April 2024 - tor-commits - lists.torproject.org

[Git][tpo/applications/tor-browser][tor-browser-115.10.0esr-13.5-1] 8 commits: fixup! Bug 30237: Add v3 onion services client authentication prompt
by richard (＠richard) 30 Apr '24

30 Apr '24

richard pushed to branch tor-browser-115.10.0esr-13.5-1 at The Tor Project / Applications / Tor Browser Commits: 795b62a7 by Henry Wilkes at 2024-04-25T10:32:13+01:00 fixup! Bug 30237: Add v3 onion services client authentication prompt Bug 42542: Remove the OnionServicesAuthPrompt class. The class is merged into OnionAuthPrompt. This currently only works when only one tab triggers the prompt at a time. Not linted to improve commit readability. - - - - - 38d07333 by Henry Wilkes at 2024-04-… [View More]25T10:32:14+01:00 fixup! Bug 30237: Add v3 onion services client authentication prompt Bug 42542: Lint after removing OnionServicesAuthPrompt class. - - - - - a35c7a68 by Henry Wilkes at 2024-04-25T11:55:07+01:00 fixup! Bug 30237: Add v3 onion services client authentication prompt Bug 42542: Re-handle showing errors. Call "_showWarning" rather than "show" when we have an error. Do not attempt to show the prompt if we cannot determine the onion service id. For the service id regex, use "^(.*\.)?" instead of "^(.*\.)*": since the ".*" is greedy, this can only ever match up to once. - - - - - df3374c4 by Henry Wilkes at 2024-04-30T11:11:39+01:00 fixup! Bug 30237: Add v3 onion services client authentication prompt Bug 42542: Reset the authentication prompt when switching between two authentication tabs. We keep a record of which tab details are being shown in the notification popup. We reset the prompt whenever we want to show different details. We also fetch elements and set event listeners (once) when we initialize OnionAuthPrompt. In particular, the listeners should only react to the shown details. We also assume that elements with an ID exist in the DOM. - - - - - 0cacad0c by Henry Wilkes at 2024-04-30T11:11:46+01:00 fixup! Bug 30237: Add v3 onion services client authentication prompt Bug 42542: Follow recent coding conventions. Do not prefix variable names with "a" and use triple equality. - - - - - 82fa0a97 by Henry Wilkes at 2024-04-30T11:11:46+01:00 fixup! Bug 30237: Add v3 onion services client authentication prompt Bug 42542: Use "keydown" instead of deprecated "keypress". Also, stop handling "Escape" key since it is already handled by PopupNotification. - - - - - 78107767 by Henry Wilkes at 2024-04-30T11:11:47+01:00 fixup! Bug 30237: Add v3 onion services client authentication prompt Bug 42542: Add documentation to OnionAuthPrompt. - - - - - 170cb7ab by Henry Wilkes at 2024-04-30T11:11:47+01:00 fixup! Bug 30237: Add v3 onion services client authentication prompt Bug 42542: Add a logger to OnionAuthPrompt. - - - - - 2 changed files: - browser/components/onionservices/content/authPopup.inc.xhtml - browser/components/onionservices/content/authPrompt.js Changes: ===================================== browser/components/onionservices/content/authPopup.inc.xhtml ===================================== @@ -5,7 +5,9 @@ <description id="tor-clientauth-notification-desc"/> <label id="tor-clientauth-notification-learnmore" class="text-link popup-notification-learnmore-link" - is="text-link"/> + is="text-link" + href="about:manual#onion-services_onion-service-authentication" + useoriginprincipal="true"/> <html:div> <html:input id="tor-clientauth-notification-key" type="password"/> <html:div id="tor-clientauth-warning"/> ===================================== browser/components/onionservices/content/authPrompt.js ===================================== @@ -2,350 +2,417 @@ "use strict"; -const OnionAuthPrompt = (function () { +var OnionAuthPrompt = { // Only import to our internal scope, rather than the global scope of // browser.xhtml. - const lazy = {}; - ChromeUtils.defineESModuleGetters(lazy, { - TorProviderBuilder: "resource://gre/modules/TorProviderBuilder.sys.mjs", - TorStrings: "resource://gre/modules/TorStrings.sys.mjs", - CommonUtils: "resource://services-common/utils.sys.mjs", - }); - - // OnionServicesAuthPrompt objects run within the main/chrome process. - // aReason is the topic passed within the observer notification that is - // causing this auth prompt to be displayed. - function OnionServicesAuthPrompt(aBrowser, aFailedURI, aReason, aOnionName) { - this._browser = aBrowser; - this._failedURI = aFailedURI; - this._reasonForPrompt = aReason; - this._onionHostname = aOnionName; - } - - const topics = { + _lazy: {}, + + /** + * The topics to listen to. + * + * @type {Object<string, string>} + */ + _topics: { clientAuthMissing: "tor-onion-services-clientauth-missing", clientAuthIncorrect: "tor-onion-services-clientauth-incorrect", - }; - - OnionServicesAuthPrompt.prototype = { - show(aWarningMessage) { - let mainAction = { - label: lazy.TorStrings.onionServices.authPrompt.done, - accessKey: lazy.TorStrings.onionServices.authPrompt.doneAccessKey, - leaveOpen: true, // Callback is responsible for closing the notification. - callback: this._onDone.bind(this), - }; - - let dialogBundle = Services.strings.createBundle( - "chrome://global/locale/dialog.properties" - ); - - let cancelAccessKey = dialogBundle.GetStringFromName("accesskey-cancel"); - if (!cancelAccessKey) { - cancelAccessKey = "c"; - } // required by PopupNotifications.show() - - let cancelAction = { - label: dialogBundle.GetStringFromName("button-cancel"), - accessKey: cancelAccessKey, - callback: this._onCancel.bind(this), - }; - - let _this = this; - let options = { - autofocus: true, - hideClose: true, - persistent: true, - removeOnDismissal: false, - eventCallback(aTopic) { - if (aTopic === "showing") { - _this._onPromptShowing(aWarningMessage); - } else if (aTopic === "shown") { - _this._onPromptShown(); - } else if (aTopic === "removed") { - _this._onPromptRemoved(); - } - }, - }; - - this._prompt = PopupNotifications.show( - this._browser, - "tor-clientauth", - "", - "tor-clientauth-notification-icon", - mainAction, - [cancelAction], - options - ); - }, - - _onPromptShowing(aWarningMessage) { - let xulDoc = this._browser.ownerDocument; - let descElem = xulDoc.getElementById("tor-clientauth-notification-desc"); - if (descElem) { - // Handle replacement of the onion name within the localized - // string ourselves so we can show the onion name as bold text. - // We do this by splitting the localized string and creating - // several HTML <span> elements. - const fmtString = lazy.TorStrings.onionServices.authPrompt.description; - const [prefix, suffix] = fmtString.split("%S"); - - const domainEl = xulDoc.createElement("span"); - domainEl.id = "tor-clientauth-notification-onionname"; - domainEl.textContent = TorUIUtils.shortenOnionAddress( - this._onionHostname - ); - - descElem.replaceChildren(prefix, domainEl, suffix); - } - - // Set "Learn More" label and href. - let learnMoreElem = xulDoc.getElementById( - "tor-clientauth-notification-learnmore" - ); - if (learnMoreElem) { - learnMoreElem.setAttribute( - "value", - lazy.TorStrings.onionServices.learnMore - ); - learnMoreElem.setAttribute( - "href", - "about:manual#onion-services_onion-service-authentication" - ); - learnMoreElem.setAttribute("useoriginprincipal", "true"); - } - - this._showWarning(aWarningMessage); - let checkboxElem = this._getCheckboxElement(); - if (checkboxElem) { - checkboxElem.checked = false; - } - }, - - _onPromptShown() { - let keyElem = this._getKeyElement(); - if (keyElem) { - keyElem.setAttribute( - "placeholder", - lazy.TorStrings.onionServices.authPrompt.keyPlaceholder - ); - this._boundOnKeyFieldKeyPress = this._onKeyFieldKeyPress.bind(this); - this._boundOnKeyFieldInput = this._onKeyFieldInput.bind(this); - keyElem.addEventListener("keypress", this._boundOnKeyFieldKeyPress); - keyElem.addEventListener("input", this._boundOnKeyFieldInput); - keyElem.focus(); - } - }, - - _onPromptRemoved() { - if (this._boundOnKeyFieldKeyPress) { - let keyElem = this._getKeyElement(); - if (keyElem) { - keyElem.value = ""; - keyElem.removeEventListener( - "keypress", - this._boundOnKeyFieldKeyPress - ); - this._boundOnKeyFieldKeyPress = undefined; - keyElem.removeEventListener("input", this._boundOnKeyFieldInput); - this._boundOnKeyFieldInput = undefined; + }, + + /** + * @typedef {object} PromptDetails + * + * @property {Browser} browser - The browser this prompt is for. + * @property {string} cause - The notification that cause this prompt. + * @property {string} onionHost - The onion host name. + * @property {nsIURI} uri - The browser URI when the notification was + * triggered. + * @property {string} onionServiceId - The onion service ID for this host. + * @property {Notification} [notification] - The notification instance for + * this prompt. + */ + + /** + * The currently shown details in the prompt. + */ + _shownDetails: null, + + /** + * Used for logging to represent PromptDetails. + * + * @param {PromptDetails} details - The details to represent. + * @returns {string} - The representation of these details. + */ + _detailsRepr(details) { + if (!details) { + return "none"; + } + return `${details.browser.browserId}:${details.onionHost}`; + }, + + /** + * Show a new prompt, using the given details. + * + * @param {PromptDetails} details - The details to show. + */ + show(details) { + this._logger.debug(`New Notification: ${this._detailsRepr(details)}`); + + let mainAction = { + label: this.TorStrings.onionServices.authPrompt.done, + accessKey: this.TorStrings.onionServices.authPrompt.doneAccessKey, + leaveOpen: true, // Callback is responsible for closing the notification. + callback: this._onDone.bind(this), + }; + + let dialogBundle = Services.strings.createBundle( + "chrome://global/locale/dialog.properties" + ); + + let cancelAccessKey = dialogBundle.GetStringFromName("accesskey-cancel"); + if (!cancelAccessKey) { + cancelAccessKey = "c"; + } // required by PopupNotifications.show() + + // The first secondarybuttoncommand (cancelAction) should be triggered when + // the user presses "Escape". + let cancelAction = { + label: dialogBundle.GetStringFromName("button-cancel"), + accessKey: cancelAccessKey, + callback: this._onCancel.bind(this), + }; + + let options = { + autofocus: true, + hideClose: true, + persistent: true, + removeOnDismissal: false, + eventCallback: topic => { + if (topic === "showing") { + this._onPromptShowing(details); + } else if (topic === "shown") { + this._onPromptShown(); + } else if (topic === "removed") { + this._onPromptRemoved(details); } + }, + }; + + details.notification = PopupNotifications.show( + details.browser, + "tor-clientauth", + "", + "tor-clientauth-notification-icon", + mainAction, + [cancelAction], + options + ); + }, + + /** + * Callback when the prompt is about to be shown. + * + * @param {PromptDetails?} details - The details to show, or null to shown + * none. + */ + _onPromptShowing(details) { + if (details === this._shownDetails) { + // The last shown details match this one exactly. + // This happens when we switch tabs to a page that has no prompt and then + // switch back. + // We don't want to reset the current state in this case. + // In particular, we keep the current _keyInput value and _persistCheckbox + // the same. + this._logger.debug(`Already showing: ${this._detailsRepr(details)}`); + return; + } + + this._logger.debug(`Now showing: ${this._detailsRepr(details)}`); + + this._shownDetails = details; + + // Clear the key input. + // In particular, clear the input when switching tabs. + this._keyInput.value = ""; + this._persistCheckbox.checked = false; + + // Handle replacement of the onion name within the localized + // string ourselves so we can show the onion name as bold text. + // We do this by splitting the localized string and creating + // several HTML <span> elements. + const fmtString = this.TorStrings.onionServices.authPrompt.description; + const [prefix, suffix] = fmtString.split("%S"); + + const domainEl = document.createElement("span"); + domainEl.id = "tor-clientauth-notification-onionname"; + domainEl.textContent = TorUIUtils.shortenOnionAddress( + this._shownDetails?.onionHost ?? "" + ); + + this._descriptionEl.replaceChildren(prefix, domainEl, suffix); + + this._showWarning(undefined); + }, + + /** + * Callback after the prompt is shown. + */ + _onPromptShown() { + this._keyInput.focus(); + }, + + /** + * Callback when a Notification is removed. + * + * @param {PromptDetails} details - The details for the removed notification. + */ + _onPromptRemoved(details) { + if (details !== this._shownDetails) { + // Removing the notification for some other page. + // For example, closing another tab that also requires authentication. + this._logger.debug(`Removed not shown: ${this._detailsRepr(details)}`); + return; + } + this._logger.debug(`Removed shown: ${this._detailsRepr(details)}`); + // Reset the prompt as a precaution. + // In particular, we want to clear the input so that the entered key does + // not persist. + this._onPromptShowing(null); + }, + + /** + * Callback when the user submits the key. + */ + async _onDone() { + this._logger.debug( + `Sumbitting key: ${this._detailsRepr(this._shownDetails)}` + ); + + // Grab the details before they might change as we await. + const { browser, onionServiceId, notification } = this._shownDetails; + const isPermanent = this._persistCheckbox.checked; + + const base64key = this._keyToBase64(this._keyInput.value); + if (!base64key) { + this._showWarning(this.TorStrings.onionServices.authPrompt.invalidKey); + return; + } + + try { + const provider = await this._lazy.TorProviderBuilder.build(); + await provider.onionAuthAdd(onionServiceId, base64key, isPermanent); + } catch (e) { + if (e.torMessage) { + this._showWarning(e.torMessage); + } else { + this._logger.error(`Failed to set key for ${onionServiceId}`, e); + this._showWarning( + this.TorStrings.onionServices.authPrompt.failedToSetKey + ); } - }, - - _onKeyFieldKeyPress(aEvent) { - if (aEvent.keyCode == aEvent.DOM_VK_RETURN) { - this._onDone(); - } else if (aEvent.keyCode == aEvent.DOM_VK_ESCAPE) { - this._prompt.remove(); - this._onCancel(); - } - }, - - _onKeyFieldInput(aEvent) { - this._showWarning(undefined); // Remove the warning. - }, - - async _onDone() { - const keyElem = this._getKeyElement(); - if (!keyElem) { - return; - } - - const base64key = this._keyToBase64(keyElem.value); - if (!base64key) { - this._showWarning(lazy.TorStrings.onionServices.authPrompt.invalidKey); - return; - } - - this._prompt.remove(); - - const controllerFailureMsg = - lazy.TorStrings.onionServices.authPrompt.failedToSetKey; + return; + } + + notification.remove(); + // Success! Reload the page. + browser.sendMessageToActor("Browser:Reload", {}, "BrowserTab"); + }, + + /** + * Callback when the user dismisses the prompt. + */ + _onCancel() { + // Arrange for an error page to be displayed: + // we build a short script calling docShell.displayError() + // and we pass it as a data: URI to loadFrameScript(), + // which runs it in the content frame which triggered + // this authentication prompt. + this._logger.debug(`Cancelling: ${this._detailsRepr(this._shownDetails)}`); + + const { browser, cause, uri } = this._shownDetails; + const errorCode = + cause === this._topics.clientAuthMissing + ? Cr.NS_ERROR_TOR_ONION_SVC_MISSING_CLIENT_AUTH + : Cr.NS_ERROR_TOR_ONION_SVC_BAD_CLIENT_AUTH; + const io = + 'ChromeUtils.import("resource://gre/modules/Services.jsm").Services.io'; + + browser.messageManager.loadFrameScript( + `data:application/javascript,${encodeURIComponent( + `docShell.displayLoadError(${errorCode}, ${io}.newURI(${JSON.stringify( + uri.spec + )}), undefined, undefined);` + )}`, + false + ); + }, + + /** + * Show a warning message to the user or clear the warning. + * + * @param {string?} warningMessage - The message to show, or undefined to + * clear the current message. + */ + _showWarning(warningMessage) { + this._logger.debug(`Showing warning: ${warningMessage}`); + if (warningMessage) { + this._warningEl.textContent = warningMessage; + this._warningEl.removeAttribute("hidden"); + this._keyInput.classList.add("invalid"); + } else { + this._warningEl.setAttribute("hidden", "true"); + this._keyInput.classList.remove("invalid"); + } + }, + + /** + * Convert the user-entered key into base64. + * + * @param {string} keyString - The key to convert. + * @returns {string?} - The base64 representation, or undefined if the given + * key was not the correct format. + */ + _keyToBase64(keyString) { + if (!keyString) { + return undefined; + } + + let base64key; + if (keyString.length === 52) { + // The key is probably base32-encoded. Attempt to decode. + // Although base32 specifies uppercase letters, we accept lowercase + // as well because users may type in lowercase or copy a key out of + // a tor onion-auth file (which uses lowercase). + let rawKey; try { - // ^(subdomain.)*onionserviceid.onion$ (case-insensitive) - const onionServiceIdRegExp = - /^(.*\.)*(?<onionServiceId>[a-z2-7]{56})\.onion$/i; - // match() will return null on bad match, causing throw - const onionServiceId = this._onionHostname - .match(onionServiceIdRegExp) - .groups.onionServiceId.toLowerCase(); - - const checkboxElem = this._getCheckboxElement(); - const isPermanent = checkboxElem && checkboxElem.checked; - const provider = await lazy.TorProviderBuilder.build(); - await provider.onionAuthAdd(onionServiceId, base64key, isPermanent); - // Success! Reload the page. - this._browser.sendMessageToActor("Browser:Reload", {}, "BrowserTab"); - } catch (e) { - if (e.torMessage) { - this.show(e.torMessage); - } else { - console.error(controllerFailureMsg, e); - this.show(controllerFailureMsg); - } - } - }, - - _onCancel() { - // Arrange for an error page to be displayed: - // we build a short script calling docShell.displayError() - // and we pass it as a data: URI to loadFrameScript(), - // which runs it in the content frame which triggered - // this authentication prompt. - const failedURI = this._failedURI.spec; - const errorCode = - this._reasonForPrompt === topics.clientAuthMissing - ? Cr.NS_ERROR_TOR_ONION_SVC_MISSING_CLIENT_AUTH - : Cr.NS_ERROR_TOR_ONION_SVC_BAD_CLIENT_AUTH; - const io = - 'ChromeUtils.import("resource://gre/modules/Services.jsm").Services.io'; - - this._browser.messageManager.loadFrameScript( - `data:application/javascript,${encodeURIComponent( - `docShell.displayLoadError(${errorCode}, ${io}.newURI(${JSON.stringify( - failedURI - )}), undefined, undefined);` - )}`, - false - ); - }, - - _getKeyElement() { - let xulDoc = this._browser.ownerDocument; - return xulDoc.getElementById("tor-clientauth-notification-key"); - }, - - _getCheckboxElement() { - let xulDoc = this._browser.ownerDocument; - return xulDoc.getElementById("tor-clientauth-persistkey-checkbox"); - }, - - _showWarning(aWarningMessage) { - let xulDoc = this._browser.ownerDocument; - let warningElem = xulDoc.getElementById("tor-clientauth-warning"); - let keyElem = this._getKeyElement(); - if (warningElem) { - if (aWarningMessage) { - warningElem.textContent = aWarningMessage; - warningElem.removeAttribute("hidden"); - if (keyElem) { - keyElem.className = "invalid"; - } - } else { - warningElem.setAttribute("hidden", "true"); - if (keyElem) { - keyElem.className = ""; - } - } - } - }, - - // Returns undefined if the key is the wrong length or format. - _keyToBase64(aKeyString) { - if (!aKeyString) { - return undefined; - } + rawKey = this._lazy.CommonUtils.decodeBase32(keyString.toUpperCase()); + } catch (e) {} - let base64key; - if (aKeyString.length == 52) { - // The key is probably base32-encoded. Attempt to decode. - // Although base32 specifies uppercase letters, we accept lowercase - // as well because users may type in lowercase or copy a key out of - // a tor onion-auth file (which uses lowercase). - let rawKey; + if (rawKey) { try { - rawKey = lazy.CommonUtils.decodeBase32(aKeyString.toUpperCase()); + base64key = btoa(rawKey); } catch (e) {} - - if (rawKey) { - try { - base64key = btoa(rawKey); - } catch (e) {} - } - } else if ( - aKeyString.length == 44 && - /^[a-zA-Z0-9+/]*=*$/.test(aKeyString) - ) { - // The key appears to be a correctly formatted base64 value. If not, - // tor will return an error when we try to add the key via the - // control port. - base64key = aKeyString; } - - return base64key; - }, - }; - - let retval = { - init() { - Services.obs.addObserver(this, topics.clientAuthMissing); - Services.obs.addObserver(this, topics.clientAuthIncorrect); - }, - - uninit() { - Services.obs.removeObserver(this, topics.clientAuthMissing); - Services.obs.removeObserver(this, topics.clientAuthIncorrect); - }, - - // aSubject is the DOM Window or browser where the prompt should be shown. - // aData contains the .onion name. - observe(aSubject, aTopic, aData) { - if ( - aTopic != topics.clientAuthMissing && - aTopic != topics.clientAuthIncorrect - ) { - return; - } - - let browser; - if (aSubject instanceof Ci.nsIDOMWindow) { - let contentWindow = aSubject.QueryInterface(Ci.nsIDOMWindow); - browser = contentWindow.docShell.chromeEventHandler; - } else { - browser = aSubject.QueryInterface(Ci.nsIBrowser); - } - - if (!gBrowser.browsers.some(aBrowser => aBrowser == browser)) { - return; // This window does not contain the subject browser; ignore. + } else if ( + keyString.length === 44 && + /^[a-zA-Z0-9+/]*=*$/.test(keyString) + ) { + // The key appears to be a correctly formatted base64 value. If not, + // tor will return an error when we try to add the key via the + // control port. + base64key = keyString; + } + + return base64key; + }, + + /** + * Initialize the authentication prompt. + */ + init() { + this._logger = console.createInstance({ + prefix: "OnionAuthPrompt", + maxLogLevel: "Warn", + maxLogLevelPref: "browser.onionAuthPrompt.loglevel", + }); + + const { TorStrings } = ChromeUtils.importESModule( + "resource://gre/modules/TorStrings.sys.mjs" + ); + this.TorStrings = TorStrings; + ChromeUtils.defineESModuleGetters(this._lazy, { + TorProviderBuilder: "resource://gre/modules/TorProviderBuilder.sys.mjs", + CommonUtils: "resource://services-common/utils.sys.mjs", + }); + + this._keyInput = document.getElementById("tor-clientauth-notification-key"); + this._persistCheckbox = document.getElementById( + "tor-clientauth-persistkey-checkbox" + ); + this._warningEl = document.getElementById("tor-clientauth-warning"); + this._descriptionEl = document.getElementById( + "tor-clientauth-notification-desc" + ); + + // Set "Learn More" label and href. + const learnMoreElem = document.getElementById( + "tor-clientauth-notification-learnmore" + ); + learnMoreElem.setAttribute( + "value", + this.TorStrings.onionServices.learnMore + ); + + this._keyInput.setAttribute( + "placeholder", + this.TorStrings.onionServices.authPrompt.keyPlaceholder + ); + this._keyInput.addEventListener("keydown", event => { + if (event.key === "Enter") { + event.preventDefault(); + this._onDone(); } - - let failedURI = browser.currentURI; - let authPrompt = new OnionServicesAuthPrompt( - browser, - failedURI, - aTopic, - aData + }); + this._keyInput.addEventListener("input", event => { + // Remove the warning. + this._showWarning(undefined); + }); + + Services.obs.addObserver(this, this._topics.clientAuthMissing); + Services.obs.addObserver(this, this._topics.clientAuthIncorrect); + }, + + /** + * Un-initialize the authentication prompt. + */ + uninit() { + Services.obs.removeObserver(this, this._topics.clientAuthMissing); + Services.obs.removeObserver(this, this._topics.clientAuthIncorrect); + }, + + observe(subject, topic, data) { + if ( + topic !== this._topics.clientAuthMissing && + topic !== this._topics.clientAuthIncorrect + ) { + return; + } + + // "subject" is the DOM window or browser where the prompt should be shown. + let browser; + if (subject instanceof Ci.nsIDOMWindow) { + let contentWindow = subject.QueryInterface(Ci.nsIDOMWindow); + browser = contentWindow.docShell.chromeEventHandler; + } else { + browser = subject.QueryInterface(Ci.nsIBrowser); + } + + if (!gBrowser.browsers.includes(browser)) { + // This window does not contain the subject browser. + this._logger.debug( + `Window ${window.docShell.outerWindowID}: Ignoring ${topic}` ); - authPrompt.show(undefined); - }, - }; - - return retval; -})(); /* OnionAuthPrompt */ - -Object.defineProperty(this, "OnionAuthPrompt", { - value: OnionAuthPrompt, - enumerable: true, - writable: false, -}); + return; + } + this._logger.debug( + `Window ${window.docShell.outerWindowID}: Handling ${topic}` + ); + + const onionHost = data; + // ^(subdomain.)*onionserviceid.onion$ (case-insensitive) + const onionServiceId = onionHost + .match(/^(.*\.)?(?<onionServiceId>[a-z2-7]{56})\.onion$/i) + ?.groups.onionServiceId.toLowerCase(); + if (!onionServiceId) { + this._logger.error(`Malformed onion address: ${onionHost}`); + return; + } + + const details = { + browser, + cause: topic, + onionHost, + uri: browser.currentURI, + onionServiceId, + }; + this.show(details); + }, +}; View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/29ff3f… -- This project does not include diff previews in email notifications. View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/29ff3f… You're receiving this email because of your account on gitlab.torproject.org. [View Less]

1 0

[Git][tpo/applications/rbm][main] Bug 40076: Take refresh_input into account when computing input_files_id
by richard (＠richard) 30 Apr '24

30 Apr '24

richard pushed to branch main at The Tor Project / Applications / RBM Commits: 148d8541 by Nicolas Vigier at 2024-04-25T14:54:32+02:00 Bug 40076: Take refresh_input into account when computing input_files_id The `refresh_input` option forces refreshing an input_file. The option is correctly taken into account when starting a build, but was not when computing `input_files_id`. - - - - - 1 changed file: - lib/RBM.pm Changes: ===================================== lib/RBM.pm ==============… [View More]

1 0

[Git][tpo/applications/tor-browser-update-responses][main] alpha: new version, 13.5a7
by boklm (＠boklm) 29 Apr '24

29 Apr '24

boklm pushed to branch main at The Tor Project / Applications / Tor Browser update responses Commits: 54df007d by Nicolas Vigier at 2024-04-29T16:51:58+02:00 alpha: new version, 13.5a7 - - - - - 30 changed files: - update_3/alpha/.htaccess - − update_3/alpha/13.5a3-13.5a6-linux-i686-ALL.xml - − update_3/alpha/13.5a3-13.5a6-linux-x86_64-ALL.xml - − update_3/alpha/13.5a3-13.5a6-macos-ALL.xml - − update_3/alpha/13.5a3-13.5a6-windows-i686-ALL.xml - − update_3/alpha/13.5a3-13.5a6-windows-… [View More]

1 0

[Git][tpo/applications/mullvad-browser-update-responses][main] alpha: new version, 13.5a7
by boklm (＠boklm) 29 Apr '24

29 Apr '24

boklm pushed to branch main at The Tor Project / Applications / mullvad-browser-update-responses Commits: ac9f621a by Nicolas Vigier at 2024-04-29T15:33:08+02:00 alpha: new version, 13.5a7 - - - - - 29 changed files: - update_1/alpha/.htaccess - − update_1/alpha/13.5a3-13.5a6-linux-x86_64-ALL.xml - − update_1/alpha/13.5a3-13.5a6-macos-ALL.xml - − update_1/alpha/13.5a3-13.5a6-windows-x86_64-ALL.xml - − update_1/alpha/13.5a4-13.5a6-linux-x86_64-ALL.xml - − update_1/alpha/13.5a4-13.5a6-macos-… [View More]

1 0

[Git][tpo/applications/tor-browser-build] Pushed new tag mb-13.5a7-build2
by boklm (＠boklm) 28 Apr '24

28 Apr '24

boklm pushed new tag mb-13.5a7-build2 at The Tor Project / Applications / tor-browser-build -- This project does not include diff previews in email notifications. View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/tree/mb-… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-build][main] Bug 41114: Mullvad Browser 13.5a7-build2
by richard (＠richard) 25 Apr '24

25 Apr '24

richard pushed to branch main at The Tor Project / Applications / tor-browser-build Commits: 5059b98c by Nicolas Vigier at 2024-04-25T17:01:35+02:00 Bug 41114: Mullvad Browser 13.5a7-build2 Update pkg_revision to force rebuild of linux-packages. Having var/browser_release_date being in the past should solve the reproducibility problem of the deb file. - - - - - 5 changed files: - .gitlab/issue_templates/Release Prep - Mullvad Browser Alpha.md - .gitlab/issue_templates/Release Prep - … [View More]Mullvad Browser Stable.md - .gitlab/issue_templates/Release Prep - Tor Browser Alpha.md - .gitlab/issue_templates/Release Prep - Tor Browser Stable.md - rbm.conf Changes: ===================================== .gitlab/issue_templates/Release Prep - Mullvad Browser Alpha.md ===================================== @@ -39,7 +39,7 @@ Mullvad Browser Alpha (and Nightly) are on the `main` branch - [ ] Update `rbm.conf` - [ ] `var/torbrowser_version` : update to next version - [ ] `var/torbrowser_build` : update to `$(MULLVAD_BROWSER_BUILD_N)` - - [ ] `var/browser_release_date` : update to build date + - [ ] `var/browser_release_date` : update to build date. For the build to be reproducible, the date should be in the past when building. - [ ] `var/torbrowser_incremental_from` : update to previous Desktop version - **NOTE**: We try to build incrementals for the previous 3 desktop versions except in the case of a watershed update - **IMPORTANT**: Really *actually* make sure this is the previous Desktop version or else the `make mullvadbrowser-incrementals-*` step will fail ===================================== .gitlab/issue_templates/Release Prep - Mullvad Browser Stable.md ===================================== @@ -39,7 +39,7 @@ Mullvad Browser Stable lives in the various `maint-$(MULLVAD_BROWSER_MAJOR).$(MU - [ ] Update `rbm.conf` - [ ] `var/torbrowser_version` : update to next version - [ ] `var/torbrowser_build` : update to `$(MULLVAD_BROWSER_BUILD_N)` - - [ ] `var/browser_release_date` : update to build date + - [ ] `var/browser_release_date` : update to build date. For the build to be reproducible, the date should be in the past when building. - [ ] `var/torbrowser_incremental_from` : update to previous Desktop version - **NOTE**: We try to build incrementals for the previous 3 desktop versions except in the case of a watershed update - **IMPORTANT**: Really *actually* make sure this is the previous Desktop version or else the `make mullvadbrowser-incrementals-*` step will fail ===================================== .gitlab/issue_templates/Release Prep - Tor Browser Alpha.md ===================================== @@ -38,7 +38,7 @@ Tor Browser Alpha (and Nightly) are on the `main` branch - [ ] Update `rbm.conf` - [ ] `var/torbrowser_version` : update to next version - [ ] `var/torbrowser_build` : update to `$(TOR_BROWSER_BUILD_N)` - - [ ] `var/browser_release_date` : update to build date + - [ ] `var/browser_release_date` : update to build date. For the build to be reproducible, the date should be in the past when building. - [ ] ***(Desktop Only)***`var/torbrowser_incremental_from` : update to previous Desktop version - **NOTE**: We try to build incrementals for the previous 3 desktop versions except in the case of a watershed update - **IMPORTANT**: Really *actually* make sure this is the previous Desktop version or else the `make torbrowser-incrementals-*` step will fail ===================================== .gitlab/issue_templates/Release Prep - Tor Browser Stable.md ===================================== @@ -38,7 +38,7 @@ Tor Browser Stable lives in the various `maint-$(TOR_BROWSER_MAJOR).$(TOR_BROWSE - [ ] Update `rbm.conf` - [ ] `var/torbrowser_version` : update to next version - [ ] `var/torbrowser_build` : update to `$(TOR_BROWSER_BUILD_N)` - - [ ] `var/browser_release_date` : update to build date + - [ ] `var/browser_release_date` : update to build date. For the build to be reproducible, the date should be in the past when building. - [ ] ***(Desktop Only)***`var/torbrowser_incremental_from` : update to previous Desktop version - **NOTE**: We try to build incrementals for the previous 3 desktop versions except in the case of a watershed update - **IMPORTANT**: Really *actually* make sure this is the previous Desktop version or else the `make torbrowser-incrementals-*` step will fail ===================================== rbm.conf ===================================== @@ -74,11 +74,13 @@ buildconf: var: torbrowser_version: '13.5a7' - torbrowser_build: 'build1' + torbrowser_build: 'build2' torbrowser_incremental_from: - '13.5a6' - '13.5a5' - '13.5a4' + # This should be the date of when the build is started. For the build + # to be reproducible, browser_release_date should always be in the past. browser_release_date: '2024/04/25 12:00:00' browser_release_date_timestamp: '[% USE date; date.format(c("var/browser_release_date"), "%s") %]' updater_enabled: 1 View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/5… -- This project does not include diff previews in email notifications. View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/5… You're receiving this email because of your account on gitlab.torproject.org. [View Less]

1 0

[Git][tpo/applications/tor-browser][tor-browser-115.10.0esr-13.5-1] fixup! Tor Browser strings
by Pier Angelo Vendrame (＠pierov) 24 Apr '24

24 Apr '24

Pier Angelo Vendrame pushed to branch tor-browser-115.10.0esr-13.5-1 at The Tor Project / Applications / Tor Browser Commits: 29ff3f1e by Henry Wilkes at 2024-04-24T16:53:07+01:00 fixup! Tor Browser strings Bug 42545: Rename "onionsite" to "onion site" in Fluent. - - - - - 1 changed file: - toolkit/locales/en-US/toolkit/global/tor-browser.ftl Changes: ===================================== toolkit/locales/en-US/toolkit/global/tor-browser.ftl =========… [View More]============================ @@ -611,25 +611,25 @@ rulesets-details-scope-input = # "Regular expression" refers to the computing term for a special pattern used for matching: https://en.wikipedia.org/wiki/Regular_expression. rulesets-details-scope-input-invalid = The scope could not be parsed as a regular expression -## Onionsite error page. -## "Onionsite" is an abbreviation of "onion website": a website whose domain URL ends in ".onion", which is reachable through the Tor network. +## Onion site error page. +## "Onion site" is an abbreviation of "onion website": a website whose domain URL ends in ".onion", which is reachable through the Tor network. -onion-neterror-page-title = Problem loading onionsite +onion-neterror-page-title = Problem loading onion site onion-neterror-authorization-title = Authentication required -onion-neterror-not-found-header = Onionsite not found -onion-neterror-not-found-description = The most likely cause is that the onionsite is offline. Contact the onionsite administrator. -onion-neterror-unreachable-header = Onionsite cannot be reached -onion-neterror-unreachable-description = The onionsite is unreachable due an internal error. -onion-neterror-disconnected-header = Onionsite has disconnected -onion-neterror-disconnected-description = The most likely cause is that the onionsite is offline. Contact the onionsite administrator. -onion-neterror-connection-failed-header = Unable to connect to onionsite -onion-neterror-connection-failed-description = The onionsite is busy or the Tor network is overloaded. Try again later. -onion-neterror-missing-authentication-header = Onionsite requires authentication -onion-neterror-missing-authentication-description = Access to the onionsite requires a key but none was provided. -onion-neterror-incorrect-authentication-header = Onionsite authentication failed -onion-neterror-incorrect-authetication-description = The provided key is incorrect or has been revoked. Contact the onionsite administrator. -onion-neterror-invalid-address-header = Invalid onionsite address -onion-neterror-invalid-address-description = The provided onionsite address is invalid. Please check that you entered it correctly. +onion-neterror-not-found-header = Onion site not found +onion-neterror-not-found-description = The most likely cause is that the onion site is offline. Contact the onion site administrator. +onion-neterror-unreachable-header = Onion site cannot be reached +onion-neterror-unreachable-description = The onion site is unreachable due an internal error. +onion-neterror-disconnected-header = Onion site has disconnected +onion-neterror-disconnected-description = The most likely cause is that the onion site is offline. Contact the onion site administrator. +onion-neterror-connection-failed-header = Unable to connect to onion site +onion-neterror-connection-failed-description = The onion site is busy or the Tor network is overloaded. Try again later. +onion-neterror-missing-authentication-header = Onion site requires authentication +onion-neterror-missing-authentication-description = Access to the onion site requires a key but none was provided. +onion-neterror-incorrect-authentication-header = Onion site authentication failed +onion-neterror-incorrect-authetication-description = The provided key is incorrect or has been revoked. Contact the onion site administrator. +onion-neterror-invalid-address-header = Invalid onion site address +onion-neterror-invalid-address-description = The provided onion site address is invalid. Please check that you entered it correctly. # "Circuit" refers to a Tor network circuit. -onion-neterror-timed-out-header = Onionsite circuit creation timed out -onion-neterror-timed-out-description = Failed to connect to the onionsite, possibly due to a poor network connection. +onion-neterror-timed-out-header = Onion site circuit creation timed out +onion-neterror-timed-out-description = Failed to connect to the onion site, possibly due to a poor network connection. View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/29ff3f1… -- This project does not include diff previews in email notifications. View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/29ff3f1… You're receiving this email because of your account on gitlab.torproject.org. [View Less]

1 0

[Git][tpo/applications/tor-browser][tor-browser-115.10.0esr-13.5-1] fixup! Lox integration
by Pier Angelo Vendrame (＠pierov) 24 Apr '24

24 Apr '24

Pier Angelo Vendrame pushed to branch tor-browser-115.10.0esr-13.5-1 at The Tor Project / Applications / Tor Browser Commits: 300bf571 by Henry Wilkes at 2024-04-24T12:27:50+00:00 fixup! Lox integration Bug 42543: Demote the validateInvitation console message to "info". - - - - - 1 changed file: - toolkit/components/lox/Lox.sys.mjs Changes: ===================================== toolkit/components/lox/Lox.sys.mjs ===================================== @@ -612,7 +612,7 @… [View More]

1 0

[Git][tpo/applications/tor-browser][tor-browser-115.10.0esr-13.5-1] fixup! Bug 40933: Add tor-launcher functionality
by Pier Angelo Vendrame (＠pierov) 24 Apr '24

24 Apr '24

Pier Angelo Vendrame pushed to branch tor-browser-115.10.0esr-13.5-1 at The Tor Project / Applications / Tor Browser Commits: a5f43320 by Pier Angelo Vendrame at 2024-04-23T18:40:17+02:00 fixup! Bug 40933: Add tor-launcher functionality Bug 42541: Bridges without fingerprint break the circuit display. The circuit display backend relies on GETCONF bridges because we want to know the pluggable transport for the circuit display and, as far as I can tell, no GETINFO command includes this … [View More]information. However, when we get a circuit from tor, we get its fingerprint, which is optional on the bridge lines. Therefore, in some cases we did not have the data to display, and we just hid the circuit display button. With this commit, when we miss the fingerprint of a bridge, we try to get it in another way. It might produce incorrect results (we rely on the IP address the user passes on the bridge line), but at least it will show the circuit display. - - - - - 1 changed file: - toolkit/components/tor-launcher/TorControlPort.sys.mjs Changes: ===================================== toolkit/components/tor-launcher/TorControlPort.sys.mjs ===================================== @@ -795,7 +795,64 @@ export class TorController { * @returns {Bridge[]} The configured bridges */ async getBridges() { - return (await this.#getConf("BRIDGE")).map(TorParsers.parseBridgeLine); + let missingId = false; + const bridges = (await this.#getConf("BRIDGE")).map(line => { + const info = TorParsers.parseBridgeLine(line); + if (!info.id) { + missingId = true; + } + return info; + }); + + // tor-browser#42541: bridge lines are allowed not to have a fingerprint. + // If such a bridge is in use, we will fail to associate it to the circuits, + // and the circuit display will not be shown. + // Tor provides a couple of GETINFO commands we can try to use to get more + // data about bridges, in particular GETINFO ns/purpose/bridge. + // While it tells us the bridge's IP (as configured by the user, which might + // be different from the real one with some PTs such as Snowflake), it does + // not tell the pluggable transport. + // Therefore, we need to start from the configured bridge lines, and if we + // detect that a bridge does not have a fingerprint, we try to associate one + // through its IP address and port. + // However, users can set them directly, therefore we might end up setting + // a fingerprint to the wrong line (e.g., if the IP address is reused). + // Also, we are not sure about when the data of ns/purpose/bridge is + // populated. + // Usually, we are interested only in the data of currently active bridges + // for the circuit display. So, as a matter of fact, we expect to have + // entries and to expose only the correct and working data in the frontend. + if (missingId) { + // See https://spec.torproject.org/dir-spec/consensus-formats.html. + // r <name> <identity> <digest> <date> <time> <address> <orport> <dirport> + const info = (await this.#getInfo("ns/purpose/bridge")).matchAll( + /^r\s+\S+\s+(?<identity>\S+)\s+\S+\s+\S+\s+\S+\s+(?<address>\S+)\s+(?<orport>\d+)/gm + ); + const b64ToHex = b64 => { + let hex = ""; + const raw = atob(b64); + for (let i = 0; i < raw.length; i++) { + hex += raw.charCodeAt(i).toString(16).toUpperCase().padStart(2, "0"); + } + return hex; + }; + const knownBridges = new Map( + Array.from(info, m => [ + `${m.groups.address}:${m.groups.orport}`, + b64ToHex(m.groups.identity), + ]) + ); + for (const b of bridges) { + if (!b.id) { + // We expect the addresses of these lines to be only IPv4, therefore + // we do not check for brackets, even though they might be matched by + // our regex. + b.id = knownBridges.get(b.addr) ?? ""; + } + } + } + + return bridges; } /** View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/a5f4332… -- This project does not include diff previews in email notifications. View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/a5f4332… You're receiving this email because of your account on gitlab.torproject.org. [View Less]

1 0

[Git][tpo/applications/mullvad-browser] Pushed new tag mullvad-browser-115.10.0esr-13.5-1-build2
by Pier Angelo Vendrame (＠pierov) 23 Apr '24

23 Apr '24

Pier Angelo Vendrame pushed new tag mullvad-browser-115.10.0esr-13.5-1-build2 at The Tor Project / Applications / Mullvad Browser -- This project does not include diff previews in email notifications. View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/tree/mullv… You're receiving this email because of your account on gitlab.torproject.org.

1 0