- tbb-commits - lists.torproject.org

[tor-browser/tor-browser-52.2.0esr-7.5-1] Bug 23044: Don't allow GIO supported protocols by default
by gk＠torproject.org 27 Jul '17

27 Jul '17

commit a96f898e0da42de751a5e1367a9899cc96fadb1f Author: Georg Koppen <gk(a)torproject.org> Date: Thu Jul 27 07:31:38 2017 +0000 Bug 23044: Don't allow GIO supported protocols by default --- browser/app/profile/000-tor-browser.js | 3 +++ extensions/gio/nsGIOProtocolHandler.cpp | 8 ++++---- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index aaeba630422d..3edaad88f59e 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -210,6 +210,9 @@ pref("network.protocol-handler.warn-external.mailto", true); pref("network.protocol-handler.warn-external.news", true); pref("network.protocol-handler.warn-external.nntp", true); pref("network.protocol-handler.warn-external.snews", true); +// Make sure we don't have any GIO supported protocols (defense in depth +// measure) +pref("network.gio.supported-protocols", ""); pref("plugin.disable", true); // Disable to search plugins on first start pref("plugins.click_to_play", true); pref("plugin.state.flash", 1); diff --git a/extensions/gio/nsGIOProtocolHandler.cpp b/extensions/gio/nsGIOProtocolHandler.cpp index a378e8700821..5f6b2a0a2a57 100644 --- a/extensions/gio/nsGIOProtocolHandler.cpp +++ b/extensions/gio/nsGIOProtocolHandler.cpp @@ -922,16 +922,16 @@ nsGIOProtocolHandler::InitSupportedProtocolsPref(nsIPrefBranch *prefs) // Get user preferences to determine which protocol is supported. // Gvfs/GIO has a set of supported protocols like obex, network, archive, // computer, dav, cdda, gphoto2, trash, etc. Some of these seems to be - // irrelevant to process by browser. By default accept only smb and sftp - // protocols so far. + // irrelevant to process by browser. By default accept none. nsresult rv = prefs->GetCharPref(MOZ_GIO_SUPPORTED_PROTOCOLS, getter_Copies(mSupportedProtocols)); if (NS_SUCCEEDED(rv)) { mSupportedProtocols.StripWhitespace(); ToLowerCase(mSupportedProtocols); } - else - mSupportedProtocols.AssignLiteral("smb:,sftp:"); // use defaults + else { + mSupportedProtocols.AssignLiteral(""); // use none by default + } LOG(("gio: supported protocols \"%s\"\n", mSupportedProtocols.get())); }

1 0

[tor-browser/tor-browser-52.2.0esr-7.0-1] Bug 23044: Don't allow GIO supported protocols by default
by gk＠torproject.org 27 Jul '17

27 Jul '17

commit 720f9061496321aa978d2f022113c40e9aeb4847 Author: Georg Koppen <gk(a)torproject.org> Date: Thu Jul 27 07:31:38 2017 +0000 Bug 23044: Don't allow GIO supported protocols by default --- browser/app/profile/000-tor-browser.js | 3 +++ extensions/gio/nsGIOProtocolHandler.cpp | 8 ++++---- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index d2fb5e57378a..dc7e99701293 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -210,6 +210,9 @@ pref("network.protocol-handler.warn-external.mailto", true); pref("network.protocol-handler.warn-external.news", true); pref("network.protocol-handler.warn-external.nntp", true); pref("network.protocol-handler.warn-external.snews", true); +// Make sure we don't have any GIO supported protocols (defense in depth +// measure) +pref("network.gio.supported-protocols", ""); pref("plugin.disable", true); // Disable to search plugins on first start pref("plugins.click_to_play", true); pref("plugin.state.flash", 1); diff --git a/extensions/gio/nsGIOProtocolHandler.cpp b/extensions/gio/nsGIOProtocolHandler.cpp index a378e8700821..5f6b2a0a2a57 100644 --- a/extensions/gio/nsGIOProtocolHandler.cpp +++ b/extensions/gio/nsGIOProtocolHandler.cpp @@ -922,16 +922,16 @@ nsGIOProtocolHandler::InitSupportedProtocolsPref(nsIPrefBranch *prefs) // Get user preferences to determine which protocol is supported. // Gvfs/GIO has a set of supported protocols like obex, network, archive, // computer, dav, cdda, gphoto2, trash, etc. Some of these seems to be - // irrelevant to process by browser. By default accept only smb and sftp - // protocols so far. + // irrelevant to process by browser. By default accept none. nsresult rv = prefs->GetCharPref(MOZ_GIO_SUPPORTED_PROTOCOLS, getter_Copies(mSupportedProtocols)); if (NS_SUCCEEDED(rv)) { mSupportedProtocols.StripWhitespace(); ToLowerCase(mSupportedProtocols); } - else - mSupportedProtocols.AssignLiteral("smb:,sftp:"); // use defaults + else { + mSupportedProtocols.AssignLiteral(""); // use none by default + } LOG(("gio: supported protocols \"%s\"\n", mSupportedProtocols.get())); }

1 0

[tor-browser-build/master] Remove some unused options
by boklm＠torproject.org 26 Jul '17

26 Jul '17

commit 0a9f7ef3459d4e19d22bc312cdaa5961eaa650da Author: Nicolas Vigier <boklm(a)torproject.org> Date: Wed Jul 26 11:40:54 2017 +0200 Remove some unused options --- projects/debootstrap-image/config | 3 --- 1 file changed, 3 deletions(-) diff --git a/projects/debootstrap-image/config b/projects/debootstrap-image/config index 15eec3b..ecb7f2d 100644 --- a/projects/debootstrap-image/config +++ b/projects/debootstrap-image/config @@ -5,9 +5,6 @@ pkg_type: build var: ubuntu_version: 17.04 - container_dir: '[% c("tmp_dir") %]/rbm-containers/[% sha256(c("build_id")) %]' - container_user: rbm - container: use_container: 1 # We need CAP_SYS_ADMIN for debootstrap to work

1 0

[tor-browser-build/master] Include uid in tmp containers directory
by boklm＠torproject.org 26 Jul '17

26 Jul '17

commit 9084d642cfc291df76b9fd4acecdce5aeb7f71b9 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Wed Jul 26 12:09:07 2017 +0200 Include uid in tmp containers directory This should allow multiple users to do builds on the same machine. --- rbm.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rbm.conf b/rbm.conf index ce444d4..4ef6b90 100644 --- a/rbm.conf +++ b/rbm.conf @@ -28,7 +28,7 @@ var: build: [% c("build", { filename => 'f', output_dir => '/out' }) %] container: - dir: '[% c("tmp_dir") %]/rbm-containers/[% sha256(c("build_id")) %]' + dir: '[% c("tmp_dir") %]/[% c("uid") %]/rbm-containers/[% sha256(c("build_id")) %]' user: rbm input_files_list: | [% FOREACH file IN c("input_files_by_name").keys.sort -%]

1 0

[tor-browser-build/master] README: mention which version of runc is needed
by boklm＠torproject.org 26 Jul '17

26 Jul '17

commit b386c5f8af06e605bdb84c5bae8bde3c8afbd485 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Wed Jul 26 12:10:54 2017 +0200 README: mention which version of runc is needed --- README | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/README b/README index fa968ff..2fcfadf 100644 --- a/README +++ b/README @@ -5,8 +5,12 @@ Installing build dependencies ----------------------------- To build Tor Browser, you need a Linux distribution that has support -for runC (such as Debian jessie, Ubuntu 14.04, Fedora 20, etc ...). -On Debian jessie, the runc package is available in backports. +for runc (such as Debian jessie, Ubuntu 14.04, Fedora 20, etc ...). +On Debian jessie, the runc package is available in backports. On Debian +stretch, the runc package is available in the main repository. +Version 0.1.1 of runc is required (which is the version available in +Debian stretch and jessie-backports). It is not yet working with runc +version 1.0.0: https://trac.torproject.org/projects/tor/ticket/23039 Your user account should have access sudo access, which is required to be able to extract container file systems, start containers and copy

1 0

[tor-browser-bundle/maint-7.0] Bug 23028: update argparse URL
by gk＠torproject.org 25 Jul '17

25 Jul '17

1 0

[tor-browser-bundle/master] Bug 23028: update argparse URL
by gk＠torproject.org 25 Jul '17

25 Jul '17

1 0

[tor-browser-build/master] Bug 20929: Bump GCC version to 5.4.0
by gk＠torproject.org 25 Jul '17

25 Jul '17

commit 51ed356d2d4d411b7566987a7cc63d61c0ecd9d4 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Tue Jul 25 14:32:21 2017 +0200 Bug 20929: Bump GCC version to 5.4.0 We bump our GCC compiler to 5.4.0 as this fixes some bugs in previous versions. It allows us in particular to build debug builds for Windows with mingw-w64. tor-browser-bundle.git author: Georg Koppen <gk(a)torproject.org> --- projects/gcc/config | 4 ++-- projects/mingw-w64/config | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/projects/gcc/config b/projects/gcc/config index 6bf14ad..de4ecc5 100644 --- a/projects/gcc/config +++ b/projects/gcc/config @@ -1,6 +1,6 @@ # vim: filetype=yaml sw=2 filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz' -version: 5.1.0 +version: 5.4.0 var: container: use_container: 1 @@ -59,4 +59,4 @@ targets: input_files: - project: container-image - URL: 'https://ftp.gnu.org/gnu/gcc/gcc-[% c("version") %]/gcc-[% c("version") %].tar.bz2' - sha256sum: b7dafdf89cbb0e20333dbf5b5349319ae06e3d1a30bf3515b5488f7e89dca5ad + sha256sum: 608df76dec2d34de6558249d8af4cbee21eceddbcb580d666f7a5a583ca3303a diff --git a/projects/mingw-w64/config b/projects/mingw-w64/config index 5e2c748..61a34bd 100644 --- a/projects/mingw-w64/config +++ b/projects/mingw-w64/config @@ -6,7 +6,7 @@ version: '[% c("abbrev") %]' var: container: use_container: 1 - gcc_version: 5.1.0 + gcc_version: 5.4.0 deps: - automake - build-essential @@ -21,7 +21,7 @@ var: input_files: - project: container-image - URL: 'https://ftp.gnu.org/gnu/gcc/gcc-[% c("var/gcc_version") %]/gcc-[% c("var/gcc_version") %].tar.bz2' - sha256sum: b7dafdf89cbb0e20333dbf5b5349319ae06e3d1a30bf3515b5488f7e89dca5ad + sha256sum: 608df76dec2d34de6558249d8af4cbee21eceddbcb580d666f7a5a583ca3303a - name: binutils project: binutils - filename: i686-w64-mingw32-g++

1 0

[tor-browser-bundle/master] Bug 20929: Bump GCC version to 5.4.0
by gk＠torproject.org 25 Jul '17

25 Jul '17

commit f890b38fd0ffc2572edc0e4dafc8a3aa3d16faa0 Author: Georg Koppen <gk(a)torproject.org> Date: Tue Jul 11 15:27:58 2017 +0000 Bug 20929: Bump GCC version to 5.4.0 We bump our GCC compiler to 5.4.0 as this fixes some bugs in previous versions. It allows us in particular to build debug builds for Windows with mingw-w64. --- gitian/versions.alpha | 4 ++-- gitian/versions.nightly | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/gitian/versions.alpha b/gitian/versions.alpha index 6351f27..025e277 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -56,7 +56,7 @@ GMP_VER=5.1.3 FIREFOX_LANG_VER=$FIREFOX_VERSION FIREFOX_LANG_BUILD=build1 BINUTILS_VER=2.24 -GCC_VER=5.1.0 +GCC_VER=5.4.0 CLANG_VER=3.8.0 PYTHON_VER=2.7.5 PYCRYPTO_VER=2.6.1 @@ -128,7 +128,7 @@ GO14_HASH=9947fc705b0b841b5938c48b22dc33e9647ec0752bae66e50278df4f23f64959 GO_HASH=5f5dea2447e7dcfdc50fa6b94c512e58bfba5673c039259fd843f68829d99fa6 NSIS_HASH=43d4c9209847e35eb6e2c7cd5a7586e1445374c056c2c7899e40a080e17a1be7 NSIS_DEBIAN_HASH=1dee6957b4a4b8dfe69bcf28bc7f301a13b96b3fa5a394e36c8926ae781e774a -GCC_HASH=b7dafdf89cbb0e20333dbf5b5349319ae06e3d1a30bf3515b5488f7e89dca5ad +GCC_HASH=608df76dec2d34de6558249d8af4cbee21eceddbcb580d666f7a5a583ca3303a STIXMATHFONT_HASH=e3b0f712e2644438eee2d0dcd2b10b2d54f1b972039de95b2f8e800bae1adbd8 NOTOEMOJIFONT_HASH=415dc6290378574135b64c808dc640c1df7531973290c4970c51fdeb849cb0c5 NOTOJPFONT_HASH=3e8146c4ce0945f255cb9dbc12b392380af80bd117e0a60eae555c99c7e618da diff --git a/gitian/versions.nightly b/gitian/versions.nightly index b89befb..f0c4be7 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -59,7 +59,7 @@ GMP_VER=5.1.3 FIREFOX_LANG_VER=$FIREFOX_VERSION FIREFOX_LANG_BUILD=build1 BINUTILS_VER=2.24 -GCC_VER=5.1.0 +GCC_VER=5.4.0 CLANG_VER=3.8.0 PYTHON_VER=2.7.5 PYCRYPTO_VER=2.6.1 @@ -131,7 +131,7 @@ GO14_HASH=9947fc705b0b841b5938c48b22dc33e9647ec0752bae66e50278df4f23f64959 GO_HASH=5f5dea2447e7dcfdc50fa6b94c512e58bfba5673c039259fd843f68829d99fa6 NSIS_HASH=43d4c9209847e35eb6e2c7cd5a7586e1445374c056c2c7899e40a080e17a1be7 NSIS_DEBIAN_HASH=1dee6957b4a4b8dfe69bcf28bc7f301a13b96b3fa5a394e36c8926ae781e774a -GCC_HASH=b7dafdf89cbb0e20333dbf5b5349319ae06e3d1a30bf3515b5488f7e89dca5ad +GCC_HASH=608df76dec2d34de6558249d8af4cbee21eceddbcb580d666f7a5a583ca3303a STIXMATHFONT_HASH=e3b0f712e2644438eee2d0dcd2b10b2d54f1b972039de95b2f8e800bae1adbd8 NOTOEMOJIFONT_HASH=415dc6290378574135b64c808dc640c1df7531973290c4970c51fdeb849cb0c5 NOTOJPFONT_HASH=3e8146c4ce0945f255cb9dbc12b392380af80bd117e0a60eae555c99c7e618da

1 0

[tor-launcher/master] Bug 22592: Default bridge settings are not removed
by gk＠torproject.org 25 Jul '17

25 Jul '17

commit 2a938feb78b49098ead0599769835cbc2a7dc183 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Mon Jul 24 16:13:28 2017 -0400 Bug 22592: Default bridge settings are not removed When the user clicks on "Remove Settings and Connect", clear the preference `extensions.torlauncher.default_bridge_type` to ensure that default bridges are not used any more. --- src/chrome/content/network-settings.js | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/chrome/content/network-settings.js b/src/chrome/content/network-settings.js index 5df4e1e..830ef31 100644 --- a/src/chrome/content/network-settings.js +++ b/src/chrome/content/network-settings.js @@ -1493,6 +1493,9 @@ function applyBridgeSettings(aUseDefaults) if (!settings) return false; + if (aUseDefaults) + TorLauncherUtil.setCharPref(kPrefDefaultBridgeType, ""); + return setConfAndReportErrors(settings, "bridgeSettings"); }

1 0