- tbb-commits - lists.torproject.org

[torbutton/maint-10.0] Switch DDG search on homepage from POST to GET
by sysrqb＠torproject.org 17 Feb '21

17 Feb '21

commit 74d22e9cc3cd29bc5f676ffb17bfd3c05c59081a Author: Peter Story <pstory(a)andrew.cmu.edu> Date: Mon Jan 11 13:56:54 2021 -0500 Switch DDG search on homepage from POST to GET See tor-browser#40287 Also, eliminate extra "b" parameter from the search form. The presence of "b" would reveal that the search was initiated from the landing page, rather than the urlbar. --- chrome/content/aboutTor/aboutTor.xhtml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/chrome/content/aboutTor/aboutTor.xhtml b/chrome/content/aboutTor/aboutTor.xhtml index fdc02593..a5ef1f1c 100644 --- a/chrome/content/aboutTor/aboutTor.xhtml +++ b/chrome/content/aboutTor/aboutTor.xhtml @@ -53,12 +53,12 @@ </div> <div class="searchbox hideIfTorOff">  - <form action="&aboutTor.searchDDGPost.link;" method="post"> + <form action="&aboutTor.searchDDGPost.link;" method="get"> <div class="searchwrapper"> <label class="searchlabel" for="search-text"> </label> <input name="q" id="search-text" placeholder="&aboutTor.search.label;" autocomplete="off" type="text"/> - <input name="b" id="search-button" value="" + <input id="search-button" value="" title="&aboutTor.search.label;" alt="&aboutTor.search.label;" type="submit"/> </div>

1 0

[tor-browser/tor-browser-78.7.1esr-10.0-1] fixup! Bug 10760: Integrate TorButton to TorBrowser core
by sysrqb＠torproject.org 16 Feb '21

16 Feb '21

commit c3890932793466b647d6f4c1c1dee32bd7e6ccbe Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Tue Feb 16 21:44:47 2021 +0000 fixup! Bug 10760: Integrate TorButton to TorBrowser core --- toolkit/torproject/torbutton | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/toolkit/torproject/torbutton b/toolkit/torproject/torbutton index 4c72d3fced61..1138ead65a4d 160000 --- a/toolkit/torproject/torbutton +++ b/toolkit/torproject/torbutton @@ -1 +1 @@ -Subproject commit 4c72d3fced61c72023621996682995ad5bf74e7e +Subproject commit 1138ead65a4d3083c9d9d9d819a5c23dd3264603

1 0

[torbutton/maint-10.0] Bug 40026: Add feedback survey banner
by sysrqb＠torproject.org 16 Feb '21

16 Feb '21

commit 90ecad19b0194b8378b770c4122800d39c4371ce Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Mon Feb 8 21:58:13 2021 +0000 Bug 40026: Add feedback survey banner --- chrome/content/aboutTor/aboutTor.xhtml | 11 ++++++++ chrome/skin/aboutTor.css | 47 ++++++++++++++++++++++++++++++++++ chrome/skin/tor-survey-icon.svg | 1 + 3 files changed, 59 insertions(+) diff --git a/chrome/content/aboutTor/aboutTor.xhtml b/chrome/content/aboutTor/aboutTor.xhtml index 5e9ffea0..6121ea5e 100644 --- a/chrome/content/aboutTor/aboutTor.xhtml +++ b/chrome/content/aboutTor/aboutTor.xhtml @@ -65,6 +65,17 @@ </form> </div> + <div id="surveyBanner"> + <img id="surveyImg" src="resource://torbutton-assets/tor-survey-icon.svg" /> + <div id="surveyTextCol"> + <div id="surveyHeader">We’d love to get your feedback</div> + <br /> + <div id="surveyDescription">We put our users at the center of our development process. You can help us improve Tor Browser by completing this short survey about your experience:</div> + <br /> + <a id="surveyLink" target="_blank" href="https://survey.torproject.org/index.php/217469">Launch the Survey</a> + </div> + </div> + <div id="bottom"> <p id="donate" class="moreInfoLink">&aboutTor.donationBanner.freeToUse; <a href="https://donate.torproject.org/">&aboutTor.donationBanner.buttonA; »</a> diff --git a/chrome/skin/aboutTor.css b/chrome/skin/aboutTor.css index 8d5c4a83..d53e4060 100644 --- a/chrome/skin/aboutTor.css +++ b/chrome/skin/aboutTor.css @@ -212,6 +212,53 @@ body:not([showmanual]) .showForManual { background-color: rgba(12, 12, 13, 0.1); /* same as Firefox's about:home */ } +#surveyBanner { + width: 690px; + padding: 20px 25px 25px; + background: rgba(0, 0, 0, 0.3); + border-radius: 6px; + margin: 35px auto 0px; + display: flex; + flex-direction: row; + align-items: flex-start; + position: static; +} + +@media only screen and (min-width: 900px) { + #surveyBanner { + margin: 35px 0px 0px 135px; + } +} + +#surveyTextCol { + padding: 8px 0px 0px 15px; + font-size: 15px; + line-height: normal; + color: #FFFFFF; + width: 633px; +} + +#surveyHeader { + font-weight: bold; +} + +#surveyImg { + width: 32px; + position: static; +} + +div.surveyDescription, div.surveyLink { + padding-top: 10px; +} + +a#surveyLink { + text-decoration: underline; +} + +a#surveyLink:hover { + text-decoration: none; +} + /* #search-text is the search input field */ #search-text { flex: 1; diff --git a/chrome/skin/tor-survey-icon.svg b/chrome/skin/tor-survey-icon.svg new file mode 100644 index 00000000..6e1eca1a --- /dev/null +++ b/chrome/skin/tor-survey-icon.svg @@ -0,0 +1 @@ +<svg fill="none" height="32" viewBox="0 0 32 32" width="32" xmlns="http://www.w3.org/2000/svg"><rect fill="#df58a9" height="32" rx="16" width="32"/><g fill="#240a3b"><path clip-rule="evenodd" d="m16.3397 25c-4.9708 0-8.99998-4.0295-8.99998-9.0002 0-4.9706 4.02918-8.9998 8.99998-8.9998 4.9706 0 9 4.0292 9 8.9998 0 4.9707-4.0294 9.0002-9 9.0002zm.0185-2.7279v1.091c4.0584-.01 7.3449-3.3024 7.3449-7.3633 0-4.0607-3.2865-7.35293-7.3449-7.36316v1.09101c3.4559.00997 6.2541 2.81395 6.2541 6.27215 0 3.4583-2.7982 6.2623-6.2541 6.2723zm3.527-6.2723c0 1.9519-1.5778 3.5344-3.527 3.5447v1.0907c2.552-.0099 4.618-2.0809 4.618-4.6354 0-2.5543-2.066-4.6253-4.618-4.6353v1.0908c1.9492.0102 3.527 1.5927 3.527 3.5445zm-3.527-1.9081c1.0456.01 1.8906.86 1.8906 1.908 0 1.0484-.845 1.8984-1.8906 1.9084z" fill-rule="evenodd"/><path d="m10.3461 4.99805c-.3237-.07201-.6639-.08099-1.00111-.02643s-.66484.17159-.96417.34441-.56449.39804-.78035.66279c-.21585.26475-.37816.56384-.47766.8802l-.2066.65635-.67173-.1492 5c-.65378-.14527-1.36067-.03082-1.96515.31818-.60449.349-1.05705.90396-1.25814 1.54278-.20108.63883-.13422 1.30922.18589 1.86362.32011.5545.86723.9476 1.52102 1.0928l.67172.1493 4.93018 1.0955 1.5164-4.81745.2066-.65635c.0997-.31632.1345-.64373.1027-.96352-.0319-.31979-.1299-.6257-.2884-.90025s-.3744-.51236-.6354-.69985c-.261-.18748-.562-.32097-.8858-.39283z" stroke="#df58a9" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.2"/></g></svg> \ No newline at end of file

1 0

[torbutton/maint-10.0] fixup! Bug 40026: Add feedback survey banner
by sysrqb＠torproject.org 16 Feb '21

16 Feb '21

commit 1138ead65a4d3083c9d9d9d819a5c23dd3264603 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Tue Feb 16 21:32:26 2021 +0000 fixup! Bug 40026: Add feedback survey banner --- chrome/content/aboutTor/aboutTor.xhtml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/chrome/content/aboutTor/aboutTor.xhtml b/chrome/content/aboutTor/aboutTor.xhtml index 6121ea5e..fdc02593 100644 --- a/chrome/content/aboutTor/aboutTor.xhtml +++ b/chrome/content/aboutTor/aboutTor.xhtml @@ -72,7 +72,7 @@ <br /> <div id="surveyDescription">We put our users at the center of our development process. You can help us improve Tor Browser by completing this short survey about your experience:</div> <br /> - <a id="surveyLink" target="_blank" href="https://survey.torproject.org/index.php/217469">Launch the Survey</a> + <a id="surveyLink" target="_blank" href="http://bogdyardcfurxcle.onion/index.php/217469">Launch the Survey</a> </div> </div>

1 0

[torbutton/master] fixup! Bug 40026: Add feedback survey banner
by sysrqb＠torproject.org 16 Feb '21

16 Feb '21

commit ac4114cd6d036cc76b98a3b35fa98e7c8e96104a Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Tue Feb 16 21:32:26 2021 +0000 fixup! Bug 40026: Add feedback survey banner --- chrome/content/aboutTor/aboutTor.xhtml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/chrome/content/aboutTor/aboutTor.xhtml b/chrome/content/aboutTor/aboutTor.xhtml index 0eca9976..a5ef1f1c 100644 --- a/chrome/content/aboutTor/aboutTor.xhtml +++ b/chrome/content/aboutTor/aboutTor.xhtml @@ -72,7 +72,7 @@ <br /> <div id="surveyDescription">We put our users at the center of our development process. You can help us improve Tor Browser by completing this short survey about your experience:</div> <br /> - <a id="surveyLink" target="_blank" href="https://survey.torproject.org/index.php/217469">Launch the Survey</a> + <a id="surveyLink" target="_blank" href="http://bogdyardcfurxcle.onion/index.php/217469">Launch the Survey</a> </div> </div>

1 0

[tor-browser-spec/master] Bug 40013: Add FF86 audit
by gk＠torproject.org 11 Feb '21

11 Feb '21

commit 5422d6088430108cbc5f407e83d8e792899f7cdd Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Tue Feb 9 22:56:18 2021 +0000 Bug 40013: Add FF86 audit --- audits/FF86_NETWORK_AUDIT | 140 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 140 insertions(+) diff --git a/audits/FF86_NETWORK_AUDIT b/audits/FF86_NETWORK_AUDIT new file mode 100644 index 0000000..74d76b0 --- /dev/null +++ b/audits/FF86_NETWORK_AUDIT @@ -0,0 +1,140 @@ +`git diff 5a2e34d5821fa203454eb9a8b12d7749a7c50d00 cb5d7889e9b8fb61fe5fe6c87f6b58e261be0ddb` +and then go over all the changes containing the +below mentioned potentially dangerous calls and features. Grep the diff for +the following strings and examine surrounding usage. + +=============== Native DNS Portion ============= + +PR_GetHostByName +PR_GetIPNodeByName +PR_GetAddrInfoByName +PR_StringToNetAddr (itself is good as it passes AI_NUMERICHOST to getaddrinfo. No resolution.) + +MDNS +TRR (DNS Trusted Recursive Resolver) +Direct Paths to DNS resolution: +nsDNSService::Resolve +nsDNSService::AsyncResolve +nsHostResolver::ResolveHost + +# FF86: +# Bug 1652723 : +# - Prefetch https rr in HTMLDNSPrefetch +# - Review Result: Safe + +============ Misc Socket Portion ============== + +SOCK_ +SOCKET_ +_SOCKET + +# FF86: +# - Bug 1685900 +# - Split internal and external contentPolicyType +# - Review Result: Safe + +UDPSocket +TCPSocket + PR_NewTCPSocket + AsyncTCPSocket + +Misc PR_Socket + +# FF86: Nothing of interest + +=========== Misc XPCOM Portion ================ + +Misc XPCOM (including commands for pre-diff review approach) + *SocketProvider + grep -R udp-socket . + grep -R tcp-socket . + grep for tcpsocket + grep -R "NS_" | grep SOCKET | grep "_C" + grep -R "@mozilla.org/network/" . | grep socket | grep -v udp-socket + +# FF86: +# Bug 1684982: +# - Add a scope to XRE_mainRun +# - Review Result: Safe + +# Bug 1681307 +# - clean up view-source utils now that .webShell property on the progress listener no longer exists +# - Review Result: Safe + +============ Rust Portion ================ + +Rust + - XXX: What do we grep for here? Or do we rely on Ritter's compile-time tool? + - Check for new sendmsg and recvmsg usage + +# FF86: Nothing of interest (mostly new neqo tests) + +============ Android Portion ============= + +Android Java calls + - URLConnection + - XXX: getInputStream? other methods? + - HttpURLConnection + - UrlConnectionDownloader + - ch.boye.httpclientandroidlib.impl.client.* (look for execute() calls) + - grep -n openConnection\( mobile/android/thirdparty/ + - java.net.URL -- has SEVERAL proxy bypass URL fetching methods :/ + - java.net + - javax.net + - ch.boye.httpclientandroidlib.conn.* (esp ssl) + - ch.boye.httpclientandroidlib.impl.conn.* (esp ssl) + - Sudden appearance of thirdparty libs: + - OkHttp + - Retrofit + - Glide + - com.amitshekhar.android + - IntentHelper + - openUriExternal (can come from GeckoAppShell too) + - getHandlersForMimeType + - getHandlersForURL + - getHandlersForIntent + - android.content.Intent - too common; instead find launch methods: + - startActivity + - startActivities + - sendBroadcast + - sendOrderedBroadcast + - startService + - bindService + - android.app.PendingIntent + - android.app.DownloadManager + - ActivityHandlerHelper.startIntentAndCatch + +# FF86: Nothing new (using `java_audit.sh`) + +============ Application Services Portion ============= + +Start: 4cc798c8cd8a1e38ce88e0bb22a05692be63b164 # v67.2.0 +End: 4cc798c8cd8a1e38ce88e0bb22a05692be63b164 # v67.2.0 + +# FF86: Same tag as FF85 + +============ Android Components Portion ============= + +Start: 21ce9abdda0bc4001a72835fbbe7d71026ac0e66 # v70.0.16 +End: 4f36d0f93dab50e946a0dede0732c901c9942851 # v72.0.5 + +# FF86 (using `java_audit.sh`) +# Issue 8598: +# - Adds ActivityDelegate to support the GeckoView delegate +# - Review Result: Conditionally Safe +# - Comment: Uses PendingIntent, safety depends on usage. Current +# usage by new WebAuthn support in Fenix is safe. + +============ Fenix Portion ============= + +Start: 24995d51a12d8e0bb10166f9f286c68d23b84a6a # v85.1.0 +End: 159c13ba04cdd8e4cd888b637d65e11e95241696 # v86.0.0-beta.2 + +# FF86: Nothing new (using `java_audit.sh`) + +============ Regression/Prior Vuln Review ========= + +Review proxy bypass bugs; check for new vectors to look for: + - https://trac.torproject.org/projects/tor/query?keywords=~tbb-proxy + - Look for new features like these. Especially external app launch vectors +

1 0

[tor-browser/tor-browser-78.7.1esr-10.5-1] 40209: Implement Basic Crypto Safety
by sysrqb＠torproject.org 10 Feb '21

10 Feb '21

commit cc7dcbbba2139416c2a4f4ab39ac04bc54f30f83 Author: sanketh <me(a)snkth.com> Date: Mon Feb 8 20:12:44 2021 -0500 40209: Implement Basic Crypto Safety Adds a CryptoSafety actor which detects when you've copied a crypto address from a HTTP webpage and shows a warning. Closes #40209. --- browser/actors/CryptoSafetyChild.jsm | 87 ++++++++++++++++ browser/actors/CryptoSafetyParent.jsm | 142 +++++++++++++++++++++++++++ browser/actors/moz.build | 2 + browser/base/content/popup-notifications.inc | 14 +++ browser/components/BrowserGlue.jsm | 17 ++++ browser/modules/TorStrings.jsm | 48 +++++++++ browser/themes/shared/browser.inc.css | 5 + toolkit/content/license.html | 32 ++++++ toolkit/modules/Bech32Decode.jsm | 103 +++++++++++++++++++ toolkit/modules/moz.build | 1 + 10 files changed, 451 insertions(+) diff --git a/browser/actors/CryptoSafetyChild.jsm b/browser/actors/CryptoSafetyChild.jsm new file mode 100644 index 000000000000..87ff261d4915 --- /dev/null +++ b/browser/actors/CryptoSafetyChild.jsm @@ -0,0 +1,87 @@ +/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */ +/* Copyright (c) 2020, The Tor Project, Inc. + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +var EXPORTED_SYMBOLS = ["CryptoSafetyChild"]; + +const { Bech32Decode } = ChromeUtils.import( + "resource://gre/modules/Bech32Decode.jsm" +); + +const { XPCOMUtils } = ChromeUtils.import( + "resource://gre/modules/XPCOMUtils.jsm" +); + +const kPrefCryptoSafety = "security.cryptoSafety"; + +XPCOMUtils.defineLazyPreferenceGetter( + this, + "isCryptoSafetyEnabled", + kPrefCryptoSafety, + true /* defaults to true */ +); + +function looksLikeCryptoAddress(s) { + // P2PKH and P2SH addresses + // https://stackoverflow.com/a/24205650 + const bitcoinAddr = /^[13][a-km-zA-HJ-NP-Z1-9]{25,39}$/; + if (bitcoinAddr.test(s)) { + return true; + } + + // Bech32 addresses + if (Bech32Decode(s) !== null) { + return true; + } + + // regular addresses + const etherAddr = /^0x[a-fA-F0-9]{40}$/; + if (etherAddr.test(s)) { + return true; + } + + // t-addresses + // https://www.reddit.com/r/zec/comments/8mxj6x/simple_regex_to_validate_a_zca… + const zcashAddr = /^t1[a-zA-Z0-9]{33}$/; + if (zcashAddr.test(s)) { + return true; + } + + // Standard, Integrated, and 256-bit Integrated addresses + // https://monero.stackexchange.com/a/10627 + const moneroAddr = /^4(?:[0-9AB]|[1-9A-HJ-NP-Za-km-z]{12}(?:[1-9A-HJ-NP-Za-km-z]{30})?)[1-9A-HJ-NP-Za-km-z]{93}$/; + if (moneroAddr.test(s)) { + return true; + } + + return false; +} + +class CryptoSafetyChild extends JSWindowActorChild { + handleEvent(event) { + if (isCryptoSafetyEnabled) { + // Ignore non-HTTP addresses + if (!this.document.documentURIObject.schemeIs("http")) { + return; + } + // Ignore onion addresses + if (this.document.documentURIObject.host.endsWith(".onion")) { + return; + } + + if (event.type == "copy" || event.type == "cut") { + this.contentWindow.navigator.clipboard.readText().then(clipText => { + const selection = clipText.trim(); + if (looksLikeCryptoAddress(selection)) { + this.sendAsyncMessage("CryptoSafety:CopiedText", { + selection, + }); + } + }); + } + } + } +} diff --git a/browser/actors/CryptoSafetyParent.jsm b/browser/actors/CryptoSafetyParent.jsm new file mode 100644 index 000000000000..bac151df5511 --- /dev/null +++ b/browser/actors/CryptoSafetyParent.jsm @@ -0,0 +1,142 @@ +/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */ +/* Copyright (c) 2020, The Tor Project, Inc. + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +var EXPORTED_SYMBOLS = ["CryptoSafetyParent"]; + +const { XPCOMUtils } = ChromeUtils.import( + "resource://gre/modules/XPCOMUtils.jsm" +); + +XPCOMUtils.defineLazyModuleGetters(this, { + TorStrings: "resource:///modules/TorStrings.jsm", +}); + +const kPrefCryptoSafety = "security.cryptoSafety"; + +XPCOMUtils.defineLazyPreferenceGetter( + this, + "isCryptoSafetyEnabled", + kPrefCryptoSafety, + true /* defaults to true */ +); + +class CryptoSafetyParent extends JSWindowActorParent { + getBrowser() { + return this.browsingContext.top.embedderElement; + } + + receiveMessage(aMessage) { + if (isCryptoSafetyEnabled) { + if (aMessage.name == "CryptoSafety:CopiedText") { + showPopup(this.getBrowser(), aMessage.data.selection); + } + } + } +} + +function trimAddress(cryptoAddr) { + if (cryptoAddr.length <= 32) { + return cryptoAddr; + } + return cryptoAddr.substring(0, 32) + "..."; +} + +function showPopup(aBrowser, cryptoAddr) { + const chromeDoc = aBrowser.ownerDocument; + if (chromeDoc) { + const win = chromeDoc.defaultView; + const cryptoSafetyPrompt = new CryptoSafetyPrompt( + aBrowser, + win, + cryptoAddr + ); + cryptoSafetyPrompt.show(); + } +} + +class CryptoSafetyPrompt { + constructor(aBrowser, aWin, cryptoAddr) { + this._browser = aBrowser; + this._win = aWin; + this._cryptoAddr = cryptoAddr; + } + + show() { + const primaryAction = { + label: TorStrings.cryptoSafetyPrompt.primaryAction, + accessKey: TorStrings.cryptoSafetyPrompt.primaryActionAccessKey, + callback: () => { + this._win.torbutton_new_circuit(); + }, + }; + + const secondaryAction = { + label: TorStrings.cryptoSafetyPrompt.secondaryAction, + accessKey: TorStrings.cryptoSafetyPrompt.secondaryActionAccessKey, + callback: () => {}, + }; + + let _this = this; + const options = { + popupIconURL: "chrome://browser/skin/cert-error.svg", + eventCallback(aTopic) { + if (aTopic === "showing") { + _this._onPromptShowing(); + } + }, + }; + + const cryptoWarningText = TorStrings.cryptoSafetyPrompt.cryptoWarning.replace( + "%S", + trimAddress(this._cryptoAddr) + ); + + if (this._win.PopupNotifications) { + this._prompt = this._win.PopupNotifications.show( + this._browser, + "crypto-safety-warning", + cryptoWarningText, + null /* anchor ID */, + primaryAction, + [secondaryAction], + options + ); + } + } + + _onPromptShowing() { + let xulDoc = this._browser.ownerDocument; + + let whatCanHeading = xulDoc.getElementById( + "crypto-safety-warning-notification-what-can-heading" + ); + if (whatCanHeading) { + whatCanHeading.textContent = TorStrings.cryptoSafetyPrompt.whatCanHeading; + } + + let whatCanBody = xulDoc.getElementById( + "crypto-safety-warning-notification-what-can-body" + ); + if (whatCanBody) { + whatCanBody.textContent = TorStrings.cryptoSafetyPrompt.whatCanBody; + } + + let learnMoreElem = xulDoc.getElementById( + "crypto-safety-warning-notification-learnmore" + ); + if (learnMoreElem) { + learnMoreElem.setAttribute( + "value", + TorStrings.cryptoSafetyPrompt.learnMore + ); + learnMoreElem.setAttribute( + "href", + TorStrings.cryptoSafetyPrompt.learnMoreURL + ); + } + } +} diff --git a/browser/actors/moz.build b/browser/actors/moz.build index e70f0f09fe3a..9eb5ca397060 100644 --- a/browser/actors/moz.build +++ b/browser/actors/moz.build @@ -50,6 +50,8 @@ FINAL_TARGET_FILES.actors += [ 'ContentSearchParent.jsm', 'ContextMenuChild.jsm', 'ContextMenuParent.jsm', + 'CryptoSafetyChild.jsm', + 'CryptoSafetyParent.jsm', 'DOMFullscreenChild.jsm', 'DOMFullscreenParent.jsm', 'FormValidationChild.jsm', diff --git a/browser/base/content/popup-notifications.inc b/browser/base/content/popup-notifications.inc index 42e17e90c648..ff6f8cdeca80 100644 --- a/browser/base/content/popup-notifications.inc +++ b/browser/base/content/popup-notifications.inc @@ -114,3 +114,17 @@ </vbox> </popupnotificationfooter> </popupnotification> + + <popupnotification id="crypto-safety-warning-notification" hidden="true"> + <popupnotificationcontent orient="vertical"> + <description id="crypto-safety-warning-notification-desc"/> + <html:div id="crypto-safety-warning-notification-what-can"> + <html:strong id="crypto-safety-warning-notification-what-can-heading" /> + <html:br/> + <html:span id="crypto-safety-warning-notification-what-can-body" /> + </html:div> + <label id="crypto-safety-warning-notification-learnmore" + class="popup-notification-learnmore-link" + is="text-link"/> + </popupnotificationcontent> + </popupnotification> diff --git a/browser/components/BrowserGlue.jsm b/browser/components/BrowserGlue.jsm index 3750230a250b..5f708fca3d5c 100644 --- a/browser/components/BrowserGlue.jsm +++ b/browser/components/BrowserGlue.jsm @@ -297,6 +297,23 @@ let JSWINDOWACTORS = { allFrames: true, }, + CryptoSafety: { + parent: { + moduleURI: "resource:///actors/CryptoSafetyParent.jsm", + }, + + child: { + moduleURI: "resource:///actors/CryptoSafetyChild.jsm", + group: "browsers", + events: { + copy: { mozSystemGroup: true }, + cut: { mozSystemGroup: true }, + }, + }, + + allFrames: true, + }, + DOMFullscreen: { parent: { moduleURI: "resource:///actors/DOMFullscreenParent.jsm", diff --git a/browser/modules/TorStrings.jsm b/browser/modules/TorStrings.jsm index e8a8d37ae373..bf522234d588 100644 --- a/browser/modules/TorStrings.jsm +++ b/browser/modules/TorStrings.jsm @@ -101,6 +101,54 @@ class TorPropertyStringBundle { Security Level Strings */ var TorStrings = { + /* + CryptoSafetyPrompt Strings + */ + cryptoSafetyPrompt: (function() { + let tsb = new TorPropertyStringBundle( + "chrome://torbutton/locale/torbutton.properties", + "cryptoSafetyPrompt." + ); + let getString = function(key, fallback) { + return tsb.getString(key, fallback); + }; + + let retval = { + cryptoWarning: getString( + "cryptoSafetyPrompt.cryptoWarning", + "A cryptocurrency address (%S) has been copied from an insecure website. It could have been modified." + ), + whatCanHeading: getString( + "cryptoSafetyPrompt.whatCanHeading", + "What can you do about it?" + ), + whatCanBody: getString( + "cryptoSafetyPrompt.whatCanBody", + "You can try reconnecting with a new circuit to establish a secure connection, or accept the risk and dismiss this warning." + ), + learnMore: getString("cryptoSafetyPrompt.learnMore", "Learn more"), + learnMoreURL: `https://support.torproject.org/${getLocale()}/`, + primaryAction: getString( + "cryptoSafetyPrompt.primaryAction", + "Reload Tab with a New Circuit" + ), + primaryActionAccessKey: getString( + "cryptoSafetyPrompt.primaryActionAccessKey", + "R" + ), + secondaryAction: getString( + "cryptoSafetyPrompt.secondaryAction", + "Dismiss Warning" + ), + secondaryActionAccessKey: getString( + "cryptoSafetyPrompt.secondaryActionAccessKey", + "D" + ), + }; + + return retval; + })() /* CryptoSafetyPrompt Strings */, + /* Tor Browser Security Level Strings */ diff --git a/browser/themes/shared/browser.inc.css b/browser/themes/shared/browser.inc.css index 0113466e8e56..4ef27d880754 100644 --- a/browser/themes/shared/browser.inc.css +++ b/browser/themes/shared/browser.inc.css @@ -620,3 +620,8 @@ menupopup::part(drop-indicator) { #sharing-warning-proceed-to-tab:hover { background-color: rgb(0,62,170); } + +#crypto-safety-warning-notification-what-can { + display: block; + margin: 5px; +} diff --git a/toolkit/content/license.html b/toolkit/content/license.html index e44c31ec6d4e..90995236b41b 100644 --- a/toolkit/content/license.html +++ b/toolkit/content/license.html @@ -72,6 +72,7 @@ <li><a href="about:license#arm">ARM License</a></li> <li><a href="about:license#babel">Babel License</a></li> <li><a href="about:license#babylon">Babylon License</a></li> + <li><a href="about:license#bech32">Bech32 License</a></li> <li><a href="about:license#bincode">bincode License</a></li> <li><a href="about:license#bsd2clause">BSD 2-Clause License</a></li> <li><a href="about:license#bsd3clause">BSD 3-Clause License</a></li> @@ -2795,6 +2796,37 @@ furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN +THE SOFTWARE. +</pre> + + + <hr> + + <h1><a id="bech32"></a>Bech32 License</h1> + + <p>This license applies to the file + <code>toolkit/modules/Bech32Decode.jsm</code>. + </p> + +<pre> +Copyright (c) 2017 Pieter Wuille + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in +all copies or substantial portions of the Software. + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE diff --git a/toolkit/modules/Bech32Decode.jsm b/toolkit/modules/Bech32Decode.jsm new file mode 100644 index 000000000000..3a2bc7ae0a10 --- /dev/null +++ b/toolkit/modules/Bech32Decode.jsm @@ -0,0 +1,103 @@ +// Adapted from the reference implementation of Bech32 +// https://github.com/sipa/bech32 + +// Copyright (c) 2017 Pieter Wuille +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: +// +// The above copyright notice and this permission notice shall be included in +// all copies or substantial portions of the Software. +// +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN +// THE SOFTWARE. + +"use strict"; + +/** + * JS module implementation of Bech32 decoding adapted from the reference + * implementation https://github.com/sipa/bech32. + */ + +var EXPORTED_SYMBOLS = ["Bech32Decode"]; + +var CHARSET = "qpzry9x8gf2tvdw0s3jn54khce6mua7l"; +var GENERATOR = [0x3b6a57b2, 0x26508e6d, 0x1ea119fa, 0x3d4233dd, 0x2a1462b3]; + +function polymod(values) { + var chk = 1; + for (var p = 0; p < values.length; ++p) { + var top = chk >> 25; + chk = ((chk & 0x1ffffff) << 5) ^ values[p]; + for (var i = 0; i < 5; ++i) { + if ((top >> i) & 1) { + chk ^= GENERATOR[i]; + } + } + } + return chk; +} + +function hrpExpand(hrp) { + var ret = []; + var p; + for (p = 0; p < hrp.length; ++p) { + ret.push(hrp.charCodeAt(p) >> 5); + } + ret.push(0); + for (p = 0; p < hrp.length; ++p) { + ret.push(hrp.charCodeAt(p) & 31); + } + return ret; +} + +function verifyChecksum(hrp, data) { + return polymod(hrpExpand(hrp).concat(data)) === 1; +} + +function Bech32Decode(bechString) { + var p; + var has_lower = false; + var has_upper = false; + for (p = 0; p < bechString.length; ++p) { + if (bechString.charCodeAt(p) < 33 || bechString.charCodeAt(p) > 126) { + return null; + } + if (bechString.charCodeAt(p) >= 97 && bechString.charCodeAt(p) <= 122) { + has_lower = true; + } + if (bechString.charCodeAt(p) >= 65 && bechString.charCodeAt(p) <= 90) { + has_upper = true; + } + } + if (has_lower && has_upper) { + return null; + } + bechString = bechString.toLowerCase(); + var pos = bechString.lastIndexOf("1"); + if (pos < 1 || pos + 7 > bechString.length || bechString.length > 90) { + return null; + } + var hrp = bechString.substring(0, pos); + var data = []; + for (p = pos + 1; p < bechString.length; ++p) { + var d = CHARSET.indexOf(bechString.charAt(p)); + if (d === -1) { + return null; + } + data.push(d); + } + if (!verifyChecksum(hrp, data)) { + return null; + } + return { hrp: hrp, data: data.slice(0, data.length - 6) }; +} diff --git a/toolkit/modules/moz.build b/toolkit/modules/moz.build index e1f1eb5759c5..698d2773a7ed 100644 --- a/toolkit/modules/moz.build +++ b/toolkit/modules/moz.build @@ -160,6 +160,7 @@ EXTRA_JS_MODULES += [ 'ActorManagerParent.jsm', 'AppMenuNotifications.jsm', 'AsyncPrefs.jsm', + 'Bech32Decode.jsm', 'BinarySearch.jsm', 'BrowserUtils.jsm', 'CanonicalJSON.jsm',

1 0

[tor-browser/tor-browser-78.7.1esr-10.5-1] Merge remote-tracking branch 'sankethgl/40209-squashed-again' into tor-browser-78.7.1esr-10.5-1
by sysrqb＠torproject.org 10 Feb '21

10 Feb '21

commit 760b25c199910e2bd9ad4ef530ecb1516f1f0d5e Merge: 46d47c8f0cb0 cc7dcbbba213 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Wed Feb 10 18:57:15 2021 +0000 Merge remote-tracking branch 'sankethgl/40209-squashed-again' into tor-browser-78.7.1esr-10.5-1 browser/actors/CryptoSafetyChild.jsm | 87 ++++++++++++++++ browser/actors/CryptoSafetyParent.jsm | 142 +++++++++++++++++++++++++++ browser/actors/moz.build | 2 + browser/base/content/popup-notifications.inc | 14 +++ browser/components/BrowserGlue.jsm | 17 ++++ browser/modules/TorStrings.jsm | 48 +++++++++ browser/themes/shared/browser.inc.css | 5 + toolkit/content/license.html | 32 ++++++ toolkit/modules/Bech32Decode.jsm | 103 +++++++++++++++++++ toolkit/modules/moz.build | 1 + 10 files changed, 451 insertions(+)

1 0

[tor-browser/tor-browser-78.7.1esr-10.5-1] fixup! Bug 10760: Integrate TorButton to TorBrowser core
by sysrqb＠torproject.org 10 Feb '21

10 Feb '21

commit 46d47c8f0cb0872f56ddb1abeac4b33e580cadc1 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Wed Feb 10 00:07:03 2021 +0000 fixup! Bug 10760: Integrate TorButton to TorBrowser core --- toolkit/torproject/torbutton | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/toolkit/torproject/torbutton b/toolkit/torproject/torbutton index 28abe803ac50..edad4c65724f 160000 --- a/toolkit/torproject/torbutton +++ b/toolkit/torproject/torbutton @@ -1 +1 @@ -Subproject commit 28abe803ac506b792269568fe02a3813157de8ef +Subproject commit edad4c65724fecfcacec5afd7e8c394f850d9f1d

1 0

[torbutton/master] Bug 40026: Add feedback survey banner
by sysrqb＠torproject.org 10 Feb '21

10 Feb '21

commit edad4c65724fecfcacec5afd7e8c394f850d9f1d Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Mon Feb 8 21:58:13 2021 +0000 Bug 40026: Add feedback survey banner --- chrome/content/aboutTor/aboutTor.xhtml | 11 ++++++++ chrome/skin/aboutTor.css | 47 ++++++++++++++++++++++++++++++++++ chrome/skin/tor-survey-icon.svg | 1 + 3 files changed, 59 insertions(+) diff --git a/chrome/content/aboutTor/aboutTor.xhtml b/chrome/content/aboutTor/aboutTor.xhtml index 6c712a67..0eca9976 100644 --- a/chrome/content/aboutTor/aboutTor.xhtml +++ b/chrome/content/aboutTor/aboutTor.xhtml @@ -65,6 +65,17 @@ </form> </div> + <div id="surveyBanner"> + <img id="surveyImg" src="resource://torbutton-assets/tor-survey-icon.svg" /> + <div id="surveyTextCol"> + <div id="surveyHeader">We’d love to get your feedback</div> + <br /> + <div id="surveyDescription">We put our users at the center of our development process. You can help us improve Tor Browser by completing this short survey about your experience:</div> + <br /> + <a id="surveyLink" target="_blank" href="https://survey.torproject.org/index.php/217469">Launch the Survey</a> + </div> + </div> + <div id="bottom"> <p id="donate" class="moreInfoLink">&aboutTor.donationBanner.freeToUse; <a href="https://donate.torproject.org/">&aboutTor.donationBanner.buttonA; »</a> diff --git a/chrome/skin/aboutTor.css b/chrome/skin/aboutTor.css index 8d5c4a83..d53e4060 100644 --- a/chrome/skin/aboutTor.css +++ b/chrome/skin/aboutTor.css @@ -212,6 +212,53 @@ body:not([showmanual]) .showForManual { background-color: rgba(12, 12, 13, 0.1); /* same as Firefox's about:home */ } +#surveyBanner { + width: 690px; + padding: 20px 25px 25px; + background: rgba(0, 0, 0, 0.3); + border-radius: 6px; + margin: 35px auto 0px; + display: flex; + flex-direction: row; + align-items: flex-start; + position: static; +} + +@media only screen and (min-width: 900px) { + #surveyBanner { + margin: 35px 0px 0px 135px; + } +} + +#surveyTextCol { + padding: 8px 0px 0px 15px; + font-size: 15px; + line-height: normal; + color: #FFFFFF; + width: 633px; +} + +#surveyHeader { + font-weight: bold; +} + +#surveyImg { + width: 32px; + position: static; +} + +div.surveyDescription, div.surveyLink { + padding-top: 10px; +} + +a#surveyLink { + text-decoration: underline; +} + +a#surveyLink:hover { + text-decoration: none; +} + /* #search-text is the search input field */ #search-text { flex: 1; diff --git a/chrome/skin/tor-survey-icon.svg b/chrome/skin/tor-survey-icon.svg new file mode 100644 index 00000000..6e1eca1a --- /dev/null +++ b/chrome/skin/tor-survey-icon.svg @@ -0,0 +1 @@ +<svg fill="none" height="32" viewBox="0 0 32 32" width="32" xmlns="http://www.w3.org/2000/svg"><rect fill="#df58a9" height="32" rx="16" width="32"/><g fill="#240a3b"><path clip-rule="evenodd" d="m16.3397 25c-4.9708 0-8.99998-4.0295-8.99998-9.0002 0-4.9706 4.02918-8.9998 8.99998-8.9998 4.9706 0 9 4.0292 9 8.9998 0 4.9707-4.0294 9.0002-9 9.0002zm.0185-2.7279v1.091c4.0584-.01 7.3449-3.3024 7.3449-7.3633 0-4.0607-3.2865-7.35293-7.3449-7.36316v1.09101c3.4559.00997 6.2541 2.81395 6.2541 6.27215 0 3.4583-2.7982 6.2623-6.2541 6.2723zm3.527-6.2723c0 1.9519-1.5778 3.5344-3.527 3.5447v1.0907c2.552-.0099 4.618-2.0809 4.618-4.6354 0-2.5543-2.066-4.6253-4.618-4.6353v1.0908c1.9492.0102 3.527 1.5927 3.527 3.5445zm-3.527-1.9081c1.0456.01 1.8906.86 1.8906 1.908 0 1.0484-.845 1.8984-1.8906 1.9084z" fill-rule="evenodd"/><path d="m10.3461 4.99805c-.3237-.07201-.6639-.08099-1.00111-.02643s-.66484.17159-.96417.34441-.56449.39804-.78035.66279c-.21585.26475-.37816.56384-.47766.8802l-.2066.65635-.67173-.1492 5c-.65378-.14527-1.36067-.03082-1.96515.31818-.60449.349-1.05705.90396-1.25814 1.54278-.20108.63883-.13422 1.30922.18589 1.86362.32011.5545.86723.9476 1.52102 1.0928l.67172.1493 4.93018 1.0955 1.5164-4.81745.2066-.65635c.0997-.31632.1345-.64373.1027-.96352-.0319-.31979-.1299-.6257-.2884-.90025s-.3744-.51236-.6354-.69985c-.261-.18748-.562-.32097-.8858-.39283z" stroke="#df58a9" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.2"/></g></svg> \ No newline at end of file

1 0