February 2022 - tor-commits - lists.torproject.org

[tor-browser/geckoview-96.0-11.5-1] Bug 40025: Remove Mozilla add-on install permissions
by sysrqb＠torproject.org 17 Feb '22

17 Feb '22

commit 1083af729a2e772a80c5aea0a2fcc8771733fc28 Author: Alex Catarineu <acat(a)torproject.org> Date: Mon Jul 27 18:12:55 2020 +0200 Bug 40025: Remove Mozilla add-on install permissions --- browser/app/permissions | 5 ----- 1 file changed, 5 deletions(-) diff --git a/browser/app/permissions b/browser/app/permissions index b75b839e366b..d8439d49346b 100644 --- a/browser/app/permissions +++ b/browser/app/permissions @@ -12,11 +12,6 @@ origin uitour 1 https://duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion/ origin uitour 1 about:tor -# XPInstall -origin install 1 https://addons.mozilla.org - # Remote troubleshooting origin remote-troubleshooting 1 https://support.mozilla.org -# addon install -origin install 1 https://fpn.firefox.com

1 0

[tor-browser/geckoview-96.0-11.5-1] Bug 40073: Disable remote Public Suffix List fetching
by sysrqb＠torproject.org 17 Feb '22

17 Feb '22

commit 7d25fbb0c59c5988cef1d931b4a5c46cf2724fee Author: Alex Catarineu <acat(a)torproject.org> Date: Thu Aug 13 11:05:03 2020 +0200 Bug 40073: Disable remote Public Suffix List fetching In https://bugzilla.mozilla.org/show_bug.cgi?id=1563246 Firefox implemented fetching the Public Suffix List via RemoteSettings and replacing the default one at runtime, which we do not want. --- browser/components/BrowserGlue.jsm | 5 ----- 1 file changed, 5 deletions(-) diff --git a/browser/components/BrowserGlue.jsm b/browser/components/BrowserGlue.jsm index 55d2c642f297..0ecd899127f4 100644 --- a/browser/components/BrowserGlue.jsm +++ b/browser/components/BrowserGlue.jsm @@ -69,7 +69,6 @@ XPCOMUtils.defineLazyModuleGetters(this, { PluralForm: "resource://gre/modules/PluralForm.jsm", PrivateBrowsingUtils: "resource://gre/modules/PrivateBrowsingUtils.jsm", ProcessHangMonitor: "resource:///modules/ProcessHangMonitor.jsm", - PublicSuffixList: "resource://gre/modules/netwerk-dns/PublicSuffixList.jsm", RemoteSettings: "resource://services-settings/remote-settings.js", RemoteSecuritySettings: "resource://gre/modules/psm/RemoteSecuritySettings.jsm", @@ -2789,10 +2788,6 @@ BrowserGlue.prototype = { this._addBreachesSyncHandler(); }, - () => { - PublicSuffixList.init(); - }, - () => { RemoteSecuritySettings.init(); },

1 0

[tor-browser/geckoview-96.0-11.5-1] Bug 40091: Load HTTPS Everywhere as a builtin addon in desktop
by sysrqb＠torproject.org 17 Feb '22

17 Feb '22

commit 7fb2ab5ebc10b16bf703bdf4761067c73acc7c00 Author: Alex Catarineu <acat(a)torproject.org> Date: Fri Sep 4 12:34:35 2020 +0200 Bug 40091: Load HTTPS Everywhere as a builtin addon in desktop This loads HTTPS Everywhere as a builtin addon from a hardcoded resource:// URI in desktop. It also ensures that the non-builtin HTTPS Everywhere addon is always uninstalled on browser startup. The reason of making this desktop-only is that there are some issues when installing a builtin extension from geckoview side, making the extension not available on first startup. So, at least for now we handle the Fenix case separately. See #40118 for a followup for investigating these. --- browser/components/BrowserGlue.jsm | 37 ++++++++++++++++++++++ toolkit/components/extensions/Extension.jsm | 10 ++++-- .../mozapps/extensions/internal/XPIProvider.jsm | 13 ++++++++ 3 files changed, 57 insertions(+), 3 deletions(-) diff --git a/browser/components/BrowserGlue.jsm b/browser/components/BrowserGlue.jsm index 0ecd899127f4..0bad95f5389c 100644 --- a/browser/components/BrowserGlue.jsm +++ b/browser/components/BrowserGlue.jsm @@ -44,6 +44,7 @@ XPCOMUtils.defineLazyModuleGetters(this, { DownloadsViewableInternally: "resource:///modules/DownloadsViewableInternally.jsm", E10SUtils: "resource://gre/modules/E10SUtils.jsm", + ExtensionData: "resource://gre/modules/Extension.jsm", ExtensionsUI: "resource:///modules/ExtensionsUI.jsm", FeatureGate: "resource://featuregates/FeatureGate.jsm", FxAccounts: "resource://gre/modules/FxAccounts.jsm", @@ -121,6 +122,13 @@ XPCOMUtils.defineLazyServiceGetters(this, { PushService: ["@mozilla.org/push/Service;1", "nsIPushService"], }); +XPCOMUtils.defineLazyServiceGetters(this, { + resProto: [ + "@mozilla.org/network/protocol;1?name=resource", + "nsISubstitutingProtocolHandler", + ], +}); + const PREF_PDFJS_ISDEFAULT_CACHE_STATE = "pdfjs.enabledCache.state"; const PREF_DFPI_ENABLED_BY_DEFAULT = "privacy.restrict3rdpartystorage.rollout.enabledByDefault"; @@ -1323,6 +1331,35 @@ BrowserGlue.prototype = { BuiltInThemes.maybeInstallActiveBuiltInTheme(); + // Install https-everywhere builtin addon if needed. + (async () => { + const HTTPS_EVERYWHERE_ID = "https-everywhere-eff(a)eff.org"; + const HTTPS_EVERYWHERE_BUILTIN_URL = + "resource://torbutton/content/extensions/https-everywhere/"; + // This does something similar as GeckoViewWebExtension.jsm: it tries + // to load the manifest to retrieve the version of the builtin and + // compares it to the currently installed one to see whether we need + // to install or not. Here we delegate that to + // AddonManager.maybeInstallBuiltinAddon. + try { + const resolvedURI = Services.io.newURI( + resProto.resolveURI(Services.io.newURI(HTTPS_EVERYWHERE_BUILTIN_URL)) + ); + const extensionData = new ExtensionData(resolvedURI); + const manifest = await extensionData.loadManifest(); + + await AddonManager.maybeInstallBuiltinAddon( + HTTPS_EVERYWHERE_ID, + manifest.version, + HTTPS_EVERYWHERE_BUILTIN_URL + ); + } catch (e) { + const log = Log.repository.getLogger("HttpsEverywhereBuiltinLoader"); + log.addAppender(new Log.ConsoleAppender(new Log.BasicFormatter())); + log.error("Could not install https-everywhere extension", e); + } + })(); + if (AppConstants.MOZ_NORMANDY) { Normandy.init(); } diff --git a/toolkit/components/extensions/Extension.jsm b/toolkit/components/extensions/Extension.jsm index c04ac3914b82..1cf787225d2f 100644 --- a/toolkit/components/extensions/Extension.jsm +++ b/toolkit/components/extensions/Extension.jsm @@ -262,6 +262,7 @@ const LOGGER_ID_BASE = "addons.webextension."; const UUID_MAP_PREF = "extensions.webextensions.uuids"; const LEAVE_STORAGE_PREF = "extensions.webextensions.keepStorageOnUninstall"; const LEAVE_UUID_PREF = "extensions.webextensions.keepUuidOnUninstall"; +const PERSISTENT_EXTENSIONS = new Set(["https-everywhere-eff(a)eff.org"]); const COMMENT_REGEXP = new RegExp( String.raw` @@ -410,7 +411,8 @@ var ExtensionAddonObserver = { ServiceWorkerCleanUp.removeFromPrincipal(principal) ); - if (!Services.prefs.getBoolPref(LEAVE_STORAGE_PREF, false)) { + if (!Services.prefs.getBoolPref(LEAVE_STORAGE_PREF, false) && + !PERSISTENT_EXTENSIONS.has(addon.id)) { // Clear browser.storage.local backends. AsyncShutdown.profileChangeTeardown.addBlocker( `Clear Extension Storage ${addon.id} (File Backend)`, @@ -458,7 +460,8 @@ var ExtensionAddonObserver = { ExtensionPermissions.removeAll(addon.id); - if (!Services.prefs.getBoolPref(LEAVE_UUID_PREF, false)) { + if (!Services.prefs.getBoolPref(LEAVE_UUID_PREF, false) && + !PERSISTENT_EXTENSIONS.has(addon.id)) { // Clear the entry in the UUID map UUIDMap.remove(addon.id); } @@ -2697,7 +2700,8 @@ class Extension extends ExtensionData { ); } else if ( this.startupReason === "ADDON_INSTALL" && - !Services.prefs.getBoolPref(LEAVE_STORAGE_PREF, false) + !Services.prefs.getBoolPref(LEAVE_STORAGE_PREF, false) && + !PERSISTENT_EXTENSIONS.has(this.id) ) { // If the extension has been just installed, set it as migrated, // because there will not be any data to migrate. diff --git a/toolkit/mozapps/extensions/internal/XPIProvider.jsm b/toolkit/mozapps/extensions/internal/XPIProvider.jsm index f243b4e04e51..0e3ec04ae208 100644 --- a/toolkit/mozapps/extensions/internal/XPIProvider.jsm +++ b/toolkit/mozapps/extensions/internal/XPIProvider.jsm @@ -1501,6 +1501,19 @@ var XPIStates = { continue; } + // Uninstall HTTPS Everywhere if it is installed in the user profile. + if ( + id === "https-everywhere-eff(a)eff.org" && + loc.name === KEY_APP_PROFILE + ) { + logger.debug( + "Uninstalling the HTTPS Everywhere extension from user profile." + ); + loc.installer.uninstallAddon(id); + changed = true; + continue; + } + let xpiState = loc.get(id); if (!xpiState) { // If the location is not supported for sideloading, skip new

1 0

[tor-browser/geckoview-96.0-11.5-1] Bug 40166: Disable security.certerrors.mitm.auto_enable_enterprise_roots
by sysrqb＠torproject.org 17 Feb '22

17 Feb '22

commit ba87a588dfef5c493dbe30c4b851f2b1fd712766 Author: Alex Catarineu <acat(a)torproject.org> Date: Fri Oct 9 12:55:35 2020 +0200 Bug 40166: Disable security.certerrors.mitm.auto_enable_enterprise_roots --- browser/app/profile/000-tor-browser.js | 3 +++ browser/components/BrowserGlue.jsm | 14 ++++++++++++++ 2 files changed, 17 insertions(+) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 6c1d617256c2..cc716dd5a6b7 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -311,6 +311,9 @@ pref("security.enterprise_roots.enabled", false); // Don't ping Mozilla for MitM detection, see bug 32321 pref("security.certerrors.mitm.priming.enabled", false); +// Don't automatically enable enterprise roots, see bug 40166 +pref("security.certerrors.mitm.auto_enable_enterprise_roots", false); + // Disable the language pack signing check for now on macOS, see #31942 #ifdef XP_MACOSX pref("extensions.langpacks.signatures.required", false); diff --git a/browser/components/BrowserGlue.jsm b/browser/components/BrowserGlue.jsm index 0bad95f5389c..756a4b23dfee 100644 --- a/browser/components/BrowserGlue.jsm +++ b/browser/components/BrowserGlue.jsm @@ -1321,6 +1321,20 @@ BrowserGlue.prototype = { // handle any UI migration this._migrateUI(); + // Clear possibly auto enabled enterprise_roots prefs (see bug 40166) + if ( + !Services.prefs.getBoolPref( + "security.certerrors.mitm.auto_enable_enterprise_roots" + ) && + Services.prefs.getBoolPref( + "security.enterprise_roots.auto-enabled", + false + ) + ) { + Services.prefs.clearUserPref("security.enterprise_roots.enabled"); + Services.prefs.clearUserPref("security.enterprise_roots.auto-enabled"); + } + if (!Services.prefs.prefHasUserValue(PREF_PDFJS_ISDEFAULT_CACHE_STATE)) { PdfJs.checkIsDefault(this._isNewProfile); }

1 0

[tor-browser/geckoview-96.0-11.5-1] Bug 40199: Avoid using system locale for intl.accept_languages in GeckoView
by sysrqb＠torproject.org 17 Feb '22

17 Feb '22

commit b1dd7d1010b943e2d99b6fe917e0ae9cc496d15c Author: Alex Catarineu <acat(a)torproject.org> Date: Tue Oct 20 17:44:36 2020 +0200 Bug 40199: Avoid using system locale for intl.accept_languages in GeckoView --- .../mozilla/geckoview/GeckoRuntimeSettings.java | 28 +++++++++++++--------- 1 file changed, 17 insertions(+), 11 deletions(-) diff --git a/mobile/android/geckoview/src/main/java/org/mozilla/geckoview/GeckoRuntimeSettings.java b/mobile/android/geckoview/src/main/java/org/mozilla/geckoview/GeckoRuntimeSettings.java index f7a5524948e6..8786ac593411 100644 --- a/mobile/android/geckoview/src/main/java/org/mozilla/geckoview/GeckoRuntimeSettings.java +++ b/mobile/android/geckoview/src/main/java/org/mozilla/geckoview/GeckoRuntimeSettings.java @@ -809,19 +809,25 @@ public final class GeckoRuntimeSettings extends RuntimeSettings { private String computeAcceptLanguages() { final ArrayList<String> locales = new ArrayList<String>(); - // Explicitly-set app prefs come first: - if (mRequestedLocales != null) { - for (final String locale : mRequestedLocales) { - locales.add(locale.toLowerCase(Locale.ROOT)); - } - } - // OS prefs come second: - for (final String locale : getDefaultLocales()) { - final String localeLowerCase = locale.toLowerCase(Locale.ROOT); - if (!locales.contains(localeLowerCase)) { - locales.add(localeLowerCase); + // In Desktop, these are defined in the `intl.accept_languages` localized property. + // At some point we should probably use the same values here, but for now we use a simple + // strategy which will hopefully result in reasonable acceptLanguage values. + if (mRequestedLocales != null && mRequestedLocales.length > 0) { + String locale = mRequestedLocales[0].toLowerCase(Locale.ROOT); + // No need to include `en-us` twice. + if (!locale.equals("en-us")) { + locales.add(locale); + if (locale.contains("-")) { + String lang = locale.split("-")[0]; + // No need to include `en` twice. + if (!lang.equals("en")) { + locales.add(lang); + } + } } } + locales.add("en-us"); + locales.add("en"); return TextUtils.join(",", locales); }

1 0

[tor-browser/geckoview-96.0-11.5-1] squash! Bug 10760: Integrate TorButton to TorBrowser core
by sysrqb＠torproject.org 17 Feb '22

17 Feb '22

commit 9849fec97bda7d1c1b40ade323d0b5228661218a Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Thu Dec 9 20:46:55 2021 +0000 squash! Bug 10760: Integrate TorButton to TorBrowser core Bug 40741: Bring back MessageChannel module --- toolkit/components/extensions/moz.build | 1 + 1 file changed, 1 insertion(+) diff --git a/toolkit/components/extensions/moz.build b/toolkit/components/extensions/moz.build index 2c5e91a2b4e2..ead79d6248c7 100755 --- a/toolkit/components/extensions/moz.build +++ b/toolkit/components/extensions/moz.build @@ -35,6 +35,7 @@ EXTRA_JS_MODULES += [ "ExtensionWorkerChild.jsm", "FindContent.jsm", "MatchURLFilters.jsm", + "MessageChannel.jsm", "MessageManagerProxy.jsm", "NativeManifests.jsm", "NativeMessaging.jsm",

1 0

[tor-browser/geckoview-96.0-11.5-1] Bug 30605: Honor privacy.spoof_english in Android
by sysrqb＠torproject.org 17 Feb '22

17 Feb '22

commit 3be7a9ae2192f74f63ae616b9c0052a686f2c222 Author: Alex Catarineu <acat(a)torproject.org> Date: Fri Oct 16 10:45:17 2020 +0200 Bug 30605: Honor privacy.spoof_english in Android This checks `privacy.spoof_english` whenever `setLocales` is called from Fenix side and sets `intl.accept_languages` accordingly. --- mobile/android/components/geckoview/GeckoViewStartup.jsm | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/mobile/android/components/geckoview/GeckoViewStartup.jsm b/mobile/android/components/geckoview/GeckoViewStartup.jsm index d5969bbd1b45..0176c1d52ca4 100644 --- a/mobile/android/components/geckoview/GeckoViewStartup.jsm +++ b/mobile/android/components/geckoview/GeckoViewStartup.jsm @@ -17,6 +17,7 @@ XPCOMUtils.defineLazyModuleGetters(this, { EventDispatcher: "resource://gre/modules/Messaging.jsm", Preferences: "resource://gre/modules/Preferences.jsm", Services: "resource://gre/modules/Services.jsm", + RFPHelper: "resource://gre/modules/RFPHelper.jsm", }); const { debug, warn } = GeckoViewUtils.initLogging("Startup"); @@ -236,6 +237,10 @@ class GeckoViewStartup { if (aData.requestedLocales) { Services.locale.requestedLocales = aData.requestedLocales; } + RFPHelper._handleSpoofEnglishChanged(); + if (Services.prefs.getIntPref("privacy.spoof_english", 0) === 2) { + break; + } const pls = Cc["@mozilla.org/pref-localizedstring;1"].createInstance( Ci.nsIPrefLocalizedString );

1 0

[tor-browser/geckoview-96.0-11.5-1] fixup! TB3: Tor Browser's official .mozconfigs.
by sysrqb＠torproject.org 17 Feb '22

17 Feb '22

commit c025288dbe5b2cc1280f9f2e192e395217659310 Author: Pier Angelo Vendrame <pierov(a)torproject.org> Date: Wed Jan 26 15:23:42 2022 +0100 fixup! TB3: Tor Browser's official .mozconfigs. This fixes bug #40793. --- build/moz.configure/old.configure | 5 --- moz.configure | 81 +++++++++++++++++++++++++++++++++++++++ old-configure.in | 49 ----------------------- 3 files changed, 81 insertions(+), 54 deletions(-) diff --git a/build/moz.configure/old.configure b/build/moz.configure/old.configure index 5c144e5c8b45..e3974613d6a1 100644 --- a/build/moz.configure/old.configure +++ b/build/moz.configure/old.configure @@ -122,11 +122,6 @@ def old_configure_options(*options): "--with-user-appdir", "--x-includes", "--x-libraries", - # Tor additions. - "--with-tor-browser-version", - "--enable-tor-browser-update", - "--enable-tor-browser-data-outside-app-dir", - "--enable-tor-launcher", ) def prepare_configure_options(host, target, all_options, *options): # old-configure only supports the options listed in @old_configure_options diff --git a/moz.configure b/moz.configure index 3d742a890443..d769e09f18c8 100755 --- a/moz.configure +++ b/moz.configure @@ -1136,6 +1136,87 @@ set_config("MOZ_SYSTEM_ZLIB", True, when="--with-system-zlib") add_old_configure_assignment("MOZ_SYSTEM_ZLIB", True, when="--with-system-zlib") +# Tor additions. + +option( + "--with-tor-browser-version", + nargs=1, + help="Set Tor Browser version, e.g., 7.0a1" +) + + +@depends("--with-tor-browser-version") +def tor_browser_version(value): + if not value: + die("--with-tor-browser-version is required for Tor Browser.") + return value[0] + + +@depends("--with-tor-browser-version") +def tor_browser_version_quoted(value): + if not value: + die("--with-tor-browser-version is required for Tor Browser.") + return '"{}"'.format(value[0]) + + +set_config("TOR_BROWSER_VERSION", tor_browser_version) +set_define("TOR_BROWSER_VERSION", tor_browser_version) +set_define("TOR_BROWSER_VERSION_QUOTED", tor_browser_version_quoted) + + +option( + "--enable-tor-browser-update", + help="Enable Tor Browser update" +) + + +@depends("--enable-tor-browser-update") +def tor_browser_update(value): + if value: + return True + + +set_config("TOR_BROWSER_UPDATE", tor_browser_update) +set_define("TOR_BROWSER_UPDATE", tor_browser_update) +add_old_configure_assignment("TOR_BROWSER_UPDATE", tor_browser_update) + + +option( + "--enable-tor-browser-data-outside-app-dir", + help="Enable Tor Browser data outside of app directory" +) + + +@depends("--enable-tor-browser-data-outside-app-dir") +def tor_browser_data_outside_app_dir(value): + if value: + return True + + +set_define( + "TOR_BROWSER_DATA_OUTSIDE_APP_DIR", tor_browser_data_outside_app_dir) +add_old_configure_assignment( + "TOR_BROWSER_DATA_OUTSIDE_APP_DIR", tor_browser_data_outside_app_dir) + + +option( + "--disable-tor-launcher", + help="Do not include Tor Launcher" +) + + +@depends("--disable-tor-launcher") +def tor_browser_disable_launcher(value): + if not value: + return True + + +set_config("TOR_BROWSER_DISABLE_TOR_LAUNCHER", tor_browser_disable_launcher) +set_define("TOR_BROWSER_DISABLE_TOR_LAUNCHER", tor_browser_disable_launcher) +add_old_configure_assignment( + "TOR_BROWSER_DISABLE_TOR_LAUNCHER", tor_browser_disable_launcher) + + # Please do not add configure checks from here on. # Fallthrough to autoconf-based configure diff --git a/old-configure.in b/old-configure.in index ebeb62640acd..d1479574d1c7 100644 --- a/old-configure.in +++ b/old-configure.in @@ -1808,55 +1808,6 @@ if test -n "$MOZ_UPDATER"; then AC_DEFINE(MOZ_UPDATER) fi -dnl ======================================================== -dnl Tor additions -dnl ======================================================== -MOZ_ARG_WITH_STRING(tor-browser-version, -[ --with-tor-browser-version=VERSION - Set Tor Browser version, e.g., 7.0a1], - TOR_BROWSER_VERSION="$withval") - -if test -z "$TOR_BROWSER_VERSION"; then - AC_MSG_ERROR([--with-tor-browser-version is required for Tor Browser.]) -fi - -MOZ_ARG_ENABLE_BOOL(tor-browser-update, -[ --enable-tor-browser-update - Enable Tor Browser update], - TOR_BROWSER_UPDATE=1, - TOR_BROWSER_UPDATE= ) - -if test -n "$TOR_BROWSER_UPDATE"; then - AC_DEFINE(TOR_BROWSER_UPDATE) -fi - -MOZ_ARG_ENABLE_BOOL(tor-browser-data-outside-app-dir, -[ --enable-tor-browser-data-outside-app-dir - Enable Tor Browser data outside of app directory], - TOR_BROWSER_DATA_OUTSIDE_APP_DIR=1, - TOR_BROWSER_DATA_OUTSIDE_APP_DIR= ) - -if test -n "$TOR_BROWSER_DATA_OUTSIDE_APP_DIR"; then - AC_DEFINE(TOR_BROWSER_DATA_OUTSIDE_APP_DIR) -fi - -AC_DEFINE_UNQUOTED(TOR_BROWSER_VERSION,$TOR_BROWSER_VERSION) -AC_DEFINE_UNQUOTED(TOR_BROWSER_VERSION_QUOTED,"$TOR_BROWSER_VERSION") -AC_SUBST(TOR_BROWSER_UPDATE) -AC_SUBST(TOR_BROWSER_DATA_OUTSIDE_APP_DIR) - -MOZ_ARG_DISABLE_BOOL(tor-launcher, -[ --disable-tor-launcher - Do not include Tor Launcher], - TOR_BROWSER_DISABLE_TOR_LAUNCHER=1, - TOR_BROWSER_DISABLE_TOR_LAUNCHER=) - -if test -n "$TOR_BROWSER_DISABLE_TOR_LAUNCHER"; then - AC_DEFINE(TOR_BROWSER_DISABLE_TOR_LAUNCHER) -fi - -AC_SUBST(TOR_BROWSER_DISABLE_TOR_LAUNCHER) - dnl ======================================================== dnl parental controls (for Windows Vista) dnl ========================================================

1 0

[tor-browser/geckoview-96.0-11.5-1] Bug 40125: Expose Security Level pref in GeckoView
by sysrqb＠torproject.org 17 Feb '22

17 Feb '22

commit d53a33f41d8e1e14e339390907d2c4eef4083f2f Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Mon Sep 14 02:52:28 2020 +0000 Bug 40125: Expose Security Level pref in GeckoView --- mobile/android/geckoview/api.txt | 3 ++ .../mozilla/geckoview/GeckoRuntimeSettings.java | 32 ++++++++++++++++++++++ 2 files changed, 35 insertions(+) diff --git a/mobile/android/geckoview/api.txt b/mobile/android/geckoview/api.txt index 90cabf5f22fe..7c926aacedcd 100644 --- a/mobile/android/geckoview/api.txt +++ b/mobile/android/geckoview/api.txt @@ -726,6 +726,7 @@ package org.mozilla.geckoview { method @Nullable public GeckoRuntime getRuntime(); method @Nullable public Rect getScreenSizeOverride(); method @Nullable public RuntimeTelemetry.Delegate getTelemetryDelegate(); + method public int getTorSecurityLevel(); method public boolean getUseMaxScreenDepth(); method public boolean getWebFontsEnabled(); method public boolean getWebManifestEnabled(); @@ -746,6 +747,7 @@ package org.mozilla.geckoview { method @NonNull public GeckoRuntimeSettings setLoginAutofillEnabled(boolean); method @NonNull public GeckoRuntimeSettings setPreferredColorScheme(int); method @NonNull public GeckoRuntimeSettings setRemoteDebuggingEnabled(boolean); + method @NonNull public GeckoRuntimeSettings setTorSecurityLevel(int); method @NonNull public GeckoRuntimeSettings setWebFontsEnabled(boolean); method @NonNull public GeckoRuntimeSettings setWebManifestEnabled(boolean); field public static final int ALLOW_ALL = 0; @@ -787,6 +789,7 @@ package org.mozilla.geckoview { method @NonNull public GeckoRuntimeSettings.Builder remoteDebuggingEnabled(boolean); method @NonNull public GeckoRuntimeSettings.Builder screenSizeOverride(int, int); method @NonNull public GeckoRuntimeSettings.Builder telemetryDelegate(@NonNull RuntimeTelemetry.Delegate); + method @NonNull public GeckoRuntimeSettings.Builder torSecurityLevel(int); method @NonNull public GeckoRuntimeSettings.Builder useMaxScreenDepth(boolean); method @NonNull public GeckoRuntimeSettings.Builder webFontsEnabled(boolean); method @NonNull public GeckoRuntimeSettings.Builder webManifest(boolean); diff --git a/mobile/android/geckoview/src/main/java/org/mozilla/geckoview/GeckoRuntimeSettings.java b/mobile/android/geckoview/src/main/java/org/mozilla/geckoview/GeckoRuntimeSettings.java index 6ce46ca83fd9..f7a5524948e6 100644 --- a/mobile/android/geckoview/src/main/java/org/mozilla/geckoview/GeckoRuntimeSettings.java +++ b/mobile/android/geckoview/src/main/java/org/mozilla/geckoview/GeckoRuntimeSettings.java @@ -470,6 +470,17 @@ public final class GeckoRuntimeSettings extends RuntimeSettings { getSettings().setAllowInsecureConnections(level); return this; } + + /** + * Set security level. + * + * @param level A value determining the security level. Default is 0. + * @return This Builder instance. + */ + public @NonNull Builder torSecurityLevel(final int level) { + getSettings().mTorSecurityLevel.set(level); + return this; + } } private GeckoRuntime mRuntime; @@ -518,6 +529,7 @@ public final class GeckoRuntimeSettings extends RuntimeSettings { /* package */ final Pref<Boolean> mHttpsOnlyPrivateMode = new Pref<Boolean>("dom.security.https_only_mode_pbm", false); /* package */ final Pref<Integer> mProcessCount = new Pref<>("dom.ipc.processCount", 2); + /* package */ final Pref<Integer> mTorSecurityLevel = new Pref<>("extensions.torbutton.security_slider", 4); /* package */ int mPreferredColorScheme = COLOR_SCHEME_SYSTEM; @@ -1256,6 +1268,26 @@ public final class GeckoRuntimeSettings extends RuntimeSettings { return this; } + /** + * Gets the current security level. + * + * @return current security protection level + */ + public int getTorSecurityLevel() { + return mTorSecurityLevel.get(); + } + + /** + * Sets the Tor Security Level. + * + * @param level security protection level + * @return This GeckoRuntimeSettings instance. + */ + public @NonNull GeckoRuntimeSettings setTorSecurityLevel(final int level) { + mTorSecurityLevel.commit(level); + return this; + } + @Override // Parcelable public void writeToParcel(final Parcel out, final int flags) { super.writeToParcel(out, flags);

1 0

[tor-browser/geckoview-96.0-11.5-1] Bug 40171: Make WebRequest and GeckoWebExecutor First-Party aware
by sysrqb＠torproject.org 17 Feb '22

17 Feb '22

commit 5b77ae907bbd2bd05e64315bca136b28c0c6a525 Author: Alex Catarineu <acat(a)torproject.org> Date: Wed Nov 4 15:58:22 2020 +0100 Bug 40171: Make WebRequest and GeckoWebExecutor First-Party aware --- .../main/java/org/mozilla/geckoview/WebRequest.java | 18 ++++++++++++++++++ widget/android/WebExecutorSupport.cpp | 10 ++++++++++ 2 files changed, 28 insertions(+) diff --git a/mobile/android/geckoview/src/main/java/org/mozilla/geckoview/WebRequest.java b/mobile/android/geckoview/src/main/java/org/mozilla/geckoview/WebRequest.java index 17c4e1cd4f35..26c36b659c6f 100644 --- a/mobile/android/geckoview/src/main/java/org/mozilla/geckoview/WebRequest.java +++ b/mobile/android/geckoview/src/main/java/org/mozilla/geckoview/WebRequest.java @@ -43,6 +43,11 @@ public class WebRequest extends WebMessage { /** The value of the Referer header for this request. */ public final @Nullable String referrer; + /** + * The value of the origin of this request. + */ + public final @Nullable String origin; + @Retention(RetentionPolicy.SOURCE) @IntDef({ CACHE_MODE_DEFAULT, @@ -103,6 +108,7 @@ public class WebRequest extends WebMessage { method = builder.mMethod; cacheMode = builder.mCacheMode; referrer = builder.mReferrer; + origin = builder.mOrigin; if (builder.mBody != null) { body = builder.mBody.asReadOnlyBuffer(); @@ -117,6 +123,7 @@ public class WebRequest extends WebMessage { /* package */ String mMethod = "GET"; /* package */ int mCacheMode = CACHE_MODE_DEFAULT; /* package */ String mReferrer; + /* package */ String mOrigin; /** * Construct a Builder instance with the specified URI. @@ -215,6 +222,17 @@ public class WebRequest extends WebMessage { return this; } + /** + * Set the origin URI. + * + * @param origin A URI String + * @return This Builder instance. + */ + public @NonNull Builder origin(final @Nullable String origin) { + mOrigin = origin; + return this; + } + /** @return A {@link WebRequest} constructed with the values from this Builder instance. */ public @NonNull WebRequest build() { if (mUri == null) { diff --git a/widget/android/WebExecutorSupport.cpp b/widget/android/WebExecutorSupport.cpp index 966192fbfa49..05ae49e03797 100644 --- a/widget/android/WebExecutorSupport.cpp +++ b/widget/android/WebExecutorSupport.cpp @@ -390,6 +390,16 @@ nsresult WebExecutorSupport::CreateStreamLoader( MOZ_ASSERT(cookieJarSettings); nsCOMPtr<nsILoadInfo> loadInfo = channel->LoadInfo(); + + RefPtr<nsIURI> originUri; + const auto origin = req->Origin(); + if (origin) { + rv = NS_NewURI(getter_AddRefs(originUri), origin->ToString()); + NS_ENSURE_SUCCESS(rv, NS_ERROR_MALFORMED_URI); + OriginAttributes attrs = loadInfo->GetOriginAttributes(); + attrs.SetFirstPartyDomain(true, originUri); + loadInfo->SetOriginAttributes(attrs); + } loadInfo->SetCookieJarSettings(cookieJarSettings); // setup http/https specific things

1 0