October 2015 - tor-commits - lists.torproject.org

[torspec/master] Fix typo in prop#259.
by isis＠torproject.org 31 Oct '15

31 Oct '15

commit 57abce5e6360ea6e39e39ab44de28958a33f68d3 Author: Isis Lovecruft <isis(a)torproject.org> Date: Fri Oct 30 23:07:49 2015 +0000 Fix typo in prop#259. --- proposals/259-guard-selection.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/proposals/259-guard-selection.txt b/proposals/259-guard-selection.txt index 407ac26..08d18db 100644 --- a/proposals/259-guard-selection.txt +++ b/proposals/259-guard-selection.txt @@ -254,7 +254,7 @@ Extends: 241-suspicious-guard-turnover.txt `. ,´A A`--__--´ - And similarly if B disappears: + And similarly if A disappears: B-´¯¯`-B ,` `.

1 0

[tor-browser-bundle/master] Version bumps, changelog update
by gk＠torproject.org 30 Oct '15

30 Oct '15

commit c023bbcc3abb9a577004c30becb38c77b38eda6f Author: Georg Koppen <gk(a)torproject.org> Date: Fri Oct 30 22:06:48 2015 +0000 Version bumps, changelog update --- Bundle-Data/Docs/ChangeLog.txt | 26 ++++++++++++++++++++++++++ gitian/versions.alpha | 12 ++++++------ gitian/versions.nightly | 8 ++++---- tools/update-responses/config.yml | 12 ++++++------ 4 files changed, 42 insertions(+), 16 deletions(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index 71154c4..ba4a3b5 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,29 @@ +Tor Browser 5.5a4 -- November 3 2015 + * All Platforms + * Update Firefox to 38.4.0esr + * Update Tor to 0.2.7.4-rc + * Update NoScript to 2.6.9.39 + * Update HTTPS-Everywhere to 5.1.1 + * Update Torbutton to 1.9.4.1 + * Bug 9263: Spoof Referer when leaving a .onion domain + * Bug 16620: Remove old window.name handling code + * Bug 17164: Don't show text-select cursor on circuit display + * Bug 17351: Remove unused code + * Translation updates + * Bug 17207: Hide MIME types and plugins from websites + * Bug 16909+17383: Adapt to HTTPS-Everywhere build changes + * Bug 16620: Move window.name handling into a Firefox patch + * Bug 17220: Support math symbols in font whitelist + * Bug 10599+17305: Include updater and build patches needed for hardened builds + * Bug 17318: Remove dead ScrambleSuit bridge + * Bug 17428: Remove default Flashproxy bridges + * Windows + * Bug 17250: Add localized font names to font whitelist + * OS X + * Bug 17122: Rename Japanese OS X bundle + * Linux + * Bug 17329: Ensure that non-ASCII characters can be typed (fixup of #5926) + Tor Browser 5.5a3 -- September 22 2015 * All Platforms * Update Firefox to 38.3.0esr diff --git a/gitian/versions.alpha b/gitian/versions.alpha index 3588096..81818e8 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -7,14 +7,14 @@ BUILD_PT_BUNDLES=1 VERIFY_TAGS=1 -FIREFOX_VERSION=38.3.0esr +FIREFOX_VERSION=38.4.0esr TORBROWSER_UPDATE_CHANNEL=alpha -TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-5.5-2-build4 -TOR_TAG=tor-0.2.7.2-alpha +TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-5.5-1-build1 +TOR_TAG=tor-0.2.7.4-rc TORLAUNCHER_TAG=0.2.7.7 -TORBUTTON_TAG=1.9.4 +TORBUTTON_TAG=1.9.4.1 HTTPSE_TAG=5.1.1 NSIS_TAG=v0.3 ZLIB_TAG=v1.2.8 @@ -62,7 +62,7 @@ NOTOCJKFONT_VER=1.004 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz GMP_PACKAGE=gmp-${GMP_VER}.tar.bz2 -NOSCRIPT_PACKAGE=noscript_security_suite-2.6.9.36-sm+fx+fn.xpi +NOSCRIPT_PACKAGE=noscript_security_suite-2.6.9.39-sm+fx+fn.xpi TOOLCHAIN4_PACKAGE=x86_64-apple-darwin10.tar.xz TOOLCHAIN4_OLD_PACKAGE=multiarch-darwin11-cctools127.2-gcc42-5666.3-llvmgcc42-2336.1-Linux-120724.tar.xz OSXSDK_PACKAGE=MacOSX10.7.sdk.tar.gz @@ -93,7 +93,7 @@ OSXSDK_HASH=da77bb0003fcca5ea8c4e8cb2da8828ded750c54afdcac29ec6f3b46ad5e3adf OSXSDK_OLD_HASH=6602d8d5ddb371fbc02e2a5967d9bd0cd7358d46f9417753c8234b923f2ea6fc TOOLCHAIN4_HASH=7b71bfe02820409b994c5c33a7eab81a81c72550f5da85ff7af70da3da244645 TOOLCHAIN4_OLD_HASH=65c1b2d302358a6b95a26c6828a66908a199276193bb0b268f2dcc1a997731e9 -NOSCRIPT_HASH=0585d95161711f6e4bcd56ed6f160c15bbf08ab6c559a675ce659e6c8ffb150d +NOSCRIPT_HASH=dd904c6a12a8b1f6b1da48d51e4df903d7f9211ba5b3f32d7272f413a3bf548a MSVCR100_HASH=1221a09484964a6f38af5e34ee292b9afefccb3dc6e55435fd3aaf7c235d9067 PYCRYPTO_HASH=f2ce1e989b272cfcb677616763e0a2e7ec659effa67a88aa92b3a65528f60a3c ARGPARSE_HASH=ddaf4b0a618335a32b6664d4ae038a1de8fbada3b25033f9021510ed2b3941a4 diff --git a/gitian/versions.nightly b/gitian/versions.nightly index 4e8cd42..9f1c6b4 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -14,11 +14,11 @@ MULTI_LINGUAL=1 VERIFY_TAGS=0 -FIREFOX_VERSION=38.3.0esr +FIREFOX_VERSION=38.4.0esr TORBROWSER_UPDATE_CHANNEL=default -TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-5.5-2 +TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-5.5-1 TOR_TAG=master TORLAUNCHER_TAG=master TORBUTTON_TAG=master @@ -69,7 +69,7 @@ NOTOCJKFONT_VER=1.004 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz GMP_PACKAGE=gmp-${GMP_VER}.tar.bz2 -NOSCRIPT_PACKAGE=noscript_security_suite-2.6.9.36-sm+fx+fn.xpi +NOSCRIPT_PACKAGE=noscript_security_suite-2.6.9.39-sm+fx+fn.xpi TOOLCHAIN4_PACKAGE=x86_64-apple-darwin10.tar.xz TOOLCHAIN4_OLD_PACKAGE=multiarch-darwin11-cctools127.2-gcc42-5666.3-llvmgcc42-2336.1-Linux-120724.tar.xz OSXSDK_PACKAGE=MacOSX10.7.sdk.tar.gz @@ -100,7 +100,7 @@ OSXSDK_HASH=da77bb0003fcca5ea8c4e8cb2da8828ded750c54afdcac29ec6f3b46ad5e3adf OSXSDK_OLD_HASH=6602d8d5ddb371fbc02e2a5967d9bd0cd7358d46f9417753c8234b923f2ea6fc TOOLCHAIN4_HASH=7b71bfe02820409b994c5c33a7eab81a81c72550f5da85ff7af70da3da244645 TOOLCHAIN4_OLD_HASH=65c1b2d302358a6b95a26c6828a66908a199276193bb0b268f2dcc1a997731e9 -NOSCRIPT_HASH=0585d95161711f6e4bcd56ed6f160c15bbf08ab6c559a675ce659e6c8ffb150d +NOSCRIPT_HASH=dd904c6a12a8b1f6b1da48d51e4df903d7f9211ba5b3f32d7272f413a3bf548a MSVCR100_HASH=1221a09484964a6f38af5e34ee292b9afefccb3dc6e55435fd3aaf7c235d9067 PYCRYPTO_HASH=f2ce1e989b272cfcb677616763e0a2e7ec659effa67a88aa92b3a65528f60a3c ARGPARSE_HASH=ddaf4b0a618335a32b6664d4ae038a1de8fbada3b25033f9021510ed2b3941a4 diff --git a/tools/update-responses/config.yml b/tools/update-responses/config.yml index dcef911..acfa5db 100644 --- a/tools/update-responses/config.yml +++ b/tools/update-responses/config.yml @@ -9,7 +9,7 @@ build_targets: osx32: Darwin_x86-gcc3 osx64: Darwin_x86_64-gcc3 channels: - alpha: 5.5a3 + alpha: 5.5a4 release: 5.0 versions: 5.0: @@ -23,12 +23,12 @@ versions: osx32: minSupportedOSVersion: 10.8 detailsURL: https://blog.torproject.org/blog/end-life-plan-tor-browser-32-bit-macs#upda… - 5.5a3: - platformVersion: 38.3.0 - detailsURL: https://blog.torproject.org/blog/tor-browser-55a3-released - download_url: https://www.torproject.org/dist/torbrowser/5.5a3 + 5.5a4: + platformVersion: 38.4.0 + detailsURL: https://blog.torproject.org/blog/tor-browser-55a4-released + download_url: https://www.torproject.org/dist/torbrowser/5.5a4 incremental_from: - - 5.5a2 + - 5.5a3 migrate_archs: osx32: osx64 osx32:

1 0

[torbutton/master] Bug 16620: Transform window.name handling into Firefox patch.
by gk＠torproject.org 30 Oct '15

30 Oct '15

commit 4afb4f104685466ee0ac4f98fda7dd57d6d522c2 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Wed Oct 14 15:19:20 2015 -0400 Bug 16620: Transform window.name handling into Firefox patch. Removed torbutton_weblistener and torbutton_check_progress(). --- src/chrome/content/torbutton.js | 173 --------------------------------------- 1 file changed, 173 deletions(-) diff --git a/src/chrome/content/torbutton.js b/src/chrome/content/torbutton.js index fb9c8c3..58ab20e 100644 --- a/src/chrome/content/torbutton.js +++ b/src/chrome/content/torbutton.js @@ -2907,15 +2907,6 @@ function torbutton_do_main_window_startup() { torbutton_log(3, "Torbutton main window startup"); m_tb_is_main_window = true; - - // http://www.xulplanet.com/references/xpcomref/ifaces/nsIWebProgress.html - var progress = - Components.classes["@mozilla.org/docloaderservice;1"]. - getService(Components.interfaces.nsIWebProgress); - - progress.addProgressListener(torbutton_weblistener, - Components.interfaces.nsIWebProgress.NOTIFY_LOCATION); - torbutton_unique_pref_observer.register(); } @@ -3181,11 +3172,6 @@ function torbutton_close_window(event) { } } - // remove old listeners - var progress = Components.classes["@mozilla.org/docloaderservice;1"]. - getService(Components.interfaces.nsIWebProgress); - - progress.removeProgressListener(torbutton_weblistener); torbutton_unique_pref_observer.unregister(); if(m_tb_is_main_window) { // main window not reset above @@ -3209,165 +3195,6 @@ function torbutton_open_network_settings() { window.addEventListener('load',torbutton_new_window,false); window.addEventListener('unload', torbutton_close_window, false); -// FIXME: Tons of exceptions get thrown from this function on account -// of its being called so early. Need to find a quick way to check if -// aProgress and aRequest are actually fully initialized -// (without throwing exceptions) -// Bug 1506 P0: This is to block full page plugins. Not needed anymore -// due to better (but non-toggle-friendly) plugin APIs) -function torbutton_check_progress(aProgress, aRequest, aFlags, new_loc) { - if (!m_tb_wasinited) { - torbutton_init(); - } - - var DOMWindow = null; - - // Bug #866: Zotero conflict with about:blank windows - // handle docshell JS switching and other early duties - var WP_STATE_START = Ci.nsIWebProgressListener.STATE_START; - var WP_STATE_DOC = Ci.nsIWebProgressListener.STATE_IS_DOCUMENT; - var WP_STATE_START_DOC = WP_STATE_START | WP_STATE_DOC; - - if ((aFlags & WP_STATE_START_DOC) == WP_STATE_START_DOC - && aRequest instanceof Ci.nsIChannel - && !(aRequest.loadFlags & aRequest.LOAD_INITIAL_DOCUMENT_URI) - && aRequest.URI.spec == "about:blank") { - torbutton_log(3, "Passing on about:blank"); - return 0; - } - - if(aProgress) { - try { - DOMWindow = aProgress.DOMWindow; - } catch(e) { - torbutton_log(4, "Exception on DOMWindow: "+e); - DOMWindow = null; - } - } - - if(!DOMWindow) { - try { - if(aRequest.notificationCallbacks) { - DOMWindow = aRequest.notificationCallbacks.QueryInterface( - Components.interfaces.nsIInterfaceRequestor).getInterface( - Components.interfaces.nsIDOMWindow); - } - } catch(e) { } - } - - // TODO: separate this from the above? - if(DOMWindow) { - var doc = DOMWindow.document; - try { - if(doc) { - if(doc.domain) { - var referrer = null; - var win = DOMWindow.window; - - try { - var hreq = aRequest.QueryInterface(Ci.nsIHttpChannel); - referrer = hreq.referrer; - } catch(e) {} - - try { - // XXX: The patch from https://bugzilla.mozilla.org/show_bug.cgi?id=444222 - // might be better here.. - // - // Ticket #3414: Apply referer policy to window.name. - // - // This keeps window.name clean between fresh urls. - // It should also apply to iframes because hookdoc gets called for all - // frames and subdocuments. - // - // The about:blank check handles the 'name' attribute of framesets, which - // get set before the referer is set on the channel. - if ((!referrer || referrer.spec == "") && win.location != "about:blank") { - if (win.top == win.window) { - // Only reset if we're the top-level window - //torbutton_log(4, "Resetting window.name: "+win.name+" for "+win.location); - win.name = ""; - win.window.name = ""; - } - } - } catch(e) { - torbutton_log(4, "Failed to reset window.name: "+e) - } - } - } - } catch(e) { - try { - if(doc && doc.location && - (doc.location.href.indexOf("about:") != 0 && - doc.location.href.indexOf("chrome:") != 0)) { - torbutton_safelog(4, "Exception "+e - +" on tag application at: ", - doc.location); - } else { - torbutton_eclog(3, "Got an about url: "+e); - } - } catch(e1) { - torbutton_eclog(3, "Got odd url "+e); - } - } - } else { - torbutton_eclog(3, "No aProgress for location!"); - } - return 0; -} - -// Warning: These can also fire when the 'debuglogger' extension -// updates its window. Typically for this, doc.domain is null. Do not -// log in this case (until we find a better way to filter those -// events out). Use torbutton_eclog for common-path stuff.] -// -// Bug 1506 P0: This listener is for blocking plugins and installing JS hooks. -// It can be eliminated. -var torbutton_weblistener = -{ - QueryInterface: function(aIID) - { - if (aIID.equals(Components.interfaces.nsIWebProgressListener) || - aIID.equals(Components.interfaces.nsISupportsWeakReference) || - aIID.equals(Components.interfaces.nsISupports)) - return this; - throw Components.results.NS_NOINTERFACE; - }, - - onLocationChange: function(aProgress, aRequest, aURI) - { - torbutton_eclog(2, 'onLocationChange: '+aURI.asciiSpec); - if(aURI.scheme == "about" || aURI.scheme == "chrome") { - torbutton_eclog(3, "Skipping location change for "+aURI.asciiSpec); - } else { - return torbutton_check_progress(aProgress, aRequest, 0, true); - } - }, - - // XXX: The following can probably go - onStateChange: function(aProgress, aRequest, aFlag, aStatus) - { - torbutton_eclog(2, 'State change()'); - return torbutton_check_progress(aProgress, aRequest, aFlag, false); - }, - - onProgressChange: function(aProgress, aRequest, curSelfProgress, maxSelfProgress, curTotalProgress, maxTotalProgress) - { - torbutton_eclog(2, 'called progressChange'); - return torbutton_check_progress(aProgress, aRequest, 0, false); - }, - - onStatusChange: function(aProgress, aRequest, stat, message) - { - torbutton_eclog(2, 'called progressChange'); - return torbutton_check_progress(aProgress, aRequest, 0, false); - }, - - onSecurityChange: function() {return 0;}, - - onLinkIconAvailable: function() - { /*torbutton_eclog(1, 'called linkIcon'); */ return 0; } -} - var m_tb_resize_handler = null; var m_tb_resize_date = null;

1 0

[torbutton/master] Update changelog; bump version
by gk＠torproject.org 30 Oct '15

30 Oct '15

commit 930cbdb5d4366815a5a04e9d4a0565c73ea2cd0c Author: Georg Koppen <gk(a)torproject.org> Date: Fri Oct 30 20:08:43 2015 +0000 Update changelog; bump version --- src/CHANGELOG | 7 +++++++ src/install.rdf | 2 +- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/src/CHANGELOG b/src/CHANGELOG index 76fa989..0347f11 100644 --- a/src/CHANGELOG +++ b/src/CHANGELOG @@ -1,3 +1,10 @@ +1.9.4.1 + * Bug 9263: Spoof Referer when leaving a .onion domain + * Bug 16620: Move window.name handling into a Firefox patch + * Bug 17164: Don't show text-select cursor on circuit display + * Bug 17351: Remove unused code + * Translation updates + 1.9.4 * Bug 16937: Don't translate the hompepage/spellchecker dictionary string * Bug 16735: about:tor should accommodate different fonts/font sizes diff --git a/src/install.rdf b/src/install.rdf index db9af4b..267870c 100644 --- a/src/install.rdf +++ b/src/install.rdf @@ -6,7 +6,7 @@ <em:name>Torbutton</em:name> <em:creator>Mike Perry</em:creator> <em:id>torbutton(a)torproject.org</em:id> - <em:version>1.9.4</em:version> + <em:version>1.9.4.1</em:version> <em:homepageURL>https://www.torproject.org/projects/torbrowser.html.en</em:homepageURL> <em:optionsURL>chrome://torbutton/content/preferences.xul</em:optionsURL> <em:iconURL>chrome://torbutton/skin/tor.png</em:iconURL>

1 0

[translation/tails-greeter_completed] Update translations for tails-greeter_completed
by translation＠torproject.org 30 Oct '15

30 Oct '15

commit 734618136813eb876dd3826d5a2685de3a2615ec Author: Translation commit bot <translation(a)torproject.org> Date: Fri Oct 30 21:45:30 2015 +0000 Update translations for tails-greeter_completed --- fr/fr.po | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/fr/fr.po b/fr/fr.po index 595ec5f..afe7f59 100644 --- a/fr/fr.po +++ b/fr/fr.po @@ -10,13 +10,14 @@ # Onizuka, 2013 # Sabrina Cater <sabcat(a)gmx.fr>, 2015 # Towinet, 2014 +# Xynn <xynn.anhnguyen(a)gmail.com>, 2015 msgid "" msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: \n" -"POT-Creation-Date: 2015-08-05 18:46+0200\n" -"PO-Revision-Date: 2015-08-20 15:52+0000\n" -"Last-Translator: Sabrina Cater <sabcat(a)gmx.fr>\n" +"POT-Creation-Date: 2015-10-26 17:51+0100\n" +"PO-Revision-Date: 2015-10-30 21:25+0000\n" +"Last-Translator: Xynn <xynn.anhnguyen(a)gmail.com>\n" "Language-Team: French (http://www.transifex.com/otf/torproject/language/fr/)\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" @@ -164,6 +165,10 @@ msgid "" "need to configure bridge, firewall, or proxy settings." msgstr "La connexion internet de cet ordinateur est censurée, filtrée ou passe par un proxy. Vous devez configurer la passerelle, le pare-feu ou les paramètres du proxy." +#: ../glade/optionswindow.glade.h:23 +msgid "Disable all networking" +msgstr "Désactiver tout réseau" + #: ../glade/langpanel.glade.h:1 msgid " " msgstr " "

1 0

[translation/tails-greeter] Update translations for tails-greeter
by translation＠torproject.org 30 Oct '15

30 Oct '15

commit f9005de95e14eb3070a79e052aef3b223ca66b35 Author: Translation commit bot <translation(a)torproject.org> Date: Fri Oct 30 21:45:26 2015 +0000 Update translations for tails-greeter --- fr/fr.po | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/fr/fr.po b/fr/fr.po index 90233ad..afe7f59 100644 --- a/fr/fr.po +++ b/fr/fr.po @@ -10,13 +10,14 @@ # Onizuka, 2013 # Sabrina Cater <sabcat(a)gmx.fr>, 2015 # Towinet, 2014 +# Xynn <xynn.anhnguyen(a)gmail.com>, 2015 msgid "" msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: \n" "POT-Creation-Date: 2015-10-26 17:51+0100\n" -"PO-Revision-Date: 2015-10-27 10:10+0000\n" -"Last-Translator: carolyn <carolyn(a)anhalt.org>\n" +"PO-Revision-Date: 2015-10-30 21:25+0000\n" +"Last-Translator: Xynn <xynn.anhnguyen(a)gmail.com>\n" "Language-Team: French (http://www.transifex.com/otf/torproject/language/fr/)\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" @@ -166,7 +167,7 @@ msgstr "La connexion internet de cet ordinateur est censurée, filtrée ou passe #: ../glade/optionswindow.glade.h:23 msgid "Disable all networking" -msgstr "" +msgstr "Désactiver tout réseau" #: ../glade/langpanel.glade.h:1 msgid " "

1 0

[tor-browser/tor-browser-38.3.0esr-5.5-2] Bug 16620: Clear window.name when no referrer sent
by gk＠torproject.org 30 Oct '15

30 Oct '15

commit 95a62d13e045b950ed2b2f242da7413d33386a47 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Fri Oct 30 14:28:13 2015 -0400 Bug 16620: Clear window.name when no referrer sent Convert JS implementation (within Torbutton) to a C++ browser patch. --- docshell/base/nsDocShell.cpp | 47 +++++++++++++ docshell/test/mochitest.ini | 2 + docshell/test/test_tor_bug16620.html | 129 ++++++++++++++++++++++++++++++++++ docshell/test/tor_bug16620.html | 51 ++++++++++++++ 4 files changed, 229 insertions(+) diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp index 03885534..59f184e 100644 --- a/docshell/base/nsDocShell.cpp +++ b/docshell/base/nsDocShell.cpp @@ -8992,6 +8992,53 @@ nsDocShell::CreateContentViewer(const char* aContentType, aOpenedChannel->GetURI(getter_AddRefs(mLoadingURI)); } FirePageHideNotification(!mSavingOldViewer); + + // Tor bug # 16620: Clear window.name if there is no referrer. We make an + // exception for new windows, e.g., window.open(url, "MyName"). + bool isNewWindowTarget = false; + nsCOMPtr<nsIPropertyBag2> props(do_QueryInterface(aRequest, &rv)); + if (props) { + props->GetPropertyAsBool(NS_LITERAL_STRING("docshell.newWindowTarget"), + &isNewWindowTarget); + } + + if (!isNewWindowTarget) { + nsCOMPtr<nsIHttpChannel> httpChannel(do_QueryInterface(aOpenedChannel)); + nsCOMPtr<nsIURI> httpReferrer; + if (httpChannel) + httpChannel->GetReferrer(getter_AddRefs(httpReferrer)); + +#ifdef DEBUG_WINDOW_NAME + printf("DOCSHELL %p CreateContentViewer - possibly clearing window.name:\n", this); + printf(" current window.name: \"%s\"\n", + NS_ConvertUTF16toUTF8(mName).get()); + + nsAutoCString curSpec, loadingSpec; + if (this->mCurrentURI) + mCurrentURI->GetSpec(curSpec); + if (mLoadingURI) + mLoadingURI->GetSpec(loadingSpec); + printf(" current URI: %s\n", curSpec.get()); + printf(" loading URI: %s\n", loadingSpec.get()); + + if (!httpReferrer) { + printf(" referrer: None\n"); + } else { + nsAutoCString refSpec; + httpReferrer->GetSpec(refSpec); + printf(" referrer: %s\n", refSpec.get()); + } +#endif + + if (!httpReferrer) + SetName(NS_LITERAL_STRING("")); + +#ifdef DEBUG_WINDOW_NAME + printf(" action taken: %s window.name\n", + httpReferrer ? "Preserved" : "Cleared"); +#endif + } + mLoadingURI = nullptr; // Set mFiredUnloadEvent = false so that the unload handler for the diff --git a/docshell/test/mochitest.ini b/docshell/test/mochitest.ini index 3668c58..a1325b9 100644 --- a/docshell/test/mochitest.ini +++ b/docshell/test/mochitest.ini @@ -34,6 +34,7 @@ support-files = file_bug728939.html file_pushState_after_document_open.html historyframes.html + tor_bug16620.html [test_anchor_scroll_after_document_open.html] [test_bfcache_plus_hash.html] @@ -107,3 +108,4 @@ support-files = file_framedhistoryframes.html skip-if = (buildapp == 'b2g' && toolkit != 'gonk') #Bug 931116, b2g desktop specific, initial triage [test_bug1121701.html] skip-if = (buildapp == 'b2g' || buildapp == 'mulet') +[test_tor_bug16620.html] diff --git a/docshell/test/test_tor_bug16620.html b/docshell/test/test_tor_bug16620.html new file mode 100644 index 0000000..0fe9603 --- /dev/null +++ b/docshell/test/test_tor_bug16620.html @@ -0,0 +1,129 @@ +<!DOCTYPE HTML> +<html> + +<meta charset="utf-8"> +<head> + <title>Test for Tor Bug 16620 - Clear window.name when no referrer sent</title> + <script type="application/javascript" + src="/tests/SimpleTest/SimpleTest.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/> +</head> +<body> +<a target="_blank" href="https://trac.torproject.org/projects/tor/ticket/16620">Tor Bug 16620</a> +<script type="application/javascript;version=1.7"> + +// ## Test constants +const kTestPath = "/tests/docshell/test/"; +const kFile = "tor_bug16620.html"; +const kBaseURL1 = "http://example.com"; +const kBaseURL2 = "http://example.net"; + +let gTests = [ + // Test #1: Same domain: + { startURL: kBaseURL1, destURL: kBaseURL1, + expectIsolation: false }, + + // Test #2: Different top-level domains: + { startURL: kBaseURL1, destURL: kBaseURL2, + expectIsolation: false }, + + // Test #3: Same domain, rel="noreferrer" on link: + { startURL: kBaseURL1, destURL: kBaseURL1, noReferrerOnLink: true, + expectIsolation: true }, + + // Test #4: Same domain, "no-referrer" meta tag in document: + { startURL: kBaseURL1, destURL: kBaseURL1, noReferrerInMetaTag: true, + expectIsolation: true }, + + // Test #5: Like test 4, but reset window.name during unload: + // (similar to http://www.thomasfrank.se/sessvarsTestPage1.html) + { startURL: kBaseURL1, destURL: kBaseURL1, noReferrerInMetaTag: true, + resetInUnload: true, + expectIsolation: true }, + + // Test #6: Data URL as destination (no referrer): + { startURL: kBaseURL1, + expectIsolation: true }, +]; + +let gCurTest = 0; +let gCurWinName, gChildWin, gDataURL; + +// ## Utility functions +function generateRandomName() +{ + // Generate a random 6 character string using 0-9 and a-z. + return ((1 + Math.random()).toString(36) + '000000').substr(2, 6); +} + +function startNextTest() { + ++gCurTest; + if (gCurTest > gTests.length) { + SimpleTest.finish(); + } else { + let curTest = gTests[gCurTest - 1]; + let url = curTest.startURL + kTestPath + kFile + "?firstDocLoaded"; + gCurWinName = generateRandomName(); + gChildWin = window.open(url, gCurWinName); + } +} + +// ## Add a message event listener. +window.addEventListener("message", function(aEvent) { + if (aEvent.source !== gChildWin) + return; + +// console.log("parent received message:" + JSON.stringify(aEvent.data)); + + let curTest = gTests[gCurTest - 1]; + let state = aEvent.data.state; + let winName = aEvent.data.winName; + if ("firstDocLoaded" == state) { + ok(winName === gCurWinName, "Test #" + gCurTest + + " - first document's name matches window.open parameter"); + + // Send an "openURL" message to the loaded document. + let url2 = (curTest.destURL) + ? curTest.destURL + kTestPath + kFile + "?secondDocLoaded" + : gDataURL; + let noReferrerOnLink = (curTest.noReferrerOnLink === true); + let noReferrerInMetaTag = (curTest.noReferrerInMetaTag === true); + let resetInUnload = (curTest.resetInUnload === true); + aEvent.source.postMessage({ action: "openURL", url: url2, + noReferrerOnLink: noReferrerOnLink, + noReferrerInMetaTag: noReferrerInMetaTag, + resetInUnload: resetInUnload }, + aEvent.origin); + } else if ("secondDocLoaded" == state) { + if (curTest.expectIsolation) { + ok(winName === "", + "Test #" + gCurTest + " - second document: name was cleared"); + } else { + ok(winName === gCurWinName, + "Test #" + gCurTest + " - second document: name was preserved"); + } + + gChildWin.close(); + startNextTest(); + } + }, false); + +SimpleTest.waitForExplicitFinish(); + +// Read file contents, construct a data URL (used by some tests), and +// then start the first test. +let url = kTestPath + kFile; +let xhr = new XMLHttpRequest(); +xhr.open("GET", url); +xhr.onload = function() { + gDataURL = "data:text/html;charset=utf-8," + + encodeURIComponent(this.responseText); + startNextTest(); +} +xhr.send(); +</script> +</body> +</html> diff --git a/docshell/test/tor_bug16620.html b/docshell/test/tor_bug16620.html new file mode 100644 index 0000000..a8e9050 --- /dev/null +++ b/docshell/test/tor_bug16620.html @@ -0,0 +1,51 @@ +<!DOCTYPE HTML> +<html> + +<head> + <meta charset="UTF-8"> + <title>Supporting Doc for Tor Bug 16620 Tests</title> +</head> +<body> +<a id="link" href="">secondDoc</a> + +<script type="application/javascript;version=1.7"> +// Extract test state from our query string, defaulting to +// "secondDocLoaded" to support use of this HTML content within +// a data URI (where query strings are not supported). +let state = (location.search.length > 0) ? location.search.substr(1) + : "secondDocLoaded"; + +// Notify the test driver. +opener.postMessage({ state: state, winName: window.name }, "*"); + +// Add a message event listener to process "openURL" actions. +window.addEventListener("message", function(aEvent) { + if (aEvent.data.action == "openURL") { + if (aEvent.data.noReferrerInMetaTag) { + let metaElem = document.createElement("meta"); + metaElem.name = "referrer"; + metaElem.content = "no-referrer"; + document.head.appendChild(metaElem); + } + + let linkElem = document.getElementById("link"); + linkElem.href = aEvent.data.url; + if (aEvent.data.noReferrerOnLink) + linkElem.rel = "noreferrer"; + + if (aEvent.data.resetInUnload) { + let tmpName = window.name; + window.addEventListener("unload", function() { + window.name = tmpName; + }, false); + } + + linkElem.click(); + } +}, false); +</script> +</body> +</html>

1 0

[tor-browser/tor-browser-38.3.0esr-5.5-2] Bug #17207: Hide mime types and plugins when resisting fingerprinting
by gk＠torproject.org 30 Oct '15

30 Oct '15

commit 5ea30524fbf92005f236756646beb77684cd2008 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Fri Oct 16 16:09:54 2015 -0700 Bug #17207: Hide mime types and plugins when resisting fingerprinting --- dom/base/nsMimeTypeArray.cpp | 19 +++++++++++++++++++ dom/base/nsPluginArray.cpp | 13 ++++++++++--- 2 files changed, 29 insertions(+), 3 deletions(-) diff --git a/dom/base/nsMimeTypeArray.cpp b/dom/base/nsMimeTypeArray.cpp index 257abf6..ee530a3 100644 --- a/dom/base/nsMimeTypeArray.cpp +++ b/dom/base/nsMimeTypeArray.cpp @@ -14,6 +14,7 @@ #include "nsIMIMEInfo.h" #include "Navigator.h" #include "nsServiceManagerUtils.h" +#include "nsContentUtils.h" using namespace mozilla; using namespace mozilla::dom; @@ -39,6 +40,12 @@ nsMimeTypeArray::~nsMimeTypeArray() { } +static bool +ResistFingerprinting() { + return !nsContentUtils::ThreadsafeIsCallerChrome() && + nsContentUtils::ResistFingerprinting(); +} + JSObject* nsMimeTypeArray::WrapObject(JSContext* aCx) { @@ -78,6 +85,10 @@ nsMimeTypeArray::IndexedGetter(uint32_t aIndex, bool &aFound) { aFound = false; + if (ResistFingerprinting()) { + return nullptr; + } + EnsurePluginMimeTypes(); if (aIndex >= mMimeTypes.Length()) { @@ -108,6 +119,10 @@ nsMimeTypeArray::NamedGetter(const nsAString& aName, bool &aFound) { aFound = false; + if (ResistFingerprinting()) { + return nullptr; + } + EnsurePluginMimeTypes(); nsString lowerName(aName); @@ -181,6 +196,10 @@ nsMimeTypeArray::NameIsEnumerable(const nsAString& aName) uint32_t nsMimeTypeArray::Length() { + if (ResistFingerprinting()) { + return 0; + } + EnsurePluginMimeTypes(); return mMimeTypes.Length(); diff --git a/dom/base/nsPluginArray.cpp b/dom/base/nsPluginArray.cpp index 1dcd551..8f789ee 100644 --- a/dom/base/nsPluginArray.cpp +++ b/dom/base/nsPluginArray.cpp @@ -20,6 +20,7 @@ #include "nsIWeakReference.h" #include "mozilla/Services.h" #include "nsIInterfaceRequestorUtils.h" +#include "nsContentUtils.h" using namespace mozilla; using namespace mozilla::dom; @@ -43,6 +44,12 @@ nsPluginArray::~nsPluginArray() { } +static bool +ResistFingerprinting() { + return !nsContentUtils::ThreadsafeIsCallerChrome() && + nsContentUtils::ResistFingerprinting(); +} + nsPIDOMWindow* nsPluginArray::GetParentObject() const { @@ -174,7 +181,7 @@ nsPluginArray::IndexedGetter(uint32_t aIndex, bool &aFound) { aFound = false; - if (!AllowPlugins()) { + if (!AllowPlugins() || ResistFingerprinting()) { return nullptr; } @@ -217,7 +224,7 @@ nsPluginArray::NamedGetter(const nsAString& aName, bool &aFound) { aFound = false; - if (!AllowPlugins()) { + if (!AllowPlugins() || ResistFingerprinting()) { return nullptr; } @@ -241,7 +248,7 @@ nsPluginArray::NameIsEnumerable(const nsAString& aName) uint32_t nsPluginArray::Length() { - if (!AllowPlugins()) { + if (!AllowPlugins() || ResistFingerprinting()) { return 0; }

1 0

[tor-browser/tor-browser-38.3.0esr-5.5-2] Regression tests for Bug #17207: Hide mime types and plugins when resisting fingerprinting
by gk＠torproject.org 30 Oct '15

30 Oct '15

commit 5578785b6c12ff62b5a2cdcc3d2f5c9762af6c5c Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Fri Oct 16 17:10:57 2015 -0700 Regression tests for Bug #17207: Hide mime types and plugins when resisting fingerprinting --- dom/base/test/mochitest.ini | 1 + dom/base/test/test_tor_bug17207.html | 49 ++++++++++++++++++++++++++++++++++ 2 files changed, 50 insertions(+) diff --git a/dom/base/test/mochitest.ini b/dom/base/test/mochitest.ini index 133348e..6a8c334 100644 --- a/dom/base/test/mochitest.ini +++ b/dom/base/test/mochitest.ini @@ -739,6 +739,7 @@ skip-if = toolkit == 'android' || e10s #RANDOM [test_title.html] [test_tor_bug15502.html] [test_tor_bug15703.html] +[test_tor_bug17207.html] [test_treewalker_nextsibling.xml] [test_viewport_scroll.html] [test_viewsource_forbidden_in_object.html] diff --git a/dom/base/test/test_tor_bug17207.html b/dom/base/test/test_tor_bug17207.html new file mode 100644 index 0000000..4ab0a0d --- /dev/null +++ b/dom/base/test/test_tor_bug17207.html @@ -0,0 +1,49 @@ +<!DOCTYPE HTML> +<html> + +<head> + <meta http-equiv="content-type" content="text/html; charset=utf-8"> + <title>Test for Tor Browser Bug 17207</title> + <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script> + <script type="text/javascript" src="/tests/SimpleTest/SpawnTask.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> +<p id="display"></p> +<div id="content"></div> + +<script class="testbody" type="application/javascript;version=1.7"> +SimpleTest.waitForExplicitFinish(); + +// __setPref(key, value)__. +// Set a pref value asynchronously, returning a promise that resolves +// when it succeeds. +let setPref = function* (key, value) { + return new Promise(function(resolve, reject) { + SpecialPowers.pushPrefEnv({"set": [[key, value]]}, resolve); + }); +}; + +// Run a test to see that we don't expose the supported mimeTypes +// or installed plugins when "privacy.resistFingerprinting" is active. +spawnTask(function* () { + yield setPref("privacy.resistFingerprinting", true); + is(navigator.mimeTypes["application/pdf"], undefined, "Don't reveal mime types"); + is(navigator.mimeTypes.length, 0, "navigator.mimeTypes.length should be 0"); + yield setPref("privacy.resistFingerprinting", false); + isnot(navigator.mimeTypes["application/pdf"], undefined), + // TODO: In Firefox 38, mimeTypes are not enumerable because of https://bugzilla.mozilla.org/757726. + // But mimeType enumeration was subsequently brought back by https://bugzilla.mozilla.org/1169945. + // So we'll need to include the following line in mozilla-central or TBB/FF45ESR: + // isnot(navigator.mimeTypes.length, 0, "navigator.mimeTypes.length should not be nonzero"); + // TODO: We don't have any plugins in Tor Browser, but we will need to implement + // similar tests for plugins in mainline Firefox. + SimpleTest.finish(); +}); + +</script> + +</body> +</html>

1 0

[translation/tails-persistence-setup_completed] Update translations for tails-persistence-setup_completed
by translation＠torproject.org 30 Oct '15

30 Oct '15

commit a3d0769a218d3c264d5b8e6310396a371c1a14d2 Author: Translation commit bot <translation(a)torproject.org> Date: Fri Oct 30 20:45:30 2015 +0000 Update translations for tails-persistence-setup_completed --- fr/fr.po | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/fr/fr.po b/fr/fr.po index c02b9bc..87b4454 100644 --- a/fr/fr.po +++ b/fr/fr.po @@ -15,13 +15,14 @@ # Towinet, 2014 # Trans-fr, 2015 # David Goulet <vanmortel(a)gmail.com>, 2012 +# Xynn <xynn.anhnguyen(a)gmail.com>, 2015 msgid "" msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: Tails developers <tails(a)boum.org>\n" -"POT-Creation-Date: 2015-08-05 19:02+0200\n" -"PO-Revision-Date: 2015-08-20 15:59+0000\n" -"Last-Translator: Sabrina Cater <sabcat(a)gmx.fr>\n" +"POT-Creation-Date: 2015-10-26 14:15+0100\n" +"PO-Revision-Date: 2015-10-30 20:25+0000\n" +"Last-Translator: Xynn <xynn.anhnguyen(a)gmail.com>\n" "Language-Team: French (http://www.transifex.com/otf/torproject/language/fr/)\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" @@ -126,10 +127,18 @@ msgid "Lists downloaded by APT" msgstr "Listes de paquets téléchargées par APT" #: ../lib/Tails/Persistence/Configuration/Presets.pm:168 +msgid "Icedove" +msgstr "Icedove" + +#: ../lib/Tails/Persistence/Configuration/Presets.pm:170 +msgid "Icedove profiles and locally stored email" +msgstr "Profiles Icedove et emails stockés localement" + +#: ../lib/Tails/Persistence/Configuration/Presets.pm:178 msgid "Dotfiles" msgstr "Dotfiles" -#: ../lib/Tails/Persistence/Configuration/Presets.pm:170 +#: ../lib/Tails/Persistence/Configuration/Presets.pm:180 msgid "" "Symlink into $HOME every file or directory found in the `dotfiles' directory" msgstr "Créer un lien symbolique, dans $HOME, vers chaque fichier ou dossier se trouvant dans le dossier `dotfiles'"

1 0