- tbb-commits - lists.torproject.org

[Git][tpo/applications/tor-browser-build][maint-13.5] Bug 41271: Prepare Tor Browser 13.5.8
by Pier Angelo Vendrame (＠pierov) 14 Oct '24

14 Oct '24

Pier Angelo Vendrame pushed to branch maint-13.5 at The Tor Project / Applications / tor-browser-build Commits: 329a359c by Pier Angelo Vendrame at 2024-10-14T19:40:11+02:00 Bug 41271: Prepare Tor Browser 13.5.8 - - - - - 6 changed files: - projects/browser/Bundle-Data/Docs-TBB/ChangeLog.txt - projects/browser/allowed_addons.json - projects/browser/config - projects/firefox-android/config - projects/translation/config - rbm.conf Changes: ===================================== projects/browser/Bundle-Data/Docs-TBB/ChangeLog.txt ===================================== @@ -1,3 +1,16 @@ +Tor Browser 13.5.8 - October 14 2024 + * Android + * Updated NoScript to 11.4.42 + * Bug 43099: YEC 2024 Takeover for Android Stable [tor-browser] + * Bug 43173: Backport security fixes from Firefox 131 [tor-browser] + +Tor Browser 14.0a9 - October 08 2024 + * All Platforms + * Bug 43197: Disable automatic exception for HTTPS-First [tor-browser] + * Bug 43201: Security fixes from Firefox 131.0.2 [tor-browser] + * Android + * Bug 43132: Enable extensions installation on Tor Browser 14 for Android. [tor-browser] + Tor Browser 13.5.7 - October 08 2024 * All Platforms * Bug 43201: Security fixes from Firefox 131.0.2 [tor-browser] ===================================== projects/browser/allowed_addons.json ===================================== @@ -17,7 +17,7 @@ "picture_url": "https://addons.mozilla.org/user-media/userpics/34/9734/13299734/13299734.pn…" } ], - "average_daily_users": 1207497, + "average_daily_users": 1213636, "categories": { "firefox": [ "web-development", @@ -218,10 +218,10 @@ "category": "recommended" }, "ratings": { - "average": 4.5261, - "bayesian_average": 4.525030500981792, - "count": 5891, - "text_count": 1850 + "average": 4.5267, + "bayesian_average": 4.5256323562411405, + "count": 5907, + "text_count": 1856 }, "ratings_url": "https://addons.mozilla.org/en-US/firefox/addon/darkreader/reviews/", "requires_payment": false, @@ -318,7 +318,7 @@ "type": "extension", "url": "https://addons.mozilla.org/en-US/firefox/addon/darkreader/", "versions_url": "https://addons.mozilla.org/en-US/firefox/addon/darkreader/versions/", - "weekly_downloads": 27615 + "weekly_downloads": 28552 }, "notes": null }, @@ -334,7 +334,7 @@ "picture_url": "https://addons.mozilla.org/user-media/userpics/56/7656/6937656/6937656.png?…" } ], - "average_daily_users": 257450, + "average_daily_users": 257891, "categories": { "firefox": [ "privacy-security" @@ -547,9 +547,9 @@ "category": "recommended" }, "ratings": { - "average": 4.7941, - "bayesian_average": 4.7894866719280875, - "count": 1462, + "average": 4.7939, + "bayesian_average": 4.789290984643476, + "count": 1465, "text_count": 263 }, "ratings_url": "https://addons.mozilla.org/en-US/firefox/addon/decentraleyes/reviews/", @@ -635,7 +635,7 @@ "type": "extension", "url": "https://addons.mozilla.org/en-US/firefox/addon/decentraleyes/", "versions_url": "https://addons.mozilla.org/en-US/firefox/addon/decentraleyes/versions/", - "weekly_downloads": 2882 + "weekly_downloads": 2980 }, "notes": null }, @@ -651,7 +651,7 @@ "picture_url": "https://addons.mozilla.org/user-media/userpics/73/4073/5474073/5474073.png?…" } ], - "average_daily_users": 1287220, + "average_daily_users": 1310964, "categories": { "firefox": [ "privacy-security" @@ -1170,10 +1170,10 @@ "category": "recommended" }, "ratings": { - "average": 4.8036, - "bayesian_average": 4.800921192769993, - "count": 2525, - "text_count": 474 + "average": 4.8041, + "bayesian_average": 4.801419862395535, + "count": 2527, + "text_count": 476 }, "ratings_url": "https://addons.mozilla.org/en-US/firefox/addon/privacy-badger17/reviews/", "requires_payment": false, @@ -1197,7 +1197,7 @@ "type": "extension", "url": "https://addons.mozilla.org/en-US/firefox/addon/privacy-badger17/", "versions_url": "https://addons.mozilla.org/en-US/firefox/addon/privacy-badger17/versions/", - "weekly_downloads": 15616 + "weekly_downloads": 14939 }, "notes": null }, @@ -1213,7 +1213,7 @@ "picture_url": null } ], - "average_daily_users": 8491310, + "average_daily_users": 8542786, "categories": { "firefox": [ "privacy-security" @@ -1378,7 +1378,7 @@ }, "is_disabled": false, "is_experimental": false, - "last_updated": "2024-10-07T16:05:33Z", + "last_updated": "2024-10-12T13:25:21Z", "name": { "ar": "uBlock Origin", "bg": "uBlock Origin", @@ -1523,10 +1523,10 @@ "category": "recommended" }, "ratings": { - "average": 4.7911, - "bayesian_average": 4.790736675455798, - "count": 18576, - "text_count": 4852 + "average": 4.7922, + "bayesian_average": 4.791837346304233, + "count": 18640, + "text_count": 4871 }, "ratings_url": "https://addons.mozilla.org/en-US/firefox/addon/ublock-origin/reviews/", "requires_payment": false, @@ -1589,7 +1589,7 @@ "type": "extension", "url": "https://addons.mozilla.org/en-US/firefox/addon/ublock-origin/", "versions_url": "https://addons.mozilla.org/en-US/firefox/addon/ublock-origin/versions/", - "weekly_downloads": 203502 + "weekly_downloads": 217905 }, "notes": null }, @@ -1605,7 +1605,7 @@ "picture_url": null } ], - "average_daily_users": 186764, + "average_daily_users": 187335, "categories": { "firefox": [ "photos-music-videos", @@ -1701,10 +1701,10 @@ "category": "recommended" }, "ratings": { - "average": 4.4529, - "bayesian_average": 4.448102217920827, - "count": 1285, - "text_count": 499 + "average": 4.45, + "bayesian_average": 4.445212842032069, + "count": 1289, + "text_count": 501 }, "ratings_url": "https://addons.mozilla.org/en-US/firefox/addon/video-background-play-fix/re…", "requires_payment": false, @@ -1742,7 +1742,7 @@ "picture_url": null } ], - "average_daily_users": 62883, + "average_daily_users": 62764, "categories": { "firefox": [ "privacy-security", @@ -1877,7 +1877,7 @@ "type": "extension", "url": "https://addons.mozilla.org/en-US/firefox/addon/privacy-possum/", "versions_url": "https://addons.mozilla.org/en-US/firefox/addon/privacy-possum/versions/", - "weekly_downloads": 252 + "weekly_downloads": 382 }, "notes": null }, @@ -1893,7 +1893,7 @@ "picture_url": "https://addons.mozilla.org/user-media/userpics/64/9064/12929064/12929064.pn…" } ], - "average_daily_users": 363798, + "average_daily_users": 364513, "categories": { "firefox": [ "search-tools", @@ -2110,10 +2110,10 @@ "category": "recommended" }, "ratings": { - "average": 4.6156, - "bayesian_average": 4.611450519760037, - "count": 1553, - "text_count": 311 + "average": 4.6173, + "bayesian_average": 4.613162490310139, + "count": 1560, + "text_count": 313 }, "ratings_url": "https://addons.mozilla.org/en-US/firefox/addon/search_by_image/reviews/", "requires_payment": false, @@ -2136,7 +2136,7 @@ "type": "extension", "url": "https://addons.mozilla.org/en-US/firefox/addon/search_by_image/", "versions_url": "https://addons.mozilla.org/en-US/firefox/addon/search_by_image/versions/", - "weekly_downloads": 4249 + "weekly_downloads": 4344 }, "notes": null }, @@ -2159,7 +2159,7 @@ "picture_url": null } ], - "average_daily_users": 122492, + "average_daily_users": 122483, "categories": { "firefox": [ "search-tools", @@ -2440,10 +2440,10 @@ "category": "recommended" }, "ratings": { - "average": 4.38, - "bayesian_average": 4.375681327971426, - "count": 1400, - "text_count": 392 + "average": 4.3776, + "bayesian_average": 4.373284794488685, + "count": 1401, + "text_count": 393 }, "ratings_url": "https://addons.mozilla.org/en-US/firefox/addon/google-search-fixer/reviews/", "requires_payment": false, @@ -2463,7 +2463,7 @@ "type": "extension", "url": "https://addons.mozilla.org/en-US/firefox/addon/google-search-fixer/", "versions_url": "https://addons.mozilla.org/en-US/firefox/addon/google-search-fixer/versions/", - "weekly_downloads": 18 + "weekly_downloads": 19 }, "notes": null }, @@ -2479,7 +2479,7 @@ "picture_url": "https://addons.mozilla.org/user-media/userpics/43/0143/143/143.png?modified…" } ], - "average_daily_users": 290667, + "average_daily_users": 290837, "categories": { "firefox": [ "privacy-security", @@ -2489,7 +2489,7 @@ "contributions_url": "https://www.paypal.com/donate/?hosted_button_id=9ERKTU5MBH4EW&utm_content=p…", "created": "2005-05-13T10:51:32Z", "current_version": { - "id": 5813035, + "id": 5819422, "compatibility": { "firefox": { "min": "59.0", @@ -2500,7 +2500,7 @@ "max": "*" } }, - "edit_url": "https://addons.mozilla.org/en-US/developers/addon/noscript/versions/5813035", + "edit_url": "https://addons.mozilla.org/en-US/developers/addon/noscript/versions/5819422", "is_strict_compatibility_enabled": false, "license": { "id": 13, @@ -2511,22 +2511,22 @@ "url": "https://www.gnu.org/licenses/gpl-2.0.html" }, "release_notes": { - "en-US": "11.4.40\n============================================================\nx [nscl] Fix patched workers failures caused by Firefox\n webRequest filters disconnect() breaking on large files\n (thanks barbaz for reporting)\n\nv 11.4.39\n============================================================\nx [nscl] Improved WebGL-hooking and worker patching\n stability\nx [L10n] Lower to 90% the threshold for including a new\n translation\nx [L10n] Updated he, pt_PT\nx [nscl] Prevent patchWindow from throwing on SOP violations\nx [nscl] Correctly propagate extra arguments to shadowed\n worker constructors" + "en-US": "v 11.4.42\n============================================================\nx [nscl] Further SyncMessage simplification\nx Mitigate race conditions on startup\n\nv 11.4.41\n============================================================\nx [nscl] Fixed Chromium worker patching regression caused by\n failSafe scope\nx [nscl] Force service workers to be patched bypassing cache\nx [nscl] More robust SyncMessage implementation\nx [nscl] Enhanced remote worker patching\nx [nscl] Remove missing source map warning for\n browser-polyfill.js\nx [nscl] Better console handling in execution context\n patches\nx Reduce console spam on non-debugging instances\nx [nscl] Avoid patched workers breakage if console API is\n disabled (thanks ayi for reporting)" }, - "reviewed": "2024-09-26T09:59:52Z", - "version": "11.4.40", + "reviewed": "2024-10-09T08:34:17Z", + "version": "11.4.42", "files": [ { - "id": 4357325, - "created": "2024-09-22T06:25:28Z", - "hash": "sha256:242ead426159d871480a13062cbee08abc97da746cdc5c643aee2692e9adbbb2", + "id": 4363712, + "created": "2024-10-03T20:53:07Z", + "hash": "sha256:fd2d420afd93829bb6fe30ec6f8ba926d3d54d7583b8bbd822053b8cd13c0472", "is_restart_required": false, "is_webextension": true, "is_mozilla_signed_extension": false, "platform": "all", - "size": 965455, + "size": 965445, "status": "public", - "url": "https://addons.mozilla.org/firefox/downloads/file/4357325/noscript-11.4.40.…", + "url": "https://addons.mozilla.org/firefox/downloads/file/4363712/noscript-11.4.42.…", "permissions": [ "contextMenus", "storage", @@ -2593,7 +2593,7 @@ }, "is_disabled": false, "is_experimental": false, - "last_updated": "2024-10-03T20:10:23Z", + "last_updated": "2024-10-09T08:34:17Z", "name": { "de": "NoScript", "el": "NoScript", @@ -2665,10 +2665,10 @@ "category": "recommended" }, "ratings": { - "average": 4.4106, - "bayesian_average": 4.407931581210998, - "count": 2287, - "text_count": 870 + "average": 4.408, + "bayesian_average": 4.405333664117888, + "count": 2289, + "text_count": 871 }, "ratings_url": "https://addons.mozilla.org/en-US/firefox/addon/noscript/reviews/", "requires_payment": false, @@ -2712,7 +2712,7 @@ "type": "extension", "url": "https://addons.mozilla.org/en-US/firefox/addon/noscript/", "versions_url": "https://addons.mozilla.org/en-US/firefox/addon/noscript/versions/", - "weekly_downloads": 8114 + "weekly_downloads": 8154 }, "notes": null }, @@ -2728,7 +2728,7 @@ "picture_url": null } ], - "average_daily_users": 164800, + "average_daily_users": 165178, "categories": { "firefox": [ "photos-music-videos", @@ -2838,10 +2838,10 @@ "category": "recommended" }, "ratings": { - "average": 3.8349, - "bayesian_average": 3.830907392554808, + "average": 3.8255, + "bayesian_average": 3.8215152080376273, "count": 1284, - "text_count": 465 + "text_count": 464 }, "ratings_url": "https://addons.mozilla.org/en-US/firefox/addon/youtube-high-definition/revi…", "requires_payment": false, @@ -2860,7 +2860,7 @@ "type": "extension", "url": "https://addons.mozilla.org/en-US/firefox/addon/youtube-high-definition/", "versions_url": "https://addons.mozilla.org/en-US/firefox/addon/youtube-high-definition/vers…", - "weekly_downloads": 1706 + "weekly_downloads": 1940 }, "notes": null } ===================================== projects/browser/config ===================================== @@ -104,9 +104,9 @@ input_files: enable: '[% ! c("var/android") %]' - filename: Bundle-Data enable: '[% ! c("var/android") %]' - - URL: https://addons.mozilla.org/firefox/downloads/file/4357325/noscript-11.4.40.… + - URL: https://addons.mozilla.org/firefox/downloads/file/4363712/noscript-11.4.42.… name: noscript - sha256sum: 242ead426159d871480a13062cbee08abc97da746cdc5c643aee2692e9adbbb2 + sha256sum: fd2d420afd93829bb6fe30ec6f8ba926d3d54d7583b8bbd822053b8cd13c0472 - URL: https://addons.mozilla.org/firefox/downloads/file/4359936/ublock_origin-1.6… name: ublock-origin sha256sum: e2cda9b2a1b0a7f6e5ef0da9f87f28df52f8560587ba2e51a3003121cfb81600 ===================================== projects/firefox-android/config ===================================== @@ -16,7 +16,7 @@ container: var: fenix_version: 115.2.1 browser_branch: 13.5-1 - browser_build: 15 + browser_build: 16 variant: Beta # This should be updated when the list of gradle dependencies is changed. gradle_dependencies_version: 3 ===================================== projects/translation/config ===================================== @@ -18,7 +18,7 @@ steps: git_hash: 'base-browser' tor-browser: tor-browser: '[% INCLUDE build %]' - git_hash: dbf1454fdbd3256d65985cc1c46391ce0ec159e7 + git_hash: 2e5133bd3f271bafc4578465103ae07567452b15 targets: nightly: git_hash: 'tor-browser' @@ -32,7 +32,7 @@ steps: fenix: '[% INCLUDE build %]' # We need to bump the commit before releasing but just pointing to a branch # might cause too much rebuidling of the Firefox part. - git_hash: 669ea989fa07933df7ab03ec0077e166e0dcc961 + git_hash: 0c637c9fa2c1ddf1e2bda1a63a0b0d974074d593 compress_tar: 'zst' targets: nightly: ===================================== rbm.conf ===================================== @@ -73,20 +73,20 @@ buildconf: git_signtag_opt: '-s' var: - torbrowser_version: '13.5.7' - torbrowser_build: 'build3' + torbrowser_version: '13.5.8' + torbrowser_build: 'build1' # This should be the date of when the build is started. For the build # to be reproducible, browser_release_date should always be in the past. - browser_release_date: '2024/10/08 18:28:00' + browser_release_date: '2024/10/14 17:30:00' browser_release_date_timestamp: '[% USE date; date.format(c("var/browser_release_date"), "%s") %]' updater_enabled: 1 build_mar: 1 torbrowser_incremental_from: + # 13.5.8 was Android-only + - 13.5.7 - 13.5.6 - '[% IF c("var/tor-browser") %]13.5.5[% END %]' - - '[% IF c("var/tor-browser") %]13.5.4[% END %]' - '[% IF c("var/mullvad-browser") %]13.5.3[% END %]' - - '[% IF c("var/mullvad-browser") %]13.5.2[% END %]' mar_channel_id: '[% c("var/projectname") %]-torproject-[% c("var/channel") %]' # By default, we sort the list of installed packages. This allows sharing View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/3… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/3… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/firefox-android] Pushed new tag firefox-android-115.2.1-13.5-1-build16
by Pier Angelo Vendrame (＠pierov) 14 Oct '24

14 Oct '24

Pier Angelo Vendrame pushed new tag firefox-android-115.2.1-13.5-1-build16 at The Tor Project / Applications / firefox-android -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/firefox-android/-/tree/firef… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-build][main] Bug 41267: Downgrade go to 1.22 series due to upstream dropping support for macOS 10.15 in 1.23
by Pier Angelo Vendrame (＠pierov) 14 Oct '24

14 Oct '24

Pier Angelo Vendrame pushed to branch main at The Tor Project / Applications / tor-browser-build Commits: b152b726 by Morgan at 2024-10-10T23:26:31+00:00 Bug 41267: Downgrade go to 1.22 series due to upstream dropping support for macOS 10.15 in 1.23 - - - - - 1 changed file: - projects/go/config Changes: ===================================== projects/go/config ===================================== @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: '1.23.2' +version: '1.22.8' filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.[% c("compress_tar") %]' container: use_container: 1 @@ -126,7 +126,7 @@ input_files: enable: '[% ! c("var/linux") %]' - URL: 'https://go.dev/dl/go[% c("version") %].src.tar.gz' name: go - sha256sum: 36930162a93df417d90bd22c6e14daff4705baac2b02418edda671cdfa9cd07f + sha256sum: df12c23ebf19dea0f4bf46a22cbeda4a3eca6f474f318390ce774974278440b8 - project: go-bootstrap name: go-bootstrap target_replace: View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/b… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/b… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-128.3.0esr-14.0-1] fixup! [android] Disable features and functionality
by Pier Angelo Vendrame (＠pierov) 14 Oct '24

14 Oct '24

Pier Angelo Vendrame pushed to branch tor-browser-128.3.0esr-14.0-1 at The Tor Project / Applications / Tor Browser Commits: c06f972b by cypherpunks1 at 2024-10-14T14:16:47+00:00 fixup! [android] Disable features and functionality Bug 43202: Do not fetch featured addons on Android - - - - - 2 changed files: - mobile/android/android-components/components/feature/addons/src/main/java/mozilla/components/feature/addons/AddonManager.kt - mobile/android/android-components/components/feature/addons/src/main/java/mozilla/components/feature/addons/ui/AddonsManagerAdapter.kt Changes: ===================================== mobile/android/android-components/components/feature/addons/src/main/java/mozilla/components/feature/addons/AddonManager.kt ===================================== @@ -78,7 +78,7 @@ class AddonManager( * the [addonsProvider] or querying web extension state from the engine / store. */ @Throws(AddonManagerException::class) - @Suppress("TooGenericExceptionCaught") + @Suppress("TooGenericExceptionCaught", "UNUSED_PARAMETER") suspend fun getAddons(waitForPendingActions: Boolean = true, allowCache: Boolean = true): List<Addon> { try { // Make sure extension support is initialized, i.e. the state of all installed extensions is known. @@ -92,6 +92,7 @@ class AddonManager( // Get all the featured add-ons not installed from provider. // NB: We're keeping translations only for the default locale. var featuredAddons = emptyList<Addon>() + /* tor-browser#40502: Do not recommend addons on Tor Browser try { val userLanguage = Locale.getDefault().language val locales = listOf(userLanguage) @@ -103,6 +104,7 @@ class AddonManager( // Do not throw when we fail to fetch the featured add-ons since there can be installed add-ons. logger.warn("Failed to get the featured add-ons", throwable) } + */ // Build a list of installed extensions that are not built-in extensions. val installedAddons = installedExtensions ===================================== mobile/android/android-components/components/feature/addons/src/main/java/mozilla/components/feature/addons/ui/AddonsManagerAdapter.kt ===================================== @@ -410,7 +410,7 @@ class AddonsManagerAdapter( } // Add recommended section and addons if available - if (false) { // recommendedAddons.isNotEmpty() tor-browser#40502: Do not recommend addons on Tor Browser + if (recommendedAddons.isNotEmpty()) { itemsWithSections.add(Section(R.string.mozac_feature_addons_recommended_section, true)) val filteredRecommendedAddons = recommendedAddons.filter { it.id !in excludedAddonIDs View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/c06f972… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/c06f972… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/mullvad-browser][mullvad-browser-128.3.0esr-14.0-1] 3 commits: Bug 1906024 - Format download file names better a=diannaS
by Pier Angelo Vendrame (＠pierov) 14 Oct '24

14 Oct '24

Pier Angelo Vendrame pushed to branch mullvad-browser-128.3.0esr-14.0-1 at The Tor Project / Applications / Mullvad Browser Commits: a21f2f46 by rahulsainani at 2024-10-14T16:09:10+02:00 Bug 1906024 - Format download file names better a=diannaS Original Revision: https://phabricator.services.mozilla.com/D220559 Differential Revision: https://phabricator.services.mozilla.com/D222254 - - - - - f5ad7ff5 by rahulsainani at 2024-10-14T16:09:12+02:00 Bug 1906024 - Format download file names a=diannaS Original Revision: https://phabricator.services.mozilla.com/D221771 Differential Revision: https://phabricator.services.mozilla.com/D222259 - - - - - 24a0b664 by Pier Angelo Vendrame at 2024-10-14T16:09:12+02:00 Bug 43196: Remove the vendor name from media notifications on Linux. Firefox shows "vendor remoteName" as a title of the "... is playing media" notification on Linux. However, for our browser the remote name is enough, and prepending the vendor to it creates a string users usually never see. - - - - - 3 changed files: - mobile/android/android-components/components/support/ktx/src/main/java/mozilla/components/support/ktx/kotlin/String.kt - mobile/android/android-components/components/support/ktx/src/test/java/mozilla/components/support/ktx/kotlin/StringTest.kt - widget/gtk/MPRISServiceHandler.cpp Changes: ===================================== mobile/android/android-components/components/support/ktx/src/main/java/mozilla/components/support/ktx/kotlin/String.kt ===================================== @@ -53,6 +53,8 @@ const val MAX_URI_LENGTH = 25000 private const val FILE_PREFIX = "file://" private const val MAX_VALID_PORT = 65_535 +private const val SPACE = " " +private const val UNDERSCORE = "_" /** * Shortens URLs to be more user friendly. @@ -307,7 +309,9 @@ fun String.sanitizeFileName(): String { file.name.replace("\\.\\.+".toRegex(), ".") } else { file.name.replace(".", "") - }.replaceEscapedCharacters() + }.replaceContinuousSpaces() + .replaceEscapedCharacters() + .trim() } /** @@ -315,8 +319,16 @@ fun String.sanitizeFileName(): String { * and is correctly displayed. */ private fun String.replaceEscapedCharacters(): String { - val controlCharactersRegex = "[\\x00-\\x13/*\"?<>:|\\\\]".toRegex() - return replace(controlCharactersRegex, "_") + val escapedCharactersRegex = "[\\x00-\\x13*\"?<>:|\\\\]".toRegex() + return replace(escapedCharactersRegex, UNDERSCORE) +} + +/** + * Replaces continuous spaces with a single space. + */ +private fun String.replaceContinuousSpaces(): String { + val escapedCharactersRegex = "[\\p{Z}\\s]+".toRegex() + return replace(escapedCharactersRegex, SPACE) } /** ===================================== mobile/android/android-components/components/support/ktx/src/test/java/mozilla/components/support/ktx/kotlin/StringTest.kt ===================================== @@ -199,11 +199,11 @@ class StringTest { "acknowledge\u0006signal" to "acknowledge_signal", "bell\u0007sound" to "bell_sound", "back\u0008space" to "back_space", - "horizontal\u0009tab" to "horizontal_tab", - "new\u000Aline" to "new_line", - "vertical\u000Btab" to "vertical_tab", - "form\u000Cfeed" to "form_feed", - "return\u000Dcarriage" to "return_carriage", + "horizontal\u0009tab" to "horizontal tab", + "new\u000Aline" to "new line", + "vertical\u000Btab" to "vertical tab", + "form\u000Cfeed" to "form feed", + "return\u000Dcarriage" to "return carriage", "shift\u000Eout" to "shift_out", "shift\u000Fin" to "shift_in", "escape\u0010data" to "escape_data", ===================================== widget/gtk/MPRISServiceHandler.cpp ===================================== @@ -414,8 +414,10 @@ void MPRISServiceHandler::InitIdentity() { do_GetService("@mozilla.org/xre/app-info;1", &rv); MOZ_ASSERT(NS_SUCCEEDED(rv)); +#ifndef BASE_BROWSER_VERSION rv = appInfo->GetVendor(mIdentity); MOZ_ASSERT(NS_SUCCEEDED(rv)); +#endif if (gAppData) { mDesktopEntry = gAppData->remotingName; @@ -424,7 +426,9 @@ void MPRISServiceHandler::InitIdentity() { MOZ_ASSERT(NS_SUCCEEDED(rv)); } +#ifndef BASE_BROWSER_VERSION mIdentity.Append(' '); +#endif mIdentity.Append(mDesktopEntry); // Compute the desktop entry name like nsAppRunner does for g_set_prgname View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/compare/2a… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/compare/2a… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][base-browser-128.3.0esr-14.0-1] 3 commits: Bug 1906024 - Format download file names better a=diannaS
by Pier Angelo Vendrame (＠pierov) 14 Oct '24

14 Oct '24

Pier Angelo Vendrame pushed to branch base-browser-128.3.0esr-14.0-1 at The Tor Project / Applications / Tor Browser Commits: febfa1bf by rahulsainani at 2024-10-14T16:07:55+02:00 Bug 1906024 - Format download file names better a=diannaS Original Revision: https://phabricator.services.mozilla.com/D220559 Differential Revision: https://phabricator.services.mozilla.com/D222254 - - - - - 0caad63c by rahulsainani at 2024-10-14T16:08:09+02:00 Bug 1906024 - Format download file names a=diannaS Original Revision: https://phabricator.services.mozilla.com/D221771 Differential Revision: https://phabricator.services.mozilla.com/D222259 - - - - - 796fd9d6 by Pier Angelo Vendrame at 2024-10-14T16:08:30+02:00 Bug 43196: Remove the vendor name from media notifications on Linux. Firefox shows "vendor remoteName" as a title of the "... is playing media" notification on Linux. However, for our browser the remote name is enough, and prepending the vendor to it creates a string users usually never see. - - - - - 3 changed files: - mobile/android/android-components/components/support/ktx/src/main/java/mozilla/components/support/ktx/kotlin/String.kt - mobile/android/android-components/components/support/ktx/src/test/java/mozilla/components/support/ktx/kotlin/StringTest.kt - widget/gtk/MPRISServiceHandler.cpp Changes: ===================================== mobile/android/android-components/components/support/ktx/src/main/java/mozilla/components/support/ktx/kotlin/String.kt ===================================== @@ -53,6 +53,8 @@ const val MAX_URI_LENGTH = 25000 private const val FILE_PREFIX = "file://" private const val MAX_VALID_PORT = 65_535 +private const val SPACE = " " +private const val UNDERSCORE = "_" /** * Shortens URLs to be more user friendly. @@ -307,7 +309,9 @@ fun String.sanitizeFileName(): String { file.name.replace("\\.\\.+".toRegex(), ".") } else { file.name.replace(".", "") - }.replaceEscapedCharacters() + }.replaceContinuousSpaces() + .replaceEscapedCharacters() + .trim() } /** @@ -315,8 +319,16 @@ fun String.sanitizeFileName(): String { * and is correctly displayed. */ private fun String.replaceEscapedCharacters(): String { - val controlCharactersRegex = "[\\x00-\\x13/*\"?<>:|\\\\]".toRegex() - return replace(controlCharactersRegex, "_") + val escapedCharactersRegex = "[\\x00-\\x13*\"?<>:|\\\\]".toRegex() + return replace(escapedCharactersRegex, UNDERSCORE) +} + +/** + * Replaces continuous spaces with a single space. + */ +private fun String.replaceContinuousSpaces(): String { + val escapedCharactersRegex = "[\\p{Z}\\s]+".toRegex() + return replace(escapedCharactersRegex, SPACE) } /** ===================================== mobile/android/android-components/components/support/ktx/src/test/java/mozilla/components/support/ktx/kotlin/StringTest.kt ===================================== @@ -199,11 +199,11 @@ class StringTest { "acknowledge\u0006signal" to "acknowledge_signal", "bell\u0007sound" to "bell_sound", "back\u0008space" to "back_space", - "horizontal\u0009tab" to "horizontal_tab", - "new\u000Aline" to "new_line", - "vertical\u000Btab" to "vertical_tab", - "form\u000Cfeed" to "form_feed", - "return\u000Dcarriage" to "return_carriage", + "horizontal\u0009tab" to "horizontal tab", + "new\u000Aline" to "new line", + "vertical\u000Btab" to "vertical tab", + "form\u000Cfeed" to "form feed", + "return\u000Dcarriage" to "return carriage", "shift\u000Eout" to "shift_out", "shift\u000Fin" to "shift_in", "escape\u0010data" to "escape_data", ===================================== widget/gtk/MPRISServiceHandler.cpp ===================================== @@ -414,8 +414,10 @@ void MPRISServiceHandler::InitIdentity() { do_GetService("@mozilla.org/xre/app-info;1", &rv); MOZ_ASSERT(NS_SUCCEEDED(rv)); +#ifndef BASE_BROWSER_VERSION rv = appInfo->GetVendor(mIdentity); MOZ_ASSERT(NS_SUCCEEDED(rv)); +#endif if (gAppData) { mDesktopEntry = gAppData->remotingName; @@ -424,7 +426,9 @@ void MPRISServiceHandler::InitIdentity() { MOZ_ASSERT(NS_SUCCEEDED(rv)); } +#ifndef BASE_BROWSER_VERSION mIdentity.Append(' '); +#endif mIdentity.Append(mDesktopEntry); // Compute the desktop entry name like nsAppRunner does for g_set_prgname View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/bdea24… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/bdea24… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/mullvad-browser][mullvad-browser-128.3.0esr-14.0-1] fixup! Firefox preference overrides.
by ma1 (＠ma1) 14 Oct '24

14 Oct '24

ma1 pushed to branch mullvad-browser-128.3.0esr-14.0-1 at The Tor Project / Applications / Mullvad Browser Commits: 2ad2eec9 by hackademix at 2024-10-14T12:56:25+02:00 fixup! Firefox preference overrides. Bug 42356: Preference review for Firefox ESR128. - - - - - 1 changed file: - browser/app/profile/001-base-profile.js Changes: ===================================== browser/app/profile/001-base-profile.js ===================================== @@ -23,7 +23,7 @@ pref("startup.homepage_welcome_url.additional", ""); pref("browser.aboutwelcome.enabled", false); #if MOZ_UPDATE_CHANNEL == release -// tor-browser#42640: Disable Firefox Flame buttond due to unknown interactions with New Identity +// tor-browser#42640: Disable Firefox Flame button due to unknown interactions with New Identity pref("browser.privatebrowsing.resetPBM.enabled", false, locked); #endif @@ -58,7 +58,7 @@ pref("media.aboutwebrtc.hist.enabled", false); // Disk Activity -// Disable auto-downloaing to ~/Downloads and other download tweaks to minimize +// Disable auto-downloading to ~/Downloads and other download tweaks to minimize // disk leaks (tor-browser#42050). pref("browser.download.useDownloadDir", false); pref("browser.download.always_ask_before_handling_new_types", true); @@ -97,7 +97,7 @@ pref("browser.pagethumbnails.capturing_disabled", true); // disk leaks, e.g., in system logs. // For example, it happened that GNOME shell logged the window name that caused // JS errors/unexpected conditions for unrelated issues. -// TODO: Enable again after more UX considerations. +// TODO: commented out for now because of UX concerns, to be reconsidered in 14.5 // pref("privacy.exposeContentTitleInWindow", false); // pref("privacy.exposeContentTitleInWindow.pbm", false); @@ -123,7 +123,7 @@ pref("dom.security.https_only_mode_pbm", true); // tor-browser#43197, defense in depth if ever https-only got disabled pref("dom.security.https_first_add_exception_on_failiure", false); -// tor-browser#22320: Hide referer when comming from a .onion address +// tor-browser#22320: Hide referer when coming from a .onion address // We enable this here (rather than in Tor Browser) in case users of other // base-browser derived browsers configure it to use a system Tor daemon // to visit onion services. @@ -214,7 +214,6 @@ pref("toolkit.telemetry.bhrPing.enabled", false); pref("toolkit.telemetry.coverage.opt-out", true); pref("toolkit.coverage.opt-out", true); pref("toolkit.coverage.endpoint.base", ""); -pref("browser.ping-centre.telemetry", false); pref("browser.tabs.crashReporting.sendReport", false); pref("browser.crashReports.unsubmittedCheck.autoSubmit2", false); // Added in tor-browser#41496 even though false by default @@ -244,7 +243,6 @@ pref("services.sync.engine.passwords", false); pref("services.sync.engine.prefs", false); pref("services.sync.engine.tabs", false); pref("extensions.getAddons.cache.enabled", false); // https://blog.mozilla.org/addons/how-to-opt-out-of-add-on-metadata-updates/ -pref("browser.fixup.alternate.enabled", false); // Bug #16783: Prevent .onion fixups pref("privacy.donottrackheader.enabled", false); // (mullvad-browser#17) // Make sure there is no Tracking Protection active in Tor Browser, see: #17898. pref("privacy.trackingprotection.enabled", false); @@ -284,9 +282,7 @@ pref("browser.newtabpage.activity-stream.telemetry", false); // Notice that null is between quotes because it is a JSON string. // Keep checked firefox.js to see if new entries are added. pref("browser.newtabpage.activity-stream.asrouter.providers.cfr", "null"); -pref("browser.newtabpage.activity-stream.asrouter.providers.whats-new-panel", "null"); pref("browser.newtabpage.activity-stream.asrouter.providers.message-groups", "null"); -pref("browser.newtabpage.activity-stream.asrouter.providers.snippets", "null"); pref("browser.newtabpage.activity-stream.asrouter.providers.messaging-experiments", "null"); // Disable fetching asrouter.ftl and related console errors (tor-browser#40763). @@ -312,6 +308,10 @@ pref("browser.preferences.moreFromMozilla", false); // Disable webcompat reporter pref("extensions.webcompat-reporter.enabled", false); +// Disable Content Analysis SDK (tor-browser#42364) +pref("browser.contentanalysis.enabled", false); +pref("browser.contentanalysis.default_result", 0); + // Disable contentRelevancy component (which itself is gated on Nimbus) (tor-browser#42867) pref("toolkit.contentRelevancy.enabled", false); pref("toolkit.contentRelevancy.ingestEnabled", false); @@ -455,12 +455,9 @@ pref("pdfjs.disabled", false, locked); #endif // Bug 40057: Ensure system colors are not used for CSS4 colors pref("browser.display.use_system_colors", false); -// tor-browser#41676: Set the TZ environment variable as a defense-in-depth. -// TODO: Remove this in ESR-128, as it has been removed in 116 with Bug 1837582. -pref("privacy.resistFingerprinting.testing.setTZtoUTC", true); -// tor-browser#41943: lock and revisit after it gets flipped to true in stable Firefox -pref("javascript.options.spectre.disable_for_isolated_content", false, locked); +// tor-browser#41943: defense-in-depth, but do not lock anymore (enabled in Firefox 119, http://bugzil.la/1851162) +pref("javascript.options.spectre.disable_for_isolated_content", false); // Third party stuff pref("privacy.firstparty.isolate", true); // Always enforce first party isolation @@ -510,27 +507,6 @@ pref("network.proxy.failover_direct", false, locked); // alters content load order in a page. See tor-browser#24686 pref("network.http.tailing.enabled", true, locked); -// Make sure the varoius http2 settings, buffer sizes, timings, etc are locked -// to firefox defaults to minimize network performance fingerprinting. -// See https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/27128 -pref("network.http.http2.enabled", true, locked); -pref("network.http.http2.enabled.deps", true, locked); -pref("network.http.http2.enforce-tls-profile", true, locked); -pref("network.http.http2.chunk-size", 16000, locked); -pref("network.http.http2.timeout", 170, locked); -pref("network.http.http2.coalesce-hostnames", true, locked); -pref("network.http.http2.persistent-settings", false, locked); -pref("network.http.http2.ping-threshold", 58, locked); -pref("network.http.http2.ping-timeout", 8, locked); -pref("network.http.http2.send-buffer-size", 0, locked); -pref("network.http.http2.allow-push", true, locked); -pref("network.http.http2.push-allowance", 131072, locked); -pref("network.http.http2.pull-allowance", 12582912, locked); -pref("network.http.http2.default-concurrent", 100, locked); -pref("network.http.http2.default-hpack-buffer", 65536, locked); -pref("network.http.http2.websockets", true, locked); -pref("network.http.http2.enable-hpack-dump", false, locked); - // tor-browser#23044: Make sure we don't have any GIO supported protocols // (defense in depth measure). // As of Firefox 118 (Bug 1843763), upstream does not add any protocol by @@ -618,8 +594,8 @@ pref("extensions.htmlaboutaddons.recommendations.enabled", false); // Disable personalized Extension Recommendations in about:addons and // addons.mozilla.org pref("browser.discovery.enabled", false); -// Bug 26114: Allow NoScript to access addons.mozilla.org etc. -// TODO: Audit again (tor-browser#41445) +// tor-browser#26114: Allow NoScript to work on addons.mozilla.org and other Mozilla sites. +// Revisited and confirmed in tor-browser#41445. pref("extensions.webextensions.restrictedDomains", ""); // Don't give Mozilla-recommended third-party extensions special privileges. pref("extensions.postDownloadThirdPartyPrompt", false); @@ -651,16 +627,16 @@ pref("browser.menu.share_url.allow", false, locked); // Disable special URL bar behaviors pref("browser.urlbar.suggest.topsites", false); +pref("browser.urlbar.quicksuggest.enabled", false); +pref("browser.urlbar.richSuggestions.featureGate", false); +pref("browser.urlbar.yelp.featureGate", false); +pref("browser.urlbar.mdn.featureGate", false); // tor-browser#41884: Do not start a search when clicking on the new tab button // with the middle mouse button (to prevent searching for anything you might // have selected or already in your clipboard). pref("browser.tabs.searchclipboardfor.middleclick", false); -// Skip checking omni.ja and other files for corruption since the result -// is only reported via telemetry (which is disabled). See tor-browser#40048. -pref("corroborator.enabled", false); - // tor-browser#41417: do not allow live reload until we switch to Fluent and // stop using .textContent. // Even after that, it might be a good idea to keep it off, as it is not handled @@ -678,7 +654,7 @@ pref("privacy.query_stripping.strip_on_share.enabled", true); pref("privacy.globalprivacycontrol.enabled", true); pref("privacy.globalprivacycontrol.pbmode.enabled", true); -// Disable platform text recogniition functionality (tor-browser#42057) +// Disable platform text recognition functionality (tor-browser#42057) pref("dom.text-recognition.enabled", false); // Log levels View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/2ad… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/2ad… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][base-browser-128.3.0esr-14.0-1] fixup! Firefox preference overrides.
by ma1 (＠ma1) 14 Oct '24

14 Oct '24

ma1 pushed to branch base-browser-128.3.0esr-14.0-1 at The Tor Project / Applications / Tor Browser Commits: bdea242f by hackademix at 2024-10-14T12:56:11+02:00 fixup! Firefox preference overrides. Bug 42356: Preference review for Firefox ESR128. - - - - - 1 changed file: - browser/app/profile/001-base-profile.js Changes: ===================================== browser/app/profile/001-base-profile.js ===================================== @@ -23,7 +23,7 @@ pref("startup.homepage_welcome_url.additional", ""); pref("browser.aboutwelcome.enabled", false); #if MOZ_UPDATE_CHANNEL == release -// tor-browser#42640: Disable Firefox Flame buttond due to unknown interactions with New Identity +// tor-browser#42640: Disable Firefox Flame button due to unknown interactions with New Identity pref("browser.privatebrowsing.resetPBM.enabled", false, locked); #endif @@ -58,7 +58,7 @@ pref("media.aboutwebrtc.hist.enabled", false); // Disk Activity -// Disable auto-downloaing to ~/Downloads and other download tweaks to minimize +// Disable auto-downloading to ~/Downloads and other download tweaks to minimize // disk leaks (tor-browser#42050). pref("browser.download.useDownloadDir", false); pref("browser.download.always_ask_before_handling_new_types", true); @@ -97,7 +97,7 @@ pref("browser.pagethumbnails.capturing_disabled", true); // disk leaks, e.g., in system logs. // For example, it happened that GNOME shell logged the window name that caused // JS errors/unexpected conditions for unrelated issues. -// TODO: Enable again after more UX considerations. +// TODO: commented out for now because of UX concerns, to be reconsidered in 14.5 // pref("privacy.exposeContentTitleInWindow", false); // pref("privacy.exposeContentTitleInWindow.pbm", false); @@ -123,7 +123,7 @@ pref("dom.security.https_only_mode_pbm", true); // tor-browser#43197, defense in depth if ever https-only got disabled pref("dom.security.https_first_add_exception_on_failiure", false); -// tor-browser#22320: Hide referer when comming from a .onion address +// tor-browser#22320: Hide referer when coming from a .onion address // We enable this here (rather than in Tor Browser) in case users of other // base-browser derived browsers configure it to use a system Tor daemon // to visit onion services. @@ -214,7 +214,6 @@ pref("toolkit.telemetry.bhrPing.enabled", false); pref("toolkit.telemetry.coverage.opt-out", true); pref("toolkit.coverage.opt-out", true); pref("toolkit.coverage.endpoint.base", ""); -pref("browser.ping-centre.telemetry", false); pref("browser.tabs.crashReporting.sendReport", false); pref("browser.crashReports.unsubmittedCheck.autoSubmit2", false); // Added in tor-browser#41496 even though false by default @@ -244,7 +243,6 @@ pref("services.sync.engine.passwords", false); pref("services.sync.engine.prefs", false); pref("services.sync.engine.tabs", false); pref("extensions.getAddons.cache.enabled", false); // https://blog.mozilla.org/addons/how-to-opt-out-of-add-on-metadata-updates/ -pref("browser.fixup.alternate.enabled", false); // Bug #16783: Prevent .onion fixups pref("privacy.donottrackheader.enabled", false); // (mullvad-browser#17) // Make sure there is no Tracking Protection active in Tor Browser, see: #17898. pref("privacy.trackingprotection.enabled", false); @@ -284,9 +282,7 @@ pref("browser.newtabpage.activity-stream.telemetry", false); // Notice that null is between quotes because it is a JSON string. // Keep checked firefox.js to see if new entries are added. pref("browser.newtabpage.activity-stream.asrouter.providers.cfr", "null"); -pref("browser.newtabpage.activity-stream.asrouter.providers.whats-new-panel", "null"); pref("browser.newtabpage.activity-stream.asrouter.providers.message-groups", "null"); -pref("browser.newtabpage.activity-stream.asrouter.providers.snippets", "null"); pref("browser.newtabpage.activity-stream.asrouter.providers.messaging-experiments", "null"); // Disable fetching asrouter.ftl and related console errors (tor-browser#40763). @@ -312,6 +308,10 @@ pref("browser.preferences.moreFromMozilla", false); // Disable webcompat reporter pref("extensions.webcompat-reporter.enabled", false); +// Disable Content Analysis SDK (tor-browser#42364) +pref("browser.contentanalysis.enabled", false); +pref("browser.contentanalysis.default_result", 0); + // Disable contentRelevancy component (which itself is gated on Nimbus) (tor-browser#42867) pref("toolkit.contentRelevancy.enabled", false); pref("toolkit.contentRelevancy.ingestEnabled", false); @@ -455,12 +455,9 @@ pref("pdfjs.disabled", false, locked); #endif // Bug 40057: Ensure system colors are not used for CSS4 colors pref("browser.display.use_system_colors", false); -// tor-browser#41676: Set the TZ environment variable as a defense-in-depth. -// TODO: Remove this in ESR-128, as it has been removed in 116 with Bug 1837582. -pref("privacy.resistFingerprinting.testing.setTZtoUTC", true); -// tor-browser#41943: lock and revisit after it gets flipped to true in stable Firefox -pref("javascript.options.spectre.disable_for_isolated_content", false, locked); +// tor-browser#41943: defense-in-depth, but do not lock anymore (enabled in Firefox 119, http://bugzil.la/1851162) +pref("javascript.options.spectre.disable_for_isolated_content", false); // Third party stuff pref("privacy.firstparty.isolate", true); // Always enforce first party isolation @@ -510,27 +507,6 @@ pref("network.proxy.failover_direct", false, locked); // alters content load order in a page. See tor-browser#24686 pref("network.http.tailing.enabled", true, locked); -// Make sure the varoius http2 settings, buffer sizes, timings, etc are locked -// to firefox defaults to minimize network performance fingerprinting. -// See https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/27128 -pref("network.http.http2.enabled", true, locked); -pref("network.http.http2.enabled.deps", true, locked); -pref("network.http.http2.enforce-tls-profile", true, locked); -pref("network.http.http2.chunk-size", 16000, locked); -pref("network.http.http2.timeout", 170, locked); -pref("network.http.http2.coalesce-hostnames", true, locked); -pref("network.http.http2.persistent-settings", false, locked); -pref("network.http.http2.ping-threshold", 58, locked); -pref("network.http.http2.ping-timeout", 8, locked); -pref("network.http.http2.send-buffer-size", 0, locked); -pref("network.http.http2.allow-push", true, locked); -pref("network.http.http2.push-allowance", 131072, locked); -pref("network.http.http2.pull-allowance", 12582912, locked); -pref("network.http.http2.default-concurrent", 100, locked); -pref("network.http.http2.default-hpack-buffer", 65536, locked); -pref("network.http.http2.websockets", true, locked); -pref("network.http.http2.enable-hpack-dump", false, locked); - // tor-browser#23044: Make sure we don't have any GIO supported protocols // (defense in depth measure). // As of Firefox 118 (Bug 1843763), upstream does not add any protocol by @@ -622,8 +598,8 @@ pref("extensions.htmlaboutaddons.recommendations.enabled", false); // Disable personalized Extension Recommendations in about:addons and // addons.mozilla.org pref("browser.discovery.enabled", false); -// Bug 26114: Allow NoScript to access addons.mozilla.org etc. -// TODO: Audit again (tor-browser#41445) +// tor-browser#26114: Allow NoScript to work on addons.mozilla.org and other Mozilla sites. +// Revisited and confirmed in tor-browser#41445. pref("extensions.webextensions.restrictedDomains", ""); // Don't give Mozilla-recommended third-party extensions special privileges. pref("extensions.postDownloadThirdPartyPrompt", false); @@ -655,16 +631,16 @@ pref("browser.menu.share_url.allow", false, locked); // Disable special URL bar behaviors pref("browser.urlbar.suggest.topsites", false); +pref("browser.urlbar.quicksuggest.enabled", false); +pref("browser.urlbar.richSuggestions.featureGate", false); +pref("browser.urlbar.yelp.featureGate", false); +pref("browser.urlbar.mdn.featureGate", false); // tor-browser#41884: Do not start a search when clicking on the new tab button // with the middle mouse button (to prevent searching for anything you might // have selected or already in your clipboard). pref("browser.tabs.searchclipboardfor.middleclick", false); -// Skip checking omni.ja and other files for corruption since the result -// is only reported via telemetry (which is disabled). See tor-browser#40048. -pref("corroborator.enabled", false); - // tor-browser#41417: do not allow live reload until we switch to Fluent and // stop using .textContent. // Even after that, it might be a good idea to keep it off, as it is not handled @@ -682,7 +658,7 @@ pref("privacy.query_stripping.strip_on_share.enabled", true); pref("privacy.globalprivacycontrol.enabled", true); pref("privacy.globalprivacycontrol.pbmode.enabled", true); -// Disable platform text recogniition functionality (tor-browser#42057) +// Disable platform text recognition functionality (tor-browser#42057) pref("dom.text-recognition.enabled", false); // Log levels View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/bdea242… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/bdea242… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-128.3.0esr-14.0-1] fixup! Firefox preference overrides.
by ma1 (＠ma1) 14 Oct '24

14 Oct '24

ma1 pushed to branch tor-browser-128.3.0esr-14.0-1 at The Tor Project / Applications / Tor Browser Commits: 55c8c9e7 by hackademix at 2024-10-11T09:17:04+02:00 fixup! Firefox preference overrides. Bug 42356: Preference review for Firefox ESR128. - - - - - 1 changed file: - browser/app/profile/001-base-profile.js Changes: ===================================== browser/app/profile/001-base-profile.js ===================================== @@ -23,7 +23,7 @@ pref("startup.homepage_welcome_url.additional", ""); pref("browser.aboutwelcome.enabled", false); #if MOZ_UPDATE_CHANNEL == release -// tor-browser#42640: Disable Firefox Flame buttond due to unknown interactions with New Identity +// tor-browser#42640: Disable Firefox Flame button due to unknown interactions with New Identity pref("browser.privatebrowsing.resetPBM.enabled", false, locked); #endif @@ -58,7 +58,7 @@ pref("media.aboutwebrtc.hist.enabled", false); // Disk Activity -// Disable auto-downloaing to ~/Downloads and other download tweaks to minimize +// Disable auto-downloading to ~/Downloads and other download tweaks to minimize // disk leaks (tor-browser#42050). pref("browser.download.useDownloadDir", false); pref("browser.download.always_ask_before_handling_new_types", true); @@ -97,7 +97,7 @@ pref("browser.pagethumbnails.capturing_disabled", true); // disk leaks, e.g., in system logs. // For example, it happened that GNOME shell logged the window name that caused // JS errors/unexpected conditions for unrelated issues. -// TODO: Enable again after more UX considerations. +// TODO: commented out for now because of UX concerns, to be reconsidered in 14.5 // pref("privacy.exposeContentTitleInWindow", false); // pref("privacy.exposeContentTitleInWindow.pbm", false); @@ -123,7 +123,7 @@ pref("dom.security.https_only_mode_pbm", true); // tor-browser#43197, defense in depth if ever https-only got disabled pref("dom.security.https_first_add_exception_on_failiure", false); -// tor-browser#22320: Hide referer when comming from a .onion address +// tor-browser#22320: Hide referer when coming from a .onion address // We enable this here (rather than in Tor Browser) in case users of other // base-browser derived browsers configure it to use a system Tor daemon // to visit onion services. @@ -214,7 +214,6 @@ pref("toolkit.telemetry.bhrPing.enabled", false); pref("toolkit.telemetry.coverage.opt-out", true); pref("toolkit.coverage.opt-out", true); pref("toolkit.coverage.endpoint.base", ""); -pref("browser.ping-centre.telemetry", false); pref("browser.tabs.crashReporting.sendReport", false); pref("browser.crashReports.unsubmittedCheck.autoSubmit2", false); // Added in tor-browser#41496 even though false by default @@ -244,7 +243,6 @@ pref("services.sync.engine.passwords", false); pref("services.sync.engine.prefs", false); pref("services.sync.engine.tabs", false); pref("extensions.getAddons.cache.enabled", false); // https://blog.mozilla.org/addons/how-to-opt-out-of-add-on-metadata-updates/ -pref("browser.fixup.alternate.enabled", false); // Bug #16783: Prevent .onion fixups pref("privacy.donottrackheader.enabled", false); // (mullvad-browser#17) // Make sure there is no Tracking Protection active in Tor Browser, see: #17898. pref("privacy.trackingprotection.enabled", false); @@ -284,9 +282,7 @@ pref("browser.newtabpage.activity-stream.telemetry", false); // Notice that null is between quotes because it is a JSON string. // Keep checked firefox.js to see if new entries are added. pref("browser.newtabpage.activity-stream.asrouter.providers.cfr", "null"); -pref("browser.newtabpage.activity-stream.asrouter.providers.whats-new-panel", "null"); pref("browser.newtabpage.activity-stream.asrouter.providers.message-groups", "null"); -pref("browser.newtabpage.activity-stream.asrouter.providers.snippets", "null"); pref("browser.newtabpage.activity-stream.asrouter.providers.messaging-experiments", "null"); // Disable fetching asrouter.ftl and related console errors (tor-browser#40763). @@ -312,6 +308,10 @@ pref("browser.preferences.moreFromMozilla", false); // Disable webcompat reporter pref("extensions.webcompat-reporter.enabled", false); +// Disable Content Analysis SDK (tor-browser#42364) +pref("browser.contentanalysis.enabled", false); +pref("browser.contentanalysis.default_result", 0); + // Disable contentRelevancy component (which itself is gated on Nimbus) (tor-browser#42867) pref("toolkit.contentRelevancy.enabled", false); pref("toolkit.contentRelevancy.ingestEnabled", false); @@ -455,12 +455,9 @@ pref("pdfjs.disabled", false, locked); #endif // Bug 40057: Ensure system colors are not used for CSS4 colors pref("browser.display.use_system_colors", false); -// tor-browser#41676: Set the TZ environment variable as a defense-in-depth. -// TODO: Remove this in ESR-128, as it has been removed in 116 with Bug 1837582. -pref("privacy.resistFingerprinting.testing.setTZtoUTC", true); -// tor-browser#41943: lock and revisit after it gets flipped to true in stable Firefox -pref("javascript.options.spectre.disable_for_isolated_content", false, locked); +// tor-browser#41943: defense-in-depth, but do not lock anymore (enabled in Firefox 119, http://bugzil.la/1851162) +pref("javascript.options.spectre.disable_for_isolated_content", false); // Third party stuff pref("privacy.firstparty.isolate", true); // Always enforce first party isolation @@ -510,27 +507,6 @@ pref("network.proxy.failover_direct", false, locked); // alters content load order in a page. See tor-browser#24686 pref("network.http.tailing.enabled", true, locked); -// Make sure the varoius http2 settings, buffer sizes, timings, etc are locked -// to firefox defaults to minimize network performance fingerprinting. -// See https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/27128 -pref("network.http.http2.enabled", true, locked); -pref("network.http.http2.enabled.deps", true, locked); -pref("network.http.http2.enforce-tls-profile", true, locked); -pref("network.http.http2.chunk-size", 16000, locked); -pref("network.http.http2.timeout", 170, locked); -pref("network.http.http2.coalesce-hostnames", true, locked); -pref("network.http.http2.persistent-settings", false, locked); -pref("network.http.http2.ping-threshold", 58, locked); -pref("network.http.http2.ping-timeout", 8, locked); -pref("network.http.http2.send-buffer-size", 0, locked); -pref("network.http.http2.allow-push", true, locked); -pref("network.http.http2.push-allowance", 131072, locked); -pref("network.http.http2.pull-allowance", 12582912, locked); -pref("network.http.http2.default-concurrent", 100, locked); -pref("network.http.http2.default-hpack-buffer", 65536, locked); -pref("network.http.http2.websockets", true, locked); -pref("network.http.http2.enable-hpack-dump", false, locked); - // tor-browser#23044: Make sure we don't have any GIO supported protocols // (defense in depth measure). // As of Firefox 118 (Bug 1843763), upstream does not add any protocol by @@ -622,8 +598,8 @@ pref("extensions.htmlaboutaddons.recommendations.enabled", false); // Disable personalized Extension Recommendations in about:addons and // addons.mozilla.org pref("browser.discovery.enabled", false); -// Bug 26114: Allow NoScript to access addons.mozilla.org etc. -// TODO: Audit again (tor-browser#41445) +// tor-browser#26114: Allow NoScript to work on addons.mozilla.org and other Mozilla sites. +// Revisited and confirmed in tor-browser#41445. pref("extensions.webextensions.restrictedDomains", ""); // Don't give Mozilla-recommended third-party extensions special privileges. pref("extensions.postDownloadThirdPartyPrompt", false); @@ -655,16 +631,16 @@ pref("browser.menu.share_url.allow", false, locked); // Disable special URL bar behaviors pref("browser.urlbar.suggest.topsites", false); +pref("browser.urlbar.quicksuggest.enabled", false); +pref("browser.urlbar.richSuggestions.featureGate", false); +pref("browser.urlbar.yelp.featureGate", false); +pref("browser.urlbar.mdn.featureGate", false); // tor-browser#41884: Do not start a search when clicking on the new tab button // with the middle mouse button (to prevent searching for anything you might // have selected or already in your clipboard). pref("browser.tabs.searchclipboardfor.middleclick", false); -// Skip checking omni.ja and other files for corruption since the result -// is only reported via telemetry (which is disabled). See tor-browser#40048. -pref("corroborator.enabled", false); - // tor-browser#41417: do not allow live reload until we switch to Fluent and // stop using .textContent. // Even after that, it might be a good idea to keep it off, as it is not handled @@ -682,7 +658,7 @@ pref("privacy.query_stripping.strip_on_share.enabled", true); pref("privacy.globalprivacycontrol.enabled", true); pref("privacy.globalprivacycontrol.pbmode.enabled", true); -// Disable platform text recogniition functionality (tor-browser#42057) +// Disable platform text recognition functionality (tor-browser#42057) pref("dom.text-recognition.enabled", false); // Log levels View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/55c8c9e… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/55c8c9e… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-build][main] Bug 41261: Use an uncompressed NoScript xpi file to improve apk compression
by morgan (＠morgan) 11 Oct '24

11 Oct '24

morgan pushed to branch main at The Tor Project / Applications / tor-browser-build Commits: 6bf962cd by cypherpunks1 at 2024-10-10T00:35:11+00:00 Bug 41261: Use an uncompressed NoScript xpi file to improve apk compression - - - - - 1 changed file: - projects/browser/build.android Changes: ===================================== projects/browser/build.android ===================================== @@ -21,7 +21,15 @@ noscript_path="$ext_dir/{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi" mkdir -p /var/tmp/build/$ext_dir [% dest_dir _ '/' _ c('filename') %] cd /var/tmp/build -mv $rootdir/[% c('input_files_by_name/noscript') %] "$noscript_path" + +mkdir noscript +pushd noscript +unzip $rootdir/[% c('input_files_by_name/noscript') %] +[% c('zip', { + zip_src => [ '.' ], + zip_args => '-0 ../$noscript_path', + }) %] +popd [%IF c("var/tor-browser") -%] tar -xaf "$rootdir/[% c("input_files_by_name/tor-expert-bundle") %]/tor-expert-bundle.tar.gz" tor/pluggable_transports/pt_config.json View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/6… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/6… You're receiving this email because of your account on gitlab.torproject.org.

1 0