tbb-commits

tbb-commits@lists.torproject.org

1 participants
17697 discussions

[torbutton/master] Bug 18913: about:tor should not have chrome privileges
by gk＠torproject.org 05 Jul '17

05 Jul '17

commit 32f9cf56c89ccd2e24924975dc5515e4198d28c3 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Sat Jun 24 08:52:19 2017 -0400 Bug 18913: about:tor should not have chrome privileges Rearchitect our implementation so that about:tor pages are always loaded in a content process. This also fixes: Bug 22535: Searching brings me to duckduckgo but my query is discarded. Bug 21948: Going back to about:tor page gives "Address isn't valid" error. Most of the code that initializes and updates about:tor content has been moved to a content script. When necessary, IPC is used to pass data from the chrome process to the content script. Removed old, no-longer-used m_tb_orig_BrowserOnAboutPageLoad variable from torbutton.js. Also, update the about:tor newChannel() implementation to accept an nsILoadInfo parameter. --- src/chrome.manifest | 3 - src/chrome/content/aboutTor/aboutTor-content.js | 328 ++++++++++++++++++++++++ src/chrome/content/aboutTor/aboutTor.xhtml | 143 +---------- src/chrome/content/torbutton.js | 257 ++++++------------- src/chrome/skin/aboutTor.css | 11 +- src/components/aboutTor.js | 21 +- src/components/startup-observer.js | 7 +- 7 files changed, 441 insertions(+), 329 deletions(-) diff --git a/src/chrome.manifest b/src/chrome.manifest index 75bef4e..272401b 100644 --- a/src/chrome.manifest +++ b/src/chrome.manifest @@ -152,9 +152,6 @@ contract @torproject.org/startup-observer;1 {06322def-6fde-4c06-aef6-47ae8e79962 component {e6204253-b690-4159-bfe8-d4eedab6b3be} components/cookie-jar-selector.js contract @torproject.org/cookie-jar-selector;1 {e6204253-b690-4159-bfe8-d4eedab6b3be} -component {84d47da6-79c3-4661-aa9f-8049476f7bf5} components/aboutTor.js -contract @mozilla.org/network/protocol/about;1?what=tor {84d47da6-79c3-4661-aa9f-8049476f7bf5} - component {5d57312b-5d8c-4169-b4af-e80d6a28a72e} components/torCheckService.js contract @torproject.org/torbutton-torCheckService;1 {5d57312b-5d8c-4169-b4af-e80d6a28a72e} diff --git a/src/chrome/content/aboutTor/aboutTor-content.js b/src/chrome/content/aboutTor/aboutTor-content.js new file mode 100644 index 0000000..ec515bb --- /dev/null +++ b/src/chrome/content/aboutTor/aboutTor-content.js @@ -0,0 +1,328 @@ +/************************************************************************* + * Copyright (c) 2017, The Tor Project, Inc. + * See LICENSE for licensing information. + * + * vim: set sw=2 sts=2 ts=8 et syntax=javascript: + * + * about:tor content script + *************************************************************************/ + +/* + * The following about:tor IPC messages are exchanged by this code and + * the code in torbutton.js: + * AboutTor:Loaded page loaded content -> chrome + * AboutTor:ChromeData privileged data chrome -> content + * AboutTor:GetToolbarData request toolbar info content -> chrome + * AboutTor:ToolbarData toolbar info chrome -> content + */ + +var {classes: Cc, interfaces: Ci, utils: Cu} = Components; + + +Cu.import("resource://gre/modules/Services.jsm"); +let { bindPrefAndInit } = Cu.import("resource://torbutton/modules/utils.js", {}); + + +var AboutTorListener = { + kAboutTorMessages: [ "AboutTor:ChromeData", "AboutTor:ToolbarData" ], + + get isAboutTor() { + return content.document.documentURI.toLowerCase() == "about:tor"; + }, + + init: function(aChromeGlobal) { + aChromeGlobal.addEventListener("AboutTorLoad", this, false, true); + }, + + handleEvent: function(aEvent) { + if (!this.isAboutTor) + return; + + switch (aEvent.type) { + case "AboutTorLoad": + this.onPageLoad(); + break; + case "pagehide": + this.onPageHide(); + break; + case "resize": + sendAsyncMessage("AboutTor:GetToolbarData"); + break; + } + }, + + receiveMessage: function(aMessage) { + if (!this.isAboutTor) + return; + + switch (aMessage.name) { + case "AboutTor:ChromeData": + this.onChromeDataUpdate(aMessage.data); + break; + case "AboutTor:ToolbarData": + this.onToolbarDataUpdate(aMessage.data); + break; + } + }, + + onPageLoad: function() { + // Arrange to update localized text and links. + bindPrefAndInit("general.useragent.locale", aNewVal => { + this.onLocaleChange(aNewVal); + }); + + // Add message and event listeners. + this.kAboutTorMessages.forEach(aMsg => addMessageListener(aMsg, this)); + addMessageListener("AboutTor:ChromeData", this); + addEventListener("pagehide", this, false); + addEventListener("resize", this, false); + + sendAsyncMessage("AboutTor:Loaded"); + }, + + onPageHide: function() { + removeEventListener("resize", this, false); + removeEventListener("pagehide", this, false); + this.kAboutTorMessages.forEach(aMsg => removeMessageListener(aMsg, this)); + }, + + onChromeDataUpdate: function(aData) { + let body = content.document.body; + + // Update status: tor on/off, update needed, Tor Browser manual shown. + if (aData.torOn) + body.setAttribute("toron", "yes"); + else + body.removeAttribute("toron"); + + if (aData.updateNeeded) + body.setAttribute("torNeedsUpdate", "yes"); + else + body.removeAttribute("torNeedsUpdate"); + + if (aData.showManual) + body.setAttribute("showmanual", "yes"); + else + body.removeAttribute("showmanual"); + + // Setting body.initialized="yes" displays the body, which must be done + // at this point because our remaining initialization depends on elements + // being visible so that their size and position are accurate. + body.setAttribute("initialized", "yes"); + + let containerName = "torstatus-" + (aData.torOn ? "on" : "off") + + "-container"; + this.adjustFontSizes(containerName); + + this.onToolbarDataUpdate(aData); + }, + + onToolbarDataUpdate: function(aData) { + this.adjustArrow(aData.toolbarButtonXPos); + }, + + onLocaleChange: function(aLocale) { + this.insertPropertyStrings(); + + // Set Tor Browser manual link. + content.document.getElementById("manualLink").href = + "https://tb-manual.torproject.org/" + aLocale; + + // Insert "Test Tor Network Settings" url. + let elem = content.document.getElementById("testTorSettings"); + if (elem) { + let url = Services.prefs.getCharPref( + "extensions.torbutton.test_url_interactive"); + elem.href = url.replace(/__LANG__/g, aLocale.replace(/-/g, '_')); + } + + // Display the Tor Browser product name and version. + try { + const kBrandBundle = "chrome://branding/locale/brand.properties"; + let brandBundle = Cc["@mozilla.org/intl/stringbundle;1"] + .getService(Ci.nsIStringBundleService) + .createBundle(kBrandBundle); + let productName = brandBundle.GetStringFromName("brandFullName"); + let tbbVersion = Services.prefs.getCharPref("torbrowser.version"); + elem = content.document.getElementById("torstatus-version"); + + while (elem.firstChild) + elem.removeChild(elem.firstChild); + elem.appendChild(content.document.createTextNode(productName + '\n' + + tbbVersion)); + } catch (e) {} + }, + + insertPropertyStrings: function() { + try { + let kPropertiesURL = "chrome://torbutton/locale/aboutTor.properties"; + + let stringBundle = Services.strings.createBundle(kPropertiesURL); + let s1 = stringBundle.GetStringFromName("aboutTor.searchDDG.privacy.link"); + let s2 = stringBundle.GetStringFromName("aboutTor.searchDDG.search.link"); + let result = stringBundle.formatStringFromName( + "aboutTor.searchDDG.privacy", [s1, s2], 2); + if (result) { + let elem = content.document.getElementById("searchProviderInfo"); + if (elem) + elem.innerHTML = result; + } + } catch(e) {} + }, + + // Ensure that text in top area does not overlap the tor on/off (onion) image. + // This is done by reducing the font sizes as necessary. + adjustFontSizes: function(aContainerName) + { + let imgElem = content.document.getElementById("torstatus-image"); + let containerElem = content.document.getElementById(aContainerName); + if (!imgElem || !containerElem) + return; + + try + { + let imgRect = imgElem.getBoundingClientRect(); + + for (let textElem = containerElem.firstChild; textElem; + textElem = textElem.nextSibling) + { + if ((textElem.nodeType != textElem.ELEMENT_NODE) || + (textElem.nodeName.toLowerCase() == "br")) + { + continue; + } + + let textRect = textElem.getBoundingClientRect(); + if (0 == textRect.width) + continue; + + // Reduce font to 90% of previous size, repeating the process up to 7 + // times. This allows for a maximum reduction to just less than 50% of + // the original size. + let maxTries = 7; + while ((textRect.left < imgRect.right) && (--maxTries >= 0)) + { + let style = content.document.defaultView + .getComputedStyle(textElem, null); + let fontSize = parseFloat(style.getPropertyValue("font-size")); + textElem.style.fontSize = (fontSize * 0.9) + "px"; + textRect = textElem.getBoundingClientRect(); + } + } + + } catch (e) {} + }, + + adjustArrow: function(aToolbarButtonXPos) + { + let win = content; + let doc = content.document; + let textElem = doc.getElementById("updatePrompt"); + let arrowHeadDiv = doc.getElementById("toolbarIconArrowHead"); + let vertExtDiv = doc.getElementById("toolbarIconArrowVertExtension"); + let bendDiv = doc.getElementById("toolbarIconArrowBend"); + let horzExtDiv = doc.getElementById("toolbarIconArrowHorzExtension"); + if (!textElem || !arrowHeadDiv || !vertExtDiv || !bendDiv || !horzExtDiv) + return; + + let arrowTailElems = [ vertExtDiv, bendDiv, horzExtDiv ]; + if (!aToolbarButtonXPos || isNaN(aToolbarButtonXPos) || + (aToolbarButtonXPos < 0)) + { + arrowHeadDiv.style.display = "none"; + for (let elem of arrowTailElems) + elem.style.display = "none"; + return; + } + + const kArrowMargin = 6; // Horizontal margin between line and text. + const kArrowHeadExtraWidth = 9; // Horizontal margin to the line. + const kArrowLineThickness = 11; + const kBendWidth = 22; + const kBendHeight = 22; + + try { + // Compensate for any content zoom that may be in effect on about:tor. + // Because window.devicePixelRatio always returns 1.0 for non-Chrome + // windows (see bug 13875), we use screenPixelsPerCSSPixel for the + // content window. + let pixRatio = content.QueryInterface(Ci.nsIInterfaceRequestor) + .getInterface(Ci.nsIDOMWindowUtils) + .screenPixelsPerCSSPixel; + let tbXpos = Math.round(aToolbarButtonXPos / pixRatio); + + arrowHeadDiv.style.display = "block"; // Must be visible to get offsetWidth. + let arrowHalfWidth = Math.round(arrowHeadDiv.offsetWidth / 2); + let leftAnchor = textElem.offsetLeft - kArrowMargin + - kBendWidth + Math.round(kArrowLineThickness / 2); + let rightAnchor = textElem.offsetLeft + textElem.offsetWidth + + kArrowMargin + arrowHalfWidth; + + let isArrowOnLeft = (tbXpos < leftAnchor); + let isArrowOnRight = (tbXpos > rightAnchor) && + (tbXpos < (win.innerWidth - arrowHalfWidth)); + let isArrowInMiddle = (tbXpos >= leftAnchor) && (tbXpos <= rightAnchor); + + if (isArrowOnLeft || isArrowOnRight || isArrowInMiddle) + { + // Position the arrow head. + let arrowHeadLeft = tbXpos - arrowHalfWidth; + arrowHeadDiv.style.left = arrowHeadLeft + "px"; + if (isArrowOnLeft || isArrowOnRight) + { + let horzExtBottom = textElem.offsetTop + + Math.round((textElem.offsetHeight + kArrowLineThickness) / 2); + + // Position the vertical (extended) line. + let arrowHeadBottom = arrowHeadDiv.offsetTop + + arrowHeadDiv.offsetHeight; + vertExtDiv.style.top = arrowHeadBottom + "px"; + vertExtDiv.style.left = (arrowHeadLeft + kArrowHeadExtraWidth) + "px"; + let ht = horzExtBottom - kBendHeight - arrowHeadBottom; + vertExtDiv.style.height = ht + "px"; + + // Position the bend (elbow). + bendDiv.style.top = (horzExtBottom - kBendHeight) + "px"; + let bendDivLeft; + if (isArrowOnLeft) + { + bendDiv.setAttribute("pos", "left"); + bendDivLeft = arrowHeadLeft + kArrowHeadExtraWidth; + } + else if (isArrowOnRight) + { + bendDiv.setAttribute("pos", "right"); + bendDivLeft = arrowHeadLeft + kArrowHeadExtraWidth + + kArrowLineThickness - kBendWidth; + } + bendDiv.style.left = bendDivLeft + "px"; + + // Position the horizontal (extended) line. + horzExtDiv.style.top = (horzExtBottom - kArrowLineThickness) + "px"; + let horzExtLeft, w; + if (isArrowOnLeft) + { + horzExtLeft = bendDivLeft + kBendWidth; + w = (textElem.offsetLeft - horzExtLeft - kArrowMargin); + } + else + { + horzExtLeft = rightAnchor - arrowHalfWidth; + w = tbXpos - arrowHalfWidth - horzExtLeft; + } + horzExtDiv.style.left = horzExtLeft + "px"; + horzExtDiv.style.width = w + "px"; + } + } + + let headDisplay = (isArrowOnLeft || isArrowInMiddle || isArrowOnRight) + ? "block" : "none"; + arrowHeadDiv.style.display = headDisplay; + let tailDisplay = (isArrowOnLeft || isArrowOnRight) ? "block" : "none"; + for (let elem of arrowTailElems) + elem.style.display = tailDisplay; + } catch (e) {} + } +}; + +AboutTorListener.init(this); diff --git a/src/chrome/content/aboutTor/aboutTor.xhtml b/src/chrome/content/aboutTor/aboutTor.xhtml index e4050fc..7ae4b8b 100644 --- a/src/chrome/content/aboutTor/aboutTor.xhtml +++ b/src/chrome/content/aboutTor/aboutTor.xhtml @@ -1,6 +1,6 @@ <?xml version="1.0" encoding="UTF-8"?>  @@ -20,154 +20,17 @@ <head> <title>&aboutTor.title;</title> <link rel="stylesheet" type="text/css" media="all" - href="chrome://torbutton/skin/aboutTor.css"/> + href="resource://torbutton/chrome/skin/aboutTor.css"/> <script type="text/javascript;version=1.7"> <![CDATA[ -Components.utils.import("resource://gre/modules/Services.jsm"); - -function onLoad() -{ - insertPropertyStrings(); - - let locale = Services.prefs.getCharPref("general.useragent.locale"); - document.getElementById("manualLink").href = "https://tb-manual.torproject.org/" + locale; - - document.addEventListener("AboutTorAdjustArrow", function() { - adjustToolbarIconArrow(); - }, false); - - window.setTimeout( function() { - adjustToolbarIconArrow(); - }, 0); -} - -function adjustToolbarIconArrow() -{ - let textElem = document.getElementById("updatePrompt"); - let arrowHeadDiv = document.getElementById("toolbarIconArrowHead"); - let vertExtDiv = document.getElementById("toolbarIconArrowVertExtension"); - let bendDiv = document.getElementById("toolbarIconArrowBend"); - let horzExtDiv = document.getElementById("toolbarIconArrowHorzExtension"); - if (!textElem || !arrowHeadDiv || !vertExtDiv || !bendDiv || !horzExtDiv) - return; - - let arrowTailElems = [ vertExtDiv, bendDiv, horzExtDiv ]; - let tbXpos; - if (document.body.hasAttribute("torbutton-xpos")) - tbXpos = parseInt(document.body.getAttribute("torbutton-xpos"), 10); - - if (!tbXpos || isNaN(tbXpos) || (tbXpos < 0)) - { - arrowHeadDiv.style.display = "none"; - for (let elem of arrowTailElems) - elem.style.display = "none"; - return; - } - - const kArrowMargin = 6; // Horizontal margin between line and text. - const kArrowHeadExtraWidth = 9; // Horizontal margin to the line. - const kArrowLineThickness = 11; - const kBendWidth = 22; - const kBendHeight = 22; - - arrowHeadDiv.style.display = "block"; // Must be visible to get offsetWidth. - let arrowHalfWidth = Math.round(arrowHeadDiv.offsetWidth / 2); - let leftAnchor = textElem.offsetLeft - kArrowMargin - - kBendWidth + Math.round(kArrowLineThickness / 2); - let rightAnchor = textElem.offsetLeft + textElem.offsetWidth - + kArrowMargin + arrowHalfWidth; - - let isArrowOnLeft = (tbXpos < leftAnchor); - let isArrowOnRight = (tbXpos > rightAnchor) && - (tbXpos < (window.innerWidth - arrowHalfWidth)); - let isArrowInMiddle = (tbXpos >= leftAnchor) && (tbXpos <= rightAnchor); - - if (isArrowOnLeft || isArrowOnRight || isArrowInMiddle) - { - // Position the arrow head. - let arrowHeadLeft = tbXpos - arrowHalfWidth; - arrowHeadDiv.style.left = arrowHeadLeft + "px"; - if (isArrowOnLeft || isArrowOnRight) - { - let horzExtBottom = textElem.offsetTop + - Math.round((textElem.offsetHeight + kArrowLineThickness) / 2); - - // Position the vertical (extended) line. - let arrowHeadBottom = arrowHeadDiv.offsetTop + arrowHeadDiv.offsetHeight; - vertExtDiv.style.top = arrowHeadBottom + "px"; - vertExtDiv.style.left = (arrowHeadLeft + kArrowHeadExtraWidth) + "px"; - let ht = horzExtBottom - kBendHeight - arrowHeadBottom; - vertExtDiv.style.height = ht + "px"; - - // Position the bend (elbow). - bendDiv.style.top = (horzExtBottom - kBendHeight) + "px"; - let bendDivLeft; - if (isArrowOnLeft) - { - bendDiv.setAttribute("pos", "left"); - bendDivLeft = arrowHeadLeft + kArrowHeadExtraWidth; - } - else if (isArrowOnRight) - { - bendDiv.setAttribute("pos", "right"); - bendDivLeft = arrowHeadLeft + kArrowHeadExtraWidth - + kArrowLineThickness - kBendWidth; - } - bendDiv.style.left = bendDivLeft + "px"; - - // Position the horizontal (extended) line. - horzExtDiv.style.top = (horzExtBottom - kArrowLineThickness) + "px"; - let horzExtLeft, w; - if (isArrowOnLeft) - { - horzExtLeft = bendDivLeft + kBendWidth; - w = (textElem.offsetLeft - horzExtLeft - kArrowMargin); - } - else - { - horzExtLeft = rightAnchor - arrowHalfWidth; - w = tbXpos - arrowHalfWidth - horzExtLeft; - } - horzExtDiv.style.left = horzExtLeft + "px"; - horzExtDiv.style.width = w + "px"; - } - } - - let headDisplay = (isArrowOnLeft || isArrowInMiddle || isArrowOnRight) - ? "block" : "none"; - arrowHeadDiv.style.display = headDisplay; - let tailDisplay = (isArrowOnLeft || isArrowOnRight) ? "block" : "none"; - for (let elem of arrowTailElems) - elem.style.display = tailDisplay; -} - -function insertPropertyStrings() -{ - try { - let kPropertiesURL = "chrome://torbutton/locale/aboutTor.properties"; - - let gStringBundle = Services.strings.createBundle(kPropertiesURL); - let s1 = gStringBundle.GetStringFromName("aboutTor.searchDDG.privacy.link"); - let s2 = gStringBundle.GetStringFromName("aboutTor.searchDDG.search.link"); - let result = gStringBundle.formatStringFromName("aboutTor.searchDDG.privacy", - [s1, s2], 2); - if (result) { - let elem = document.getElementById("searchProviderInfo"); - if (elem) - elem.innerHTML = result; - } - } catch(e) {}; -} - window.addEventListener("pageshow", function() { let evt = new CustomEvent("AboutTorLoad", { bubbles: true }); document.dispatchEvent(evt); }); - ]]> </script> </head> -<body dir="&locale.dir;" onload="onLoad();"> +<body dir="&locale.dir;"> <div id="torstatus" class="top"> <div id="torstatus-version"/> <div id="torstatus-image"/> diff --git a/src/chrome/content/torbutton.js b/src/chrome/content/torbutton.js index ae705a3..3999bd4 100644 --- a/src/chrome/content/torbutton.js +++ b/src/chrome/content/torbutton.js @@ -40,8 +40,6 @@ var m_tb_control_host = null; // Set if using TCP. var m_tb_control_pass = null; var m_tb_control_desc = null; // For logging. -var m_tb_orig_BrowserOnAboutPageLoad = null; - var m_tb_domWindowUtils = window.QueryInterface(Ci.nsIInterfaceRequestor). getInterface(Ci.nsIDOMWindowUtils); @@ -203,15 +201,24 @@ var torbutton_tor_check_observer = { // Update toolbar icon and tooltip. torbutton_update_toolbutton(); - // Update all open about:tor pages. If the user does not have an - // about:tor page open in the front most window, open one. - if (torbutton_update_all_abouttor_pages(undefined, false) < 1) { - var wm = Cc["@mozilla.org/appshell/window-mediator;1"] + // Update all open about:tor pages. + torbutton_abouttor_message_handler.updateAllOpenPages(); + + // If the user does not have an about:tor tab open in the front most + // window, open one. + var wm = Cc["@mozilla.org/appshell/window-mediator;1"] .getService(Components.interfaces.nsIWindowMediator); - var win = wm.getMostRecentWindow("navigator:browser"); - if (win == window) { - gBrowser.selectedTab = gBrowser.addTab("about:tor"); + var win = wm.getMostRecentWindow("navigator:browser"); + if (win == window) { + let foundTab = false; + let tabBrowser = top.getBrowser(); + for (let i = 0; !foundTab && (i < tabBrowser.browsers.length); ++i) { + let b = tabBrowser.getBrowserAtIndex(i); + foundTab = (b.currentURI.spec.toLowerCase() == "about:tor"); } + + if (!foundTab) + gBrowser.selectedTab = gBrowser.addTab("about:tor"); } } } @@ -332,10 +339,10 @@ function torbutton_init() { } } - // Add event listener for about:tor page loads. - document.addEventListener("AboutTorLoad", function(aEvent) { - torbutton_on_abouttor_load(aEvent.target); - }, false, true); + // Add about:tor IPC message listeners. + let aboutTorMessages = [ "AboutTor:Loaded", "AboutTor:GetToolbarData" ]; + aboutTorMessages.forEach(aMsg => window.messageManager.addMessageListener( + aMsg, torbutton_abouttor_message_handler)); // XXX: Get rid of the cached asmjs (or IndexedDB) files on disk in case we // don't allow things saved to disk. This is an ad-hoc fix to work around @@ -365,7 +372,7 @@ function torbutton_init() { // Detect toolbar customization and update arrow on about:tor pages. window.addEventListener("aftercustomization", function() { - torbutton_update_all_abouttor_pages(undefined, undefined); + torbutton_abouttor_message_handler.updateAllOpenPages(); }, false); //setting up context menu @@ -404,9 +411,58 @@ function torbutton_init() { torbutton_init_user_manual_links(); + // Arrange for our about:tor content script to be loaded in each frame. + window.messageManager.loadFrameScript( + "chrome://torbutton/content/aboutTor/aboutTor-content.js", true); + torbutton_log(3, 'init completed'); } +var torbutton_abouttor_message_handler = { + // Receive IPC messages from the about:tor content script. + receiveMessage: function(aMessage) { + switch(aMessage.name) { + case "AboutTor:Loaded": + torbutton_show_sec_slider_notification(); + aMessage.target.messageManager.sendAsyncMessage("AboutTor:ChromeData", + this.chromeData); + break; + case "AboutTor:GetToolbarData": + aMessage.target.messageManager.sendAsyncMessage("AboutTor:ToolbarData", + this.toolbarData); + break; + } + }, + + // Send privileged data to all of the about:tor content scripts. + updateAllOpenPages: function() { + window.messageManager.broadcastAsyncMessage("AboutTor:ChromeData", + this.chromeData); + }, + + // The chrome data contains all of the data needed by the about:tor + // content process that is only available here (in the chrome process). + // It is sent to the content process when an about:tor window is opened + // and in response to events such as the browser noticing that an update + // is available. + get chromeData() { + return { + torOn: torbutton_tor_check_ok(), + updateNeeded: torbutton_update_is_needed(), + showManual: torbutton_show_torbrowser_manual(), + toolbarButtonXPos: torbutton_get_toolbarbutton_xpos() + }; + }, + + // The toolbar data only contains the x coordinate of Torbutton's toolbar + // item; it is sent back to the content process as the about:tor window + // is resized. + get toolbarData() { + return { + toolbarButtonXPos: torbutton_get_toolbarbutton_xpos() + }; + } +}; function torbutton_should_prompt_for_language_preference() { return torbutton_get_general_useragent_locale().substring(0, 2) != "en" && @@ -570,7 +626,7 @@ function torbutton_notify_if_update_needed() { setOrClearAttribute(btn, "tbUpdateNeeded", updateNeeded); // Update all open about:tor pages. - torbutton_update_all_abouttor_pages(updateNeeded, undefined); + torbutton_abouttor_message_handler.updateAllOpenPages(); // Make the "check for update" menu item bold if an update is needed. var item = document.getElementById("torbutton-checkForUpdate"); @@ -597,117 +653,11 @@ function torbutton_check_for_update() { prompter.checkForUpdates(); } -// Pass undefined for a parameter to have this function determine it. -// Returns a count of open pages that were updated, -function torbutton_update_all_abouttor_pages(aUpdateNeeded, aTorIsOn) { - if (aUpdateNeeded === undefined) - aUpdateNeeded = torbutton_update_is_needed(); - if (aTorIsOn === undefined) - aTorIsOn = torbutton_tor_check_ok(); - - var count = 0; - var tabBrowser = top.getBrowser(); - var tabs = tabBrowser.mTabs; - if (tabs && (tabs.length > 0)) { - for (var tab = tabs[0]; tab != null; tab = tab.nextSibling) { - try { - let doc = tabBrowser.getBrowserForTab(tab).contentDocument; - if (torbutton_update_abouttor_doc(doc, aTorIsOn, aUpdateNeeded)) - ++count; - } catch(e) {} - } - } - - return count; -} - -// Returns true if aDoc is an about:tor page. -function torbutton_update_abouttor_doc(aDoc, aTorOn, aUpdateNeeded) { - var isAboutTor = torbutton_is_abouttor_doc(aDoc); - if (isAboutTor) { - if (aTorOn) - aDoc.body.setAttribute("toron", "yes"); - else - aDoc.body.removeAttribute("toron"); - - if (aUpdateNeeded) - aDoc.body.setAttribute("torNeedsUpdate", "yes"); - else - aDoc.body.removeAttribute("torNeedsUpdate"); - - if (torbutton_show_torbrowser_manual()) - aDoc.body.setAttribute("showmanual", "yes"); - else - aDoc.body.removeAttribute("showmanual"); - - // Display product name and TBB version. - try { - const kBrandBundle = "chrome://branding/locale/brand.properties"; - let brandBundle = Cc["@mozilla.org/intl/stringbundle;1"] - .getService(Ci.nsIStringBundleService) - .createBundle(kBrandBundle); - let productName = brandBundle.GetStringFromName("brandFullName"); - let tbbVersion = m_tb_prefs.getCharPref("torbrowser.version"); - let e = aDoc.getElementById("torstatus-version"); - - while (e.firstChild) - e.removeChild(e.firstChild); - e.appendChild(aDoc.createTextNode(productName + '\n' + tbbVersion)); - } catch (e) {} - - let containerName = "torstatus-" + (aTorOn ? "on" : "off") + "-container"; - torbutton_adjust_abouttor_fontsizes(aDoc, containerName); - torbutton_update_abouttor_arrow(aDoc); - } - - return isAboutTor; -} - -// Ensure that text in top area does not overlap the tor on/off (onion) image. -// This is done by reducing the font sizes as necessary. -function torbutton_adjust_abouttor_fontsizes(aDoc, aContainerName) -{ - let imgElem = aDoc.getElementById("torstatus-image"); - let containerElem = aDoc.getElementById(aContainerName); - if (!imgElem || !containerElem) - return; - - try - { - let imgRect = imgElem.getBoundingClientRect(); - - for (let textElem = containerElem.firstChild; textElem; - textElem = textElem.nextSibling) - { - if ((textElem.nodeType != textElem.ELEMENT_NODE) || - (textElem.nodeName.toLowerCase() == "br")) - { - continue; - } - - let textRect = textElem.getBoundingClientRect(); - if (0 == textRect.width) - continue; - - // Reduce font to 90% of previous size, repeating the process up to 7 - // times. This allows for a maximum reduction to just less than 50% of - // the original size. - let maxTries = 7; - while ((textRect.left < imgRect.right) && (--maxTries >= 0)) - { - let style = aDoc.defaultView.getComputedStyle(textElem, null); - let fontSize = parseFloat(style.getPropertyValue("font-size")); - textElem.style.fontSize = (fontSize * 0.9) + "px"; - textRect = textElem.getBoundingClientRect(); - } - } - } catch (e) {} -} - -// Determine X position of torbutton toolbar item and pass it through -// to the xhtml document by setting a torbutton-xpos attribute on the body. -// The value that is set takes retina displays and content zoom into account. -function torbutton_update_abouttor_arrow(aDoc) { +// Determine X position of Torbutton toolbar item. The value returned +// accounts for retina but not content zoom. +// undefined is returned if the value cannot be determined (e.g., if the +// toolbar item is not on the toolbar). +function torbutton_get_toolbarbutton_xpos() { try { let tbXpos = -1; let tbItem = torbutton_get_toolbutton(); @@ -721,55 +671,16 @@ function torbutton_update_abouttor_arrow(aDoc) { } if (tbXpos >= 0) { - // Convert to device-independent units, compensating for retina display - // and content zoom that may be in effect on the about:tor page. - // Because window.devicePixelRatio always returns 1.0 for non-Chrome - // windows (see bug 13875), we use screenPixelsPerCSSPixel for the - // content window. + // Convert to device-independent units, compensating for retina display. tbXpos *= window.devicePixelRatio; - let pixRatio = gBrowser.contentWindow - .QueryInterface(Ci.nsIInterfaceRequestor) - .getInterface(Ci.nsIDOMWindowUtils) - .screenPixelsPerCSSPixel; - tbXpos = Math.round(tbXpos / pixRatio); - aDoc.body.setAttribute("torbutton-xpos", tbXpos); - } else { - aDoc.body.removeAttribute("torbutton-xpos"); + return tbXpos; } - - let evt = new Event("AboutTorAdjustArrow"); - aDoc.dispatchEvent(evt); } catch(e) {} -} - -function torbutton_on_abouttor_load(aDoc) { - if (torbutton_is_abouttor_doc(aDoc) && - !aDoc.documentElement.hasAttribute("aboutTorLoaded")) { - aDoc.documentElement.setAttribute("aboutTorLoaded", true); - - // Show correct Tor on/off and "update needed" status. - let torOn = torbutton_tor_check_ok(); - let needsUpdate = torbutton_update_is_needed(); - torbutton_update_abouttor_doc(aDoc, torOn, needsUpdate); - - aDoc.defaultView.addEventListener("resize", - function() { torbutton_update_abouttor_arrow(aDoc); }, - false); - - // Insert "Test Tor Network Settings" url. - let elem = aDoc.getElementById("testTorSettings"); - if (elem) { - let locale = m_tb_prefs.getCharPref("general.useragent.locale"); - locale = locale.replace(/-/g, '_'); - let url = m_tb_prefs.getCharPref( - "extensions.torbutton.test_url_interactive"); - elem.href = url.replace(/__LANG__/g, locale); - } - } - if (m_tb_orig_BrowserOnAboutPageLoad) - m_tb_orig_BrowserOnAboutPageLoad(aDoc); + return undefined; +} +function torbutton_show_sec_slider_notification() { // Show the notification about the new security slider. if (m_tb_prefs. getBoolPref("extensions.torbutton.show_slider_notification")) { @@ -797,10 +708,6 @@ function torbutton_on_abouttor_load(aDoc) { } } -function torbutton_is_abouttor_doc(aDoc) { - return (aDoc && /^about:tor$/i.test(aDoc.documentURI.toLowerCase())); -} - // Bug 1506 P4: Checking for Tor Browser updates is pretty important, // probably even as a fallback if we ever do get a working updater. function torbutton_do_async_versioncheck() { @@ -2449,7 +2356,7 @@ function torbutton_init_user_manual_links() { let menuitem = document.getElementById("torBrowserUserManual"); bindPrefAndInit("general.useragent.locale", val => { menuitem.hidden = !torbutton_show_torbrowser_manual(); - torbutton_update_all_abouttor_pages(undefined, undefined); + torbutton_abouttor_message_handler.updateAllOpenPages(); }); } diff --git a/src/chrome/skin/aboutTor.css b/src/chrome/skin/aboutTor.css index 3f747a9..c0d2ebc 100644 --- a/src/chrome/skin/aboutTor.css +++ b/src/chrome/skin/aboutTor.css @@ -1,5 +1,5 @@ /* - * Copyright (c) 2015, The Tor Project, Inc. + * Copyright (c) 2017, The Tor Project, Inc. * See LICENSE for licensing information. * * vim: set sw=2 sts=2 ts=8 et syntax=css: @@ -34,6 +34,15 @@ body[toron] { background-image: -moz-linear-gradient(top, #ffffff, #ffffff 10%, #d5ffd5 50%, #d5ffd5); } +/* Hide the entire document by default to avoid showing the incorrect + * Tor on / off status (that info must be retrieved from the chrome + * process, which involves IPC when multiprocess mode is enabled). An + * initialized attribute will be added as soon as the status is known. + */ +body:not([initialized]) { + display: none; +} + #torstatus-version { position: fixed; top: 6px; diff --git a/src/components/aboutTor.js b/src/components/aboutTor.js index 2a3431f..e3ee03d 100644 --- a/src/components/aboutTor.js +++ b/src/components/aboutTor.js @@ -1,9 +1,9 @@ /************************************************************************* - * Copyright (c) 2013, The Tor Project, Inc. + * Copyright (c) 2017, The Tor Project, Inc. * See LICENSE for licensing information. * * vim: set sw=2 sts=2 ts=8 et syntax=javascript: - * + * * about:tor component *************************************************************************/ @@ -17,9 +17,9 @@ const kAboutTorURL = "chrome://torbutton/content/aboutTor/aboutTor.xhtml"; const Cc = Components.classes; const Ci = Components.interfaces; const Cu = Components.utils; - + Cu.import("resource://gre/modules/XPCOMUtils.jsm"); - + function AboutTor() { } @@ -35,11 +35,12 @@ AboutTor.prototype = contractID: kMODULE_CONTRACTID, // nsIAboutModule implementation: - newChannel: function(aURI) + newChannel: function(aURI, aLoadInfo) { let ioSvc = Cc["@mozilla.org/network/io-service;1"] .getService(Ci.nsIIOService); - let channel = ioSvc.newChannel(kAboutTorURL, null, null); + let uri = ioSvc.newURI(kAboutTorURL, null, null); + let channel = ioSvc.newChannelFromURIWithLoadInfo(uri, aLoadInfo); channel.originalURI = aURI; return channel; @@ -47,9 +48,13 @@ AboutTor.prototype = getURIFlags: function(aURI) { - return Ci.nsIAboutModule.ALLOW_SCRIPT; + return Ci.nsIAboutModule.URI_SAFE_FOR_UNTRUSTED_CONTENT | + Ci.nsIAboutModule.URI_MUST_LOAD_IN_CHILD | + Ci.nsIAboutModule.ALLOW_SCRIPT; } }; -const NSGetFactory = XPCOMUtils.generateNSGetFactory([AboutTor]); +let factory = XPCOMUtils._getFactory(AboutTor); +let reg = Components.manager.QueryInterface(Ci.nsIComponentRegistrar); +reg.registerFactory(kMODULE_CID, "", kMODULE_CONTRACTID, factory); diff --git a/src/components/startup-observer.js b/src/components/startup-observer.js index 65ca659..dac7aff 100644 --- a/src/components/startup-observer.js +++ b/src/components/startup-observer.js @@ -61,12 +61,15 @@ function StartupObserver() { this.logger.log(4, "Early proxy change failed. Will try again at profile load. Error: "+e); } - // Arrange for our nsIContentPolicy filter to be loaded in the - // default (chrome) process as well as in each content process. + // Arrange for our nsIContentPolicy filter and about:tor handler to be + // loaded in the default (chrome) process as well as in each content + // process. let ppmm = Cc["@mozilla.org/parentprocessmessagemanager;1"] .getService(Ci.nsIProcessScriptLoader); ppmm.loadProcessScript("resource://torbutton/components/content-policy.js", true); + ppmm.loadProcessScript("resource://torbutton/components/aboutTor.js", + true); } StartupObserver.prototype = {

1 0

[tor-browser-bundle/master] 2014 is already far, far away
by gk＠torproject.org 05 Jul '17

05 Jul '17

commit 3f466124baf2718906e330b45388c22b2f1a44a7 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Jul 5 10:12:05 2017 +0000 2014 is already far, far away --- Bundle-Data/Docs/ChangeLog.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index c73f9ac..45210dd 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -1,4 +1,4 @@ -Tor Browser 7.5a2 -- July 6 2014 +Tor Browser 7.5a2 -- July 6 2017 * All Platforms * Update Tor to 0.3.1.4-alpha * Update HTTPS-Everywhere to 5.2.19

1 0

[tor-browser-bundle/master] Release preparations for 7.5a2
by boklm＠torproject.org 04 Jul '17

04 Jul '17

commit e2f067395d180d2ef484375e9025b6c958d504dc Author: Nicolas Vigier <boklm(a)torproject.org> Date: Tue Jul 4 02:56:23 2017 +0200 Release preparations for 7.5a2 --- Bundle-Data/Docs/ChangeLog.txt | 7 +++++++ gitian/versions.alpha | 6 +++--- tools/update-responses/config.yml | 8 ++++---- 3 files changed, 14 insertions(+), 7 deletions(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index 94e967f..c73f9ac 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,10 @@ +Tor Browser 7.5a2 -- July 6 2014 + * All Platforms + * Update Tor to 0.3.1.4-alpha + * Update HTTPS-Everywhere to 5.2.19 + * Linux + * Update sandboxed-tor-browser to 0.0.9 + Tor Browser 7.5a1 -- June 14 2017 * All Platforms * Update Firefox to 52.2.0esr diff --git a/gitian/versions.alpha b/gitian/versions.alpha index 7ce2e5a..6351f27 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -15,10 +15,10 @@ FIREFOX_VERSION=52.2.0esr TORBROWSER_UPDATE_CHANNEL=alpha TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-7.5-1-build2 -TOR_TAG=tor-0.3.1.3-alpha +TOR_TAG=tor-0.3.1.4-alpha TORLAUNCHER_TAG=0.2.12.2 TORBUTTON_TAG=1.9.7.4 -HTTPSE_TAG=5.2.18 +HTTPSE_TAG=5.2.19 NSIS_TAG=v0.3.1 ZLIB_TAG=v1.2.8 LIBEVENT_TAG=release-2.0.22-stable @@ -41,7 +41,7 @@ OBFS4_TAG=obfs4proxy-0.0.5 NOTOFONTS_TAG=720e34851382ee3c1ef024d8dffb68ffbfb234c2 ERRORS_TAG=248dadf4e9068a0b3e79f02ed0a610d935de5302 GB_TAG=06cc925cce6592e922dcc4839a8b44feb384e71e -SANDBOX_TAG=sandboxed-tor-browser-0.0.7 +SANDBOX_TAG=sandboxed-tor-browser-0.0.9 DEPOT_TOOLS_TAG=28216cd14b44716db5c83634afbdc6e90492652b WEBRTC_TAG=c279861207c5b15fc51069e96595782350e0ac12 # https://chromium.googlesource.com/external/webrtc.git/+/refs/branch-heads/58 GO_WEBRTC_TAG=ab1b64862e0c4b4182010699911c2c5818f0a101 diff --git a/tools/update-responses/config.yml b/tools/update-responses/config.yml index d12ef1c..a4f1f91 100644 --- a/tools/update-responses/config.yml +++ b/tools/update-responses/config.yml @@ -19,14 +19,14 @@ build_targets: osx32: Darwin_x86-gcc3 osx64: Darwin_x86_64-gcc3 channels: - alpha: 7.5a1 + alpha: 7.5a2 release: 6.0.1 versions: - 7.5a1: + 7.5a2: platformVersion: 52.2.0 - detailsURL: https://blog.torproject.org/blog/tor-browser-75a1-released + detailsURL: https://blog.torproject.org/blog/tor-browser-75a2-released incremental_from: - - 7.0a4 + - 7.5a1 migrate_archs: osx32: osx64 migrate_langs:

1 0

[tor-browser-bundle/maint-7.0] Release preparations for 7.0.2
by boklm＠torproject.org 29 Jun '17

29 Jun '17

commit 3b5c0fdc4061d9b8568002d829f03c0e8a01d742 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Fri Jun 30 00:55:43 2017 +0200 Release preparations for 7.0.2 Version bumps, changelog update, and config.yml update --- Bundle-Data/Docs/ChangeLog.txt | 5 +++++ gitian/versions | 4 ++-- tools/update-responses/config.yml | 9 ++++----- 3 files changed, 11 insertions(+), 7 deletions(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index d0c95b2..c7cb8c2 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,8 @@ +Tor Browser 7.0.2 -- July 3 2017 + * All Platforms + * Update Tor to 0.3.0.9, fixing bug #22753 + * Update HTTPS-Everywhere to 5.2.19 + Tor Browser 7.0.1 -- June 13 2017 * All Platforms * Update Firefox to 52.2.0esr diff --git a/gitian/versions b/gitian/versions index ae21121..b8670f5 100755 --- a/gitian/versions +++ b/gitian/versions @@ -15,10 +15,10 @@ FIREFOX_VERSION=52.2.0esr TORBROWSER_UPDATE_CHANNEL=release TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-7.0-1-build1 -TOR_TAG=tor-0.3.0.8 +TOR_TAG=tor-0.3.0.9 TORLAUNCHER_TAG=0.2.12.2 TORBUTTON_TAG=1.9.7.4 -HTTPSE_TAG=5.2.18 +HTTPSE_TAG=5.2.19 NSIS_TAG=v0.3.1 ZLIB_TAG=v1.2.8 LIBEVENT_TAG=release-2.0.22-stable diff --git a/tools/update-responses/config.yml b/tools/update-responses/config.yml index d5151bc..9ff92ce 100644 --- a/tools/update-responses/config.yml +++ b/tools/update-responses/config.yml @@ -20,14 +20,13 @@ build_targets: osx64: Darwin_x86_64-gcc3 channels: alpha: 7.0a4 - release: 7.0.1 + release: 7.0.2 versions: - 7.0.1: + 7.0.2: platformVersion: 52.2.0 - detailsURL: https://blog.torproject.org/blog/tor-browser-701-released + detailsURL: https://blog.torproject.org/blog/tor-browser-702-released incremental_from: - - 6.5.2 - - 7.0 + - 7.0.1 migrate_archs: osx32: osx64 migrate_langs:

1 0

[torbutton/master] Bug 22560: Update privacy.thirdparty.isolate preference
by gk＠torproject.org 16 Jun '17

16 Jun '17

commit b917b2024bb71b2be832439df793ae5ec91d8082 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Jun 16 11:36:06 2017 +0000 Bug 22560: Update privacy.thirdparty.isolate preference In commit 2978978e64fbc9164185564a19d56d5fea0b25d8 we hinted at updating `privacy.thirdparty.isolate` once we switch to ESR 52. We forgot that while migrating but replace it now with `privacy.firstparty.isolate` as expected. We remove `dom.workers.sharedWorkers.enabled` as this preference is long gone. --- src/chrome/content/torbutton.js | 25 ++++++++++++------------- 1 file changed, 12 insertions(+), 13 deletions(-) diff --git a/src/chrome/content/torbutton.js b/src/chrome/content/torbutton.js index 2d69b0c..ae705a3 100644 --- a/src/chrome/content/torbutton.js +++ b/src/chrome/content/torbutton.js @@ -86,7 +86,7 @@ var torbutton_unique_pref_observer = m_tb_prefs.addObserver("javascript", this, false); m_tb_prefs.addObserver("noscript", this, false); m_tb_prefs.addObserver("plugin.disable", this, false); - m_tb_prefs.addObserver("privacy.thirdparty.isolate", this, false); + m_tb_prefs.addObserver("privacy.firstparty.isolate", this, false); m_tb_prefs.addObserver("privacy.resistFingerprinting", this, false); // We observe xpcom-category-entry-added for plugins w/ Gecko-Content-Viewers @@ -103,7 +103,7 @@ var torbutton_unique_pref_observer = m_tb_prefs.removeObserver("javascript", this); m_tb_prefs.removeObserver("noscript", this); m_tb_prefs.removeObserver("plugin.disable", this); - m_tb_prefs.removeObserver("privacy.thirdparty.isolate", this); + m_tb_prefs.removeObserver("privacy.firstparty.isolate", this); m_tb_prefs.removeObserver("privacy.resistFingerprinting", this); var observerService = Cc["@mozilla.org/observer-service;1"]. @@ -151,12 +151,12 @@ var torbutton_unique_pref_observer = } switch (data) { case "network.cookie.cookieBehavior": - var val = m_tb_prefs.getIntPref("network.cookie.cookieBehavior"); - var block_thirdparty = m_tb_prefs.getIntPref("privacy.thirdparty.isolate") !== 0; - if (val == 0 && block_thirdparty) // Allow all cookies - m_tb_prefs.setIntPref("privacy.thirdparty.isolate", 0); - else if (val == 1 && !block_thirdparty) // Block third party cookies - m_tb_prefs.setIntPref("privacy.thirdparty.isolate", 2); + let val = m_tb_prefs.getIntPref("network.cookie.cookieBehavior"); + let firstparty_isolate = m_tb_prefs.getBoolPref("privacy.firstparty.isolate"); + if (val == 0 && firstparty_isolate) // Allow all cookies + m_tb_prefs.setBoolPref("privacy.firstparty.isolate", false); + else if (val == 1 && !firstparty_isolate) // Block third party cookies + m_tb_prefs.setBoolPref("privacy.firstparty.isolate", true); break; case "plugin.disable": @@ -173,8 +173,8 @@ var torbutton_unique_pref_observer = case "extensions.torbutton.spoof_english": torbutton_update_fingerprinting_prefs(); break; - case "privacy.thirdparty.isolate": - torbutton_update_thirdparty_prefs(); + case "privacy.firstparty.isolate": + torbutton_update_isolation_prefs(); break; case "extensions.torbutton.hide_sync_ui": torbutton_update_sync_ui(); @@ -1743,8 +1743,8 @@ function torbutton_update_fingerprinting_prefs() { m_tb_prefs.savePrefFile(null); } -function torbutton_update_thirdparty_prefs() { - let isolate = m_tb_prefs.getIntPref("privacy.thirdparty.isolate") !== 0; +function torbutton_update_isolation_prefs() { + let isolate = m_tb_prefs.getBoolPref("privacy.firstparty.isolate"); if (isolate) { m_tb_prefs.setIntPref("network.cookie.cookieBehavior", 1); @@ -1752,7 +1752,6 @@ function torbutton_update_thirdparty_prefs() { m_tb_prefs.setIntPref("network.cookie.cookieBehavior", 0); } - m_tb_prefs.setBoolPref("dom.workers.sharedWorkers.enabled", !isolate); m_tb_prefs.setBoolPref("security.enable_tls_session_tickets", !isolate); // Force prefs to be synced to disk

1 0

[tor-browser-build/master] Update versions and ChangeLog for 7.5a1
by boklm＠torproject.org 13 Jun '17

13 Jun '17

commit 48e45a9a60d3987e8c9726d009db54912246ed34 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Tue Jun 13 13:09:36 2017 +0200 Update versions and ChangeLog for 7.5a1 tor-browser-bundle.git author: Georg Koppen <gk(a)torproject.org> tor-browser-bundle.git commit: 321ad6021df0b3d55625c5bd88dcfc5acdf112f8 tor-browser-bundle.git commit: ade53c43e1230a05e0b138b3ade92914e9d9a279 tor-browser-bundle.git commit: 638da360d67407b2866f0747a5df40d8ae36af78 --- projects/firefox/config | 4 +- projects/https-everywhere/config | 2 +- projects/sandbox/config | 2 +- .../tor-browser/Bundle-Data/Docs/ChangeLog.txt | 55 +++++++++++++++++++++- projects/tor-browser/config | 4 +- projects/tor-launcher/config | 2 +- projects/tor/config | 2 +- projects/torbutton/config | 2 +- rbm.conf | 2 +- 9 files changed, 64 insertions(+), 11 deletions(-) diff --git a/projects/firefox/config b/projects/firefox/config index 1cd986f..5db64ff 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -7,8 +7,8 @@ git_url: https://git.torproject.org/tor-browser.git gpg_keyring: torbutton.gpg var: - firefox_version: 52.1.1esr - torbrowser_branch: 7.0 + firefox_version: 52.2.0esr + torbrowser_branch: 7.5 torbrowser_update_channel: alpha copyright_year: '[% exec("git show -s --format=%ci").remove("-.*") %]' deps: diff --git a/projects/https-everywhere/config b/projects/https-everywhere/config index 23c4e1e..3652aaa 100644 --- a/projects/https-everywhere/config +++ b/projects/https-everywhere/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 5.2.16 +version: 5.2.18 git_url: https://git.torproject.org/https-everywhere.git git_hash: '[% c("version") %]' git_submodule: 1 diff --git a/projects/sandbox/config b/projects/sandbox/config index 3970322..017d78d 100644 --- a/projects/sandbox/config +++ b/projects/sandbox/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 0.0.6 +version: 0.0.7 git_url: https://git.torproject.org/tor-browser/sandboxed-tor-browser git_hash: 'sandboxed-tor-browser-[% c("version") %]' tag_gpg_id: 1 diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index 9f00100..94e967f 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,56 @@ +Tor Browser 7.5a1 -- June 14 2017 + * All Platforms + * Update Firefox to 52.2.0esr + * Update Tor to 0.3.1.3-alpha + * Update Torbutton to 1.9.7.4 + * Bug 22542: Security Settings window too small on macOS 10.12 + * Bug 22104: Adjust our content policy whitelist for ff52-esr + * Bug 22457: Allow resources loaded by view-source:// + * Bug 21627: Ignore HTTP 304 responses when checking redirects + * Bug 22459: Adapt our use of the nsIContentPolicy to e10s mode + * Translations update + * Update Tor Launcher to 0.2.12.2 + * Bug 22283: Linux 7.0a4 is broken after update due to unix: lines in torrc + * Translations update + * Update HTTPS-Everywhere to 5.2.18 + * Update NoScript to 5.0.5 + * Update sandboxed-tor-browser to 0.0.7 + * Bug 22362: NoScript's XSS filter freezes the browser + * Bug 21766: Fix crash when the external application helper dialog is invoked + * Bug 21886: Download is stalled in non-e10s mode + * Bug 22333: Disable WebGL2 API for now + * Bug 21861: Disable additional mDNS code to avoid proxy bypasses + * Bug 21684: Don't expose navigator.AddonManager to content + * Bug 21431: Clean-up system extensions shipped in Firefox 52 + * Bug 22320: Use preference name 'referer.hideOnionSource' everywhere + * Bug 16285: Don't ship ClearKey EME system and update EME preferences + * Bug 21972: about:support is partially broken + * Bug 21323: Enable Mixed Content Blocking + * Bug 22415: Fix format error in our pipeline patch + * Bug 21862: Rip out potentially unsafe Rust code + * Bug 16485: Improve about:cache page + * Bug 22462: Backport of patch for bug 1329521 to fix assertion failure + * Bug 22458: Fix broken `about:cache` page on higher security levels + * Bug 18531: Uncaught exception when opening ip-check.info + * Bug 18574: Uncaught exception when clicking items in Library + * Bug 22327: Isolate Page Info media previews to first party domain + * Bug 22452: Isolate tab list menuitem favicons to first party domain + * Bug 15555: View-source requests are not isolated by first party domain + * Bug 5293: Neuter fingerprinting with Battery API + * Bug 22429: Add IPv6 address for Lisbeth:443 obfs4 bridge + * Bug 22468: Add default obfs4 bridges frosty and dragon + * Windows + * Bug 22419: Prevent access to file:// + * Bug 21617: Fix single RWX page on Windows + * OS X + * Bug 22558: Don't update OS X 10.7.x and 10.8.x users to Tor Browser 7.0 + + * Linux + * Bug 16285: Remove ClearKey related library stripping + * Bug 21852: Don't use jemalloc4 anymore + * Android + * Bug 19078: Disable RtspMediaResource stuff in Orfox + Tor Browser 7.0a4 -- May 15 2017 * All Platforms * Update Firefox to 52.1.1esr @@ -84,7 +137,7 @@ Tor Browser 7.0a3 -- April 20 2017 * Bug 17334: Hide Referer when leaving a .onion domain (improved patch) * Bug 3246: Double-key cookies * Bug 8842: Fix XML parsing error - * Bug 16886: 16886: "Add-on compatibility check dialog" contains Firefox logo + * Bug 16886: "Add-on compatibility check dialog" contains Firefox logo * Bug 19192: Untrust Blue Coat CA * Bug 19955: Avoid confusing warning that favicon load request got cancelled * Bug 20005: Backport fixes for memory leaks investigation diff --git a/projects/tor-browser/config b/projects/tor-browser/config index a2c21ed..8e8398a 100644 --- a/projects/tor-browser/config +++ b/projects/tor-browser/config @@ -54,9 +54,9 @@ input_files: name: snowflake enable: '[% c("var/snowflake") %]' - filename: Bundle-Data - - URL: https://addons.cdn.mozilla.net/user-media/addons/722/noscript_security_suit… + - URL: https://addons.cdn.mozilla.net/user-media/addons/722/noscript_security_suit… name: noscript - sha256sum: cd8e5561bdd7331d9fdd510fb1bd1cb6460d64f351076b523d31361ff9853c76 + sha256sum: bf1dee39f6e5936df2b03b794c1efc9236b440536a05fafcff667e33903e6aed - filename: RelativeLink enable: '[% c("var/linux") %]' - project: libdmg-hfsplus diff --git a/projects/tor-launcher/config b/projects/tor-launcher/config index a164ef3..2995d08 100644 --- a/projects/tor-launcher/config +++ b/projects/tor-launcher/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 0.2.12.1 +version: 0.2.12.2 git_url: https://git.torproject.org/tor-launcher.git git_hash: '[% c("version") %]' gpg_keyring: torbutton.gpg diff --git a/projects/tor/config b/projects/tor/config index b92fb4f..74ae828 100644 --- a/projects/tor/config +++ b/projects/tor/config @@ -1,6 +1,6 @@ # vim: filetype=yaml sw=2 filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %]' -version: 0.3.0.6 +version: 0.3.1.3-alpha git_hash: 'tor-[% c("version") %]' git_url: https://git.torproject.org/tor.git gpg_keyring: tor.gpg diff --git a/projects/torbutton/config b/projects/torbutton/config index 41d4d69..7864a38 100644 --- a/projects/torbutton/config +++ b/projects/torbutton/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 1.9.7.2 +version: 1.9.7.4 git_url: https://git.torproject.org/torbutton.git git_hash: '[% c("version") %]' gpg_keyring: torbutton.gpg diff --git a/rbm.conf b/rbm.conf index 7b58503..8941ba9 100644 --- a/rbm.conf +++ b/rbm.conf @@ -7,7 +7,7 @@ build_log: '[% GET ENV.RBM_LOGS_DIR ? ENV.RBM_LOGS_DIR : "logs" %]/[% project %] pkg_type: build var: - torbrowser_version: '7.0a4' + torbrowser_version: '7.5a1' project_name: tor-browser multi_lingual: 0 build_mar: 1

1 0

[tor-browser-build/master] Bump OpenSSL version for nightly builds
by boklm＠torproject.org 13 Jun '17

13 Jun '17

commit 8d3c245def1e9047715266953fe83df560da0328 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Tue Jun 13 13:12:46 2017 +0200 Bump OpenSSL version for nightly builds tor-browser-bundle.git author: Georg Koppen <gk(a)torproject.org> tor-browser-bundle.git commit: 515f9581b36e87d8180d2e74d57a9aed11d7c1e2 --- projects/openssl/config | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/projects/openssl/config b/projects/openssl/config index 8b4ea4f..4cb9eea 100644 --- a/projects/openssl/config +++ b/projects/openssl/config @@ -7,6 +7,8 @@ var: use_container: 1 targets: + nightly: + version: 1.0.2l linux-x86_64: var: configure_opts: -shared enable-ec_nistp_64_gcc_128 linux-generic64 @@ -26,3 +28,6 @@ input_files: project: '[% c("var/compiler") %]' - URL: 'https://www.openssl.org/source/openssl-[% c("version") %].tar.gz' sha256sum: 6b3977c61f2aedf0f96367dcfb5c6e578cf37e7b8d913b4ecb6643c3cb88d8c0 + targets: + nightly: + sha256sum: ce07195b659e75f4e1db43552860070061f156a98bb37b672b101ba6e3ddf30c

1 0

[tor-browser-build/master] Bug 22362: NoScript's XSS filter freezes the browser
by boklm＠torproject.org 13 Jun '17

13 Jun '17

commit cec0a1d787b90f1b27c92ba83bd8f12b5a3b0fb1 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Jun 7 11:58:21 2017 +0000 Bug 22362: NoScript's XSS filter freezes the browser Due to a bug in NoScript's XSS filter Tor Browser freezes on some websites. We disable that filter for now while waiting on a NoScript update. --- .../Data/Browser/profile.default/preferences/extension-overrides.js | 4 ++++ .../Data/Browser/profile.default/preferences/extension-overrides.js | 4 ++++ .../Data/Browser/profile.default/preferences/extension-overrides.js | 4 ++++ 3 files changed, 12 insertions(+) diff --git a/projects/tor-browser/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js b/projects/tor-browser/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js index 6ef2c45..a34fb36 100644 --- a/projects/tor-browser/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/projects/tor-browser/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js @@ -55,3 +55,7 @@ pref("noscript.restrictSubdocScripting", true); pref("noscript.showVolatilePrivatePermissionsToggle", false); pref("noscript.volatilePrivatePermissions", true); pref("noscript.clearClick", 0); +// Workaround for bug 22362: Disable XSS filter for now as it freezes the +// browser in some circumstances. +pref("noscript.filterXGet", false); +pref("noscript.filterXPost", false); diff --git a/projects/tor-browser/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js b/projects/tor-browser/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js index 6ef2c45..a34fb36 100644 --- a/projects/tor-browser/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/projects/tor-browser/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js @@ -55,3 +55,7 @@ pref("noscript.restrictSubdocScripting", true); pref("noscript.showVolatilePrivatePermissionsToggle", false); pref("noscript.volatilePrivatePermissions", true); pref("noscript.clearClick", 0); +// Workaround for bug 22362: Disable XSS filter for now as it freezes the +// browser in some circumstances. +pref("noscript.filterXGet", false); +pref("noscript.filterXPost", false); diff --git a/projects/tor-browser/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js b/projects/tor-browser/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js index 6ef2c45..a34fb36 100644 --- a/projects/tor-browser/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/projects/tor-browser/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js @@ -55,3 +55,7 @@ pref("noscript.restrictSubdocScripting", true); pref("noscript.showVolatilePrivatePermissionsToggle", false); pref("noscript.volatilePrivatePermissions", true); pref("noscript.clearClick", 0); +// Workaround for bug 22362: Disable XSS filter for now as it freezes the +// browser in some circumstances. +pref("noscript.filterXGet", false); +pref("noscript.filterXPost", false);

1 0

[tor-browser-bundle/master] Bump OpenSSL version for nightly builds
by gk＠torproject.org 13 Jun '17

13 Jun '17

commit 515f9581b36e87d8180d2e74d57a9aed11d7c1e2 Author: Georg Koppen <gk(a)torproject.org> Date: Tue Jun 13 09:44:37 2017 +0000 Bump OpenSSL version for nightly builds --- gitian/versions.nightly | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/gitian/versions.nightly b/gitian/versions.nightly index 5a504d0..b89befb 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -54,7 +54,7 @@ SELFRANDO_TAG=tb-v0.2 GITIAN_TAG=tor-browser-builder-4 -OPENSSL_VER=1.0.2k +OPENSSL_VER=1.0.2l GMP_VER=5.1.3 FIREFOX_LANG_VER=$FIREFOX_VERSION FIREFOX_LANG_BUILD=build1 @@ -113,7 +113,7 @@ YASM_PACKAGE=yasm-${YASM_VER}.tar.gz ELFUTILS_PACKAGE=elfutils-${ELFUTILS_VER}.tar.bz2 # Hashes for packages with weak sigs or no sigs -OPENSSL_HASH=6b3977c61f2aedf0f96367dcfb5c6e578cf37e7b8d913b4ecb6643c3cb88d8c0 +OPENSSL_HASH=ce07195b659e75f4e1db43552860070061f156a98bb37b672b101ba6e3ddf30c GMP_HASH=752079520b4690531171d0f4532e40f08600215feefede70b24fabdc6f1ab160 OSXSDK_HASH=da77bb0003fcca5ea8c4e8cb2da8828ded750c54afdcac29ec6f3b46ad5e3adf NOSCRIPT_HASH=bf1dee39f6e5936df2b03b794c1efc9236b440536a05fafcff667e33903e6aed

1 0

[tor-browser-bundle/master] Bumping tor browser branch for nightly builds
by gk＠torproject.org 12 Jun '17

12 Jun '17

commit 5bb561cc765dabbd1ecbdee9c33dfe3df3a94cf3 Author: Georg Koppen <gk(a)torproject.org> Date: Mon Jun 12 12:46:09 2017 +0000 Bumping tor browser branch for nightly builds --- gitian/versions.nightly | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/gitian/versions.nightly b/gitian/versions.nightly index 03c543c..df05fbd 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -13,11 +13,11 @@ DATA_OUTSIDE_APP_DIR=1 VERIFY_TAGS=0 -FIREFOX_VERSION=52.1.1esr +FIREFOX_VERSION=52.2.0esr TORBROWSER_UPDATE_CHANNEL=default -TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-7.0-1 +TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-7.5-1 TOR_TAG=master TORLAUNCHER_TAG=master TORBUTTON_TAG=master

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

tbb-commits