropertyStub, - JSPROP_ENUMERATE | JSPROP_PERMANENT | JSPROP_READONLY); - NS_ENSURE_TRUE(ok, NS_ERROR_OUT_OF_MEMORY); - } - - return NS_OK; -} - NS_IMETHODIMP nsWindowSH::NewResolve(nsIXPConnectWrappedNative *wrapper, JSContext *cx, JSObject *obj_, jsid id_, uint32_t flags, @@ -4386,12 +4294,6 @@ nsWindowSH::NewResolve(nsIXPConnectWrappedNative *wrapper, JSContext *cx, return NS_OK; } - MOZ_ASSERT(*_retval == true); // guaranteed by XPC_WN_Helper_NewResolve - if (id == XPCJSRuntime::Get()->GetStringID(XPCJSRuntime::IDX_COMPONENTS)) { - *objp = obj; - return DefineComponentsShim(cx, obj); - } - nsGlobalWindow *win = nsGlobalWindow::FromWrapper(wrapper); MOZ_ASSERT(win->IsInnerWindow()); diff --git a/js/xpconnect/tests/mochitest/Makefile.in b/js/xpconnect/tests/mochitest/Makefile.in index e3e1b63..666d1e2 100644 --- a/js/xpconnect/tests/mochitest/Makefile.in +++ b/js/xpconnect/tests/mochitest/Makefile.in @@ -80,8 +80,6 @@ MOCHITEST_FILES = chrome_wrappers_helper.html \ file_bug781476.html \ test_bug785096.html \ test_bug789713.html \ - test_bug790732.html \ - file_bug790732.html \ test_bug793969.html \ file_bug795275.html \ file_bug795275.xml \ @@ -101,6 +99,7 @@ MOCHITEST_FILES = chrome_wrappers_helper.html \ test_crosscompartment_weakmap.html \ test_asmjs.html \ file_asmjs.js \ + test_tor_bug2874.html \ $(NULL) include $(topsrcdir)/config/rules.mk diff --git a/js/xpconnect/tests/mochitest/file_bug790732.html b/js/xpconnect/tests/mochitest/file_bug790732.html deleted file mode 100644 index 5515dfc..0000000 --- a/js/xpconnect/tests/mochitest/file_bug790732.html +++ /dev/null @@ -1,56 +0,0 @@ -<!DOCTYPE html> -<html> -<head> -<script> -function testShim() { - - // Basic stuff - ok(Components, "Components shim exists!"); - var Ci = Components.interfaces; - ok(Ci, "interfaces shim exists!"); - is(typeof Components.classes, 'undefined', "Shouldn't have a Cc"); - - // Check each interface that we shim. We start by checking specific - // constants for a couple of interfaces, and then once it's pretty clear that - // it's working as intended we just check that the objects themselves are the - // same. - is(Ci.nsIDOMFileReader.DONE, FileReader.DONE); - is(Ci.nsIXMLHttpRequest.HEADERS_RECEIVED, XMLHttpRequest.HEADERS_RECEIVED); - is(Ci.nsIDOMDOMException.DATA_CLONE_ERR, DOMException.DATA_CLONE_ERR); - is(Ci.nsIDOMNode.DOCUMENT_NODE, Node.DOCUMENT_NODE); - is(Ci.nsIDOMUserDataHandler.NODE_CLONED, UserDataHandler.NODE_CLONED); - is(Ci.nsIDOMCSSPrimitiveValue.CSS_PX, CSSPrimitiveValue.CSS_PX); - is(Ci.nsIDOMCSSRule.NAMESPACE_RULE, CSSRule.NAMESPACE_RULE); - is(Ci.nsIDOMCSSValue.CSS_PRIMITIVE_VALUE, CSSValue.CSS_PRIMITIVE_VALUE); - is(Ci.nsIDOMEvent.FOCUS, Event.FOCUS); - is(Ci.nsIDOMNSEvent.CLICK, Event.CLICK); - is(Ci.nsIDOMKeyEvent, KeyEvent); - is(Ci.nsIDOMMouseEvent, MouseEvent); - is(Ci.nsIDOMMouseScrollEvent, MouseScrollEvent); - is(Ci.nsIDOMMutationEvent, MutationEvent); - is(Ci.nsIDOMSimpleGestureEvent, SimpleGestureEvent); - is(Ci.nsIDOMUIEvent, UIEvent); - is(Ci.nsIDOMGeoPositionError, GeoPositionError); - is(Ci.nsIDOMHTMLMediaElement, HTMLMediaElement); - is(Ci.nsIDOMMediaError, MediaError); - is(Ci.nsIDOMLoadStatus, LoadStatus); - is(Ci.nsIDOMOfflineResourceList, OfflineResourceList); - is(Ci.nsIDOMRange, Range); - is(Ci.nsIDOMSVGFETurbulenceElement, SVGFETurbulenceElement); - is(Ci.nsIDOMSVGFEMorphologyElement, SVGFEMorphologyElement); - is(Ci.nsIDOMSVGFEConvolveMatrixElement, SVGFEConvolveMatrixElement); - is(Ci.nsIDOMSVGFEDisplacementMapElement, SVGFEDisplacementMapElement); - is(Ci.nsIDOMSVGLength, SVGLength); - is(Ci.nsIDOMSVGUnitTypes, SVGUnitTypes); - is(Ci.nsIDOMNodeFilter, NodeFilter); - is(Ci.nsIDOMXPathNamespace, XPathNamespace); - is(Ci.nsIDOMXPathResult, XPathResult); - is(Ci.nsIDOMXULButtonElement, XULButtonElement); - is(Ci.nsIDOMXULCheckboxElement, XULCheckboxElement); - is(Ci.nsIDOMXULPopupElement, XULPopupElement); -} -</script> -</head> -<body> -</body> -</html> diff --git a/js/xpconnect/tests/mochitest/test_bug790732.html b/js/xpconnect/tests/mochitest/test_bug790732.html deleted file mode 100644 index 771950e..0000000 --- a/js/xpconnect/tests/mochitest/test_bug790732.html +++ /dev/null @@ -1,46 +0,0 @@ -<!DOCTYPE HTML> -<html> - -<head> - <meta charset="utf-8"> - <title>Test for Bug 790732</title> - <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script> - <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/> - <script type="application/javascript"> - - /** Test for the Components shim. We split into two files because this stuff - is currently pref-controlled. **/ - SimpleTest.waitForExplicitFinish(); - - function prepare() { - SpecialPowers.pushPrefEnv({set: [['dom.omit_components_in_content', true]]}, - function () { $('ifr').onload = go; - $('ifr').contentWindow.location = - '/tests/js/xpconnect/tests/mochitest/file_bug790732.html'; } - ); - } - - function go() { - ok(true, "Started test"); - var iwin = $('ifr').contentWindow; - iwin.ok = ok; - iwin.is = is; - iwin.testShim(); - SimpleTest.finish(); - } - - </script> -</head> -<body onload="prepare()"> -<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=790732">Mozilla Bug 790732</a> -<p id="display"></p> -<div id="content" style="display: none"> - -</div> -<pre id="test"> -</pre> -<iframe id="ifr"></iframe> -</body> -</html> diff --git a/js/xpconnect/tests/mochitest/test_tor_bug2874.html b/js/xpconnect/tests/mochitest/test_tor_bug2874.html new file mode 100644 index 0000000..c0a956e --- /dev/null +++ b/js/xpconnect/tests/mochitest/test_tor_bug2874.html @@ -0,0 +1,25 @@ +<!DOCTYPE HTML> +<html> + +<head> + <meta charset="utf-8"> + <title>Test for Tor Bug 2874</title> + <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/> + <script type="application/javascript"> + is(typeof Components, 'undefined', "The global window object should not expose a Components property to untrusted content."); + </script> +</head> +<body> +<a target="_blank" href="https://trac.torproject.org/projects/tor/ticket/2874">Tor Bug 2874</a> +<p id="display"></p> +<div id="content" style="display: none"> + +</div> +<pre id="test"> +</pre> +</body> +</html> diff --git a/toolkit/components/telemetry/Histograms.json b/toolkit/components/telemetry/Histograms.json index 9698fac..5594e01 100644 --- a/toolkit/components/telemetry/Histograms.json +++ b/toolkit/components/telemetry/Histograms.json @@ -2955,10 +2955,6 @@ "kind": "flag", "description": "Whether content ever accesed Components.interfaces in this session" }, - "COMPONENTS_SHIM_ACCESSED_BY_CONTENT": { - "kind": "flag", - "description": "Whether content ever accesed the Components shim in this session" - }, "CHECK_ADDONS_MODIFIED_MS": { "kind": "exponential", "high": "5000",

1 0

[tor-browser/tor-browser-24.7.0esr-3.x-1] fixup! API allows you to get the url bar URI for a channel or nsIDocument.
by mikeperry＠torproject.org 20 Aug '14

20 Aug '14

commit 8751adf3f98016212a3aac2d5a12e59b2e425d5a Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Sat Aug 16 19:25:57 2014 -0700 fixup! API allows you to get the url bar URI for a channel or nsIDocument. Log the URI of the source doc/channel that failed. --- content/base/src/ThirdPartyUtil.cpp | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/content/base/src/ThirdPartyUtil.cpp b/content/base/src/ThirdPartyUtil.cpp index 55eb316..569201e 100644 --- a/content/base/src/ThirdPartyUtil.cpp +++ b/content/base/src/ThirdPartyUtil.cpp @@ -427,6 +427,7 @@ ThirdPartyUtil::GetFirstPartyURIInternal(nsIChannel *aChannel, nsIURI **aOutput) { nsresult rv = NS_ERROR_NULL_POINTER; + nsCOMPtr<nsIURI> srcURI; if (!aOutput) return rv; @@ -441,6 +442,7 @@ ThirdPartyUtil::GetFirstPartyURIInternal(nsIChannel *aChannel, // for sure if (aChannel) { rv = GetOriginatingURI(aChannel, aOutput); + aChannel->GetURI(getter_AddRefs(srcURI)); if (NS_SUCCEEDED(rv) && *aOutput) { // At this point, about: and chrome: URLs have been mapped to file: or // jar: URLs. Try to recover the original URL. @@ -467,6 +469,7 @@ ThirdPartyUtil::GetFirstPartyURIInternal(nsIChannel *aChannel, nsCOMPtr<nsIDOMWindow> top; nsCOMPtr<nsIDOMDocument> topDDoc; nsIURI *docURI = nullptr; + srcURI = aDoc->GetDocumentURI(); if (aDoc->GetWindow()) { aDoc->GetWindow()->GetTop(getter_AddRefs(top)); @@ -505,14 +508,19 @@ ThirdPartyUtil::GetFirstPartyURIInternal(nsIChannel *aChannel, (do_GetService(NS_CONSOLESERVICE_CONTRACTID)); if (console) { nsCString spec; + nsCString srcSpec("unknown"); + + if (srcURI) + srcURI->GetSpec(srcSpec); + if (*aOutput) (*aOutput)->GetSpec(spec); if (spec.Length() > 0) { - nsPrintfCString msg("getFirstPartyURI: no host in first party URI %s", - spec.get()); // TODO: L10N + nsPrintfCString msg("getFirstPartyURI failed for %s: no host in first party URI %s", + srcSpec.get(), spec.get()); // TODO: L10N console->LogStringMessage(NS_ConvertUTF8toUTF16(msg).get()); } else { - nsPrintfCString msg("getFirstPartyURI failed: 0x%x", rv); + nsPrintfCString msg("getFirstPartyURI failed for %s: 0x%x", srcSpec.get(), rv); console->LogStringMessage(NS_ConvertUTF8toUTF16(msg).get()); } }

1 0

[tor-browser/tor-browser-24.7.0esr-4.x-2] fixup! Bug #6253: Add canvas image extraction prompt.
by mikeperry＠torproject.org 20 Aug '14

20 Aug '14

commit 3ef809fcfc22b0d46a52a3393cc685f44b66180e Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Tue Aug 19 20:34:23 2014 -0700 fixup! Bug #6253: Add canvas image extraction prompt. Use JSContext to get URL information for HTML5 canvas access. --- content/canvas/src/CanvasRenderingContext2D.cpp | 2 +- content/canvas/src/CanvasUtils.cpp | 18 +++++++++++++----- content/canvas/src/CanvasUtils.h | 2 +- content/html/content/src/HTMLCanvasElement.cpp | 9 +++++---- 4 files changed, 20 insertions(+), 11 deletions(-) diff --git a/content/canvas/src/CanvasRenderingContext2D.cpp b/content/canvas/src/CanvasRenderingContext2D.cpp index 9be4ced..c53ac07 100644 --- a/content/canvas/src/CanvasRenderingContext2D.cpp +++ b/content/canvas/src/CanvasRenderingContext2D.cpp @@ -3506,7 +3506,7 @@ CanvasRenderingContext2D::GetImageDataArray(JSContext* aCx, if (mCanvasElement) { nsCOMPtr<nsIDocument> ownerDoc = mCanvasElement->OwnerDoc(); usePlaceholder = !ownerDoc || - !CanvasUtils::IsImageExtractionAllowed(ownerDoc); + !CanvasUtils::IsImageExtractionAllowed(ownerDoc, aCx); } if (usePlaceholder) { diff --git a/content/canvas/src/CanvasUtils.cpp b/content/canvas/src/CanvasUtils.cpp index f2f4536..591650a 100644 --- a/content/canvas/src/CanvasUtils.cpp +++ b/content/canvas/src/CanvasUtils.cpp @@ -35,6 +35,7 @@ using namespace mozilla::gfx; #include "nsUnicharUtils.h" #include "nsPrintfCString.h" #include "nsIConsoleService.h" +#include "jsdbgapi.h" #define TOPIC_CANVAS_PERMISSIONS_PROMPT "canvas-permissions-prompt" #define PERMISSION_CANVAS_EXTRACT_DATA "canvas/extractData" @@ -43,10 +44,9 @@ namespace mozilla { namespace CanvasUtils { // Check site-specific permission and display prompt if appropriate. -bool -IsImageExtractionAllowed(nsIDocument *aDocument) +bool IsImageExtractionAllowed(nsIDocument *aDocument, JSContext *aCx) { - if (!aDocument) + if (!aDocument || !aCx) return false; nsPIDOMWindow *win = aDocument->GetWindow(); @@ -87,13 +87,21 @@ IsImageExtractionAllowed(nsIDocument *aDocument) rv = thirdPartyUtil->IsThirdPartyURI(uri, docURI, &isThirdParty); NS_ENSURE_SUCCESS(rv, false); + nsCString scriptFile("unknown"); + unsigned scriptLine = 0; + JSScript *script; + if (JS_DescribeScriptedCaller(aCx, &script, &scriptLine)) { + scriptFile = JS_GetScriptFilename(aCx, script); + } + nsCString firstPartySpec; rv = uri->GetSpec(firstPartySpec); nsCString docSpec; docURI->GetSpec(docSpec); nsPrintfCString msg("On %s: blocked access to canvas image data" - " from %s ", // L10n - firstPartySpec.get(), docSpec.get()); + " from document %s, script from %s:%u ", // L10n + firstPartySpec.get(), docSpec.get(), + scriptFile.get(), scriptLine); nsCOMPtr<nsIConsoleService> console (do_GetService(NS_CONSOLESERVICE_CONTRACTID)); diff --git a/content/canvas/src/CanvasUtils.h b/content/canvas/src/CanvasUtils.h index d7aae4d..1e7f726 100644 --- a/content/canvas/src/CanvasUtils.h +++ b/content/canvas/src/CanvasUtils.h @@ -45,7 +45,7 @@ void DoDrawImageSecurityCheck(dom::HTMLCanvasElement *aCanvasElement, bool forceWriteOnly, bool CORSUsed); -bool IsImageExtractionAllowed(nsIDocument *aDocument); +bool IsImageExtractionAllowed(nsIDocument *aDocument, JSContext *aCx); // Make a double out of |v|, treating undefined values as 0.0 (for // the sake of sparse arrays). Return true iff coercion diff --git a/content/html/content/src/HTMLCanvasElement.cpp b/content/html/content/src/HTMLCanvasElement.cpp index e229e1c..d6cb88a 100644 --- a/content/html/content/src/HTMLCanvasElement.cpp +++ b/content/html/content/src/HTMLCanvasElement.cpp @@ -355,7 +355,7 @@ HTMLCanvasElement::ToDataURL(const nsAString& aType, const JS::Value& aParams, // Check site-specific permission and display prompt if appropriate. // If no permission, return all-white, opaque image data. - bool usePlaceholder = !CanvasUtils::IsImageExtractionAllowed(OwnerDoc()); + bool usePlaceholder = !CanvasUtils::IsImageExtractionAllowed(OwnerDoc(), aCx); return ToDataURLImpl(aCx, aType, aParams, usePlaceholder, aDataURL); } @@ -590,10 +590,11 @@ HTMLCanvasElement::ToBlob(nsIFileCallback* aCallback, } bool fallbackToPNG = false; + JSContext* cx = nsContentUtils::GetCurrentJSContext(); // Check site-specific permission and display prompt if appropriate. // If no permission, return all-white, opaque image data. - bool usePlaceholder = !CanvasUtils::IsImageExtractionAllowed(OwnerDoc()); + bool usePlaceholder = !CanvasUtils::IsImageExtractionAllowed(OwnerDoc(), cx); nsCOMPtr<nsIInputStream> stream; rv = ExtractData(type, EmptyString(), usePlaceholder, getter_AddRefs(stream), fallbackToPNG); @@ -616,7 +617,6 @@ HTMLCanvasElement::ToBlob(nsIFileCallback* aCallback, nsRefPtr<nsDOMMemoryFile> blob = new nsDOMMemoryFile(imgData, imgSize, type); - JSContext* cx = nsContentUtils::GetCurrentJSContext(); if (cx) { JS_updateMallocCounter(cx, imgSize); } @@ -648,7 +648,8 @@ HTMLCanvasElement::MozGetAsFile(const nsAString& aName, // Check site-speciifc permission and display prompt if appropriate. // If no permission, return all-white, opaque image data. - bool usePlaceholder = !CanvasUtils::IsImageExtractionAllowed(OwnerDoc()); + bool usePlaceholder = !CanvasUtils::IsImageExtractionAllowed(OwnerDoc(), + nsContentUtils::GetCurrentJSContext()); return MozGetAsFileImpl(aName, aType, usePlaceholder, aResult); }

1 0