ma1 pushed to branch tor-browser-115.17.0esr-13.5-1 at The Tor Project / Applications / Tor Browser

Commits: 0090727a by Randell Jesup at 2024-10-23T16:34:13+02:00 Bug 1829029: clean up memory reporting for CacheFileIOManager r=necko-reviewers,valentin, a=RyanVM

Differential Revision: https://phabricator.services.mozilla.com/D221350 - - - - - 883dd4a0 by Valentin Gosu at 2024-10-23T22:54:40+02:00 Bug 1914521 - Make nsPartChannel inherit the content disposition of the multipart response a=RyanVM

Original Revision: https://phabricator.services.mozilla.com/D223728

Differential Revision: https://phabricator.services.mozilla.com/D224288 - - - - - 857b9ac0 by Andrew McCreight at 2024-10-23T23:17:44+02:00 Bug 1919809 - Always clear mArgumentStorage in Console's Unlink. a=RyanVM

Original Revision: https://phabricator.services.mozilla.com/D222803

Differential Revision: https://phabricator.services.mozilla.com/D224384 - - - - - 52815ac6 by Paul Zuehlcke at 2024-10-23T23:42:13+02:00 Bug 1920423, a=RyanVM

Differential Revision: https://phabricator.services.mozilla.com/D224349

- - - - - 011ad74a by Andrew McCreight at 2024-10-24T15:07:56+02:00 Bug 1923706 - Pass by value, not reference in CamerasChild::AllocateCapture. a=RyanVM

Original Revision: https://phabricator.services.mozilla.com/D225121

Differential Revision: https://phabricator.services.mozilla.com/D225363 - - - - - 8e9e58fe by Kagami Sascha Rosylight at 2024-10-24T15:11:06+02:00 Bug 1924154 - Disallow too small record a=RyanVM

Original Revision: https://phabricator.services.mozilla.com/D225687

Differential Revision: https://phabricator.services.mozilla.com/D226147 - - - - -

8 changed files:

- dom/console/Console.cpp - dom/media/systemservices/CamerasChild.cpp - dom/push/PushCrypto.sys.mjs - netwerk/cache2/CacheFileIOManager.cpp - netwerk/streamconv/converters/nsMultiMixedConv.cpp - netwerk/streamconv/converters/nsMultiMixedConv.h - toolkit/content/widgets/popupnotification.js - toolkit/themes/shared/popupnotification.css

Changes:

===================================== dom/console/Console.cpp ===================================== @@ -802,6 +802,7 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(Console) NS_IMPL_CYCLE_COLLECTION_UNLINK(mDumpFunction) NS_IMPL_CYCLE_COLLECTION_UNLINK_WEAK_REFERENCE tmp->Shutdown(); + tmp->mArgumentStorage.clearAndFree(); NS_IMPL_CYCLE_COLLECTION_UNLINK_END

NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(Console)

===================================== dom/media/systemservices/CamerasChild.cpp ===================================== @@ -331,7 +331,7 @@ int CamerasChild::AllocateCapture(CaptureEngine aCapEngine, LOG(("%s", __PRETTY_FUNCTION__)); nsCString unique_id(unique_idUTF8); nsCOMPtr<nsIRunnable> runnable = - mozilla::NewRunnableMethod<CaptureEngine, nsCString, const uint64_t&>( + mozilla::NewRunnableMethod<CaptureEngine, nsCString, uint64_t>( "camera::PCamerasChild::SendAllocateCapture", this, &CamerasChild::SendAllocateCapture, aCapEngine, unique_id, aWindowID); LockAndDispatch<> dispatcher(this, __func__, runnable, -1, mReplyInteger);

===================================== dom/push/PushCrypto.sys.mjs ===================================== @@ -108,6 +108,8 @@ function getEncryptionParams(encryptField) { // aes128gcm scheme. function getCryptoParamsFromPayload(payload) { if (payload.byteLength < 21) { + // The value 21 is from https://datatracker.ietf.org/doc/html/rfc8188#section-2.1 + // | salt (16) | rs (4) | idlen (1) | keyid (idlen) | throw new CryptoError("Truncated header", BAD_CRYPTO); } let rs = @@ -115,8 +117,16 @@ function getCryptoParamsFromPayload(payload) { (payload[17] << 16) | (payload[18] << 8) | payload[19]; + if (rs < 18) { + // https://datatracker.ietf.org/doc/html/rfc8188#section-2.1 + throw new CryptoError( + "Record sizes smaller than 18 are invalid", + BAD_RS_PARAM + ); + } let keyIdLen = payload[20]; if (keyIdLen != 65) { + // https://datatracker.ietf.org/doc/html/rfc8291/#section-4 throw new CryptoError("Invalid sender public key", BAD_DH_PARAM); } if (payload.byteLength <= 21 + keyIdLen) { @@ -171,8 +181,12 @@ export function getCryptoParamsFromHeaders(headers) { throw new CryptoError("Invalid salt parameter", BAD_SALT_PARAM); } var rs = enc.rs ? parseInt(enc.rs, 10) : 4096; - if (isNaN(rs)) { - throw new CryptoError("rs parameter must be a number", BAD_RS_PARAM); + if (isNaN(rs) || rs < 1 || rs > 68719476705) { + // https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-encryption-encoding... + throw new CryptoError( + "rs parameter must be a number greater than 1 and smaller than 2^36-31", + BAD_RS_PARAM + ); } return { salt, @@ -791,6 +805,7 @@ class aes128gcmEncoder { // Perform the actual encryption of the payload. async encrypt(key, nonce) { if (this.rs < 18) { + // https://datatracker.ietf.org/doc/html/rfc8188#section-2.1 throw new CryptoError("recordsize is too small", BAD_RS_PARAM); }

@@ -869,6 +884,7 @@ class aes128gcmEncoder { createHeader(key) { // layout is "salt|32-bit-int|8-bit-int|key" if (key.byteLength != 65) { + // https://datatracker.ietf.org/doc/html/rfc8291/#section-4 throw new CryptoError("Invalid key length for header", BAD_DH_PARAM); } // the 2 ints

===================================== netwerk/cache2/CacheFileIOManager.cpp ===================================== @@ -4359,13 +4359,15 @@ class SizeOfHandlesRunnable : public Runnable { public: SizeOfHandlesRunnable(mozilla::MallocSizeOf mallocSizeOf, CacheFileHandles const& handles, - nsTArray<CacheFileHandle*> const& specialHandles) + nsTArray<CacheFileHandle*> const& specialHandles, + nsCOMPtr<nsITimer> const& metadataWritesTimer) : Runnable("net::SizeOfHandlesRunnable"), mMonitor("SizeOfHandlesRunnable.mMonitor"), mMonitorNotified(false), mMallocSizeOf(mallocSizeOf), mHandles(handles), mSpecialHandles(specialHandles), + mMetadataWritesTimer(metadataWritesTimer), mSize(0) {}

size_t Get(CacheIOThread* thread) { @@ -4397,6 +4399,10 @@ class SizeOfHandlesRunnable : public Runnable { for (uint32_t i = 0; i < mSpecialHandles.Length(); ++i) { mSize += mSpecialHandles[i]->SizeOfIncludingThis(mMallocSizeOf); } + nsCOMPtr<nsISizeOf> sizeOf = do_QueryInterface(mMetadataWritesTimer); + if (sizeOf) { + mSize += sizeOf->SizeOfIncludingThis(mMallocSizeOf); + }

mMonitorNotified = true; mon.Notify(); @@ -4404,11 +4410,12 @@ class SizeOfHandlesRunnable : public Runnable { }

private: - mozilla::Monitor mMonitor MOZ_UNANNOTATED; + mozilla::Monitor mMonitor; bool mMonitorNotified; mozilla::MallocSizeOf mMallocSizeOf; CacheFileHandles const& mHandles; nsTArray<CacheFileHandle*> const& mSpecialHandles; + nsCOMPtr<nsITimer> const& mMetadataWritesTimer; size_t mSize; };

@@ -4422,10 +4429,11 @@ size_t CacheFileIOManager::SizeOfExcludingThisInternal( if (mIOThread) { n += mIOThread->SizeOfIncludingThis(mallocSizeOf);

- // mHandles and mSpecialHandles must be accessed only on the I/O thread, - // must sync dispatch. + // mHandles, mSpecialHandles and mMetadataWritesTimer must be accessed + // only on the I/O thread, must sync dispatch. RefPtr<SizeOfHandlesRunnable> sizeOfHandlesRunnable = - new SizeOfHandlesRunnable(mallocSizeOf, mHandles, mSpecialHandles); + new SizeOfHandlesRunnable(mallocSizeOf, mHandles, mSpecialHandles, + mMetadataWritesTimer); n += sizeOfHandlesRunnable->Get(mIOThread); }

@@ -4434,9 +4442,6 @@ size_t CacheFileIOManager::SizeOfExcludingThisInternal( sizeOf = do_QueryInterface(mCacheDirectory); if (sizeOf) n += sizeOf->SizeOfIncludingThis(mallocSizeOf);

- sizeOf = do_QueryInterface(mMetadataWritesTimer); - if (sizeOf) n += sizeOf->SizeOfIncludingThis(mallocSizeOf); - sizeOf = do_QueryInterface(mTrashTimer); if (sizeOf) n += sizeOf->SizeOfIncludingThis(mallocSizeOf);

===================================== netwerk/streamconv/converters/nsMultiMixedConv.cpp ===================================== @@ -467,6 +467,12 @@ nsMultiMixedConv::OnStartRequest(nsIRequest* request) { if (NS_SUCCEEDED(rv)) { mRootContentSecurityPolicy = csp; } + nsCString contentDisposition; + rv = httpChannel->GetResponseHeader("content-disposition"_ns, + contentDisposition); + if (NS_SUCCEEDED(rv)) { + mRootContentDisposition = contentDisposition; + } } else { // try asking the channel directly rv = mChannel->GetContentType(contentType); @@ -837,7 +843,11 @@ nsresult nsMultiMixedConv::SendStart() { rv = mPartChannel->SetContentLength(mContentLength); if (NS_FAILED(rv)) return rv;

- mPartChannel->SetContentDisposition(mContentDisposition); + if (!mRootContentDisposition.IsEmpty()) { + mPartChannel->SetContentDisposition(mRootContentDisposition); + } else { + mPartChannel->SetContentDisposition(mContentDisposition); + }

// Each part of a multipart/replace response can be used // for the top level document. We must inform upper layers

===================================== netwerk/streamconv/converters/nsMultiMixedConv.h ===================================== @@ -150,15 +150,17 @@ class nsMultiMixedConv : public nsIStreamConverter { nsCOMPtr<nsIStreamListener> mFinalListener; // this guy gets the converted // data via his OnDataAvailable()

- nsCOMPtr<nsIChannel> - mChannel; // The channel as we get in in OnStartRequest call - RefPtr<nsPartChannel> mPartChannel; // the channel for the given part we're - // processing. one channel per part. + // The channel as we get it in OnStartRequest call + nsCOMPtr<nsIChannel> mChannel; + // the channel for the given part we're + // processing. one channel per part. + RefPtr<nsPartChannel> mPartChannel; nsCOMPtr<nsISupports> mContext; nsCString mContentType; nsCString mContentDisposition; nsCString mContentSecurityPolicy; nsCString mRootContentSecurityPolicy; + nsCString mRootContentDisposition; uint64_t mContentLength{UINT64_MAX}; uint64_t mTotalSent{0};

===================================== toolkit/content/widgets/popupnotification.js ===================================== @@ -15,7 +15,7 @@ ".popup-notification-description": "popupid,id=descriptionid", ".popup-notification-description > span:first-of-type": "text=label,popupid", - ".popup-notification-description > b:first-of-type": + ".popup-notification-description > .popup-notification-description-name": "text=name,popupid", ".popup-notification-description > span:nth-of-type(2)": "text=endlabel,popupid", @@ -82,7 +82,7 @@ <!-- These need to be on the same line to avoid creating whitespace between them (whitespace is added in the localization file, if necessary). --> - <description class="popup-notification-description">html:span</html:span>html:b</html:b>html:span</html:span>html:b</html:b>html:span</html:span></description> + <description class="popup-notification-description">html:span</html:span><html:b class="popup-notification-description-name"></html:b>html:span</html:span>html:b</html:b>html:span</html:span></description> <description class="popup-notification-hint-text"></description> </vbox> <toolbarbutton class="messageCloseButton close-icon popup-notification-closebutton tabbable" data-l10n-id="close-notification-message"></toolbarbutton>

===================================== toolkit/themes/shared/popupnotification.css ===================================== @@ -52,6 +52,16 @@ popupnotificationcontent { flex: 1 auto; }

+/* + * Ensure that host names in PopupNotifications wrap. This targets the "name" + * element in the description container which is the "name" property of the + * PopupNotification. Name is what gets substituted from the l10n string using + * the placeholder <>. + */ +.popup-notification-description-name { + word-break: break-all; +} + .popup-notification-closebutton { margin-inline-end: -8px; margin-top: -8px;

View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/18d48e8...