tor-commits February 2023

tor-commits@lists.torproject.org

2 participants
149 discussions

[Git][tpo/applications/tor-browser][tor-browser-102.8.0esr-12.0-1] amend! Bug 8324: Prevent DNS proxy bypasses caused by Drag&Drop
by Richard Pospesel (＠richard) 15 Feb '23

15 Feb '23

Richard Pospesel pushed to branch tor-browser-102.8.0esr-12.0-1 at The Tor Project / Applications / Tor Browser Commits: 07121bec by hackademix at 2023-02-15T18:38:54+00:00 amend! Bug 8324: Prevent DNS proxy bypasses caused by Drag&Drop Bug 8324: Prevent DNS proxy bypasses caused by Drag&Drop Bug 41613: Skip Drang & Drop filtering for DNS-safe URLs - - - - - 1 changed file: - toolkit/torbutton/components/dragDropFilter.js Changes: ===================================== toolkit/torbutton/components/dragDropFilter.js ===================================== @@ -113,6 +113,25 @@ DragDropFilter.prototype = { for (let i = 0, count = aDataTransfer.mozItemCount; i < count; ++i) { this.logger.log(3, `Inspecting the data transfer: ${i}.`); const types = aDataTransfer.mozTypesAt(i); + const urlType = "text/x-moz-url"; + // Fallback url type, to be parsed by this browser but not externally + const INTERNAL_FALLBACK = "application/x-torbrowser-opaque"; + if (types.contains(urlType)) { + const links = aDataTransfer.mozGetDataAt(urlType, i); + // Skip DNS-safe URLs (no hostname, e.g. RFC 3966 tel:) + const mayLeakDNS = links.split("\n").some(link => { + try { + return new URL(link).hostname; + } catch (e) { + return false; + } + }); + if (!mayLeakDNS) { + continue; + } + const opaqueKey = OpaqueDrag.store(links, urlType); + aDataTransfer.mozSetDataAt(INTERNAL_FALLBACK, opaqueKey, i); + } for (const type of types) { this.logger.log(3, `Type is: ${type}.`); if (URLISH_TYPES.includes(type)) { @@ -120,14 +139,6 @@ DragDropFilter.prototype = { 3, `Removing transfer data ${aDataTransfer.mozGetDataAt(type, i)}` ); - const urlType = "text/x-moz-url"; - // Fallback url type, to be parsed by this browser but not externally - const INTERNAL_FALLBACK = "application/x-torbrowser-opaque"; - if (types.contains(urlType)) { - const link = aDataTransfer.mozGetDataAt(urlType, i); - const opaqueKey = OpaqueDrag.store(link, urlType); - aDataTransfer.mozSetDataAt(INTERNAL_FALLBACK, opaqueKey, i); - } for (const type of types) { if ( type !== INTERNAL_FALLBACK && View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/07121be… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/07121be… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-102.8.0esr-12.0-1] Bug 41603: Customize the creation of MOZ_SOURCE_URL
by Richard Pospesel (＠richard) 15 Feb '23

15 Feb '23

Richard Pospesel pushed to branch tor-browser-102.8.0esr-12.0-1 at The Tor Project / Applications / Tor Browser Commits: f6e9971c by Pier Angelo Vendrame at 2023-02-15T18:21:39+00:00 Bug 41603: Customize the creation of MOZ_SOURCE_URL MOZ_SOURCE_URL is created by combining MOZ_SOURCE_REPO and MOZ_SOURCE_CHANGESET. But the code takes for granted that it refers to a Hg instance, so it combines them as `$MOZ_SOURCE_REPO/rev/$MOZ_SOURCE_CHANGESET`. With this commit, we change this logic to combine them to create a URL that is valid for GitLab. $MOZ_SOURCE_CHANGESET needs to be a commit hash, not a branch or a tag. If that is needed, we could use /-/tree/, instead of /-/commit/. - - - - - 1 changed file: - build/variables.py Changes: ===================================== build/variables.py ===================================== @@ -97,7 +97,7 @@ def source_repo_header(output): output.write("#define MOZ_SOURCE_STAMP %s\n" % changeset) if repo and buildconfig.substs.get("MOZ_INCLUDE_SOURCE_INFO"): - source = "%s/rev/%s" % (repo, changeset) + source = "%s/-/commit/%s" % (repo, changeset) output.write("#define MOZ_SOURCE_REPO %s\n" % repo) output.write("#define MOZ_SOURCE_URL %s\n" % source) View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/f6e9971… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/f6e9971… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][base-browser-102.8.0esr-12.0-1] Bug 41603: Customize the creation of MOZ_SOURCE_URL
by Richard Pospesel (＠richard) 15 Feb '23

15 Feb '23

Richard Pospesel pushed to branch base-browser-102.8.0esr-12.0-1 at The Tor Project / Applications / Tor Browser Commits: 002dd17a by Pier Angelo Vendrame at 2023-02-15T18:22:05+00:00 Bug 41603: Customize the creation of MOZ_SOURCE_URL MOZ_SOURCE_URL is created by combining MOZ_SOURCE_REPO and MOZ_SOURCE_CHANGESET. But the code takes for granted that it refers to a Hg instance, so it combines them as `$MOZ_SOURCE_REPO/rev/$MOZ_SOURCE_CHANGESET`. With this commit, we change this logic to combine them to create a URL that is valid for GitLab. $MOZ_SOURCE_CHANGESET needs to be a commit hash, not a branch or a tag. If that is needed, we could use /-/tree/, instead of /-/commit/. - - - - - 1 changed file: - build/variables.py Changes: ===================================== build/variables.py ===================================== @@ -97,7 +97,7 @@ def source_repo_header(output): output.write("#define MOZ_SOURCE_STAMP %s\n" % changeset) if repo and buildconfig.substs.get("MOZ_INCLUDE_SOURCE_INFO"): - source = "%s/rev/%s" % (repo, changeset) + source = "%s/-/commit/%s" % (repo, changeset) output.write("#define MOZ_SOURCE_REPO %s\n" % repo) output.write("#define MOZ_SOURCE_URL %s\n" % source) View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/002dd17… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/002dd17… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-build][maint-12.0] Bug 40764: Embed repo URL and git revision in Firefox
by Richard Pospesel (＠richard) 15 Feb '23

15 Feb '23

Richard Pospesel pushed to branch maint-12.0 at The Tor Project / Applications / tor-browser-build Commits: ce346cd9 by Pier Angelo Vendrame at 2023-02-15T18:19:09+00:00 Bug 40764: Embed repo URL and git revision in Firefox They will be visible and clickable in about:buildconfig. - - - - - 2 changed files: - projects/firefox/config - projects/firefox/mozconfig Changes: ===================================== projects/firefox/config ===================================== @@ -19,6 +19,8 @@ var: branding_directory: 'browser/branding/alpha' copyright_year: '[% exec("git show -s --format=%ci").remove("-.*") %]' nightly_updates_osname: '[% c("var/osname") %]' + gitlab_project: https://gitlab.torproject.org/tpo/applications/tor-browser + git_commit: '[% exec("git rev-parse HEAD") %]' deps: - build-essential - unzip ===================================== projects/firefox/mozconfig ===================================== @@ -75,3 +75,6 @@ ac_add_options --with-relative-profile=[% c('var/ProjectName') %]/Data/Browser mk_add_options MOZ_APP_DISPLAYNAME="[% c('var/Project_Name') %]" mk_add_options MOZ_PARALLEL_BUILD=[% c("num_procs") %] +export MOZ_INCLUDE_SOURCE_INFO=1 +export MOZ_SOURCE_REPO="[% c('var/gitlab_project') %]" +export MOZ_SOURCE_CHANGESET=[% c("var/git_commit") %] View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/c… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/c… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-102.8.0esr-12.0-1] fixup! Bug 40253: Explicitly allow NoScript in Private Browsing mode.
by Richard Pospesel (＠richard) 15 Feb '23

15 Feb '23

Richard Pospesel pushed to branch tor-browser-102.8.0esr-12.0-1 at The Tor Project / Applications / Tor Browser Commits: 8a4c761e by hackademix at 2023-02-15T18:05:45+00:00 fixup! Bug 40253: Explicitly allow NoScript in Private Browsing mode. Bug 41598: Prevent NoScript from being removed/disabled. Bug 40253: Explicitly allow NoScript in Private Browsing mode. - - - - - 1 changed file: - toolkit/mozapps/extensions/internal/XPIDatabase.jsm Changes: ===================================== toolkit/mozapps/extensions/internal/XPIDatabase.jsm ===================================== @@ -854,6 +854,15 @@ class AddonInternal { } } + // Bug 41598: prevent NoScript from being uninstalled/disabled + if (this.id === "{73a6fe31-595d-460b-a920-fcc0f8843232}") { + permissions &= ~( + AddonManager.PERM_CAN_UNINSTALL | + AddonManager.PERM_CAN_DISABLE | + AddonManager.PERM_CAN_CHANGE_PRIVATEBROWSING_ACCESS + ); + } + return permissions; } View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/8a4c761… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/8a4c761… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][base-browser-102.8.0esr-12.0-1] fixup! Bug 40253: Explicitly allow NoScript in Private Browsing mode.
by Richard Pospesel (＠richard) 15 Feb '23

15 Feb '23

Richard Pospesel pushed to branch base-browser-102.8.0esr-12.0-1 at The Tor Project / Applications / Tor Browser Commits: 3c99d6af by hackademix at 2023-02-15T18:06:33+00:00 fixup! Bug 40253: Explicitly allow NoScript in Private Browsing mode. Bug 41598: Prevent NoScript from being removed/disabled. Bug 40253: Explicitly allow NoScript in Private Browsing mode. - - - - - 1 changed file: - toolkit/mozapps/extensions/internal/XPIDatabase.jsm Changes: ===================================== toolkit/mozapps/extensions/internal/XPIDatabase.jsm ===================================== @@ -854,6 +854,15 @@ class AddonInternal { } } + // Bug 41598: prevent NoScript from being uninstalled/disabled + if (this.id === "{73a6fe31-595d-460b-a920-fcc0f8843232}") { + permissions &= ~( + AddonManager.PERM_CAN_UNINSTALL | + AddonManager.PERM_CAN_DISABLE | + AddonManager.PERM_CAN_CHANGE_PRIVATEBROWSING_ACCESS + ); + } + return permissions; } View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/3c99d6a… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/3c99d6a… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/fenix] Pushed new tag tor-browser-102.2.1-12.5-1-build2
by Richard Pospesel (＠richard) 15 Feb '23

15 Feb '23

Richard Pospesel pushed new tag tor-browser-102.2.1-12.5-1-build2 at The Tor Project / Applications / fenix -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/fenix/-/tree/tor-browser-102… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser] Pushed new tag tor-browser-102.8.0esr-12.5-1-build2
by Richard Pospesel (＠richard) 15 Feb '23

15 Feb '23

Richard Pospesel pushed new tag tor-browser-102.8.0esr-12.5-1-build2 at The Tor Project / Applications / Tor Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/tree/tor-brows… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser] Pushed new tag tor-browser-102.8.0esr-12.5-1-build1
by Richard Pospesel (＠richard) 15 Feb '23

15 Feb '23

Richard Pospesel pushed new tag tor-browser-102.8.0esr-12.5-1-build1 at The Tor Project / Applications / Tor Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/tree/tor-brows… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser] Pushed new tag base-browser-102.8.0esr-12.5-1-build2
by Richard Pospesel (＠richard) 15 Feb '23

15 Feb '23

Richard Pospesel pushed new tag base-browser-102.8.0esr-12.5-1-build2 at The Tor Project / Applications / Tor Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/tree/base-brow… You're receiving this email because of your account on gitlab.torproject.org.

1 0

← Newer
1
2
3
4
5
6
7
8
9
...
15
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

tor-commits February 2023