September 2023 - tor-commits - lists.torproject.org

[Git][tpo/applications/tor-browser][tor-browser-115.2.0esr-13.0-1] Bug 42084: Ensure spoofing works even if preferences are set out of order.
by ma1 (＠ma1) 12 Sep '23

12 Sep '23

ma1 pushed to branch tor-browser-115.2.0esr-13.0-1 at The Tor Project / Applications / Tor Browser Commits: 8cff1681 by hackademix at 2023-09-12T10:37:14+02:00 Bug 42084: Ensure spoofing works even if preferences are set out of order. - - - - - 1 changed file: - toolkit/components/resistfingerprinting/RFPHelper.sys.mjs Changes: ===================================== toolkit/components/resistfingerprinting/RFPHelper.sys.mjs ===================================== @@ -158,6 +158,9 @@ class _RFPHelper { // Add RFP and Letterboxing observers if prefs are enabled this._handleResistFingerprintingChanged(); this._handleLetterboxingPrefChanged(); + + // Synchronize language preferences if accidentally messed up (tor-browser#42084) + this._handleSpoofEnglishChanged(); } uninit() { @@ -211,6 +214,7 @@ class _RFPHelper { this._handleResistFingerprintingChanged(); break; case kPrefSpoofEnglish: + case "intl.accept_languages": this._handleSpoofEnglishChanged(); break; case kPrefLetterboxing: @@ -259,6 +263,7 @@ class _RFPHelper { } _handleSpoofEnglishChanged() { + Services.prefs.removeObserver("intl.accept_languages", this); switch (Services.prefs.getIntPref(kPrefSpoofEnglish)) { case 0: // will prompt // This should only happen when turning privacy.resistFingerprinting off. @@ -277,6 +282,8 @@ class _RFPHelper { case 2: // spoof Services.prefs.setCharPref("intl.accept_languages", "en-US, en"); Services.prefs.setBoolPref("javascript.use_us_english_locale", true); + // Ensure spoofing works if preferences are set out of order + Services.prefs.addObserver("intl.accept_languages", this); break; default: break; View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/8cff168… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/8cff168… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser] Pushed new branch tor-browser-102.15.1esr-12.5-1
by Pier Angelo Vendrame (＠pierov) 12 Sep '23

12 Sep '23

Pier Angelo Vendrame pushed new branch tor-browser-102.15.1esr-12.5-1 at The Tor Project / Applications / Tor Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/tree/tor-brows… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser] Pushed new tag FIREFOX_102_15_1esr_BUILD1
by Pier Angelo Vendrame (＠pierov) 12 Sep '23

12 Sep '23

Pier Angelo Vendrame pushed new tag FIREFOX_102_15_1esr_BUILD1 at The Tor Project / Applications / Tor Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/tree/FIREFOX_1… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-spec][main] 2 commits: Bug 40055: FF108 Audit
by richard (＠richard) 12 Sep '23

12 Sep '23

richard pushed to branch main at The Tor Project / Applications / tor-browser-spec Commits: e8e6f825 by Richard Pospesel at 2023-09-11T23:56:52+00:00 Bug 40055: FF108 Audit - - - - - fc74e1ae by Richard Pospesel at 2023-09-12T00:41:12+00:00 Bug 40061: FF114 Audit - - - - - 2 changed files: - + audits/FF108_AUDIT - + audits/FF114_AUDIT Changes: ===================================== audits/FF108_AUDIT ===================================== @@ -0,0 +1,80 @@ +# General + +The audit begins at the commit hash where the previous audit ended. Use code_audit.sh for creating the diff and highlighting potentially problematic code. The audit is scoped to a specific language (currently C/C++, Rust, Java/Kotlin, and Javascript). + +The output includes the entire patch where the new problematic code was introduced. Search for `XXX MATCH XXX` to find the next potential violation. + +`code_audit.sh` contains the list of known problematic APIs. New usage of these functions are documented and analyzed in this audit. + +## Firefox: https://github.com/mozilla/gecko-dev.git + +- Start: `1187da3c99c93ad941eea0809d3b2c8f81ac5ccf` ( `FIREFOX_107_0_1_RELEASE` ) +- End: `0ae93a27c796bea7836d4b0885c8a1f2c4c18284` ( `FIREFOX_108_0_2_RELEASE` ) + +### Languages: +- [x] java +- [x] cpp +- [x] js +- [x] rust + +Nothing of interest (using `code_audit.sh`) + +--- + +## Application Services: https://github.com/mozilla/application-services.git + +- Start: `ce8f1767d991da9d6d26331faecd426210071c7e` ( `v96.1.0` ) +- End: `d8b5a386936aa156f4c6d93e6645a6d2188aa788` ( `v96.2.1` ) + +### Languages: +- [x] java +- [x] cpp +- [x] js +- [x] rust + +Nothing of interest (using `code_audit.sh`) + +## Firefox Android: https://github.com/mozilla-mobile/firefox-android.git + +- Start: `0486e931b4427d646af1dcf69a53c90efbe60862` +- End: `55d34bf82ad051e25f15c0d1ef5fb8b3a32a7522` + +### Languages: +- [x] java +- [x] cpp +- [x] js +- [x] rust + +Nothing of interest (using `code_audit.sh`) + +## Fenix: https://github.com/mozilla-mobile/fenix.git + +- Start: `171d8a7aa521676d008bfd98bfae34ce8774e5f5` ( `v108.0b1` ) +- End: `78718ba91dd19f78e94d8f8c462598c29d48069a` ( `v108.2.0` ) + +### Languages: +- [x] java +- [x] cpp +- [x] js +- [x] rust + +Nothing of interest (using `code_audit.sh`) + +## Ticket Review ## + +Bugzilla Query: `https://bugzilla.mozilla.org/buglist.cgi?query_format=advanced&resolution=FIXED&target_milestone=108%20Branch&order=priority%2Cbug_severity&limit=0` + +#### Problematic Issues: + +- **Remove descriptionheightworkaround.** https://bugzilla.mozilla.org/show_bug.cgi?id=1795944 + - https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/41959 + - **RESOLUTOIN** not a security issue, more of a general ESR migration/functionality issue +- **Proxy environment variables should be upper case / case insensitive** https://bugzilla.mozilla.org/show_bug.cgi?id=1797896 + - https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/41960 + - **RESOLUTION**: determined this logic is gated behind our tor configuration settings, and so aren't relevant or a de-anonimisation vector; nothing to do here +- **Hide cookie banner handling UI by default** https://bugzilla.mozilla.org/show_bug.cgi?id=1798868 + - https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/41961 + - **RESOLUTION**: we will hide the UI to enable/disable the feature, and likely enable the feature for everyone + +## Export +- [ ] Export Report and save to `tor-browser-spec/audits` \ No newline at end of file ===================================== audits/FF114_AUDIT ===================================== @@ -0,0 +1,59 @@ +# General + +The audit begins at the commit hash where the previous audit ended. Use code_audit.sh for creating the diff and highlighting potentially problematic code. The audit is scoped to a specific language (currently C/C++, Rust, Java/Kotlin, and Javascript). + +The output includes the entire patch where the new problematic code was introduced. Search for `XXX MATCH XXX` to find the next potential violation. + +`code_audit.sh` contains the list of known problematic APIs. New usage of these functions are documented and analyzed in this audit. + +## Firefox: https://github.com/mozilla/gecko-dev.git + +- Start: `8a724297d78ba792067a7e4d17d170c6b3af796e` ( `FIREFOX_113_0_2_RELEASE` ) +- End: `b1d2c35b2699a6d77f6a41ae2338d9c370c5172e` ( `FIREFOX_114_0_2_RELEASE` ) + +### Languages: +- [x] java +- [x] cpp +- [x] js +- [x] rust + +Nothing of interest (using `code_audit.sh`) + +--- + +## Application Services: https://github.com/mozilla/application-services.git + +- Start: `b126218b17a2273edb2f1ed5806f689440740b23` ( `v114.1` not really, Mozilla created a new branch and there's no tag associated with v114.1 in ) +- End: `78ab4ce85120f45a4b67b055936e401193eabd68` ( `v115.0` ) + +### Languages: +- [x] java +- [x] cpp +- [x] js +- [x] rust + +#### Problematic Commits + +- Add Remote Settings client component `d054f01641a3da94dba4076c3ac8236547e2b3f4` + +## Firefox Android: https://github.com/mozilla-mobile/firefox-android.git + +- Start: `9d87757910437e94a860e1d6f2577d5648ded966` +- End: `fa28e4ddf82bedaa65153cbc6bac3ce7d8729ef5` + +### Languages: +- [x] java +- [x] cpp +- [x] js +- [x] rust + +Nothing of interest (using `code_audit.sh`) + +## Ticket Review ## + +Bugzilla Query: `https://bugzilla.mozilla.org/buglist.cgi?query_format=advanced&resolution=FIXED&target_milestone=114%20Branch&order=priority%2Cbug_severity&limit=0` + +Nothing of interest (manual inspection) + +## Export +- [x] Export Report and save to `tor-browser-spec/audits` \ No newline at end of file View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-spec/-/compare/7… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-spec/-/compare/7… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/firefox-android][firefox-android-115.2.1-13.0-1] fixup! Modify UI/UX
by Dan Ballard (＠dan) 11 Sep '23

11 Sep '23

Dan Ballard pushed to branch firefox-android-115.2.1-13.0-1 at The Tor Project / Applications / firefox-android Commits: d19b676f by clairehurst at 2023-09-11T23:51:22+00:00 fixup! Modify UI/UX Bug 42076: Remove theme options from UI - - - - - 2 changed files: - fenix/app/src/main/java/org/mozilla/fenix/settings/CustomizationFragment.kt - fenix/app/src/main/res/xml/customization_preferences.xml Changes: ===================================== fenix/app/src/main/java/org/mozilla/fenix/settings/CustomizationFragment.kt ===================================== @@ -46,11 +46,12 @@ class CustomizationFragment : PreferenceFragmentCompat() { } private fun setupPreferences() { - bindFollowDeviceTheme() - bindDarkTheme() - bindLightTheme() - bindAutoBatteryTheme() - setupRadioGroups() +// Remove as part of tor-browser#42076 : https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/42076 +// bindFollowDeviceTheme() +// bindDarkTheme() +// bindLightTheme() +// bindAutoBatteryTheme() +// setupRadioGroups() setupToolbarCategory() setupGesturesCategory() } ===================================== fenix/app/src/main/res/xml/customization_preferences.xml ===================================== @@ -4,32 +4,33 @@ - file, You can obtain one at http://mozilla.org/MPL/2.0/. --> <androidx.preference.PreferenceScreen xmlns:android="http://schemas.android.com/apk/res/android" xmlns:app="http://schemas.android.com/apk/res-auto"> - <androidx.preference.PreferenceCategory - android:layout="@layout/preference_cat_style" - android:title="@string/preferences_theme" - app:iconSpaceReserved="false"> - <org.mozilla.fenix.settings.RadioButtonPreference - android:defaultValue="@bool/underAPI28" - android:key="@string/pref_key_light_theme" - android:title="@string/preference_light_theme" /> - - <org.mozilla.fenix.settings.RadioButtonPreference - android:defaultValue="false" - android:key="@string/pref_key_dark_theme" - android:title="@string/preference_dark_theme" /> - - <org.mozilla.fenix.settings.RadioButtonPreference - android:defaultValue="false" - android:key="@string/pref_key_auto_battery_theme" - android:title="@string/preference_auto_battery_theme" - app:isPreferenceVisible="@bool/underAPI28" /> - - <org.mozilla.fenix.settings.RadioButtonPreference - android:defaultValue="@bool/API28" - android:key="@string/pref_key_follow_device_theme" - android:title="@string/preference_follow_device_theme" - app:isPreferenceVisible="@bool/API28" /> - </androidx.preference.PreferenceCategory> + + + + + + + + + + + + + + + + + + + + + + + + + + + <androidx.preference.PreferenceCategory android:layout="@layout/preference_cat_style" View it on GitLab: https://gitlab.torproject.org/tpo/applications/firefox-android/-/commit/d19… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/firefox-android/-/commit/d19… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-spec][main] Bug 40054: FF107 Audit
by richard (＠richard) 11 Sep '23

11 Sep '23

richard pushed to branch main at The Tor Project / Applications / tor-browser-spec Commits: 724a427b by Richard Pospesel at 2023-09-11T23:48:58+00:00 Bug 40054: FF107 Audit - - - - - 1 changed file: - + audits/FF107_AUDIT Changes: ===================================== audits/FF107_AUDIT ===================================== @@ -0,0 +1,72 @@ +# General + +The audit begins at the commit hash where the previous audit ended. Use code_audit.sh for creating the diff and highlighting potentially problematic code. The audit is scoped to a specific language (currently C/C++, Rust, Java/Kotlin, and Javascript). + +The output includes the entire patch where the new problematic code was introduced. Search for `XXX MATCH XXX` to find the next potential violation. + +`code_audit.sh` contains the list of known problematic APIs. New usage of these functions are documented and analyzed in this audit. + +## Firefox: https://github.com/mozilla/gecko-dev.git + +- Start: `ac898d40ded7de23ef22a6f336f2ab1f0bca0d3f` ( `FIREFOX_106_0_5_RELEASE` ) +- End: `1187da3c99c93ad941eea0809d3b2c8f81ac5ccf` ( `FIREFOX_107_0_1_RELEASE` ) + +### Languages: +- [x] java +- [x] cpp +- [x] js +- [x] rust + +Nothing of interest (using `code_audit.sh`) + +--- + +## Application Services: https://github.com/mozilla/application-services.git + +- Start: `f1276e45b7c284bc4435896b1d5d09b35f3b295b` ( `v95.0.1` ) +- End: `ce8f1767d991da9d6d26331faecd426210071c7e` ( `v96.1.0` ) + +### Languages: +- [x] java +- [x] cpp +- [x] js +- [x] rust + +Nothing of interest (using `code_audit.sh`) + +## Android Components: https://github.com/mozilla-mobile/android-components.git + +- Start: `1c48533cff068056259e62861344bd8a490a83e7` +- End: `ff4f1f8ae3c12e6f6e0dcf52f88049ca251470d8` ( `v107.0.3` ) + +### Languages: +- [x] java +- [x] cpp +- [x] js +- [x] rust + +Nothing of interest (using `code_audit.sh`) + +## Fenix: https://github.com/mozilla-mobile/fenix.git + +- Start: `8c088f08d339514ac12732bffdc9bb90540d9337` ( `v107.0b1` ) +- End: `1490acda7e44894c8437cc7fb677d3fba1a711ce` ( `v107.2.0` ) + +### Languages: +- [x] java +- [x] cpp +- [x] js +- [x] rust + +Nothing of interest (using `code_audit.sh`) + +## Ticket Review ## + +Bugzilla Query: `https://bugzilla.mozilla.org/buglist.cgi?query_format=advanced&resolution=FIXED&target_milestone=107%20Branch&order=priority%2Cbug_severity&limit=0` + +where `$(FIREFOX_VERSION)` is the major Firefox version we are auditing (eg: '91') + +Nothing of interest (manual inspection) + +## Export +- [x] Export Report and save to `tor-browser-spec/audits` \ No newline at end of file View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-spec/-/commit/72… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-spec/-/commit/72… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-115.2.0esr-13.0-1] fixup! Bug 7494: Create local home page for TBB.
by richard (＠richard) 11 Sep '23

11 Sep '23

richard pushed to branch tor-browser-115.2.0esr-13.0-1 at The Tor Project / Applications / Tor Browser Commits: ea5cd3a3 by Henry Wilkes at 2023-09-11T18:34:24+01:00 fixup! Bug 7494: Create local home page for TBB. Bug 42075: Increase inline margin for the message links in about:tor. Also increase the end margin of the emoji icon. - - - - - 1 changed file: - browser/components/abouttor/content/aboutTor.css Changes: ===================================== browser/components/abouttor/content/aboutTor.css ===================================== @@ -56,6 +56,12 @@ h1 { .message-emoji { height: 1em; vertical-align: sub; + margin-inline-end: 0.3em; +} + +.home-message a { + /* Increase gap between the link and the rest of the text. */ + margin-inline: 0.4em; } #search-form { View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/ea5cd3a… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/ea5cd3a… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/firefox-android][firefox-android-115.2.1-13.0-1] Adding gitlab merge request template
by Dan Ballard (＠dan) 11 Sep '23

11 Sep '23

Dan Ballard pushed to branch firefox-android-115.2.1-13.0-1 at The Tor Project / Applications / firefox-android Commits: c190fae9 by Richard Pospesel at 2023-09-08T02:17:22+00:00 Adding gitlab merge request template - - - - - 1 changed file: - + .gitlab/merge_request_templates/default.md Changes: ===================================== .gitlab/merge_request_templates/default.md ===================================== @@ -0,0 +1,57 @@ +## Merge Info + + + +### Related Issues +- tor-browser#xxxxx +- tor-browser-build#xxxxx + +### Backporting + +#### Timeline +- [ ] **Immediate**: patchset needed as soon as possible +- [ ] **Next Minor Stable Release**: patchset that needs to be verified in nightly before backport +- [ ] **Eventually**: patchset that needs to be verified in alpha before backport +- [ ] **No Backport (preferred)**: patchset for the next major stable + +#### (Optional) Justification +- [ ] **Emergency security update**: patchset fixes CVEs, 0-days, etc +- [ ] **Censorship event**: patchset enables censorship circumvention +- [ ] **Critical bug-fix**: patchset fixes a bug in core-functionality +- [ ] **Consistency**: patchset which would make development easier if it were in both the alpha and release branches; developer tools, build system changes, etc +- [ ] **Sponsor required**: patchset required for sponsor +- [ ] **Other**: please explain + +### Issue Tracking +- [ ] Link resolved issues with appropriate [Release Prep issue](https://gitlab.torproject.org/groups/tpo/applications/-/issues/?sort… for changelog generation + +### Review + +#### Request Reviewer + +- [ ] Request review from an applications developer depending on modified system: + - **NOTE**: if the MR modifies multiple areas, please `/cc` all the relevant reviewers (since gitlab only allows 1 reviewer) + - **accessibility** : henry + - **android** : clairehurst, dan + - **build system** : boklm + - **extensions** : ma1 + - **firefox internals (XUL/JS/XPCOM)** : ma1 + - **fonts** : pierov + - **frontend (implementation)** : henry + - **frontend (review)** : donuts, richard + - **localization** : henry, pierov + - **macos** : clairehurst, dan + - **misc/other** : pierov, richard + - **nightly builds** : boklm + - **rebases/release-prep** : dan, ma1, pierov, richard + - **security** : ma1 + - **signing** : boklm, richard + - **updater** : pierov + +#### Change Description + + + +#### How Tested + + \ No newline at end of file View it on GitLab: https://gitlab.torproject.org/tpo/applications/firefox-android/-/commit/c19… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/firefox-android/-/commit/c19… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-115.2.0esr-13.0-1] fixup! Bug 23247: Communicating security expectations for .onion
by ma1 (＠ma1) 08 Sep '23

08 Sep '23

ma1 pushed to branch tor-browser-115.2.0esr-13.0-1 at The Tor Project / Applications / Tor Browser Commits: 03a24c6d by cypherpunks1 at 2023-09-08T22:06:56+00:00 fixup! Bug 23247: Communicating security expectations for .onion Bug 41934: Treat unencrypted websocket connections to onion services as secure - - - - - 1 changed file: - dom/websocket/WebSocket.cpp Changes: ===================================== dom/websocket/WebSocket.cpp ===================================== @@ -1734,12 +1734,15 @@ nsresult WebSocketImpl::Init(JSContext* aCx, bool aIsSecure, } // Don't allow https:// to open ws:// - if (!mIsServerSide && !mSecure && + if (!mIsServerSide && !mSecure && aIsSecure && !Preferences::GetBool("network.websocket.allowInsecureFromHTTPS", false) && !nsMixedContentBlocker::IsPotentiallyTrustworthyLoopbackHost( mAsciiHost)) { - if (aIsSecure) { + nsCOMPtr<nsIURI> uri; + nsresult rv = NS_NewURI(getter_AddRefs(uri), mURI); + NS_ENSURE_SUCCESS(rv, rv); + if (!nsMixedContentBlocker::IsPotentiallyTrustworthyOnion(uri)) { return NS_ERROR_DOM_SECURITY_ERR; } } View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/03a24c6… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/03a24c6… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][base-browser-115.2.0esr-13.0-1] Bug 41881: Don't persist custom network requests on private windows
by ma1 (＠ma1) 08 Sep '23

08 Sep '23

ma1 pushed to branch base-browser-115.2.0esr-13.0-1 at The Tor Project / Applications / Tor Browser Commits: 95b3625a by cypherpunks1 at 2023-09-08T11:45:15+01:00 Bug 41881: Don't persist custom network requests on private windows - - - - - 1 changed file: - devtools/client/netmonitor/src/components/new-request/HTTPCustomRequestPanel.js Changes: ===================================== devtools/client/netmonitor/src/components/new-request/HTTPCustomRequestPanel.js ===================================== @@ -4,6 +4,11 @@ "use strict"; +const lazy = {}; +ChromeUtils.defineESModuleGetters(lazy, { + PrivateBrowsingUtils: "resource://gre/modules/PrivateBrowsingUtils.sys.mjs", +}); + const { Component, createFactory, @@ -122,10 +127,12 @@ class HTTPCustomRequestPanel extends Component { async componentDidMount() { let { connector, request } = this.props; - const persistedCustomRequest = await asyncStorage.getItem( - "devtools.netmonitor.customRequest" - ); - request = request || persistedCustomRequest; + if (!lazy.PrivateBrowsingUtils.isWindowPrivate(window)) { + const persistedCustomRequest = await asyncStorage.getItem( + "devtools.netmonitor.customRequest" + ); + request = request || persistedCustomRequest; + } if (!request) { this.setState({ _isStateDataReady: true }); @@ -191,7 +198,9 @@ class HTTPCustomRequestPanel extends Component { } componentWillUnmount() { - asyncStorage.setItem("devtools.netmonitor.customRequest", this.state); + if (!lazy.PrivateBrowsingUtils.isWindowPrivate(window)) { + asyncStorage.setItem("devtools.netmonitor.customRequest", this.state); + } } handleChangeURL(event) { View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/95b3625… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/95b3625… You're receiving this email because of your account on gitlab.torproject.org.

1 0