- tbb-commits - lists.torproject.org

[tor-browser/tor-browser-45.8.0esr-7.0-1] fixup! Bug 13900: Remove 3rd party HTTP auth tokens.
by gk＠torproject.org 08 Mar '17

08 Mar '17

commit 340377b882408b5de24ff69bcd76e774d9844e4c Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Fri Mar 3 21:47:20 2017 -0800 fixup! Bug 13900: Remove 3rd party HTTP auth tokens. The HostPartIsTheSame() is too strict about deciding what is first party. Instead we use IsThirdPartyURI() to check if the request is from the first party. Specifically, it considers an XHR to api.twitter.com from a twitter.com top-level page to be first-party. This fixes bug 21555 and 16450. --- netwerk/protocol/http/nsHttpChannel.cpp | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/netwerk/protocol/http/nsHttpChannel.cpp b/netwerk/protocol/http/nsHttpChannel.cpp index 3a9a126..e571394 100644 --- a/netwerk/protocol/http/nsHttpChannel.cpp +++ b/netwerk/protocol/http/nsHttpChannel.cpp @@ -6558,8 +6558,12 @@ nsHttpChannel::RemoveAuthorizationHeaderIfAppropriate() nsresult rv = thirdPartySvc->GetFirstPartyURIFromChannel(this, false, getter_AddRefs(firstPartyURI)); if (NS_SUCCEEDED(rv) && firstPartyURI) { - isAuthAllowed = (mURI == firstPartyURI) - || HostPartIsTheSame(firstPartyURI); + bool isThirdParty; + rv = thirdPartySvc->IsThirdPartyURI(firstPartyURI, mURI, &isThirdParty); + if (NS_SUCCEEDED(rv)) { + // Prevent third-party requests from sending auth tokens. + isAuthAllowed = !isThirdParty; + } } else { // We failed to get the first party URI. Check the document URI so // that we can allow authentication if the request originates from the

1 0

[tor-browser-bundle/hardened-builds] Switch nightlies to 45.8.0esr
by gk＠torproject.org 07 Mar '17

07 Mar '17

commit 3c1ae6423d866c462c27fbd85365a30dd64f2d86 Author: Georg Koppen <gk(a)torproject.org> Date: Tue Mar 7 09:44:16 2017 +0000 Switch nightlies to 45.8.0esr --- gitian/versions.nightly | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/gitian/versions.nightly b/gitian/versions.nightly index 7f10c69..042095a 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -17,7 +17,7 @@ MULTI_LINGUAL=1 VERIFY_TAGS=0 -FIREFOX_VERSION=45.7.0esr +FIREFOX_VERSION=45.8.0esr TORBROWSER_UPDATE_CHANNEL=default @@ -61,7 +61,7 @@ GITIAN_TAG=tor-browser-builder-4 OPENSSL_VER=1.0.2k GMP_VER=5.1.3 FIREFOX_LANG_VER=$FIREFOX_VERSION -FIREFOX_LANG_BUILD=build1 +FIREFOX_LANG_BUILD=build2 BINUTILS_VER=2.24 GCC_VER=5.4.0 CLANG_VER=r247539

1 0

[tor-browser-bundle/master] Switch nightlies to 45.8.0esr
by gk＠torproject.org 07 Mar '17

07 Mar '17

commit 24fdda2e33fc1f6e82f6a09f9bd32118fa3f2fa7 Author: Georg Koppen <gk(a)torproject.org> Date: Tue Mar 7 09:43:07 2017 +0000 Switch nightlies to 45.8.0esr --- gitian/versions.nightly | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/gitian/versions.nightly b/gitian/versions.nightly index 94b3003..b9779e2 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -17,7 +17,7 @@ MULTI_LINGUAL=1 VERIFY_TAGS=0 -FIREFOX_VERSION=45.7.0esr +FIREFOX_VERSION=45.8.0esr TORBROWSER_UPDATE_CHANNEL=default @@ -62,7 +62,7 @@ GITIAN_TAG=tor-browser-builder-4 OPENSSL_VER=1.0.2k GMP_VER=5.1.3 FIREFOX_LANG_VER=$FIREFOX_VERSION -FIREFOX_LANG_BUILD=build1 +FIREFOX_LANG_BUILD=build2 BINUTILS_VER=2.24 GCC_VER=5.1.0 CLANG_VER=r247539

1 0

[tor-browser-build/master] Update rbm to fix installation of some packages
by boklm＠torproject.org 06 Mar '17

06 Mar '17

commit dc243808466f77c44e594b02962317c16bb379e4 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Mon Mar 6 13:41:42 2017 +0100 Update rbm to fix installation of some packages This change will cause all containers to be rebuilt. --- rbm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rbm b/rbm index 1945b67..845bb90 160000 --- a/rbm +++ b/rbm @@ -1 +1 @@ -Subproject commit 1945b67fefbcf7b834b71275e301da06232f0241 +Subproject commit 845bb904fb87b6c56ab789f35cd02bce32453f52

1 0

[rbm/master] Fix install_package on Debian
by boklm＠torproject.org 06 Mar '17

06 Mar '17

commit 845bb904fb87b6c56ab789f35cd02bce32453f52 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Mon Mar 6 13:34:11 2017 +0100 Fix install_package on Debian dpkg -s not returning an error means that the package has a status, but its status is not always installed, so checking the exit value is not enough. We are now checking that the status is "install ok installed". --- lib/RBM/DefaultConfig.pm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/RBM/DefaultConfig.pm b/lib/RBM/DefaultConfig.pm index 2f6264e..c0764bd 100644 --- a/lib/RBM/DefaultConfig.pm +++ b/lib/RBM/DefaultConfig.pm @@ -525,7 +525,7 @@ OPT_END my $dnf = 'rpm -q [% c("pkg_name") %] > /dev/null || dnf install -y [% c("pkg_name") %]'; my $zypper = 'rpm -q [% c("pkg_name") %] > /dev/null || zypper install [% c("pkg_name") %]'; my $urpmi = 'rpm -q [% c("pkg_name") %] > /dev/null || urpmi [% c("pkg_name") %]'; - my $apt = 'dpkg -s [% c("pkg_name") %] > /dev/null 2>&1 || apt-get install -y [% c("pkg_name") %]'; + my $apt = 'dpkg -s [% c("pkg_name") %] 2> /dev/null | grep -q "^Status: install ok installed\$" || apt-get install -y [% c("pkg_name") %]'; my %install = ( Fedora => $dnf, 'Fedora-20' => $yum,

1 0

[tor-browser-bundle/maint-6.5] Fix release date bug in Changelog
by gk＠torproject.org 06 Mar '17

06 Mar '17

commit 21ddc8a6be0f6ffe4723b1eba615e99460889e64 Author: Georg Koppen <gk(a)torproject.org> Date: Mon Mar 6 11:04:23 2017 +0000 Fix release date bug in Changelog --- Bundle-Data/Docs/ChangeLog.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index 311a894..5438022 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -1,4 +1,4 @@ -Tor Browser 6.5.1 -- March 6 2017 +Tor Browser 6.5.1 -- March 7 2017 * All Platforms * Update Firefox to 45.8.0esr * Tor to 0.2.9.10

1 0

[tor-browser-bundle/hardened-builds] Release preparations for 7.0a2-hardened
by gk＠torproject.org 06 Mar '17

06 Mar '17

commit dcfd2efd5b155830e4d9443b9f6b69f60313e6fb Author: Georg Koppen <gk(a)torproject.org> Date: Mon Mar 6 08:12:25 2017 +0000 Release preparations for 7.0a2-hardened Version bumps, Changelog update, and update of config.yml --- Bundle-Data/Docs/ChangeLog.txt | 20 ++++++++++++++++++++ gitian/versions.alpha | 14 +++++++------- tools/update-responses/config.yml | 10 +++++----- 3 files changed, 32 insertions(+), 12 deletions(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index f349311..c192940 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,23 @@ +Tor Browser 7.0a2-hardened -- March 7 2017 + * All Platforms + * Update Firefox to 45.8.0esr + * Tor to 0.3.0.4-rc + * OpenSSL to 1.0.2k + * Update Torbutton to 1.9.7.1 + * Bug 21396: Allow leaking of resource/chrome URIs (off by default) + * Bug 21574: Add link for zh manual and create manual links dynamically + * Bug 21330: Non-usable scrollbar appears in tor browser security settings + * Bug 21324: Don't update NoScript button with timer update + * Translation updates + * Update HTTPS-Everywhere to 5.2.11 + * Bug 21514: Restore W^X JIT implementation removed from ESR45 + * Bug 21536: Remove scramblesuit bridge + * Bug 21342: Move meek-azure to the meek.azureedge.net backend and cymrubridge02 bridge + * Bug 21326: Update the "Using a system-installed Tor" section in start script + * Build system + * Bug 17034: Use our built binutils and GCC for building tor + * Code clean-up + Tor Browser 7.0a1-hardened -- January 25 2017 * All Platforms * Update Firefox to 45.7.0esr diff --git a/gitian/versions.alpha b/gitian/versions.alpha index aaacef9..e3352c4 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -14,15 +14,15 @@ DATA_OUTSIDE_APP_DIR=1 VERIFY_TAGS=1 -FIREFOX_VERSION=45.7.0esr +FIREFOX_VERSION=45.8.0esr TORBROWSER_UPDATE_CHANNEL=hardened TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-7.0-1-build1 -TOR_TAG=tor-0.3.0.2-alpha +TOR_TAG=tor-0.3.0.4-rc TORLAUNCHER_TAG=0.2.11.1 -TORBUTTON_TAG=1.9.7 -HTTPSE_TAG=5.2.9 +TORBUTTON_TAG=1.9.7.1 +HTTPSE_TAG=5.2.11 NSIS_TAG=v0.3.1 ZLIB_TAG=v1.2.8 LIBEVENT_TAG=release-2.0.22-stable @@ -55,10 +55,10 @@ UNIURI_TAG=8902c56451e9b58ff940bbe5fec35d5f9c04584a GITIAN_TAG=tor-browser-builder-4-1 -OPENSSL_VER=1.0.2j +OPENSSL_VER=1.0.2k GMP_VER=5.1.3 FIREFOX_LANG_VER=$FIREFOX_VERSION -FIREFOX_LANG_BUILD=build1 +FIREFOX_LANG_BUILD=build2 BINUTILS_VER=2.24 GCC_VER=5.4.0 CLANG_VER=r247539 @@ -110,7 +110,7 @@ NOTOTCFONT_PACKAGE=NotoSansTC-Regular.otf ELFUTILS_PACKAGE=elfutils-${ELFUTILS_VER}.tar.bz2 # Hashes for packages with weak sigs or no sigs -OPENSSL_HASH=e7aff292be21c259c6af26469c7a9b3ba26e9abaaffd325e3dccc9785256c431 +OPENSSL_HASH=6b3977c61f2aedf0f96367dcfb5c6e578cf37e7b8d913b4ecb6643c3cb88d8c0 GMP_HASH=752079520b4690531171d0f4532e40f08600215feefede70b24fabdc6f1ab160 OSXSDK_HASH=da77bb0003fcca5ea8c4e8cb2da8828ded750c54afdcac29ec6f3b46ad5e3adf OSXSDK_OLD_HASH=6602d8d5ddb371fbc02e2a5967d9bd0cd7358d46f9417753c8234b923f2ea6fc diff --git a/tools/update-responses/config.yml b/tools/update-responses/config.yml index 21c039b..0f112a3 100644 --- a/tools/update-responses/config.yml +++ b/tools/update-responses/config.yml @@ -20,7 +20,7 @@ build_targets: osx32: Darwin_x86-gcc3 osx64: Darwin_x86_64-gcc3 channels: - hardened: 7.0a1-hardened + hardened: 7.0a2-hardened release: 6.0.1 versions: 6.0.1: @@ -33,11 +33,11 @@ versions: osx32: minSupportedOSVersion: 10.8 detailsURL: https://blog.torproject.org/blog/end-life-plan-tor-browser-32-bit-macs#upda… - 7.0a1-hardened: - platformVersion: 45.7.0 - detailsURL: https://blog.torproject.org/blog/tor-browser-70a1-hardened-released + 7.0a2-hardened: + platformVersion: 45.8.0 + detailsURL: https://blog.torproject.org/blog/tor-browser-70a2-hardened-released incremental_from: - - 6.5a6-hardened + - 7.0a1-hardened migrate_archs: osx32: osx64 osx32:

1 0

[tor-browser-build/master] binutils: add the --enable-plugins configure flag
by boklm＠torproject.org 05 Mar '17

05 Mar '17

commit 375e3655ba9855a11aea1a78f7861f7843db81d6 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Sun Mar 5 18:33:27 2017 +0100 binutils: add the --enable-plugins configure flag --- projects/binutils/config | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/projects/binutils/config b/projects/binutils/config index c1e67df..2975f14 100644 --- a/projects/binutils/config +++ b/projects/binutils/config @@ -3,7 +3,7 @@ version: 2.24 filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz' remote_docker: 1 var: - configure_opt: '--disable-multilib --enable-gold --enable-deterministic-archives' + configure_opt: '--disable-multilib --enable-gold --enable-deterministic-archives --enable-plugins' targets: windows-i686:

1 0

[tor-browser-build/master] firefox: correctly extract binutils
by boklm＠torproject.org 05 Mar '17

05 Mar '17

commit b4e028b87ff81ea12e22f1e1d59025419c911f65 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Sun Mar 5 18:34:23 2017 +0100 firefox: correctly extract binutils --- projects/firefox/build | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/projects/firefox/build b/projects/firefox/build index 453f6b3..496c215 100644 --- a/projects/firefox/build +++ b/projects/firefox/build @@ -17,7 +17,8 @@ distdir=/var/tmp/dist/[% project %] mkdir -p /var/tmp/build [% IF c("var/linux") %] -tar xf $rootdir/[% c('input_files_by_name/binutils') %] +mkdir -p /var/tmp/dist +tar -C /var/tmp/dist -xf $rootdir/[% c('input_files_by_name/binutils') %] export PATH="/var/tmp/dist/binutils/bin:$PATH" [% END -%]

1 0

[tor-browser-build/master] Bug 21605: Switch to tpo repo for sandboxed tor browser
by boklm＠torproject.org 05 Mar '17

05 Mar '17

commit d7d65fa096b65eb5b0748658f05bbb31736bedca Author: Nicolas Vigier <boklm(a)torproject.org> Date: Thu Mar 2 13:52:49 2017 +0100 Bug 21605: Switch to tpo repo for sandboxed tor browser --- projects/sandbox/config | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/projects/sandbox/config b/projects/sandbox/config index 54fe4df..44faca9 100644 --- a/projects/sandbox/config +++ b/projects/sandbox/config @@ -1,6 +1,6 @@ # vim: filetype=yaml sw=2 version: 0.0.3 -git_url: https://git.schwanenlied.me/yawning/sandboxed-tor-browser +git_url: https://git.torproject.org/tor-browser/sandboxed-tor-browser git_hash: 'sandboxed-tor-browser-[% c("version") %]' tag_gpg_id: 1 gpg_keyring: obfs4.gpg

1 0