- tbb-commits - lists.torproject.org

[tor-browser-bundle/master] Version bumps, changelog update
by gk＠torproject.org 30 Oct '15

30 Oct '15

commit c023bbcc3abb9a577004c30becb38c77b38eda6f Author: Georg Koppen <gk(a)torproject.org> Date: Fri Oct 30 22:06:48 2015 +0000 Version bumps, changelog update --- Bundle-Data/Docs/ChangeLog.txt | 26 ++++++++++++++++++++++++++ gitian/versions.alpha | 12 ++++++------ gitian/versions.nightly | 8 ++++---- tools/update-responses/config.yml | 12 ++++++------ 4 files changed, 42 insertions(+), 16 deletions(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index 71154c4..ba4a3b5 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,29 @@ +Tor Browser 5.5a4 -- November 3 2015 + * All Platforms + * Update Firefox to 38.4.0esr + * Update Tor to 0.2.7.4-rc + * Update NoScript to 2.6.9.39 + * Update HTTPS-Everywhere to 5.1.1 + * Update Torbutton to 1.9.4.1 + * Bug 9263: Spoof Referer when leaving a .onion domain + * Bug 16620: Remove old window.name handling code + * Bug 17164: Don't show text-select cursor on circuit display + * Bug 17351: Remove unused code + * Translation updates + * Bug 17207: Hide MIME types and plugins from websites + * Bug 16909+17383: Adapt to HTTPS-Everywhere build changes + * Bug 16620: Move window.name handling into a Firefox patch + * Bug 17220: Support math symbols in font whitelist + * Bug 10599+17305: Include updater and build patches needed for hardened builds + * Bug 17318: Remove dead ScrambleSuit bridge + * Bug 17428: Remove default Flashproxy bridges + * Windows + * Bug 17250: Add localized font names to font whitelist + * OS X + * Bug 17122: Rename Japanese OS X bundle + * Linux + * Bug 17329: Ensure that non-ASCII characters can be typed (fixup of #5926) + Tor Browser 5.5a3 -- September 22 2015 * All Platforms * Update Firefox to 38.3.0esr diff --git a/gitian/versions.alpha b/gitian/versions.alpha index 3588096..81818e8 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -7,14 +7,14 @@ BUILD_PT_BUNDLES=1 VERIFY_TAGS=1 -FIREFOX_VERSION=38.3.0esr +FIREFOX_VERSION=38.4.0esr TORBROWSER_UPDATE_CHANNEL=alpha -TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-5.5-2-build4 -TOR_TAG=tor-0.2.7.2-alpha +TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-5.5-1-build1 +TOR_TAG=tor-0.2.7.4-rc TORLAUNCHER_TAG=0.2.7.7 -TORBUTTON_TAG=1.9.4 +TORBUTTON_TAG=1.9.4.1 HTTPSE_TAG=5.1.1 NSIS_TAG=v0.3 ZLIB_TAG=v1.2.8 @@ -62,7 +62,7 @@ NOTOCJKFONT_VER=1.004 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz GMP_PACKAGE=gmp-${GMP_VER}.tar.bz2 -NOSCRIPT_PACKAGE=noscript_security_suite-2.6.9.36-sm+fx+fn.xpi +NOSCRIPT_PACKAGE=noscript_security_suite-2.6.9.39-sm+fx+fn.xpi TOOLCHAIN4_PACKAGE=x86_64-apple-darwin10.tar.xz TOOLCHAIN4_OLD_PACKAGE=multiarch-darwin11-cctools127.2-gcc42-5666.3-llvmgcc42-2336.1-Linux-120724.tar.xz OSXSDK_PACKAGE=MacOSX10.7.sdk.tar.gz @@ -93,7 +93,7 @@ OSXSDK_HASH=da77bb0003fcca5ea8c4e8cb2da8828ded750c54afdcac29ec6f3b46ad5e3adf OSXSDK_OLD_HASH=6602d8d5ddb371fbc02e2a5967d9bd0cd7358d46f9417753c8234b923f2ea6fc TOOLCHAIN4_HASH=7b71bfe02820409b994c5c33a7eab81a81c72550f5da85ff7af70da3da244645 TOOLCHAIN4_OLD_HASH=65c1b2d302358a6b95a26c6828a66908a199276193bb0b268f2dcc1a997731e9 -NOSCRIPT_HASH=0585d95161711f6e4bcd56ed6f160c15bbf08ab6c559a675ce659e6c8ffb150d +NOSCRIPT_HASH=dd904c6a12a8b1f6b1da48d51e4df903d7f9211ba5b3f32d7272f413a3bf548a MSVCR100_HASH=1221a09484964a6f38af5e34ee292b9afefccb3dc6e55435fd3aaf7c235d9067 PYCRYPTO_HASH=f2ce1e989b272cfcb677616763e0a2e7ec659effa67a88aa92b3a65528f60a3c ARGPARSE_HASH=ddaf4b0a618335a32b6664d4ae038a1de8fbada3b25033f9021510ed2b3941a4 diff --git a/gitian/versions.nightly b/gitian/versions.nightly index 4e8cd42..9f1c6b4 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -14,11 +14,11 @@ MULTI_LINGUAL=1 VERIFY_TAGS=0 -FIREFOX_VERSION=38.3.0esr +FIREFOX_VERSION=38.4.0esr TORBROWSER_UPDATE_CHANNEL=default -TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-5.5-2 +TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-5.5-1 TOR_TAG=master TORLAUNCHER_TAG=master TORBUTTON_TAG=master @@ -69,7 +69,7 @@ NOTOCJKFONT_VER=1.004 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz GMP_PACKAGE=gmp-${GMP_VER}.tar.bz2 -NOSCRIPT_PACKAGE=noscript_security_suite-2.6.9.36-sm+fx+fn.xpi +NOSCRIPT_PACKAGE=noscript_security_suite-2.6.9.39-sm+fx+fn.xpi TOOLCHAIN4_PACKAGE=x86_64-apple-darwin10.tar.xz TOOLCHAIN4_OLD_PACKAGE=multiarch-darwin11-cctools127.2-gcc42-5666.3-llvmgcc42-2336.1-Linux-120724.tar.xz OSXSDK_PACKAGE=MacOSX10.7.sdk.tar.gz @@ -100,7 +100,7 @@ OSXSDK_HASH=da77bb0003fcca5ea8c4e8cb2da8828ded750c54afdcac29ec6f3b46ad5e3adf OSXSDK_OLD_HASH=6602d8d5ddb371fbc02e2a5967d9bd0cd7358d46f9417753c8234b923f2ea6fc TOOLCHAIN4_HASH=7b71bfe02820409b994c5c33a7eab81a81c72550f5da85ff7af70da3da244645 TOOLCHAIN4_OLD_HASH=65c1b2d302358a6b95a26c6828a66908a199276193bb0b268f2dcc1a997731e9 -NOSCRIPT_HASH=0585d95161711f6e4bcd56ed6f160c15bbf08ab6c559a675ce659e6c8ffb150d +NOSCRIPT_HASH=dd904c6a12a8b1f6b1da48d51e4df903d7f9211ba5b3f32d7272f413a3bf548a MSVCR100_HASH=1221a09484964a6f38af5e34ee292b9afefccb3dc6e55435fd3aaf7c235d9067 PYCRYPTO_HASH=f2ce1e989b272cfcb677616763e0a2e7ec659effa67a88aa92b3a65528f60a3c ARGPARSE_HASH=ddaf4b0a618335a32b6664d4ae038a1de8fbada3b25033f9021510ed2b3941a4 diff --git a/tools/update-responses/config.yml b/tools/update-responses/config.yml index dcef911..acfa5db 100644 --- a/tools/update-responses/config.yml +++ b/tools/update-responses/config.yml @@ -9,7 +9,7 @@ build_targets: osx32: Darwin_x86-gcc3 osx64: Darwin_x86_64-gcc3 channels: - alpha: 5.5a3 + alpha: 5.5a4 release: 5.0 versions: 5.0: @@ -23,12 +23,12 @@ versions: osx32: minSupportedOSVersion: 10.8 detailsURL: https://blog.torproject.org/blog/end-life-plan-tor-browser-32-bit-macs#upda… - 5.5a3: - platformVersion: 38.3.0 - detailsURL: https://blog.torproject.org/blog/tor-browser-55a3-released - download_url: https://www.torproject.org/dist/torbrowser/5.5a3 + 5.5a4: + platformVersion: 38.4.0 + detailsURL: https://blog.torproject.org/blog/tor-browser-55a4-released + download_url: https://www.torproject.org/dist/torbrowser/5.5a4 incremental_from: - - 5.5a2 + - 5.5a3 migrate_archs: osx32: osx64 osx32:

1 0

[torbutton/master] Update changelog; bump version
by gk＠torproject.org 30 Oct '15

30 Oct '15

commit 930cbdb5d4366815a5a04e9d4a0565c73ea2cd0c Author: Georg Koppen <gk(a)torproject.org> Date: Fri Oct 30 20:08:43 2015 +0000 Update changelog; bump version --- src/CHANGELOG | 7 +++++++ src/install.rdf | 2 +- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/src/CHANGELOG b/src/CHANGELOG index 76fa989..0347f11 100644 --- a/src/CHANGELOG +++ b/src/CHANGELOG @@ -1,3 +1,10 @@ +1.9.4.1 + * Bug 9263: Spoof Referer when leaving a .onion domain + * Bug 16620: Move window.name handling into a Firefox patch + * Bug 17164: Don't show text-select cursor on circuit display + * Bug 17351: Remove unused code + * Translation updates + 1.9.4 * Bug 16937: Don't translate the hompepage/spellchecker dictionary string * Bug 16735: about:tor should accommodate different fonts/font sizes diff --git a/src/install.rdf b/src/install.rdf index db9af4b..267870c 100644 --- a/src/install.rdf +++ b/src/install.rdf @@ -6,7 +6,7 @@ <em:name>Torbutton</em:name> <em:creator>Mike Perry</em:creator> <em:id>torbutton(a)torproject.org</em:id> - <em:version>1.9.4</em:version> + <em:version>1.9.4.1</em:version> <em:homepageURL>https://www.torproject.org/projects/torbrowser.html.en</em:homepageURL> <em:optionsURL>chrome://torbutton/content/preferences.xul</em:optionsURL> <em:iconURL>chrome://torbutton/skin/tor.png</em:iconURL>

1 0

[torbutton/master] Bug 16620: Transform window.name handling into Firefox patch.
by gk＠torproject.org 30 Oct '15

30 Oct '15

commit 4afb4f104685466ee0ac4f98fda7dd57d6d522c2 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Wed Oct 14 15:19:20 2015 -0400 Bug 16620: Transform window.name handling into Firefox patch. Removed torbutton_weblistener and torbutton_check_progress(). --- src/chrome/content/torbutton.js | 173 --------------------------------------- 1 file changed, 173 deletions(-) diff --git a/src/chrome/content/torbutton.js b/src/chrome/content/torbutton.js index fb9c8c3..58ab20e 100644 --- a/src/chrome/content/torbutton.js +++ b/src/chrome/content/torbutton.js @@ -2907,15 +2907,6 @@ function torbutton_do_main_window_startup() { torbutton_log(3, "Torbutton main window startup"); m_tb_is_main_window = true; - - // http://www.xulplanet.com/references/xpcomref/ifaces/nsIWebProgress.html - var progress = - Components.classes["@mozilla.org/docloaderservice;1"]. - getService(Components.interfaces.nsIWebProgress); - - progress.addProgressListener(torbutton_weblistener, - Components.interfaces.nsIWebProgress.NOTIFY_LOCATION); - torbutton_unique_pref_observer.register(); } @@ -3181,11 +3172,6 @@ function torbutton_close_window(event) { } } - // remove old listeners - var progress = Components.classes["@mozilla.org/docloaderservice;1"]. - getService(Components.interfaces.nsIWebProgress); - - progress.removeProgressListener(torbutton_weblistener); torbutton_unique_pref_observer.unregister(); if(m_tb_is_main_window) { // main window not reset above @@ -3209,165 +3195,6 @@ function torbutton_open_network_settings() { window.addEventListener('load',torbutton_new_window,false); window.addEventListener('unload', torbutton_close_window, false); -// FIXME: Tons of exceptions get thrown from this function on account -// of its being called so early. Need to find a quick way to check if -// aProgress and aRequest are actually fully initialized -// (without throwing exceptions) -// Bug 1506 P0: This is to block full page plugins. Not needed anymore -// due to better (but non-toggle-friendly) plugin APIs) -function torbutton_check_progress(aProgress, aRequest, aFlags, new_loc) { - if (!m_tb_wasinited) { - torbutton_init(); - } - - var DOMWindow = null; - - // Bug #866: Zotero conflict with about:blank windows - // handle docshell JS switching and other early duties - var WP_STATE_START = Ci.nsIWebProgressListener.STATE_START; - var WP_STATE_DOC = Ci.nsIWebProgressListener.STATE_IS_DOCUMENT; - var WP_STATE_START_DOC = WP_STATE_START | WP_STATE_DOC; - - if ((aFlags & WP_STATE_START_DOC) == WP_STATE_START_DOC - && aRequest instanceof Ci.nsIChannel - && !(aRequest.loadFlags & aRequest.LOAD_INITIAL_DOCUMENT_URI) - && aRequest.URI.spec == "about:blank") { - torbutton_log(3, "Passing on about:blank"); - return 0; - } - - if(aProgress) { - try { - DOMWindow = aProgress.DOMWindow; - } catch(e) { - torbutton_log(4, "Exception on DOMWindow: "+e); - DOMWindow = null; - } - } - - if(!DOMWindow) { - try { - if(aRequest.notificationCallbacks) { - DOMWindow = aRequest.notificationCallbacks.QueryInterface( - Components.interfaces.nsIInterfaceRequestor).getInterface( - Components.interfaces.nsIDOMWindow); - } - } catch(e) { } - } - - // TODO: separate this from the above? - if(DOMWindow) { - var doc = DOMWindow.document; - try { - if(doc) { - if(doc.domain) { - var referrer = null; - var win = DOMWindow.window; - - try { - var hreq = aRequest.QueryInterface(Ci.nsIHttpChannel); - referrer = hreq.referrer; - } catch(e) {} - - try { - // XXX: The patch from https://bugzilla.mozilla.org/show_bug.cgi?id=444222 - // might be better here.. - // - // Ticket #3414: Apply referer policy to window.name. - // - // This keeps window.name clean between fresh urls. - // It should also apply to iframes because hookdoc gets called for all - // frames and subdocuments. - // - // The about:blank check handles the 'name' attribute of framesets, which - // get set before the referer is set on the channel. - if ((!referrer || referrer.spec == "") && win.location != "about:blank") { - if (win.top == win.window) { - // Only reset if we're the top-level window - //torbutton_log(4, "Resetting window.name: "+win.name+" for "+win.location); - win.name = ""; - win.window.name = ""; - } - } - } catch(e) { - torbutton_log(4, "Failed to reset window.name: "+e) - } - } - } - } catch(e) { - try { - if(doc && doc.location && - (doc.location.href.indexOf("about:") != 0 && - doc.location.href.indexOf("chrome:") != 0)) { - torbutton_safelog(4, "Exception "+e - +" on tag application at: ", - doc.location); - } else { - torbutton_eclog(3, "Got an about url: "+e); - } - } catch(e1) { - torbutton_eclog(3, "Got odd url "+e); - } - } - } else { - torbutton_eclog(3, "No aProgress for location!"); - } - return 0; -} - -// Warning: These can also fire when the 'debuglogger' extension -// updates its window. Typically for this, doc.domain is null. Do not -// log in this case (until we find a better way to filter those -// events out). Use torbutton_eclog for common-path stuff.] -// -// Bug 1506 P0: This listener is for blocking plugins and installing JS hooks. -// It can be eliminated. -var torbutton_weblistener = -{ - QueryInterface: function(aIID) - { - if (aIID.equals(Components.interfaces.nsIWebProgressListener) || - aIID.equals(Components.interfaces.nsISupportsWeakReference) || - aIID.equals(Components.interfaces.nsISupports)) - return this; - throw Components.results.NS_NOINTERFACE; - }, - - onLocationChange: function(aProgress, aRequest, aURI) - { - torbutton_eclog(2, 'onLocationChange: '+aURI.asciiSpec); - if(aURI.scheme == "about" || aURI.scheme == "chrome") { - torbutton_eclog(3, "Skipping location change for "+aURI.asciiSpec); - } else { - return torbutton_check_progress(aProgress, aRequest, 0, true); - } - }, - - // XXX: The following can probably go - onStateChange: function(aProgress, aRequest, aFlag, aStatus) - { - torbutton_eclog(2, 'State change()'); - return torbutton_check_progress(aProgress, aRequest, aFlag, false); - }, - - onProgressChange: function(aProgress, aRequest, curSelfProgress, maxSelfProgress, curTotalProgress, maxTotalProgress) - { - torbutton_eclog(2, 'called progressChange'); - return torbutton_check_progress(aProgress, aRequest, 0, false); - }, - - onStatusChange: function(aProgress, aRequest, stat, message) - { - torbutton_eclog(2, 'called progressChange'); - return torbutton_check_progress(aProgress, aRequest, 0, false); - }, - - onSecurityChange: function() {return 0;}, - - onLinkIconAvailable: function() - { /*torbutton_eclog(1, 'called linkIcon'); */ return 0; } -} - var m_tb_resize_handler = null; var m_tb_resize_date = null;

1 0

[tor-browser/tor-browser-38.3.0esr-5.5-2] Bug 16620: Clear window.name when no referrer sent
by gk＠torproject.org 30 Oct '15

30 Oct '15

commit 95a62d13e045b950ed2b2f242da7413d33386a47 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Fri Oct 30 14:28:13 2015 -0400 Bug 16620: Clear window.name when no referrer sent Convert JS implementation (within Torbutton) to a C++ browser patch. --- docshell/base/nsDocShell.cpp | 47 +++++++++++++ docshell/test/mochitest.ini | 2 + docshell/test/test_tor_bug16620.html | 129 ++++++++++++++++++++++++++++++++++ docshell/test/tor_bug16620.html | 51 ++++++++++++++ 4 files changed, 229 insertions(+) diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp index 03885534..59f184e 100644 --- a/docshell/base/nsDocShell.cpp +++ b/docshell/base/nsDocShell.cpp @@ -8992,6 +8992,53 @@ nsDocShell::CreateContentViewer(const char* aContentType, aOpenedChannel->GetURI(getter_AddRefs(mLoadingURI)); } FirePageHideNotification(!mSavingOldViewer); + + // Tor bug # 16620: Clear window.name if there is no referrer. We make an + // exception for new windows, e.g., window.open(url, "MyName"). + bool isNewWindowTarget = false; + nsCOMPtr<nsIPropertyBag2> props(do_QueryInterface(aRequest, &rv)); + if (props) { + props->GetPropertyAsBool(NS_LITERAL_STRING("docshell.newWindowTarget"), + &isNewWindowTarget); + } + + if (!isNewWindowTarget) { + nsCOMPtr<nsIHttpChannel> httpChannel(do_QueryInterface(aOpenedChannel)); + nsCOMPtr<nsIURI> httpReferrer; + if (httpChannel) + httpChannel->GetReferrer(getter_AddRefs(httpReferrer)); + +#ifdef DEBUG_WINDOW_NAME + printf("DOCSHELL %p CreateContentViewer - possibly clearing window.name:\n", this); + printf(" current window.name: \"%s\"\n", + NS_ConvertUTF16toUTF8(mName).get()); + + nsAutoCString curSpec, loadingSpec; + if (this->mCurrentURI) + mCurrentURI->GetSpec(curSpec); + if (mLoadingURI) + mLoadingURI->GetSpec(loadingSpec); + printf(" current URI: %s\n", curSpec.get()); + printf(" loading URI: %s\n", loadingSpec.get()); + + if (!httpReferrer) { + printf(" referrer: None\n"); + } else { + nsAutoCString refSpec; + httpReferrer->GetSpec(refSpec); + printf(" referrer: %s\n", refSpec.get()); + } +#endif + + if (!httpReferrer) + SetName(NS_LITERAL_STRING("")); + +#ifdef DEBUG_WINDOW_NAME + printf(" action taken: %s window.name\n", + httpReferrer ? "Preserved" : "Cleared"); +#endif + } + mLoadingURI = nullptr; // Set mFiredUnloadEvent = false so that the unload handler for the diff --git a/docshell/test/mochitest.ini b/docshell/test/mochitest.ini index 3668c58..a1325b9 100644 --- a/docshell/test/mochitest.ini +++ b/docshell/test/mochitest.ini @@ -34,6 +34,7 @@ support-files = file_bug728939.html file_pushState_after_document_open.html historyframes.html + tor_bug16620.html [test_anchor_scroll_after_document_open.html] [test_bfcache_plus_hash.html] @@ -107,3 +108,4 @@ support-files = file_framedhistoryframes.html skip-if = (buildapp == 'b2g' && toolkit != 'gonk') #Bug 931116, b2g desktop specific, initial triage [test_bug1121701.html] skip-if = (buildapp == 'b2g' || buildapp == 'mulet') +[test_tor_bug16620.html] diff --git a/docshell/test/test_tor_bug16620.html b/docshell/test/test_tor_bug16620.html new file mode 100644 index 0000000..0fe9603 --- /dev/null +++ b/docshell/test/test_tor_bug16620.html @@ -0,0 +1,129 @@ +<!DOCTYPE HTML> +<html> + +<meta charset="utf-8"> +<head> + <title>Test for Tor Bug 16620 - Clear window.name when no referrer sent</title> + <script type="application/javascript" + src="/tests/SimpleTest/SimpleTest.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/> +</head> +<body> +<a target="_blank" href="https://trac.torproject.org/projects/tor/ticket/16620">Tor Bug 16620</a> +<script type="application/javascript;version=1.7"> + +// ## Test constants +const kTestPath = "/tests/docshell/test/"; +const kFile = "tor_bug16620.html"; +const kBaseURL1 = "http://example.com"; +const kBaseURL2 = "http://example.net"; + +let gTests = [ + // Test #1: Same domain: + { startURL: kBaseURL1, destURL: kBaseURL1, + expectIsolation: false }, + + // Test #2: Different top-level domains: + { startURL: kBaseURL1, destURL: kBaseURL2, + expectIsolation: false }, + + // Test #3: Same domain, rel="noreferrer" on link: + { startURL: kBaseURL1, destURL: kBaseURL1, noReferrerOnLink: true, + expectIsolation: true }, + + // Test #4: Same domain, "no-referrer" meta tag in document: + { startURL: kBaseURL1, destURL: kBaseURL1, noReferrerInMetaTag: true, + expectIsolation: true }, + + // Test #5: Like test 4, but reset window.name during unload: + // (similar to http://www.thomasfrank.se/sessvarsTestPage1.html) + { startURL: kBaseURL1, destURL: kBaseURL1, noReferrerInMetaTag: true, + resetInUnload: true, + expectIsolation: true }, + + // Test #6: Data URL as destination (no referrer): + { startURL: kBaseURL1, + expectIsolation: true }, +]; + +let gCurTest = 0; +let gCurWinName, gChildWin, gDataURL; + +// ## Utility functions +function generateRandomName() +{ + // Generate a random 6 character string using 0-9 and a-z. + return ((1 + Math.random()).toString(36) + '000000').substr(2, 6); +} + +function startNextTest() { + ++gCurTest; + if (gCurTest > gTests.length) { + SimpleTest.finish(); + } else { + let curTest = gTests[gCurTest - 1]; + let url = curTest.startURL + kTestPath + kFile + "?firstDocLoaded"; + gCurWinName = generateRandomName(); + gChildWin = window.open(url, gCurWinName); + } +} + +// ## Add a message event listener. +window.addEventListener("message", function(aEvent) { + if (aEvent.source !== gChildWin) + return; + +// console.log("parent received message:" + JSON.stringify(aEvent.data)); + + let curTest = gTests[gCurTest - 1]; + let state = aEvent.data.state; + let winName = aEvent.data.winName; + if ("firstDocLoaded" == state) { + ok(winName === gCurWinName, "Test #" + gCurTest + + " - first document's name matches window.open parameter"); + + // Send an "openURL" message to the loaded document. + let url2 = (curTest.destURL) + ? curTest.destURL + kTestPath + kFile + "?secondDocLoaded" + : gDataURL; + let noReferrerOnLink = (curTest.noReferrerOnLink === true); + let noReferrerInMetaTag = (curTest.noReferrerInMetaTag === true); + let resetInUnload = (curTest.resetInUnload === true); + aEvent.source.postMessage({ action: "openURL", url: url2, + noReferrerOnLink: noReferrerOnLink, + noReferrerInMetaTag: noReferrerInMetaTag, + resetInUnload: resetInUnload }, + aEvent.origin); + } else if ("secondDocLoaded" == state) { + if (curTest.expectIsolation) { + ok(winName === "", + "Test #" + gCurTest + " - second document: name was cleared"); + } else { + ok(winName === gCurWinName, + "Test #" + gCurTest + " - second document: name was preserved"); + } + + gChildWin.close(); + startNextTest(); + } + }, false); + +SimpleTest.waitForExplicitFinish(); + +// Read file contents, construct a data URL (used by some tests), and +// then start the first test. +let url = kTestPath + kFile; +let xhr = new XMLHttpRequest(); +xhr.open("GET", url); +xhr.onload = function() { + gDataURL = "data:text/html;charset=utf-8," + + encodeURIComponent(this.responseText); + startNextTest(); +} +xhr.send(); +</script> +</body> +</html> diff --git a/docshell/test/tor_bug16620.html b/docshell/test/tor_bug16620.html new file mode 100644 index 0000000..a8e9050 --- /dev/null +++ b/docshell/test/tor_bug16620.html @@ -0,0 +1,51 @@ +<!DOCTYPE HTML> +<html> + +<head> + <meta charset="UTF-8"> + <title>Supporting Doc for Tor Bug 16620 Tests</title> +</head> +<body> +<a id="link" href="">secondDoc</a> + +<script type="application/javascript;version=1.7"> +// Extract test state from our query string, defaulting to +// "secondDocLoaded" to support use of this HTML content within +// a data URI (where query strings are not supported). +let state = (location.search.length > 0) ? location.search.substr(1) + : "secondDocLoaded"; + +// Notify the test driver. +opener.postMessage({ state: state, winName: window.name }, "*"); + +// Add a message event listener to process "openURL" actions. +window.addEventListener("message", function(aEvent) { + if (aEvent.data.action == "openURL") { + if (aEvent.data.noReferrerInMetaTag) { + let metaElem = document.createElement("meta"); + metaElem.name = "referrer"; + metaElem.content = "no-referrer"; + document.head.appendChild(metaElem); + } + + let linkElem = document.getElementById("link"); + linkElem.href = aEvent.data.url; + if (aEvent.data.noReferrerOnLink) + linkElem.rel = "noreferrer"; + + if (aEvent.data.resetInUnload) { + let tmpName = window.name; + window.addEventListener("unload", function() { + window.name = tmpName; + }, false); + } + + linkElem.click(); + } +}, false); +</script> +</body> +</html>

1 0

[tor-browser/tor-browser-38.3.0esr-5.5-2] Bug #17207: Hide mime types and plugins when resisting fingerprinting
by gk＠torproject.org 30 Oct '15

30 Oct '15

commit 5ea30524fbf92005f236756646beb77684cd2008 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Fri Oct 16 16:09:54 2015 -0700 Bug #17207: Hide mime types and plugins when resisting fingerprinting --- dom/base/nsMimeTypeArray.cpp | 19 +++++++++++++++++++ dom/base/nsPluginArray.cpp | 13 ++++++++++--- 2 files changed, 29 insertions(+), 3 deletions(-) diff --git a/dom/base/nsMimeTypeArray.cpp b/dom/base/nsMimeTypeArray.cpp index 257abf6..ee530a3 100644 --- a/dom/base/nsMimeTypeArray.cpp +++ b/dom/base/nsMimeTypeArray.cpp @@ -14,6 +14,7 @@ #include "nsIMIMEInfo.h" #include "Navigator.h" #include "nsServiceManagerUtils.h" +#include "nsContentUtils.h" using namespace mozilla; using namespace mozilla::dom; @@ -39,6 +40,12 @@ nsMimeTypeArray::~nsMimeTypeArray() { } +static bool +ResistFingerprinting() { + return !nsContentUtils::ThreadsafeIsCallerChrome() && + nsContentUtils::ResistFingerprinting(); +} + JSObject* nsMimeTypeArray::WrapObject(JSContext* aCx) { @@ -78,6 +85,10 @@ nsMimeTypeArray::IndexedGetter(uint32_t aIndex, bool &aFound) { aFound = false; + if (ResistFingerprinting()) { + return nullptr; + } + EnsurePluginMimeTypes(); if (aIndex >= mMimeTypes.Length()) { @@ -108,6 +119,10 @@ nsMimeTypeArray::NamedGetter(const nsAString& aName, bool &aFound) { aFound = false; + if (ResistFingerprinting()) { + return nullptr; + } + EnsurePluginMimeTypes(); nsString lowerName(aName); @@ -181,6 +196,10 @@ nsMimeTypeArray::NameIsEnumerable(const nsAString& aName) uint32_t nsMimeTypeArray::Length() { + if (ResistFingerprinting()) { + return 0; + } + EnsurePluginMimeTypes(); return mMimeTypes.Length(); diff --git a/dom/base/nsPluginArray.cpp b/dom/base/nsPluginArray.cpp index 1dcd551..8f789ee 100644 --- a/dom/base/nsPluginArray.cpp +++ b/dom/base/nsPluginArray.cpp @@ -20,6 +20,7 @@ #include "nsIWeakReference.h" #include "mozilla/Services.h" #include "nsIInterfaceRequestorUtils.h" +#include "nsContentUtils.h" using namespace mozilla; using namespace mozilla::dom; @@ -43,6 +44,12 @@ nsPluginArray::~nsPluginArray() { } +static bool +ResistFingerprinting() { + return !nsContentUtils::ThreadsafeIsCallerChrome() && + nsContentUtils::ResistFingerprinting(); +} + nsPIDOMWindow* nsPluginArray::GetParentObject() const { @@ -174,7 +181,7 @@ nsPluginArray::IndexedGetter(uint32_t aIndex, bool &aFound) { aFound = false; - if (!AllowPlugins()) { + if (!AllowPlugins() || ResistFingerprinting()) { return nullptr; } @@ -217,7 +224,7 @@ nsPluginArray::NamedGetter(const nsAString& aName, bool &aFound) { aFound = false; - if (!AllowPlugins()) { + if (!AllowPlugins() || ResistFingerprinting()) { return nullptr; } @@ -241,7 +248,7 @@ nsPluginArray::NameIsEnumerable(const nsAString& aName) uint32_t nsPluginArray::Length() { - if (!AllowPlugins()) { + if (!AllowPlugins() || ResistFingerprinting()) { return 0; }

1 0

[tor-browser/tor-browser-38.3.0esr-5.5-2] Regression tests for Bug #17207: Hide mime types and plugins when resisting fingerprinting
by gk＠torproject.org 30 Oct '15

30 Oct '15

commit 5578785b6c12ff62b5a2cdcc3d2f5c9762af6c5c Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Fri Oct 16 17:10:57 2015 -0700 Regression tests for Bug #17207: Hide mime types and plugins when resisting fingerprinting --- dom/base/test/mochitest.ini | 1 + dom/base/test/test_tor_bug17207.html | 49 ++++++++++++++++++++++++++++++++++ 2 files changed, 50 insertions(+) diff --git a/dom/base/test/mochitest.ini b/dom/base/test/mochitest.ini index 133348e..6a8c334 100644 --- a/dom/base/test/mochitest.ini +++ b/dom/base/test/mochitest.ini @@ -739,6 +739,7 @@ skip-if = toolkit == 'android' || e10s #RANDOM [test_title.html] [test_tor_bug15502.html] [test_tor_bug15703.html] +[test_tor_bug17207.html] [test_treewalker_nextsibling.xml] [test_viewport_scroll.html] [test_viewsource_forbidden_in_object.html] diff --git a/dom/base/test/test_tor_bug17207.html b/dom/base/test/test_tor_bug17207.html new file mode 100644 index 0000000..4ab0a0d --- /dev/null +++ b/dom/base/test/test_tor_bug17207.html @@ -0,0 +1,49 @@ +<!DOCTYPE HTML> +<html> + +<head> + <meta http-equiv="content-type" content="text/html; charset=utf-8"> + <title>Test for Tor Browser Bug 17207</title> + <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script> + <script type="text/javascript" src="/tests/SimpleTest/SpawnTask.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> +<p id="display"></p> +<div id="content"></div> + +<script class="testbody" type="application/javascript;version=1.7"> +SimpleTest.waitForExplicitFinish(); + +// __setPref(key, value)__. +// Set a pref value asynchronously, returning a promise that resolves +// when it succeeds. +let setPref = function* (key, value) { + return new Promise(function(resolve, reject) { + SpecialPowers.pushPrefEnv({"set": [[key, value]]}, resolve); + }); +}; + +// Run a test to see that we don't expose the supported mimeTypes +// or installed plugins when "privacy.resistFingerprinting" is active. +spawnTask(function* () { + yield setPref("privacy.resistFingerprinting", true); + is(navigator.mimeTypes["application/pdf"], undefined, "Don't reveal mime types"); + is(navigator.mimeTypes.length, 0, "navigator.mimeTypes.length should be 0"); + yield setPref("privacy.resistFingerprinting", false); + isnot(navigator.mimeTypes["application/pdf"], undefined), + // TODO: In Firefox 38, mimeTypes are not enumerable because of https://bugzilla.mozilla.org/757726. + // But mimeType enumeration was subsequently brought back by https://bugzilla.mozilla.org/1169945. + // So we'll need to include the following line in mozilla-central or TBB/FF45ESR: + // isnot(navigator.mimeTypes.length, 0, "navigator.mimeTypes.length should not be nonzero"); + // TODO: We don't have any plugins in Tor Browser, but we will need to implement + // similar tests for plugins in mainline Firefox. + SimpleTest.finish(); +}); + +</script> + +</body> +</html>

1 0

[tor-browser/tor-browser-38.3.0esr-5.5-2] fixup! Bug #4234: Use the Firefox Update Process for Tor Browser.
by gk＠torproject.org 30 Oct '15

30 Oct '15

commit 517d9fec4b6d464d276410385942323124488255 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Mon Oct 26 18:05:33 2015 +0100 fixup! Bug #4234: Use the Firefox Update Process for Tor Browser. Bug #17305: add the hardened channel --- toolkit/modules/debug.js | 1 + toolkit/mozapps/extensions/moz.build | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/toolkit/modules/debug.js b/toolkit/modules/debug.js index a30b586..486105e 100644 --- a/toolkit/modules/debug.js +++ b/toolkit/modules/debug.js @@ -42,6 +42,7 @@ this.NS_ASSERT = function NS_ASSERT(condition, message) { case "nightly": case "aurora": case "alpha": + case "hardened": case "beta": case "default": releaseBuild = false; diff --git a/toolkit/mozapps/extensions/moz.build b/toolkit/mozapps/extensions/moz.build index c6a072c..58f8c3f 100644 --- a/toolkit/mozapps/extensions/moz.build +++ b/toolkit/mozapps/extensions/moz.build @@ -38,7 +38,7 @@ EXTRA_PP_JS_MODULES += [ 'AddonManager.jsm' ] -if CONFIG['MOZ_UPDATE_CHANNEL'] not in ('aurora', 'alpha', 'beta', 'release', 'esr'): +if CONFIG['MOZ_UPDATE_CHANNEL'] not in ('aurora', 'alpha', 'beta', 'hardened', 'release', 'esr'): DEFINES['MOZ_COMPATIBILITY_NIGHTLY'] = 1 # Additional debugging info is exposed in debug builds

1 0

[tor-browser/tor-browser-38.3.0esr-5.5-2] fixup! Bug 13379: Sign our MAR files.
by gk＠torproject.org 30 Oct '15

30 Oct '15

commit f799aa38f56abda676cacd8d435e16286edea772 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Mon Oct 26 18:09:28 2015 +0100 fixup! Bug 13379: Sign our MAR files. Bug #17305: add the hardened channel --- toolkit/mozapps/update/updater/Makefile.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/toolkit/mozapps/update/updater/Makefile.in b/toolkit/mozapps/update/updater/Makefile.in index 1f27acf..100a0df 100644 --- a/toolkit/mozapps/update/updater/Makefile.in +++ b/toolkit/mozapps/update/updater/Makefile.in @@ -15,7 +15,7 @@ endif include $(topsrcdir)/config/rules.mk -ifneq (,$(filter alpha beta release esr,$(MOZ_UPDATE_CHANNEL))) +ifneq (,$(filter alpha beta hardened release esr,$(MOZ_UPDATE_CHANNEL))) PRIMARY_CERT = release_primary.der SECONDARY_CERT = release_secondary.der else ifneq (,$(filter nightly aurora nightly-elm nightly-profiling nightly-oak nightly-ux,$(MOZ_UPDATE_CHANNEL)))

1 0

[tor-browser-bundle/master] updating the obfs4 key we ship
by gk＠torproject.org 30 Oct '15

30 Oct '15

commit 360f726f02e214890ba9be4c6046ecaf0f655541 Author: Georg Koppen <gk(a)torproject.org> Date: Thu Oct 29 10:47:45 2015 +0000 updating the obfs4 key we ship --- gitian/gpg/obfs4proxy.gpg | Bin 34128 -> 41312 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/gitian/gpg/obfs4proxy.gpg b/gitian/gpg/obfs4proxy.gpg index b9c490a..f26a4cd 100644 Binary files a/gitian/gpg/obfs4proxy.gpg and b/gitian/gpg/obfs4proxy.gpg differ

1 0

[tor-browser-bundle/master] Bug 17428: Remove default Flashproxy bridges
by gk＠torproject.org 30 Oct '15

30 Oct '15

commit fc32287aa1c0519998b31ab560ccccd45b0ea1df Author: Georg Koppen <gk(a)torproject.org> Date: Fri Oct 30 09:01:41 2015 +0000 Bug 17428: Remove default Flashproxy bridges --- Bundle-Data/PTConfigs/bridge_prefs.js | 6 ------ 1 file changed, 6 deletions(-) diff --git a/Bundle-Data/PTConfigs/bridge_prefs.js b/Bundle-Data/PTConfigs/bridge_prefs.js index 8f8af9a..fa0d92f 100644 --- a/Bundle-Data/PTConfigs/bridge_prefs.js +++ b/Bundle-Data/PTConfigs/bridge_prefs.js @@ -8,12 +8,6 @@ pref("extensions.torlauncher.default_bridge.obfs3.3", "obfs3 169.229.59.75:46328 pref("extensions.torlauncher.default_bridge.obfs3.4", "obfs3 109.105.109.163:38980 1E05F577A0EC0213F971D81BF4D86A9E4E8229ED"); pref("extensions.torlauncher.default_bridge.obfs3.5", "obfs3 109.105.109.163:47779 4C331FA9B3D1D6D8FB0D8FBBF0C259C360D97E6A"); -pref("extensions.torlauncher.default_bridge.flashproxy.1", "flashproxy 0.0.1.0:1 4D6C0DF6DEC9398A4DEF07084F3CD395A96DD2AD"); -pref("extensions.torlauncher.default_bridge.flashproxy.2", "flashproxy 0.0.1.0:2 4D6C0DF6DEC9398A4DEF07084F3CD395A96DD2AD"); -pref("extensions.torlauncher.default_bridge.flashproxy.3", "flashproxy 0.0.1.0:3 4D6C0DF6DEC9398A4DEF07084F3CD395A96DD2AD"); -pref("extensions.torlauncher.default_bridge.flashproxy.4", "flashproxy 0.0.1.0:4 4D6C0DF6DEC9398A4DEF07084F3CD395A96DD2AD"); -pref("extensions.torlauncher.default_bridge.flashproxy.5", "flashproxy 0.0.1.0:5 4D6C0DF6DEC9398A4DEF07084F3CD395A96DD2AD"); - pref("extensions.torlauncher.default_bridge.fte.1", "fte 192.240.101.106:80 FDC5BA65D93B6BCA5EBDF8EF8E4FA936B7F1F8E5"); pref("extensions.torlauncher.default_bridge.fte.2", "fte 50.7.176.114:80 2BD466989944867075E872310EBAD65BC88C8AEF"); pref("extensions.torlauncher.default_bridge.fte.3", "fte 131.252.210.150:8080 0E858AC201BF0F3FA3C462F64844CBFFC7297A42");

1 0