- tbb-commits - lists.torproject.org

[tor-browser/tor-browser-78.11.0esr-10.5-1] Merge remote-tracking branch 'richardgl/40507' into tor-browser-78.11.0esr-10.5-1
by sysrqb＠torproject.org 08 Jul '21

08 Jul '21

commit 9037e5de6dd14b0791528aeae78cf6c4b264bbf1 Merge: 21083586165d 2d2ed519296f Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Thu Jul 8 16:53:00 2021 +0000 Merge remote-tracking branch 'richardgl/40507' into tor-browser-78.11.0esr-10.5-1 toolkit/mozapps/update/UpdateService.jsm | 29 ++++++++++++++++++++++++----- 1 file changed, 24 insertions(+), 5 deletions(-)

1 0

[tor-browser/tor-browser-78.11.0esr-11.0-1] fixup! Bug 27476: Implement about:torconnect captive portal within Tor Browser
by sysrqb＠torproject.org 08 Jul '21

08 Jul '21

commit a2581284372175491fbd55b5f44e4c681b9009dd Author: Richard Pospesel <richard(a)torproject.org> Date: Mon Jul 5 17:07:23 2021 +0200 fixup! Bug 27476: Implement about:torconnect captive portal within Tor Browser --- browser/components/torconnect/TorConnectParent.jsm | 11 +---------- .../torconnect/content/aboutTorConnect.js | 21 +++++---------------- browser/modules/TorConnect.jsm | 19 +++++++++++++++++-- dom/base/nsGlobalWindowOuter.cpp | 2 ++ toolkit/modules/RemotePageAccessManager.jsm | 4 ---- 5 files changed, 25 insertions(+), 32 deletions(-) diff --git a/browser/components/torconnect/TorConnectParent.jsm b/browser/components/torconnect/TorConnectParent.jsm index f775507a744f..54548891fbab 100644 --- a/browser/components/torconnect/TorConnectParent.jsm +++ b/browser/components/torconnect/TorConnectParent.jsm @@ -27,6 +27,7 @@ const gActiveTopics = [ kTorBootstrapStatusTopic, kTorBootstrapErrorTopic, kTorLogHasWarnOrErrTopic, + "torconnect:bootstrap-complete", ]; const gTorLauncherPrefs = { @@ -69,9 +70,6 @@ class TorConnectParent extends JSWindowActorParent { } } - get browser() { - return this.browsingContext.top.embedderElement; - } _OpenTorAdvancedPreferences() { const win = this.browsingContext.top.embedderElement.ownerGlobal; @@ -93,11 +91,6 @@ class TorConnectParent extends JSWindowActorParent { ); } - _GoToBrowserHome() { - const window = this.browser.ownerGlobal; - window.BrowserHome(); - } - receiveMessage(message) { switch (message.name) { case "TorBootstrapErrorOccurred": @@ -106,8 +99,6 @@ class TorConnectParent extends JSWindowActorParent { return TorProtocolService.retrieveBootstrapStatus(); case "OpenTorAdvancedPreferences": return this._OpenTorAdvancedPreferences(); - case "GoToBrowserHome": - return this._GoToBrowserHome(); case "GetLocalizedBootstrapStatus": const { status, keyword } = message.data; return TorLauncherUtil.getLocalizedBootstrapStatus(status, keyword); diff --git a/browser/components/torconnect/content/aboutTorConnect.js b/browser/components/torconnect/content/aboutTorConnect.js index 11301fa10cab..19fd335ccd13 100644 --- a/browser/components/torconnect/content/aboutTorConnect.js +++ b/browser/components/torconnect/content/aboutTorConnect.js @@ -15,10 +15,6 @@ const TorLauncherPrefs = { prompt_at_startup: "extensions.torlauncher.prompt_at_startup", } -const BrowserPrefs = { - homepage: "browser.startup.homepage", -} - class AboutTorConnect { log(...args) { console.log(...args); @@ -133,14 +129,6 @@ class AboutTorConnect { this.elemTitle.classList.add("error"); } - goToBrowserHome() { - this.hideElem(this.elemCancelButton); - - // redirect this about:torconnect to browser homepage - const homepage = RPMGetStringPref(BrowserPrefs.homepage); - window.location.replace(homepage); - } - set state(state) { const oldState = this.state; if (oldState === state) { @@ -158,7 +146,7 @@ class AboutTorConnect { this.setBootstrapErrorUI(); break; case AboutTorConnect.STATE_BOOTSTRAPPED: - this.goToBrowserHome(); + window.close(); break; } } @@ -219,8 +207,6 @@ class AboutTorConnect { // if bootstrap state is greater than 0. this.state = AboutTorConnect.STATE_INITIAL; return; - } else if (percentComplete >= 100) { - this.state = AboutTorConnect.STATE_BOOTSTRAPPED; } else if (percentComplete > 0) { this.state = AboutTorConnect.STATE_BOOTSTRAPPING; } @@ -306,7 +292,10 @@ class AboutTorConnect { RPMAddMessageListener(kTorQuickstartPrefChanged, ({ data }) => { // update checkbox with latest quickstart pref value this.elemQuickstartCheckbox.checked = data; - }) + }); + RPMAddMessageListener("torconnect:bootstrap-complete", () => { + this.state = AboutTorConnect.STATE_BOOTSTRAPPED; + }); } initKeyboardShortcuts() { diff --git a/browser/modules/TorConnect.jsm b/browser/modules/TorConnect.jsm index 2b8cd15e3b62..3125c84558db 100644 --- a/browser/modules/TorConnect.jsm +++ b/browser/modules/TorConnect.jsm @@ -3,11 +3,15 @@ var EXPORTED_SYMBOLS = ["TorConnect"]; const { Services } = ChromeUtils.import( - "resource://gre/modules/Services.jsm" + "resource://gre/modules/Services.jsm" +); + +const { BrowserWindowTracker } = ChromeUtils.import( + "resource:///modules/BrowserWindowTracker.jsm" ); const { TorProtocolService } = ChromeUtils.import( - "resource:///modules/TorProtocolService.jsm" + "resource:///modules/TorProtocolService.jsm" ); // TODO: move the bootstrap state management out of each of the individual @@ -29,6 +33,17 @@ var TorConnect = (() => { case "TorBootstrapStatus": const obj = subject?.wrappedJSObject; if (obj?.PROGRESS === 100) { + // open home page(s) in new tabs + const win = BrowserWindowTracker.getTopWindow() + const urls = Services.prefs.getStringPref("browser.startup.homepage").split('|'); + + let location="tab"; + for(const url of urls) { + win.openTrustedLinkIn(url, location); + // open subsequent tabs behind first tab + location = "tabshifted"; + } + Services.obs.notifyObservers(null, "torconnect:bootstrap-complete"); } break; diff --git a/dom/base/nsGlobalWindowOuter.cpp b/dom/base/nsGlobalWindowOuter.cpp index abe1e56d9714..759060f131ff 100644 --- a/dom/base/nsGlobalWindowOuter.cpp +++ b/dom/base/nsGlobalWindowOuter.cpp @@ -6082,6 +6082,8 @@ void nsGlobalWindowOuter::CloseOuter(bool aTrustedCaller) { NS_ENSURE_SUCCESS_VOID(rv); if (!StringBeginsWith(url, NS_LITERAL_STRING("about:neterror")) && + // we want about:torconnect pages to be able to close themselves after bootstrap + !StringBeginsWith(url, NS_LITERAL_STRING("about:torconnect")) && !HadOriginalOpener() && !aTrustedCaller) { bool allowClose = mAllowScriptsToClose || diff --git a/toolkit/modules/RemotePageAccessManager.jsm b/toolkit/modules/RemotePageAccessManager.jsm index 0c001e707096..0927391c2ba7 100644 --- a/toolkit/modules/RemotePageAccessManager.jsm +++ b/toolkit/modules/RemotePageAccessManager.jsm @@ -183,7 +183,6 @@ let RemotePageAccessManager = { "about:torconnect": { RPMAddMessageListener: ["*"], RPMSendAsyncMessage: [ - "GoToBrowserHome", "OpenTorAdvancedPreferences", "TorRetrieveBootstrapStatus", "TorStopBootstrap", @@ -205,9 +204,6 @@ let RemotePageAccessManager = { RPMSetBoolPref: [ "extensions.torlauncher.quickstart", ], - RPMGetStringPref: [ - "browser.startup.homepage", - ], }, },

1 0

[tor-browser/tor-browser-78.11.0esr-11.0-1] fixup! Bug 27476: Implement about:torconnect captive portal within Tor Browser
by sysrqb＠torproject.org 08 Jul '21

08 Jul '21

commit 21083586165d60491d7b4c590ca166415d1f104e Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Thu Jul 8 16:25:50 2021 +0000 fixup! Bug 27476: Implement about:torconnect captive portal within Tor Browser --- browser/components/sessionstore/SessionStore.jsm | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/browser/components/sessionstore/SessionStore.jsm b/browser/components/sessionstore/SessionStore.jsm index 6ab86fd5913e..2d66422abf58 100644 --- a/browser/components/sessionstore/SessionStore.jsm +++ b/browser/components/sessionstore/SessionStore.jsm @@ -213,6 +213,10 @@ ChromeUtils.defineModuleGetter( "resource://gre/modules/sessionstore/SessionHistory.jsm" ); +const { TorProtocolService } = ChromeUtils.import( + "resource:///modules/TorProtocolService.jsm" +); + XPCOMUtils.defineLazyServiceGetters(this, { gScreenManager: ["@mozilla.org/gfx/screenmanager;1", "nsIScreenManager"], Telemetry: ["@mozilla.org/base/telemetry;1", "nsITelemetry"], @@ -1888,11 +1892,23 @@ var SessionStoreInternal = { }, "browser-delayed-startup-finished"); }); + let bootstrapPromise = new Promise(resolve => { + if (TorProtocolService.isBootstrapDone() || !TorProtocolService.ownsTorDaemon) { + resolve(); + } else { + Services.obs.addObserver(function obs(subject, topic) { + Services.obs.removeObserver(obs, topic); + resolve(); + }, "torconnect:bootstrap-complete"); + } + }); + // We are ready for initialization as soon as the session file has been // read from disk and the initial window's delayed startup has finished. this._promiseReadyForInitialization = Promise.all([ promise, SessionStartup.onceInitialized, + bootstrapPromise, ]); }

1 0

[tor-browser/tor-browser-78.11.0esr-10.5-1] fixup! Bug 27476: Implement about:torconnect captive portal within Tor Browser
by sysrqb＠torproject.org 08 Jul '21

08 Jul '21

commit a2581284372175491fbd55b5f44e4c681b9009dd Author: Richard Pospesel <richard(a)torproject.org> Date: Mon Jul 5 17:07:23 2021 +0200 fixup! Bug 27476: Implement about:torconnect captive portal within Tor Browser --- browser/components/torconnect/TorConnectParent.jsm | 11 +---------- .../torconnect/content/aboutTorConnect.js | 21 +++++---------------- browser/modules/TorConnect.jsm | 19 +++++++++++++++++-- dom/base/nsGlobalWindowOuter.cpp | 2 ++ toolkit/modules/RemotePageAccessManager.jsm | 4 ---- 5 files changed, 25 insertions(+), 32 deletions(-) diff --git a/browser/components/torconnect/TorConnectParent.jsm b/browser/components/torconnect/TorConnectParent.jsm index f775507a744f..54548891fbab 100644 --- a/browser/components/torconnect/TorConnectParent.jsm +++ b/browser/components/torconnect/TorConnectParent.jsm @@ -27,6 +27,7 @@ const gActiveTopics = [ kTorBootstrapStatusTopic, kTorBootstrapErrorTopic, kTorLogHasWarnOrErrTopic, + "torconnect:bootstrap-complete", ]; const gTorLauncherPrefs = { @@ -69,9 +70,6 @@ class TorConnectParent extends JSWindowActorParent { } } - get browser() { - return this.browsingContext.top.embedderElement; - } _OpenTorAdvancedPreferences() { const win = this.browsingContext.top.embedderElement.ownerGlobal; @@ -93,11 +91,6 @@ class TorConnectParent extends JSWindowActorParent { ); } - _GoToBrowserHome() { - const window = this.browser.ownerGlobal; - window.BrowserHome(); - } - receiveMessage(message) { switch (message.name) { case "TorBootstrapErrorOccurred": @@ -106,8 +99,6 @@ class TorConnectParent extends JSWindowActorParent { return TorProtocolService.retrieveBootstrapStatus(); case "OpenTorAdvancedPreferences": return this._OpenTorAdvancedPreferences(); - case "GoToBrowserHome": - return this._GoToBrowserHome(); case "GetLocalizedBootstrapStatus": const { status, keyword } = message.data; return TorLauncherUtil.getLocalizedBootstrapStatus(status, keyword); diff --git a/browser/components/torconnect/content/aboutTorConnect.js b/browser/components/torconnect/content/aboutTorConnect.js index 11301fa10cab..19fd335ccd13 100644 --- a/browser/components/torconnect/content/aboutTorConnect.js +++ b/browser/components/torconnect/content/aboutTorConnect.js @@ -15,10 +15,6 @@ const TorLauncherPrefs = { prompt_at_startup: "extensions.torlauncher.prompt_at_startup", } -const BrowserPrefs = { - homepage: "browser.startup.homepage", -} - class AboutTorConnect { log(...args) { console.log(...args); @@ -133,14 +129,6 @@ class AboutTorConnect { this.elemTitle.classList.add("error"); } - goToBrowserHome() { - this.hideElem(this.elemCancelButton); - - // redirect this about:torconnect to browser homepage - const homepage = RPMGetStringPref(BrowserPrefs.homepage); - window.location.replace(homepage); - } - set state(state) { const oldState = this.state; if (oldState === state) { @@ -158,7 +146,7 @@ class AboutTorConnect { this.setBootstrapErrorUI(); break; case AboutTorConnect.STATE_BOOTSTRAPPED: - this.goToBrowserHome(); + window.close(); break; } } @@ -219,8 +207,6 @@ class AboutTorConnect { // if bootstrap state is greater than 0. this.state = AboutTorConnect.STATE_INITIAL; return; - } else if (percentComplete >= 100) { - this.state = AboutTorConnect.STATE_BOOTSTRAPPED; } else if (percentComplete > 0) { this.state = AboutTorConnect.STATE_BOOTSTRAPPING; } @@ -306,7 +292,10 @@ class AboutTorConnect { RPMAddMessageListener(kTorQuickstartPrefChanged, ({ data }) => { // update checkbox with latest quickstart pref value this.elemQuickstartCheckbox.checked = data; - }) + }); + RPMAddMessageListener("torconnect:bootstrap-complete", () => { + this.state = AboutTorConnect.STATE_BOOTSTRAPPED; + }); } initKeyboardShortcuts() { diff --git a/browser/modules/TorConnect.jsm b/browser/modules/TorConnect.jsm index 2b8cd15e3b62..3125c84558db 100644 --- a/browser/modules/TorConnect.jsm +++ b/browser/modules/TorConnect.jsm @@ -3,11 +3,15 @@ var EXPORTED_SYMBOLS = ["TorConnect"]; const { Services } = ChromeUtils.import( - "resource://gre/modules/Services.jsm" + "resource://gre/modules/Services.jsm" +); + +const { BrowserWindowTracker } = ChromeUtils.import( + "resource:///modules/BrowserWindowTracker.jsm" ); const { TorProtocolService } = ChromeUtils.import( - "resource:///modules/TorProtocolService.jsm" + "resource:///modules/TorProtocolService.jsm" ); // TODO: move the bootstrap state management out of each of the individual @@ -29,6 +33,17 @@ var TorConnect = (() => { case "TorBootstrapStatus": const obj = subject?.wrappedJSObject; if (obj?.PROGRESS === 100) { + // open home page(s) in new tabs + const win = BrowserWindowTracker.getTopWindow() + const urls = Services.prefs.getStringPref("browser.startup.homepage").split('|'); + + let location="tab"; + for(const url of urls) { + win.openTrustedLinkIn(url, location); + // open subsequent tabs behind first tab + location = "tabshifted"; + } + Services.obs.notifyObservers(null, "torconnect:bootstrap-complete"); } break; diff --git a/dom/base/nsGlobalWindowOuter.cpp b/dom/base/nsGlobalWindowOuter.cpp index abe1e56d9714..759060f131ff 100644 --- a/dom/base/nsGlobalWindowOuter.cpp +++ b/dom/base/nsGlobalWindowOuter.cpp @@ -6082,6 +6082,8 @@ void nsGlobalWindowOuter::CloseOuter(bool aTrustedCaller) { NS_ENSURE_SUCCESS_VOID(rv); if (!StringBeginsWith(url, NS_LITERAL_STRING("about:neterror")) && + // we want about:torconnect pages to be able to close themselves after bootstrap + !StringBeginsWith(url, NS_LITERAL_STRING("about:torconnect")) && !HadOriginalOpener() && !aTrustedCaller) { bool allowClose = mAllowScriptsToClose || diff --git a/toolkit/modules/RemotePageAccessManager.jsm b/toolkit/modules/RemotePageAccessManager.jsm index 0c001e707096..0927391c2ba7 100644 --- a/toolkit/modules/RemotePageAccessManager.jsm +++ b/toolkit/modules/RemotePageAccessManager.jsm @@ -183,7 +183,6 @@ let RemotePageAccessManager = { "about:torconnect": { RPMAddMessageListener: ["*"], RPMSendAsyncMessage: [ - "GoToBrowserHome", "OpenTorAdvancedPreferences", "TorRetrieveBootstrapStatus", "TorStopBootstrap", @@ -205,9 +204,6 @@ let RemotePageAccessManager = { RPMSetBoolPref: [ "extensions.torlauncher.quickstart", ], - RPMGetStringPref: [ - "browser.startup.homepage", - ], }, },

1 0

[tor-browser/tor-browser-78.11.0esr-10.5-1] fixup! Bug 27476: Implement about:torconnect captive portal within Tor Browser
by sysrqb＠torproject.org 08 Jul '21

08 Jul '21

commit 21083586165d60491d7b4c590ca166415d1f104e Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Thu Jul 8 16:25:50 2021 +0000 fixup! Bug 27476: Implement about:torconnect captive portal within Tor Browser --- browser/components/sessionstore/SessionStore.jsm | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/browser/components/sessionstore/SessionStore.jsm b/browser/components/sessionstore/SessionStore.jsm index 6ab86fd5913e..2d66422abf58 100644 --- a/browser/components/sessionstore/SessionStore.jsm +++ b/browser/components/sessionstore/SessionStore.jsm @@ -213,6 +213,10 @@ ChromeUtils.defineModuleGetter( "resource://gre/modules/sessionstore/SessionHistory.jsm" ); +const { TorProtocolService } = ChromeUtils.import( + "resource:///modules/TorProtocolService.jsm" +); + XPCOMUtils.defineLazyServiceGetters(this, { gScreenManager: ["@mozilla.org/gfx/screenmanager;1", "nsIScreenManager"], Telemetry: ["@mozilla.org/base/telemetry;1", "nsITelemetry"], @@ -1888,11 +1892,23 @@ var SessionStoreInternal = { }, "browser-delayed-startup-finished"); }); + let bootstrapPromise = new Promise(resolve => { + if (TorProtocolService.isBootstrapDone() || !TorProtocolService.ownsTorDaemon) { + resolve(); + } else { + Services.obs.addObserver(function obs(subject, topic) { + Services.obs.removeObserver(obs, topic); + resolve(); + }, "torconnect:bootstrap-complete"); + } + }); + // We are ready for initialization as soon as the session file has been // read from disk and the initial window's delayed startup has finished. this._promiseReadyForInitialization = Promise.all([ promise, SessionStartup.onceInitialized, + bootstrapPromise, ]); }

1 0

[tor-browser-spec/master] Bug 40019: Add FF90 audit
by sysrqb＠torproject.org 07 Jul '21

07 Jul '21

commit cdda784cb76aeba1a6856e151b26139c04e97595 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Thu Jul 8 03:05:32 2021 +0000 Bug 40019: Add FF90 audit --- audits/FF90_NETWORK_AUDIT | 77 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 77 insertions(+) diff --git a/audits/FF90_NETWORK_AUDIT b/audits/FF90_NETWORK_AUDIT new file mode 100644 index 0000000..7a667c1 --- /dev/null +++ b/audits/FF90_NETWORK_AUDIT @@ -0,0 +1,77 @@ +============ General ============= + +The audit begins at the commit hash where the previous audit ended. Use +code_audit.sh for creating the diff and highlighting potentially problematic +code. The audit is scoped to a specific language (currently C/C++, Rust, +Java/Kotlin, and Javascript). + +The output includes the entire patch where the new problematic code was +introduced. Search for "XXX MATCH XXX" to find the next potential violation. + +code_audit.sh contains the list of known problematic APIs. New usage of these +functions are documented and analyzed in this audit. + +============ Firefox General Portion ============= + +Start: 3862f77749dd50e54c3d9eea32fb59e84d978c96 # FIREFOX_89_0_RELEASE +End: 5e8ffbe1bf6d448cb235cb0a64a56646a6537b22 # FIREFOX_90_0b12_BUILD1 + +# Nothing of interest (using `code_audit.sh`) + +============ Application Services Portion ============= + +Start: ad7b64fa03eeeb00815125e635d1fb8809befd40 # v74.0.1 +End: dd09c25f14dbf45f1637ed8dca2d1e5ff668479f # v77.0.2 + +# a994a18d2cfec9ef404029885a64985126d8e265 +# - Restructured Nimbus-SDK to prep for move to app-services repo. +# - Review Result: Safe + +# 5cbae43a3cc4c461108c2a7ff9f57018f982046f +# - Move Nimbus.kt from Android Components (#4036) +# - Review Result: Safe + +============ Android Components Portion ============= + +Start: 5204f4025ce8b60c64f92eb3f60ee644cafd4fc8 # v75.0.22 +End: 536cb9fe133e555109c3f25024148260aace6dab # v90.0.11 + +# Issue #10162 +# - Don't show the contextual menu for blocked urls +# - Review Result: Safe + +# 8ef0c763d42c554c50dc37815d6e3cdd4361373f +# - Move Nimbus.kt to Application Services +# - Review Result: Safe + +# b19c84beca0d6f31e145cd5e49896176b8b592c6 +# - Restore Nimbus object passing in threads, observers and logtag +# - Review Result: Safe + +# Issue #9189 +# - Refactor service-pocket to support recommended articles. +# - Review Result: Safe (background requests are not isolated) + +============ Fenix Portion ============= + +Start: edea181c543ffee077bb3ca52830ba8d320358b2 # v89.1.1 +End: 6d43c622b4515becbf29ba7956ec2fbe1e5bdc31 # v90.0.0-beta.6 + +# Issue #19693 +# - Display a biometric prompt when a credit card is selected to autofill (#19697) +# - Review Result: Safe + +# Issue #11819 +# - Show the mic in widget only if setting is enabled +# - Review Result: Safe + +# Issue #18264 +# - Add biometric prompt to credit card settings (#19505) +# - Review Result: Safe + +============ Regression/Prior Vuln Review ========= + +Review proxy bypass bugs; check for new vectors to look for: + - https://gitlab.torproject.org/groups/tpo/applications/-/issues?scope=all&ut… + - Look for new features like these. Especially external app launch vectors +

1 0

[tor-browser-build/maint-10.5] Correct changelog version number
by sysrqb＠torproject.org 07 Jul '21

07 Jul '21

commit 2a36dcd75d27778231ecd670a7c6f371a0118fc7 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Wed Jul 7 23:16:22 2021 +0000 Correct changelog version number --- projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index ff35c84..06d533d 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -1,4 +1,4 @@ -Tor Browser 10.5 -- July 7 2021 +Tor Browser 10.5.1 -- July 7 2021 * Android * Bug 40324: Change Fenix variant to Release [fenix]

1 0

[tor-browser-spec/master] Update link to Proxy Bypass vectors in recent audits
by sysrqb＠torproject.org 07 Jul '21

07 Jul '21

commit 33e8cbd0ac0242296fda272841b8ef4cfbab9923 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Wed Jul 7 19:45:36 2021 +0000 Update link to Proxy Bypass vectors in recent audits --- audits/FF85_NETWORK_AUDIT | 2 +- audits/FF86_NETWORK_AUDIT | 2 +- audits/FF87_NETWORK_AUDIT | 2 +- audits/FF88_NETWORK_AUDIT | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/audits/FF85_NETWORK_AUDIT b/audits/FF85_NETWORK_AUDIT index 17ad0db..9e79d23 100644 --- a/audits/FF85_NETWORK_AUDIT +++ b/audits/FF85_NETWORK_AUDIT @@ -154,6 +154,6 @@ End: 24995d51a12d8e0bb10166f9f286c68d23b84a6a # v85.1.0 ============ Regression/Prior Vuln Review ========= Review proxy bypass bugs; check for new vectors to look for: - - https://trac.torproject.org/projects/tor/query?keywords=~tbb-proxy + - https://gitlab.torproject.org/groups/tpo/applications/-/issues?scope=all&ut… - Look for new features like these. Especially external app launch vectors diff --git a/audits/FF86_NETWORK_AUDIT b/audits/FF86_NETWORK_AUDIT index 663c65b..94077ae 100644 --- a/audits/FF86_NETWORK_AUDIT +++ b/audits/FF86_NETWORK_AUDIT @@ -135,6 +135,6 @@ End: db196d0e49eb0f69ab620856491deb8c4c7ccf57 # v86.1.0 ============ Regression/Prior Vuln Review ========= Review proxy bypass bugs; check for new vectors to look for: - - https://trac.torproject.org/projects/tor/query?keywords=~tbb-proxy + - https://gitlab.torproject.org/groups/tpo/applications/-/issues?scope=all&ut… - Look for new features like these. Especially external app launch vectors diff --git a/audits/FF87_NETWORK_AUDIT b/audits/FF87_NETWORK_AUDIT index fba3a86..cd22847 100644 --- a/audits/FF87_NETWORK_AUDIT +++ b/audits/FF87_NETWORK_AUDIT @@ -148,6 +148,6 @@ End: 9d91b8eeb9d287ee95937b5edfffde383982267a # v87.0.0-rc.1 ============ Regression/Prior Vuln Review ========= Review proxy bypass bugs; check for new vectors to look for: - - https://trac.torproject.org/projects/tor/query?keywords=~tbb-proxy + - https://gitlab.torproject.org/groups/tpo/applications/-/issues?scope=all&ut… - Look for new features like these. Especially external app launch vectors diff --git a/audits/FF88_NETWORK_AUDIT b/audits/FF88_NETWORK_AUDIT index 6462aad..a40b693 100644 --- a/audits/FF88_NETWORK_AUDIT +++ b/audits/FF88_NETWORK_AUDIT @@ -136,6 +136,6 @@ End: 5f98c4ec98d663c763dc4ec5ea84a14cdf342d04 # v88.1.1 ============ Regression/Prior Vuln Review ========= Review proxy bypass bugs; check for new vectors to look for: - - https://trac.torproject.org/projects/tor/query?keywords=~tbb-proxy + - https://gitlab.torproject.org/groups/tpo/applications/-/issues?scope=all&ut… - Look for new features like these. Especially external app launch vectors

1 0

[tor-browser-spec/master] fixup! Bug 40018: Add FF89 audit
by sysrqb＠torproject.org 07 Jul '21

07 Jul '21

commit aae0dc27b8ecf38a9a074125d18a2209a1251654 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Wed Jul 7 19:42:02 2021 +0000 fixup! Bug 40018: Add FF89 audit --- audits/FF89_NETWORK_AUDIT | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/audits/FF89_NETWORK_AUDIT b/audits/FF89_NETWORK_AUDIT index d62dcda..755746b 100644 --- a/audits/FF89_NETWORK_AUDIT +++ b/audits/FF89_NETWORK_AUDIT @@ -119,6 +119,6 @@ End: edea181c543ffee077bb3ca52830ba8d320358b2 # v89.1.1 ============ Regression/Prior Vuln Review ========= Review proxy bypass bugs; check for new vectors to look for: - - https://trac.torproject.org/projects/tor/query?keywords=~tbb-proxy + - https://gitlab.torproject.org/groups/tpo/applications/-/issues?scope=all&ut… - Look for new features like these. Especially external app launch vectors

1 0

[tor-browser-spec/master] Bug 40018: Add FF89 audit
by sysrqb＠torproject.org 07 Jul '21

07 Jul '21

commit 80f02da492bf415045b9df1035f522a8dd973918 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Tue Jun 15 13:55:55 2021 +0000 Bug 40018: Add FF89 audit --- audits/FF89_NETWORK_AUDIT | 124 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 124 insertions(+) diff --git a/audits/FF89_NETWORK_AUDIT b/audits/FF89_NETWORK_AUDIT new file mode 100644 index 0000000..d62dcda --- /dev/null +++ b/audits/FF89_NETWORK_AUDIT @@ -0,0 +1,124 @@ +=============== Firefox General ============= + +Start: 676143236541851e068696fa4528d87a9bb0088d # FIREFOX_88_0_BUILD1 +End: 3862f77749dd50e54c3d9eea32fb59e84d978c96 # FIREFOX_89_0_RELEASE + +=============== Firefox Native DNS Portion ============= + +PR_GetHostByName +PR_GetIPNodeByName +PR_GetAddrInfoByName +PR_StringToNetAddr (itself is good as it passes AI_NUMERICHOST to getaddrinfo. No resolution.) + +MDNS +TRR (DNS Trusted Recursive Resolver) +Direct Paths to DNS resolution: +nsDNSService::Resolve +nsDNSService::AsyncResolve +nsHostResolver::ResolveHost + +# FF89: Nothing of interest (using `code_audit.sh`) + +============ Firefox Misc Socket Portion ============== + +SOCK_ +SOCKET_ +_SOCKET + +UDPSocket +TCPSocket + PR_NewTCPSocket + AsyncTCPSocket + +Misc PR_Socket + +# FF89: Nothing of interest (using `code_audit.sh`) + +=========== Firefox Misc XPCOM Portion ================ + +Misc XPCOM (including commands for pre-diff review approach) + *SocketProvider + grep -R udp-socket . + grep -R tcp-socket . + grep for tcpsocket + grep -R "NS_" | grep SOCKET | grep "_C" + grep -R "@mozilla.org/network/" . | grep socket | grep -v udp-socket + +# FF89: Nothing of interest (using `code_audit.sh`) + +============ Firefox Rust Portion ================ + +Rust + +# FF89: Nothing of interest (using `code_audit.sh`) + +============ Firefox Android Portion ============= + +Android Java calls + - URLConnection + - XXX: getInputStream? other methods? + - HttpURLConnection + - UrlConnectionDownloader + - ch.boye.httpclientandroidlib.impl.client.* (look for execute() calls) + - grep -n openConnection\( mobile/android/thirdparty/ + - java.net.URL -- has SEVERAL proxy bypass URL fetching methods :/ + - java.net + - javax.net + - ch.boye.httpclientandroidlib.conn.* (esp ssl) + - ch.boye.httpclientandroidlib.impl.conn.* (esp ssl) + - Sudden appearance of thirdparty libs: + - OkHttp + - Retrofit + - Glide + - com.amitshekhar.android + - IntentHelper + - openUriExternal (can come from GeckoAppShell too) + - getHandlersForMimeType + - getHandlersForURL + - getHandlersForIntent + - android.content.Intent - too common; instead find launch methods: + - startActivity + - startActivities + - sendBroadcast + - sendOrderedBroadcast + - startService + - bindService + - android.app.PendingIntent + - android.app.DownloadManager + - ActivityHandlerHelper.startIntentAndCatch + +# FF89: Nothing of interest (using `code_audit.sh`) + +============ Application Services Portion ============= + +Start: ad7b64fa03eeeb00815125e635d1fb8809befd40 # v74.0.1 +End: ad7b64fa03eeeb00815125e635d1fb8809befd40 # v74.0.1 + +# FF89: No change + +============ Android Components Portion ============= + +Start: e09d8a00b5eae63767d905a74966be301b5dd059 # v74.0.11 +End: 5204f4025ce8b60c64f92eb3f60ee644cafd4fc8 # v75.0.22 + +# FF89 (using `code_audit.sh`) +# Issue #9857 +# - Add first test cases for FillRequestHandler. +# - Review Result: Safe + +============ Fenix Portion ============= + +Start: 5f98c4ec98d663c763dc4ec5ea84a14cdf342d04 # v88.1.1 +End: edea181c543ffee077bb3ca52830ba8d320358b2 # v89.1.1 + +# FF89: (using `code_audit.sh`) +# For #18608 +# - made set a default browser functionality publicly available. +# - Review Result: Safe + +============ Regression/Prior Vuln Review ========= + +Review proxy bypass bugs; check for new vectors to look for: + - https://trac.torproject.org/projects/tor/query?keywords=~tbb-proxy + - Look for new features like these. Especially external app launch vectors +

1 0