September 2024 - tor-commits - lists.torproject.org

[Git][tpo/applications/tor-browser][base-browser-128.2.0esr-14.0-1] fixup! Firefox preference overrides.
by morgan (＠morgan) 03 Sep '24

03 Sep '24

morgan pushed to branch base-browser-128.2.0esr-14.0-1 at The Tor Project / Applications / Tor Browser Commits: 59b4e929 by Pier Angelo Vendrame at 2024-09-03T04:21:15+00:00 fixup! Firefox preference overrides. Bug 40147: Re-enable Picture-in-Picture mode. Media capabilities are already protected by RFP. - - - - - 1 changed file: - browser/app/profile/001-base-profile.js Changes: ===================================== browser/app/profile/001-base-profile.js ===================================== @@ -425,7 +425,6 @@ pref("dom.netinfo.enabled", false); pref("network.http.referer.defaultPolicy", 2); // Bug 32948: Make referer behavior consistent regardless of private browing mode status pref("network.http.referer.defaultPolicy.pbmode", 2); pref("network.http.referer.XOriginTrimmingPolicy", 2); // Bug 17228: Force trim referer to scheme+host+port in cross-origin requests -pref("media.videocontrols.picture-in-picture.enabled", false); // Bug 40148: disable until audited in #40147 // Bug 40463: Disable Windows SSO pref("network.http.windows-sso.enabled", false, locked); // tor-browser#40424 View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/59b4e92… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/59b4e92… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-128.2.0esr-14.0-1] fixup! Firefox preference overrides.
by morgan (＠morgan) 03 Sep '24

03 Sep '24

morgan pushed to branch tor-browser-128.2.0esr-14.0-1 at The Tor Project / Applications / Tor Browser Commits: 7ec83a57 by Pier Angelo Vendrame at 2024-09-03T04:16:56+00:00 fixup! Firefox preference overrides. Bug 40147: Re-enable Picture-in-Picture mode. Media capabilities are already protected by RFP. - - - - - 1 changed file: - browser/app/profile/001-base-profile.js Changes: ===================================== browser/app/profile/001-base-profile.js ===================================== @@ -425,7 +425,6 @@ pref("dom.netinfo.enabled", false); pref("network.http.referer.defaultPolicy", 2); // Bug 32948: Make referer behavior consistent regardless of private browing mode status pref("network.http.referer.defaultPolicy.pbmode", 2); pref("network.http.referer.XOriginTrimmingPolicy", 2); // Bug 17228: Force trim referer to scheme+host+port in cross-origin requests -pref("media.videocontrols.picture-in-picture.enabled", false); // Bug 40148: disable until audited in #40147 // Bug 40463: Disable Windows SSO pref("network.http.windows-sso.enabled", false, locked); // tor-browser#40424 View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/7ec83a5… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/7ec83a5… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][base-browser-128.2.0esr-14.0-1] fixup! Firefox preference overrides.
by Pier Angelo Vendrame (＠pierov) 02 Sep '24

02 Sep '24

Pier Angelo Vendrame pushed to branch base-browser-128.2.0esr-14.0-1 at The Tor Project / Applications / Tor Browser Commits: d5811acf by Morgan at 2024-09-02T18:23:47+02:00 fixup! Firefox preference overrides. Bug 42735: Disable recent search suggestions; fix type in comment - - - - - 1 changed file: - browser/app/profile/001-base-profile.js Changes: ===================================== browser/app/profile/001-base-profile.js ===================================== @@ -171,7 +171,7 @@ pref("browser.urlbar.suggest.trending", false); pref("browser.urlbar.trending.featureGate", false); // tor-browser#42792: Explicitly turn off Pocket suggestions in the URL bar. pref("browser.urlbar.pocket.featureGate", false); -// tor-browser#41691: Hide "Firefox Suggets" in the UI +// tor-browser#41691: Hide "Firefox Suggest" in the UI pref("browser.urlbar.groupLabels.enabled", false); pref("browser.safebrowsing.malware.enabled", false); pref("browser.safebrowsing.phishing.enabled", false); @@ -187,6 +187,10 @@ pref("browser.safebrowsing.provider.mozilla.updateURL", ""); pref("browser.safebrowsing.provider.mozilla.gethashURL", ""); pref("datareporting.healthreport.uploadEnabled", false); pref("datareporting.policy.dataSubmissionEnabled", false); +// tor-browser#42735: Disable recent search suggestions +pref("browser.urlbar.recentsearches.featureGate", false); +pref("browser.urlbar.suggest.recentsearches", false); + // Make sure Unified Telemetry is really disabled, see: #18738. pref("toolkit.telemetry.unified", false); // This needs to be locked, or nightly builds will automatically lock it to true View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/d5811ac… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/d5811ac… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/mullvad-browser][mullvad-browser-128.2.0esr-14.0-1] fixup! Firefox preference overrides.
by Pier Angelo Vendrame (＠pierov) 02 Sep '24

02 Sep '24

Pier Angelo Vendrame pushed to branch mullvad-browser-128.2.0esr-14.0-1 at The Tor Project / Applications / Mullvad Browser Commits: 03170f93 by Morgan at 2024-09-02T18:24:00+02:00 fixup! Firefox preference overrides. Bug 42735: Disable recent search suggestions; fix type in comment - - - - - 1 changed file: - browser/app/profile/001-base-profile.js Changes: ===================================== browser/app/profile/001-base-profile.js ===================================== @@ -171,7 +171,7 @@ pref("browser.urlbar.suggest.trending", false); pref("browser.urlbar.trending.featureGate", false); // tor-browser#42792: Explicitly turn off Pocket suggestions in the URL bar. pref("browser.urlbar.pocket.featureGate", false); -// tor-browser#41691: Hide "Firefox Suggets" in the UI +// tor-browser#41691: Hide "Firefox Suggest" in the UI pref("browser.urlbar.groupLabels.enabled", false); pref("browser.safebrowsing.malware.enabled", false); pref("browser.safebrowsing.phishing.enabled", false); @@ -187,6 +187,10 @@ pref("browser.safebrowsing.provider.mozilla.updateURL", ""); pref("browser.safebrowsing.provider.mozilla.gethashURL", ""); pref("datareporting.healthreport.uploadEnabled", false); pref("datareporting.policy.dataSubmissionEnabled", false); +// tor-browser#42735: Disable recent search suggestions +pref("browser.urlbar.recentsearches.featureGate", false); +pref("browser.urlbar.suggest.recentsearches", false); + // Make sure Unified Telemetry is really disabled, see: #18738. pref("toolkit.telemetry.unified", false); // This needs to be locked, or nightly builds will automatically lock it to true View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/031… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/031… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-128.2.0esr-14.0-1] fixup! Firefox preference overrides.
by Pier Angelo Vendrame (＠pierov) 02 Sep '24

02 Sep '24

Pier Angelo Vendrame pushed to branch tor-browser-128.2.0esr-14.0-1 at The Tor Project / Applications / Tor Browser Commits: 44186d33 by Morgan at 2024-09-02T16:22:24+00:00 fixup! Firefox preference overrides. Bug 42735: Disable recent search suggestions; fix type in comment - - - - - 1 changed file: - browser/app/profile/001-base-profile.js Changes: ===================================== browser/app/profile/001-base-profile.js ===================================== @@ -171,7 +171,7 @@ pref("browser.urlbar.suggest.trending", false); pref("browser.urlbar.trending.featureGate", false); // tor-browser#42792: Explicitly turn off Pocket suggestions in the URL bar. pref("browser.urlbar.pocket.featureGate", false); -// tor-browser#41691: Hide "Firefox Suggets" in the UI +// tor-browser#41691: Hide "Firefox Suggest" in the UI pref("browser.urlbar.groupLabels.enabled", false); pref("browser.safebrowsing.malware.enabled", false); pref("browser.safebrowsing.phishing.enabled", false); @@ -187,6 +187,10 @@ pref("browser.safebrowsing.provider.mozilla.updateURL", ""); pref("browser.safebrowsing.provider.mozilla.gethashURL", ""); pref("datareporting.healthreport.uploadEnabled", false); pref("datareporting.policy.dataSubmissionEnabled", false); +// tor-browser#42735: Disable recent search suggestions +pref("browser.urlbar.recentsearches.featureGate", false); +pref("browser.urlbar.suggest.recentsearches", false); + // Make sure Unified Telemetry is really disabled, see: #18738. pref("toolkit.telemetry.unified", false); // This needs to be locked, or nightly builds will automatically lock it to true View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/44186d3… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/44186d3… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][base-browser-128.2.0esr-14.0-1] fixup! Firefox preference overrides.
by Pier Angelo Vendrame (＠pierov) 02 Sep '24

02 Sep '24

Pier Angelo Vendrame pushed to branch base-browser-128.2.0esr-14.0-1 at The Tor Project / Applications / Tor Browser Commits: ce72462c by Pier Angelo Vendrame at 2024-09-02T15:41:51+02:00 fixup! Firefox preference overrides. Fixed syntax error. - - - - - 1 changed file: - browser/app/profile/001-base-profile.js Changes: ===================================== browser/app/profile/001-base-profile.js ===================================== @@ -291,7 +291,7 @@ pref("extensions.screenshots.disabled", true); pref("extensions.webcompat-reporter.enabled", false); // Disable contentRelevancy component (which itself is gated on Nimbus) (tor-browser#42867) -pref("toolkit.contentRelevancy.enabled", false; +pref("toolkit.contentRelevancy.enabled", false); pref("toolkit.contentRelevancy.ingestEnabled", false); pref("toolkit.contentRelevancy.log", false); View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/ce72462… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/ce72462… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/mullvad-browser][mullvad-browser-128.2.0esr-14.0-1] fixup! Firefox preference overrides.
by Pier Angelo Vendrame (＠pierov) 02 Sep '24

02 Sep '24

Pier Angelo Vendrame pushed to branch mullvad-browser-128.2.0esr-14.0-1 at The Tor Project / Applications / Mullvad Browser Commits: b2e40769 by Pier Angelo Vendrame at 2024-09-02T15:38:17+02:00 fixup! Firefox preference overrides. Fixed syntax error. - - - - - 1 changed file: - browser/app/profile/001-base-profile.js Changes: ===================================== browser/app/profile/001-base-profile.js ===================================== @@ -291,7 +291,7 @@ pref("extensions.screenshots.disabled", true); pref("extensions.webcompat-reporter.enabled", false); // Disable contentRelevancy component (which itself is gated on Nimbus) (tor-browser#42867) -pref("toolkit.contentRelevancy.enabled", false; +pref("toolkit.contentRelevancy.enabled", false); pref("toolkit.contentRelevancy.ingestEnabled", false); pref("toolkit.contentRelevancy.log", false); View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/b2e… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/b2e… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-128.2.0esr-14.0-1] fixup! Firefox preference overrides.
by Pier Angelo Vendrame (＠pierov) 02 Sep '24

02 Sep '24

Pier Angelo Vendrame pushed to branch tor-browser-128.2.0esr-14.0-1 at The Tor Project / Applications / Tor Browser Commits: ad5e6e6b by Pier Angelo Vendrame at 2024-09-02T15:37:40+02:00 fixup! Firefox preference overrides. Fixed syntax error. - - - - - 1 changed file: - browser/app/profile/001-base-profile.js Changes: ===================================== browser/app/profile/001-base-profile.js ===================================== @@ -291,7 +291,7 @@ pref("extensions.screenshots.disabled", true); pref("extensions.webcompat-reporter.enabled", false); // Disable contentRelevancy component (which itself is gated on Nimbus) (tor-browser#42867) -pref("toolkit.contentRelevancy.enabled", false; +pref("toolkit.contentRelevancy.enabled", false); pref("toolkit.contentRelevancy.ingestEnabled", false); pref("toolkit.contentRelevancy.log", false); View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/ad5e6e6… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/ad5e6e6… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/mullvad-browser][mullvad-browser-128.2.0esr-14.0-1] 3 commits: fixup! Bug 42472: Spoof timezone in XSLT.
by Pier Angelo Vendrame (＠pierov) 02 Sep '24

02 Sep '24

Pier Angelo Vendrame pushed to branch mullvad-browser-128.2.0esr-14.0-1 at The Tor Project / Applications / Mullvad Browser Commits: 1bffea64 by Pier Angelo Vendrame at 2024-09-02T11:56:55+02:00 fixup! Bug 42472: Spoof timezone in XSLT. Revert "Bug 42472: Spoof timezone in XSLT." This reverts commit 7bdf1f4f6cd90346da288435564ca67d1b0e58e5. - - - - - a1950094 by Fatih at 2024-09-02T11:56:57+02:00 Bug 1891690: Return GMT when RFPTarget::JSDateTimeUTC is enabled. r=timhuang Differential Revision: https://phabricator.services.mozilla.com/D216411 - - - - - 8bfe4829 by Fatih at 2024-09-02T11:56:57+02:00 Bug 1912129: Reduce time precision for EXSLT date time function. r=timhuang Differential Revision: https://phabricator.services.mozilla.com/D218783 - - - - - 4 changed files: - browser/components/resistfingerprinting/test/browser/browser.toml - + browser/components/resistfingerprinting/test/browser/browser_exslt_time_precision.js - + browser/components/resistfingerprinting/test/browser/browser_exslt_timezone_load.js - dom/xslt/xslt/txEXSLTFunctions.cpp Changes: ===================================== browser/components/resistfingerprinting/test/browser/browser.toml ===================================== @@ -196,3 +196,7 @@ lineno = "172" ["browser_timezone.js"] lineno = "176" + +["browser_exslt_timezone_load.js"] + +["browser_exslt_time_precision.js"] ===================================== browser/components/resistfingerprinting/test/browser/browser_exslt_time_precision.js ===================================== @@ -0,0 +1,71 @@ +/** + * Bug 1912129 - A test case for verifying EXSLT date will report second-precise + * time fingerprinting resistance is enabled. + */ + +function getTime(tab) { + const extractTime = function () { + const xslText = ` + <xsl:stylesheet version="1.0" + xmlns:xsl="http://www.w3.org/1999/XSL/Transform" + xmlns:date="http://exslt.org/dates-and-times" + extension-element-prefixes="date"> + <xsl:output method="text" /> + <xsl:template match="/"> + <xsl:value-of select="date:date-time()" /> + </xsl:template> + </xsl:stylesheet>`; + + const parser = new DOMParser(); + const xsltProcessor = new XSLTProcessor(); + const xslStylesheet = parser.parseFromString(xslText, "application/xml"); + xsltProcessor.importStylesheet(xslStylesheet); + const xmlDoc = parser.parseFromString("<test />", "application/xml"); + const styledDoc = xsltProcessor.transformToDocument(xmlDoc); + const time = styledDoc.firstChild.textContent; + + return time; + }; + + const extractTimeExpr = `(${extractTime.toString()})();`; + + return SpecialPowers.spawn( + tab.linkedBrowser, + [extractTimeExpr], + async funccode => content.eval(funccode) + ); +} + +add_task(async function test_new_window() { + await SpecialPowers.pushPrefEnv({ + set: [ + ["privacy.fingerprintingProtection", true], + ["privacy.fingerprintingProtection.overrides", "+ReduceTimerPrecision"], + ], + }); + + // Open a tab for extracting the time from XSLT. + const tab = await BrowserTestUtils.openNewForegroundTab({ + gBrowser, + opening: TEST_PATH + "file_dummy.html", + forceNewProcess: true, + }); + + for (let i = 0; i < 10; i++) { + // eslint-disable-next-line mozilla/no-arbitrary-setTimeout + await new Promise(res => setTimeout(res, 25)); + + // The regex could be a lot shorter (e.g. /\.(\d{3})/) but I wrote the whole + // thing to make sure the time is in the expected format and to allow us + // to re-use this regex in the future if we need to. + // Note: Date format is not locale dependent. + const regex = /\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.(\d{3})[-+]\d{2}:\d{2}/; + const time = await getTime(tab); + const [, milliseconds] = time.match(regex); + + is(milliseconds, "000", "Date's precision was reduced to seconds."); + } + + BrowserTestUtils.removeTab(tab); + await SpecialPowers.popPrefEnv(); +}); ===================================== browser/components/resistfingerprinting/test/browser/browser_exslt_timezone_load.js ===================================== @@ -0,0 +1,62 @@ +/** + * Bug 1891690 - A test case for verifying EXSLT date will use Atlantic/Reykjavik + * timezone (GMT and "real" equivalent to UTC) after fingerprinting + * resistance is enabled. + */ + +function getTimeZone(tab) { + const extractTime = function () { + const xslText = ` + <xsl:stylesheet version="1.0" + xmlns:xsl="http://www.w3.org/1999/XSL/Transform" + xmlns:date="http://exslt.org/dates-and-times" + extension-element-prefixes="date"> + <xsl:output method="text" /> + <xsl:template match="/"> + <xsl:value-of select="date:date-time()" /> + </xsl:template> + </xsl:stylesheet>`; + + const parser = new DOMParser(); + const xsltProcessor = new XSLTProcessor(); + const xslStylesheet = parser.parseFromString(xslText, "application/xml"); + xsltProcessor.importStylesheet(xslStylesheet); + const xmlDoc = parser.parseFromString("<test />", "application/xml"); + const styledDoc = xsltProcessor.transformToDocument(xmlDoc); + const time = styledDoc.firstChild.textContent; + + return time; + }; + + const extractTimeExpr = `(${extractTime.toString()})();`; + + return SpecialPowers.spawn( + tab.linkedBrowser, + [extractTimeExpr], + async funccode => content.eval(funccode) + ); +} + +add_task(async function test_new_window() { + await SpecialPowers.pushPrefEnv({ + set: [ + ["privacy.fingerprintingProtection", true], + ["privacy.fingerprintingProtection.overrides", "+JSDateTimeUTC"], + ], + }); + + // Open a tab for extracting the time zone from XSLT. + const tab = await BrowserTestUtils.openNewForegroundTab({ + gBrowser, + opening: TEST_PATH + "file_dummy.html", + forceNewProcess: true, + }); + + SpecialPowers.Cu.getJSTestingFunctions().setTimeZone("America/Toronto"); + const timeZone = await getTimeZone(tab); + + ok(timeZone.endsWith("+00:00"), "Timezone was spoofed."); + + BrowserTestUtils.removeTab(tab); + await SpecialPowers.popPrefEnv(); +}); ===================================== dom/xslt/xslt/txEXSLTFunctions.cpp ===================================== @@ -590,14 +590,22 @@ nsresult txEXSLTFunctionCall::evaluate(txIEvalContext* aContext, // http://exslt.org/date/functions/date-time/ PRExplodedTime prtime; - PR_ExplodeTime(PR_Now(), - nsContentUtils::ShouldResistFingerprinting( - "We are not allowed to access the document at this " - "stage (we are given a txEarlyEvalContext context).", - RFPTarget::JSDateTimeUTC) - ? PR_GMTParameters - : PR_LocalTimeParameters, - &prtime); + Document* sourceDoc = getSourceDocument(aContext); + NS_ENSURE_STATE(sourceDoc); + + PRTimeParamFn timezone = + sourceDoc->ShouldResistFingerprinting(RFPTarget::JSDateTimeUTC) + ? PR_GMTParameters + : PR_LocalTimeParameters; + + PRTime time = + sourceDoc->ShouldResistFingerprinting(RFPTarget::ReduceTimerPrecision) + ? (PRTime)nsRFPService::ReduceTimePrecisionAsSecs( + (double)PR_Now() / PR_USEC_PER_SEC, 0, + RTPCallerType::ResistFingerprinting) * + PR_USEC_PER_SEC + : PR_Now(); + PR_ExplodeTime(time, timezone, &prtime); int32_t offset = (prtime.tm_params.tp_gmt_offset + prtime.tm_params.tp_dst_offset) / @@ -641,7 +649,7 @@ Expr::ResultType txEXSLTFunctionCall::getReturnType() { bool txEXSLTFunctionCall::isSensitiveTo(ContextSensitivity aContext) { if (mType == txEXSLTType::NODE_SET || mType == txEXSLTType::SPLIT || - mType == txEXSLTType::TOKENIZE) { + mType == txEXSLTType::TOKENIZE || mType == txEXSLTType::DATE_TIME) { return (aContext & PRIVATE_CONTEXT) || argsSensitiveTo(aContext); } return argsSensitiveTo(aContext); View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/compare/e6… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/compare/e6… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][base-browser-128.2.0esr-14.0-1] 4 commits: fixup! Bug 42472: Spoof timezone in XSLT.
by Pier Angelo Vendrame (＠pierov) 02 Sep '24

02 Sep '24

Pier Angelo Vendrame pushed to branch base-browser-128.2.0esr-14.0-1 at The Tor Project / Applications / Tor Browser Commits: 6b4e61a1 by Pier Angelo Vendrame at 2024-09-02T11:54:45+02:00 fixup! Bug 42472: Spoof timezone in XSLT. Revert "Bug 42472: Spoof timezone in XSLT." This reverts commit 7bdf1f4f6cd90346da288435564ca67d1b0e58e5. - - - - - 79feae7c by Fatih at 2024-09-02T11:54:49+02:00 Bug 1891690: Return GMT when RFPTarget::JSDateTimeUTC is enabled. r=timhuang Differential Revision: https://phabricator.services.mozilla.com/D216411 - - - - - 442dcc5e by Fatih at 2024-09-02T11:54:50+02:00 Bug 1912129: Reduce time precision for EXSLT date time function. r=timhuang Differential Revision: https://phabricator.services.mozilla.com/D218783 - - - - - cda055ab by Pier Angelo Vendrame at 2024-09-02T11:56:23+02:00 Bug 42774: Always hide the third-pary certs UI. - - - - - 5 changed files: - browser/components/preferences/privacy.js - browser/components/resistfingerprinting/test/browser/browser.toml - + browser/components/resistfingerprinting/test/browser/browser_exslt_time_precision.js - + browser/components/resistfingerprinting/test/browser/browser_exslt_timezone_load.js - dom/xslt/xslt/txEXSLTFunctions.cpp Changes: ===================================== browser/components/preferences/privacy.js ===================================== @@ -505,7 +505,8 @@ var gPrivacyPane = { let canConfigureThirdPartyCerts = (AppConstants.platform == "win" || AppConstants.platform == "macosx") && typeof Services.policies.getActivePolicies()?.Certificates - ?.ImportEnterpriseRoots == "undefined"; + ?.ImportEnterpriseRoots == "undefined" && + !AppConstants.BASE_BROWSER_VERSION; document.getElementById("certEnableThirdPartyToggleBox").hidden = !canConfigureThirdPartyCerts; ===================================== browser/components/resistfingerprinting/test/browser/browser.toml ===================================== @@ -196,3 +196,7 @@ lineno = "172" ["browser_timezone.js"] lineno = "176" + +["browser_exslt_timezone_load.js"] + +["browser_exslt_time_precision.js"] ===================================== browser/components/resistfingerprinting/test/browser/browser_exslt_time_precision.js ===================================== @@ -0,0 +1,71 @@ +/** + * Bug 1912129 - A test case for verifying EXSLT date will report second-precise + * time fingerprinting resistance is enabled. + */ + +function getTime(tab) { + const extractTime = function () { + const xslText = ` + <xsl:stylesheet version="1.0" + xmlns:xsl="http://www.w3.org/1999/XSL/Transform" + xmlns:date="http://exslt.org/dates-and-times" + extension-element-prefixes="date"> + <xsl:output method="text" /> + <xsl:template match="/"> + <xsl:value-of select="date:date-time()" /> + </xsl:template> + </xsl:stylesheet>`; + + const parser = new DOMParser(); + const xsltProcessor = new XSLTProcessor(); + const xslStylesheet = parser.parseFromString(xslText, "application/xml"); + xsltProcessor.importStylesheet(xslStylesheet); + const xmlDoc = parser.parseFromString("<test />", "application/xml"); + const styledDoc = xsltProcessor.transformToDocument(xmlDoc); + const time = styledDoc.firstChild.textContent; + + return time; + }; + + const extractTimeExpr = `(${extractTime.toString()})();`; + + return SpecialPowers.spawn( + tab.linkedBrowser, + [extractTimeExpr], + async funccode => content.eval(funccode) + ); +} + +add_task(async function test_new_window() { + await SpecialPowers.pushPrefEnv({ + set: [ + ["privacy.fingerprintingProtection", true], + ["privacy.fingerprintingProtection.overrides", "+ReduceTimerPrecision"], + ], + }); + + // Open a tab for extracting the time from XSLT. + const tab = await BrowserTestUtils.openNewForegroundTab({ + gBrowser, + opening: TEST_PATH + "file_dummy.html", + forceNewProcess: true, + }); + + for (let i = 0; i < 10; i++) { + // eslint-disable-next-line mozilla/no-arbitrary-setTimeout + await new Promise(res => setTimeout(res, 25)); + + // The regex could be a lot shorter (e.g. /\.(\d{3})/) but I wrote the whole + // thing to make sure the time is in the expected format and to allow us + // to re-use this regex in the future if we need to. + // Note: Date format is not locale dependent. + const regex = /\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.(\d{3})[-+]\d{2}:\d{2}/; + const time = await getTime(tab); + const [, milliseconds] = time.match(regex); + + is(milliseconds, "000", "Date's precision was reduced to seconds."); + } + + BrowserTestUtils.removeTab(tab); + await SpecialPowers.popPrefEnv(); +}); ===================================== browser/components/resistfingerprinting/test/browser/browser_exslt_timezone_load.js ===================================== @@ -0,0 +1,62 @@ +/** + * Bug 1891690 - A test case for verifying EXSLT date will use Atlantic/Reykjavik + * timezone (GMT and "real" equivalent to UTC) after fingerprinting + * resistance is enabled. + */ + +function getTimeZone(tab) { + const extractTime = function () { + const xslText = ` + <xsl:stylesheet version="1.0" + xmlns:xsl="http://www.w3.org/1999/XSL/Transform" + xmlns:date="http://exslt.org/dates-and-times" + extension-element-prefixes="date"> + <xsl:output method="text" /> + <xsl:template match="/"> + <xsl:value-of select="date:date-time()" /> + </xsl:template> + </xsl:stylesheet>`; + + const parser = new DOMParser(); + const xsltProcessor = new XSLTProcessor(); + const xslStylesheet = parser.parseFromString(xslText, "application/xml"); + xsltProcessor.importStylesheet(xslStylesheet); + const xmlDoc = parser.parseFromString("<test />", "application/xml"); + const styledDoc = xsltProcessor.transformToDocument(xmlDoc); + const time = styledDoc.firstChild.textContent; + + return time; + }; + + const extractTimeExpr = `(${extractTime.toString()})();`; + + return SpecialPowers.spawn( + tab.linkedBrowser, + [extractTimeExpr], + async funccode => content.eval(funccode) + ); +} + +add_task(async function test_new_window() { + await SpecialPowers.pushPrefEnv({ + set: [ + ["privacy.fingerprintingProtection", true], + ["privacy.fingerprintingProtection.overrides", "+JSDateTimeUTC"], + ], + }); + + // Open a tab for extracting the time zone from XSLT. + const tab = await BrowserTestUtils.openNewForegroundTab({ + gBrowser, + opening: TEST_PATH + "file_dummy.html", + forceNewProcess: true, + }); + + SpecialPowers.Cu.getJSTestingFunctions().setTimeZone("America/Toronto"); + const timeZone = await getTimeZone(tab); + + ok(timeZone.endsWith("+00:00"), "Timezone was spoofed."); + + BrowserTestUtils.removeTab(tab); + await SpecialPowers.popPrefEnv(); +}); ===================================== dom/xslt/xslt/txEXSLTFunctions.cpp ===================================== @@ -590,14 +590,22 @@ nsresult txEXSLTFunctionCall::evaluate(txIEvalContext* aContext, // http://exslt.org/date/functions/date-time/ PRExplodedTime prtime; - PR_ExplodeTime(PR_Now(), - nsContentUtils::ShouldResistFingerprinting( - "We are not allowed to access the document at this " - "stage (we are given a txEarlyEvalContext context).", - RFPTarget::JSDateTimeUTC) - ? PR_GMTParameters - : PR_LocalTimeParameters, - &prtime); + Document* sourceDoc = getSourceDocument(aContext); + NS_ENSURE_STATE(sourceDoc); + + PRTimeParamFn timezone = + sourceDoc->ShouldResistFingerprinting(RFPTarget::JSDateTimeUTC) + ? PR_GMTParameters + : PR_LocalTimeParameters; + + PRTime time = + sourceDoc->ShouldResistFingerprinting(RFPTarget::ReduceTimerPrecision) + ? (PRTime)nsRFPService::ReduceTimePrecisionAsSecs( + (double)PR_Now() / PR_USEC_PER_SEC, 0, + RTPCallerType::ResistFingerprinting) * + PR_USEC_PER_SEC + : PR_Now(); + PR_ExplodeTime(time, timezone, &prtime); int32_t offset = (prtime.tm_params.tp_gmt_offset + prtime.tm_params.tp_dst_offset) / @@ -641,7 +649,7 @@ Expr::ResultType txEXSLTFunctionCall::getReturnType() { bool txEXSLTFunctionCall::isSensitiveTo(ContextSensitivity aContext) { if (mType == txEXSLTType::NODE_SET || mType == txEXSLTType::SPLIT || - mType == txEXSLTType::TOKENIZE) { + mType == txEXSLTType::TOKENIZE || mType == txEXSLTType::DATE_TIME) { return (aContext & PRIVATE_CONTEXT) || argsSensitiveTo(aContext); } return argsSensitiveTo(aContext); View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/bd93d2… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/bd93d2… You're receiving this email because of your account on gitlab.torproject.org.

1 0