November 2017 - tor-commits - lists.torproject.org

[tor/master] Re-remove AllowDotExit deprecation.
by nickm＠torproject.org 09 Nov '17

09 Nov '17

commit 40c64f45f04a7cc1ec0149b6c8e8805fba9a2259 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Nov 9 07:58:27 2017 -0500 Re-remove AllowDotExit deprecation. This was accidentally reintroduced in 5a46074e55. It should be harmless, though: the option is obsolete, so calling it deprecated is redundant. --- src/or/config.c | 5 ----- 1 file changed, 5 deletions(-) diff --git a/src/or/config.c b/src/or/config.c index d6e1abaa1..78db03c68 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -691,11 +691,6 @@ static const config_var_t testing_tor_network_defaults[] = { #undef OBSOLETE static const config_deprecation_t option_deprecation_notes_[] = { - /* Deprecated since 0.2.9.2-alpha... */ - { "AllowDotExit", "Unrestricted use of the .exit notation can be used for " - "a wide variety of application-level attacks." }, - /* End of options deprecated since 0.2.9.2-alpha. */ - /* Deprecated since 0.3.2.0-alpha. */ { "HTTPProxy", "It only applies to direct unencrypted HTTP connections " "to your directory server, which your Tor probably wasn't using." },

1 0

[tor/release-0.3.2] Re-remove AllowDotExit deprecation.
by nickm＠torproject.org 09 Nov '17

09 Nov '17

commit 40c64f45f04a7cc1ec0149b6c8e8805fba9a2259 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Nov 9 07:58:27 2017 -0500 Re-remove AllowDotExit deprecation. This was accidentally reintroduced in 5a46074e55. It should be harmless, though: the option is obsolete, so calling it deprecated is redundant. --- src/or/config.c | 5 ----- 1 file changed, 5 deletions(-) diff --git a/src/or/config.c b/src/or/config.c index d6e1abaa1..78db03c68 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -691,11 +691,6 @@ static const config_var_t testing_tor_network_defaults[] = { #undef OBSOLETE static const config_deprecation_t option_deprecation_notes_[] = { - /* Deprecated since 0.2.9.2-alpha... */ - { "AllowDotExit", "Unrestricted use of the .exit notation can be used for " - "a wide variety of application-level attacks." }, - /* End of options deprecated since 0.2.9.2-alpha. */ - /* Deprecated since 0.3.2.0-alpha. */ { "HTTPProxy", "It only applies to direct unencrypted HTTP connections " "to your directory server, which your Tor probably wasn't using." },

1 0

[tor/release-0.3.2] Merge branch 'maint-0.3.2' into release-0.3.2
by nickm＠torproject.org 09 Nov '17

09 Nov '17

commit 57deb20f357eac5fe0a8467d6dd8ef9a10050808 Merge: 7cbda1181 40c64f45f Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Nov 9 08:02:36 2017 -0500 Merge branch 'maint-0.3.2' into release-0.3.2 src/or/config.c | 5 ----- 1 file changed, 5 deletions(-)

1 0

[tor/master] Merge branch 'maint-0.3.2'
by nickm＠torproject.org 09 Nov '17

09 Nov '17

commit ce3d5da0d20361dbcaf0c5bc277d95e6706cd955 Merge: 23820a394 40c64f45f Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Nov 9 08:02:36 2017 -0500 Merge branch 'maint-0.3.2' src/or/config.c | 5 ----- 1 file changed, 5 deletions(-)

1 0

[tor/maint-0.3.2] Re-remove AllowDotExit deprecation.
by nickm＠torproject.org 09 Nov '17

09 Nov '17

commit 40c64f45f04a7cc1ec0149b6c8e8805fba9a2259 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Nov 9 07:58:27 2017 -0500 Re-remove AllowDotExit deprecation. This was accidentally reintroduced in 5a46074e55. It should be harmless, though: the option is obsolete, so calling it deprecated is redundant. --- src/or/config.c | 5 ----- 1 file changed, 5 deletions(-) diff --git a/src/or/config.c b/src/or/config.c index d6e1abaa1..78db03c68 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -691,11 +691,6 @@ static const config_var_t testing_tor_network_defaults[] = { #undef OBSOLETE static const config_deprecation_t option_deprecation_notes_[] = { - /* Deprecated since 0.2.9.2-alpha... */ - { "AllowDotExit", "Unrestricted use of the .exit notation can be used for " - "a wide variety of application-level attacks." }, - /* End of options deprecated since 0.2.9.2-alpha. */ - /* Deprecated since 0.3.2.0-alpha. */ { "HTTPProxy", "It only applies to direct unencrypted HTTP connections " "to your directory server, which your Tor probably wasn't using." },

1 0

[translation/whisperback_completed] Update translations for whisperback_completed
by translation＠torproject.org 09 Nov '17

09 Nov '17

commit d3c64a584b8edcb930f05ec5d0861c4a4a3a757e Author: Translation commit bot <translation(a)torproject.org> Date: Thu Nov 9 12:15:32 2017 +0000 Update translations for whisperback_completed --- ru/ru.po | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ru/ru.po b/ru/ru.po index a61fbe9f4..f42e45d68 100644 --- a/ru/ru.po +++ b/ru/ru.po @@ -15,7 +15,7 @@ msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: \n" "POT-Creation-Date: 2017-03-20 12:09+0000\n" -"PO-Revision-Date: 2017-09-19 11:41+0000\n" +"PO-Revision-Date: 2017-11-09 11:56+0000\n" "Last-Translator: Andrey\n" "Language-Team: Russian (http://www.transifex.com/otf/torproject/language/ru/)\n" "MIME-Version: 1.0\n"

1 0

[translation/whisperback] Update translations for whisperback
by translation＠torproject.org 09 Nov '17

09 Nov '17

commit 8ee3833c32833843f6e1e316b58cc038680e5d22 Author: Translation commit bot <translation(a)torproject.org> Date: Thu Nov 9 12:15:24 2017 +0000 Update translations for whisperback --- ru/ru.po | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ru/ru.po b/ru/ru.po index a61fbe9f4..f42e45d68 100644 --- a/ru/ru.po +++ b/ru/ru.po @@ -15,7 +15,7 @@ msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: \n" "POT-Creation-Date: 2017-03-20 12:09+0000\n" -"PO-Revision-Date: 2017-09-19 11:41+0000\n" +"PO-Revision-Date: 2017-11-09 11:56+0000\n" "Last-Translator: Andrey\n" "Language-Team: Russian (http://www.transifex.com/otf/torproject/language/ru/)\n" "MIME-Version: 1.0\n"

1 0

[tor-browser-build/master] Bug 20636: remove fte from bridge_prefs.js for Windows 64
by gk＠torproject.org 09 Nov '17

09 Nov '17

commit 3c517c1a36a4e9f1251679fc4c129569a874be76 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Thu Nov 9 11:18:18 2017 +0100 Bug 20636: remove fte from bridge_prefs.js for Windows 64 --- projects/tor-browser/build | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/projects/tor-browser/build b/projects/tor-browser/build index f9740f7..022d6e9 100644 --- a/projects/tor-browser/build +++ b/projects/tor-browser/build @@ -118,7 +118,10 @@ cat Bundle-Data/PTConfigs/[% bundledata_osname %]/torrc-defaults-appendix >> $TB [% END -%] [% IF c("var/windows") -%] # We don't have snowflake available on Windows yet - grep -v 'default_bridge\.snowflake' Bundle-Data/PTConfigs/bridge_prefs.js >> $TBDIR/$EXTOVERRIDESPATH + # We don't have fte available on Windows x86_64 yet + grep -v 'default_bridge\.snowflake' Bundle-Data/PTConfigs/bridge_prefs.js \ + [% IF c("var/windows-x86_64") %]| grep -v 'default_bridge\.fte' [% END %] \ + >> $TBDIR/$EXTOVERRIDESPATH [% END -%] [% IF c("var/osx") -%] # FTE is temporarily removed due to bug 18495.

1 0

[tor-browser/tor-browser-52.4.1esr-7.5-1] Bug 24052: Handle redirects by blocking them early
by gk＠torproject.org 09 Nov '17

09 Nov '17

commit a99a3504e931768ce57dd26d3ae784576da7c5ac Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Wed Nov 1 02:33:18 2017 -0700 Bug 24052: Handle redirects by blocking them early This is the second part of the workaround for https://bugzilla.mozilla.org/show_bug.cgi?id=1412081. --- netwerk/protocol/http/nsHttpChannel.cpp | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/netwerk/protocol/http/nsHttpChannel.cpp b/netwerk/protocol/http/nsHttpChannel.cpp index 0e570e8cb57d..b38be48bf0c9 100644 --- a/netwerk/protocol/http/nsHttpChannel.cpp +++ b/netwerk/protocol/http/nsHttpChannel.cpp @@ -5419,6 +5419,13 @@ nsHttpChannel::AsyncProcessRedirection(uint32_t redirectType) return NS_ERROR_CORRUPTED_CONTENT; } + bool isRedirectToFile = false; + rv = mRedirectURI->SchemeIs("file", &isRedirectToFile); + if (!NS_FAILED(rv) && isRedirectToFile) { + LOG(("Attempted to redirect from a remote page to a file:// URI.")); + return NS_ERROR_FAILURE; + } + if (mApplicationCache) { // if we are redirected to a different origin check if there is a fallback // cache entry to fall back to. we don't care about file strict

1 0

[tor-browser/tor-browser-52.4.1esr-7.5-1] Bug 24052: Streamline handling of file:// resources
by gk＠torproject.org 09 Nov '17

09 Nov '17

commit c6e2b905b793c803c73b7d3e5a1a2926e34df8f2 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Oct 27 20:40:57 2017 +0000 Bug 24052: Streamline handling of file:// resources We should make sure restrictions regarding loading of file:// resources are adhered to more strictly, at least on *nix platforms. This is a workaround for https://bugzilla.mozilla.org/show_bug.cgi?id=1412081. --- netwerk/base/nsIOService.cpp | 8 ++++++++ netwerk/protocol/file/nsFileProtocolHandler.cpp | 7 +++++++ 2 files changed, 15 insertions(+) diff --git a/netwerk/base/nsIOService.cpp b/netwerk/base/nsIOService.cpp index 0da79c18ae41..0cc67da7b18f 100644 --- a/netwerk/base/nsIOService.cpp +++ b/netwerk/base/nsIOService.cpp @@ -789,12 +789,20 @@ nsIOService::NewChannelFromURIWithProxyFlagsInternal(nsIURI* aURI, // if calling newChannel2() fails we try to fall back to // creating a new channel by calling NewChannel(). if (NS_FAILED(rv)) { +#ifdef XP_UNIX + if (rv == NS_ERROR_FILE_TARGET_DOES_NOT_EXIST) { + return rv; + } else { +#endif rv = handler->NewChannel(aURI, getter_AddRefs(channel)); NS_ENSURE_SUCCESS(rv, rv); // The protocol handler does not implement NewChannel2, so // maybe we need to wrap the channel (see comment in MaybeWrap // function). channel = nsSecCheckWrapChannel::MaybeWrap(channel, aLoadInfo); +#ifdef XP_UNIX + } +#endif } } diff --git a/netwerk/protocol/file/nsFileProtocolHandler.cpp b/netwerk/protocol/file/nsFileProtocolHandler.cpp index e55cb9d47460..c24c928b6f02 100644 --- a/netwerk/protocol/file/nsFileProtocolHandler.cpp +++ b/netwerk/protocol/file/nsFileProtocolHandler.cpp @@ -188,6 +188,13 @@ nsFileProtocolHandler::NewChannel2(nsIURI* uri, nsILoadInfo* aLoadInfo, nsIChannel** result) { +#ifdef XP_UNIX + if (aLoadInfo && aLoadInfo->TriggeringPrincipal()) { + if (aLoadInfo->TriggeringPrincipal()->GetIsCodebasePrincipal()) { + return NS_ERROR_FILE_TARGET_DOES_NOT_EXIST; + } + } +#endif nsFileChannel *chan = new nsFileChannel(uri); if (!chan) return NS_ERROR_OUT_OF_MEMORY;

1 0