October 2025 - tor-commits - lists.torproject.org

[Git][tpo/applications/tor-browser] Pushed new branch tor-browser-115.29.0esr-13.5-1
by Pier Angelo Vendrame (＠pierov) 13 Oct '25

13 Oct '25

Pier Angelo Vendrame pushed new branch tor-browser-115.29.0esr-13.5-1 at The Tor Project / Applications / Tor Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/tree/tor-brows… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-115.28.0esr-13.5-1] 3 commits: Bug 1881258 - Make HTML mimesniffing match the spec...
by Pier Angelo Vendrame (＠pierov) 13 Oct '25

13 Oct '25

Pier Angelo Vendrame pushed to branch tor-browser-115.28.0esr-13.5-1 at The Tor Project / Applications / Tor Browser Commits: 6ffceaac by Valentin Gosu at 2025-10-08T14:15:40+02:00 Bug 1881258 - Make HTML mimesniffing match the spec r=necko-reviewers,jesup,devtools-reviewers,nchevobbe Differential Revision: https://phabricator.services.mozilla.com/D255120 - - - - - beca59e1 by Jonathan Kew at 2025-10-08T14:15:44+02:00 Bug 1988244 - Guard the space-features bit vectors with the feature-info mutex. a=RyanVM DONTBUILD Original Revision: https://phabricator.services.mozilla.com/D266136 Differential Revision: https://phabricator.services.mozilla.com/D267025 - - - - - db14671a by Christian Holler (:decoder) at 2025-10-08T14:15:45+02:00 Bug 1990085 - Improve enum serialization in gfx. r=lsalzman a=RyanVM Differential Revision: https://phabricator.services.mozilla.com/D266443 - - - - - 13 changed files: - devtools/client/webconsole/test/browser/browser_webconsole_context_menu_copy_entire_message.js - devtools/client/webconsole/test/browser/browser_webconsole_context_menu_copy_message_with_async_stacktrace.js - devtools/client/webconsole/test/browser/browser_webconsole_context_menu_copy_message_with_framework_stacktrace.js - devtools/client/webconsole/test/browser/browser_webconsole_context_menu_export_console_output.js - devtools/client/webconsole/test/browser/browser_webconsole_css_error_impacted_elements.js - devtools/client/webconsole/test/browser/browser_webconsole_filter_by_input.js - devtools/shared/commands/resource/tests/browser_resources_css_messages.js - dom/tests/browser/set-samesite-cookies-and-redirect.sjs - gfx/2d/RecordingTypes.h - gfx/thebes/gfxFont.cpp - gfx/thebes/gfxFontEntry.h - modules/libpref/init/StaticPrefList.yaml - netwerk/streamconv/converters/nsUnknownDecoder.cpp Changes: ===================================== devtools/client/webconsole/test/browser/browser_webconsole_context_menu_copy_entire_message.js ===================================== @@ -5,6 +5,7 @@ const httpServer = createTestHTTPServer(); httpServer.registerPathHandler(`/`, function (request, response) { + response.setHeader("Content-Type", "text/html"); response.setStatusLine(request.httpVersion, 200, "OK"); response.write(` <meta charset=utf8> ===================================== devtools/client/webconsole/test/browser/browser_webconsole_context_menu_copy_message_with_async_stacktrace.js ===================================== @@ -8,6 +8,7 @@ const httpServer = createTestHTTPServer(); httpServer.registerPathHandler(`/`, function (request, response) { + response.setHeader("Content-Type", "text/html"); response.setStatusLine(request.httpVersion, 200, "OK"); response.write(`<script type="text/javascript" src="test.js"></script>`); }); ===================================== devtools/client/webconsole/test/browser/browser_webconsole_context_menu_copy_message_with_framework_stacktrace.js ===================================== @@ -5,6 +5,7 @@ const httpServer = createTestHTTPServer(); httpServer.registerPathHandler(`/`, function (request, response) { + response.setHeader("Content-Type", "text/html"); response.setStatusLine(request.httpVersion, 200, "OK"); response.write(` <meta charset=utf8> ===================================== devtools/client/webconsole/test/browser/browser_webconsole_context_menu_export_console_output.js ===================================== @@ -6,6 +6,7 @@ const httpServer = createTestHTTPServer(); httpServer.registerPathHandler(`/`, function (request, response) { response.setStatusLine(request.httpVersion, 200, "OK"); + response.setHeader("Content-Type", "text/html"); response.write(` <html> <head> ===================================== devtools/client/webconsole/test/browser/browser_webconsole_css_error_impacted_elements.js ===================================== @@ -7,6 +7,7 @@ const httpServer = createTestHTTPServer(); httpServer.registerPathHandler(`/`, function (request, response) { response.setStatusLine(request.httpVersion, 200, "OK"); + response.setHeader("Content-Type", "text/html"); response.write(` <html> <head> ===================================== devtools/client/webconsole/test/browser/browser_webconsole_filter_by_input.js ===================================== @@ -207,6 +207,7 @@ function createServerAndGetTestUrl() { "/" + HTML_FILENAME, function (request, response) { response.setStatusLine(request.httpVersion, 200, "OK"); + response.setHeader("Content-Type", "text/html"); response.write(HTML_CONTENT); } ); ===================================== devtools/shared/commands/resource/tests/browser_resources_css_messages.js ===================================== @@ -12,6 +12,7 @@ const { MESSAGE_CATEGORY } = require("resource://devtools/shared/constants.js"); const httpServer = createTestHTTPServer(); httpServer.registerPathHandler(`/test_css_messages.html`, (req, res) => { res.setStatusLine(req.httpVersion, 200, "OK"); + res.setHeader("Content-Type", "text/html"); res.write(`<meta charset=utf8> <style> html { ===================================== dom/tests/browser/set-samesite-cookies-and-redirect.sjs ===================================== @@ -17,6 +17,7 @@ function handleRequest(request, response) { "strictHeader=true; path=/; SameSite=Strict", true ); + response.setHeader("Content-Type", "text/html"); response.write(` <head> <meta http-equiv='set-cookie' content='laxMeta=true; path=/; SameSite=Lax'> @@ -33,6 +34,7 @@ function handleRequest(request, response) { let baseURI = "https://example.org/" + request.path.replace(/[a-z-]*\.sjs/, "mimeme.sjs?type="); + response.setHeader("Content-Type", "text/html"); response.write(` <link rel="stylesheet" type="text/css" href="${baseURI}css"> <iframe src="${baseURI}html"></iframe> ===================================== gfx/2d/RecordingTypes.h ===================================== @@ -70,9 +70,16 @@ void ReadElement(S& aStream, T& aElement) { template <class S, class T> void ReadElementConstrained(S& aStream, T& aElement, const T& aMinValue, const T& aMaxValue) { - ElementStreamFormat<S, T>::Read(aStream, aElement); - if (aElement < aMinValue || aElement > aMaxValue) { + std::underlying_type_t<T> value = 0; + ReadElement(aStream, value); + + auto minInt = static_cast<std::underlying_type_t<T>>(aMinValue); + auto maxInt = static_cast<std::underlying_type_t<T>>(aMaxValue); + + if (value < minInt || value > maxInt) { aStream.SetIsBad(); + } else { + aElement = static_cast<T>(value); } } template <class S, class T> ===================================== gfx/thebes/gfxFont.cpp ===================================== @@ -1378,6 +1378,7 @@ void gfxFont::CheckForFeaturesInvolvingSpace() const { flags = flags | gfxFontEntry::SpaceFeatures::HasFeatures; uint32_t index = static_cast<uint32_t>(s) >> 5; uint32_t bit = static_cast<uint32_t>(s) & 0x1f; + MutexAutoLock lock(mFontEntry->mFeatureInfoLock); if (isDefaultFeature) { mFontEntry->mDefaultSubSpaceFeatures[index] |= (1 << bit); } else { @@ -1391,8 +1392,11 @@ void gfxFont::CheckForFeaturesInvolvingSpace() const { // spaces in default features of default script? // ==> can't use word cache, skip GPOS analysis bool canUseWordCache = true; - if (HasSubstitution(mFontEntry->mDefaultSubSpaceFeatures, Script::COMMON)) { - canUseWordCache = false; + { + MutexAutoLock lock(mFontEntry->mFeatureInfoLock); + if (HasSubstitution(mFontEntry->mDefaultSubSpaceFeatures, Script::COMMON)) { + canUseWordCache = false; + } } // GPOS lookups - distinguish kerning from non-kerning features @@ -1411,6 +1415,7 @@ void gfxFont::CheckForFeaturesInvolvingSpace() const { } if (MOZ_UNLIKELY(log)) { + MutexAutoLock lock(mFontEntry->mFeatureInfoLock); TimeDuration elapsed = TimeStamp::Now() - start; LOG_FONTINIT(( "(fontinit-spacelookups) font: %s - " @@ -1445,6 +1450,7 @@ bool gfxFont::HasSubstitutionRulesWithSpaceLookups(Script aRunScript) const { } // default features have space lookups ==> true + MutexAutoLock lock(mFontEntry->mFeatureInfoLock); if (HasSubstitution(mFontEntry->mDefaultSubSpaceFeatures, Script::COMMON) || HasSubstitution(mFontEntry->mDefaultSubSpaceFeatures, aRunScript)) { return true; ===================================== gfx/thebes/gfxFontEntry.h ===================================== @@ -592,9 +592,10 @@ class gfxFontEntry { // bitvector of substitution space features per script, one each // for default and non-default features - uint32_t mDefaultSubSpaceFeatures[(int(Script::NUM_SCRIPT_CODES) + 31) / 32]; - uint32_t - mNonDefaultSubSpaceFeatures[(int(Script::NUM_SCRIPT_CODES) + 31) / 32]; + uint32_t mDefaultSubSpaceFeatures[(int(Script::NUM_SCRIPT_CODES) + 31) / + 32] MOZ_GUARDED_BY(mFeatureInfoLock); + uint32_t mNonDefaultSubSpaceFeatures[(int(Script::NUM_SCRIPT_CODES) + 31) / + 32] MOZ_GUARDED_BY(mFeatureInfoLock); mozilla::Atomic<uint32_t> mUVSOffset; ===================================== modules/libpref/init/StaticPrefList.yaml ===================================== @@ -12833,6 +12833,14 @@ value: true mirror: always +# If true, it will include extra tags to be sniffed by nsUnknownDecoder +# These tags were previously sniffed by Firefox for legacy/webcompat but +# are not part of the MIME sniffing spec. +- name: network.mimesniff.extra_moz_html_tags + type: RelaxedAtomicBool + value: false + mirror: always + # The maximum count that we allow socket prrocess to crash. If this count is # reached, we won't use networking over socket process. - name: network.max_socket_process_failed_count ===================================== netwerk/streamconv/converters/nsUnknownDecoder.cpp ===================================== @@ -492,6 +492,7 @@ void nsUnknownDecoder::DetermineContentType(nsIRequest* aRequest) { #endif } +// https://mimesniff.spec.whatwg.org/#identifying-a-resource-with-an-unknown-m… bool nsUnknownDecoder::SniffForHTML(nsIRequest* aRequest) { MutexAutoLock lock(mMutex); @@ -517,34 +518,44 @@ bool nsUnknownDecoder::SniffForHTML(nsIRequest* aRequest) { return false; } - // If we seem to be SGML or XML and we got down here, just pretend we're HTML - if (*str == '!' || *str == '?') { - mContentType = TEXT_HTML; + uint32_t bufSize = end - str; + nsDependentCSubstring substr(str, bufSize); + + if (StringBeginsWith(substr, "?xml"_ns)) { + mContentType = TEXT_XML; return true; } - uint32_t bufSize = end - str; // We use sizeof(_tagstr) below because that's the length of _tagstr // with the one char " " or ">" appended. -#define MATCHES_TAG(_tagstr) \ - (bufSize >= sizeof(_tagstr) && \ - (nsCRT::strncasecmp(str, _tagstr " ", sizeof(_tagstr)) == 0 || \ - nsCRT::strncasecmp(str, _tagstr ">", sizeof(_tagstr)) == 0)) +#define MATCHES_TAG(_tagstr) \ + (substr.Length() >= sizeof(_tagstr) && \ + StringBeginsWith(substr, _tagstr##_ns, \ + nsCaseInsensitiveCStringComparator) && \ + (substr[sizeof(_tagstr) - 1] == ' ' || substr[sizeof(_tagstr) - 1] == '>')) - if (MATCHES_TAG("html") || MATCHES_TAG("frameset") || MATCHES_TAG("body") || + if (MATCHES_TAG("!DOCTYPE HTML") || MATCHES_TAG("html") || MATCHES_TAG("head") || MATCHES_TAG("script") || MATCHES_TAG("iframe") || - MATCHES_TAG("a") || MATCHES_TAG("img") || MATCHES_TAG("table") || - MATCHES_TAG("title") || MATCHES_TAG("link") || MATCHES_TAG("base") || - MATCHES_TAG("style") || MATCHES_TAG("div") || MATCHES_TAG("p") || - MATCHES_TAG("font") || MATCHES_TAG("applet") || MATCHES_TAG("meta") || - MATCHES_TAG("center") || MATCHES_TAG("form") || MATCHES_TAG("isindex") || - MATCHES_TAG("h1") || MATCHES_TAG("h2") || MATCHES_TAG("h3") || - MATCHES_TAG("h4") || MATCHES_TAG("h5") || MATCHES_TAG("h6") || - MATCHES_TAG("b") || MATCHES_TAG("pre")) { + MATCHES_TAG("h1") || MATCHES_TAG("div") || MATCHES_TAG("font") || + MATCHES_TAG("table") || MATCHES_TAG("a") || MATCHES_TAG("style") || + MATCHES_TAG("title") || MATCHES_TAG("b") || MATCHES_TAG("body") || + MATCHES_TAG("br") || MATCHES_TAG("p") || MATCHES_TAG("!--")) { mContentType = TEXT_HTML; return true; } + if (StaticPrefs::network_mimesniff_extra_moz_html_tags()) { + if (MATCHES_TAG("frameset") || MATCHES_TAG("img") || MATCHES_TAG("link") || + MATCHES_TAG("base") || MATCHES_TAG("applet") || MATCHES_TAG("meta") || + MATCHES_TAG("center") || MATCHES_TAG("form") || + MATCHES_TAG("isindex") || MATCHES_TAG("h2") || MATCHES_TAG("h3") || + MATCHES_TAG("h4") || MATCHES_TAG("h5") || MATCHES_TAG("h6") || + MATCHES_TAG("pre")) { + mContentType = TEXT_HTML; + return true; + } + } + #undef MATCHES_TAG return false; View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/1a51c1… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/1a51c1… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-build][main] 2 commits: Bug 41270: Add updater rewriterules to make 13.5.7 a watershed
by boklm (＠boklm) 10 Oct '25

10 Oct '25

boklm pushed to branch main at The Tor Project / Applications / tor-browser-build Commits: 0e6c4e0a by Nicolas Vigier at 2025-10-09T14:04:50+02:00 Bug 41270: Add updater rewriterules to make 13.5.7 a watershed Co-authored-by: Pier Angelo Vendrame <pierov(a)torproject.org> - - - - - 9aa33f3b by Nicolas Vigier at 2025-10-09T14:08:02+02:00 Bug 41588: Restore legacy channel support in projects/release/update_responses_config.yml - - - - - 2 changed files: - projects/release/update_responses_config.yml - rbm.conf Changes: ===================================== projects/release/update_responses_config.yml ===================================== @@ -33,6 +33,9 @@ build_targets: channels: [% c('var/channel') %]: - [% c("var/torbrowser_version") %] +[% IF c("var/tor-browser") && c("var/torbrowser_legacy_version") -%] + - [% c("var/torbrowser_legacy_version") %] +[% END -%] versions: [% c("var/torbrowser_version") %]: [% IF c("var/create_unsigned_incrementals") -%] @@ -69,6 +72,25 @@ versions: minSupportedInstructionSet: SSE2 linux-x86_64: minSupportedInstructionSet: SSE2 +[% IF c("var/tor-browser") && c("var/torbrowser_legacy_version") -%] + [% c("var/torbrowser_legacy_version") %]: + mar_channel_id: [% c('var/mar_channel_id') %] + platformVersion: [% c('var/torbrowser_legacy_platform_version') %] + detailsURL: https://blog.torproject.org/new[% IF c("var/alpha") %]-alpha[% END %]-release-tor-browser-[% c("var/torbrowser_legacy_version") FILTER remove('\.') %] + # minSupportedOsVersion on macOS corresponds to the Darwin version ( https://en.wikipedia.org/wiki/Darwin_(operating_system) ) + macos: + # macOS v10.12.0 + minSupportedOSVersion: 16.0.0 + # minSupportedOsVersion on Windows corresponds to the operating system version ( https://docs.microsoft.com/en-us/windows/win32/sysinfo/operating-system-ver… ) + windows-i686: + # Windows 7 + minSupportedOSVersion: 6.1 + minSupportedInstructionSet: SSE2 + windows-x86_64: + # Windows 7 + minSupportedOSVersion: 6.1 + minSupportedInstructionSet: SSE2 +[% END -%] mar_compression: xz [% IF c("var/tor-browser") -%] tag: 'tbb-[% c("var/torbrowser_version") %]-[% c("var/torbrowser_build") %]' @@ -99,4 +121,9 @@ htaccess_rewrite_rules: RewriteRule ^[^/]+/11\.0.*/.* https://aus1.torproject.org/torbrowser/update_pre12.0/release/$0 [last] RewriteRule ^[^/]+/11\.5/.* https://aus1.torproject.org/torbrowser/update_pre12.0/release/$0 [last] RewriteRule ^[^/]+/11\.5\.[01234567]/.* https://aus1.torproject.org/torbrowser/update_pre12.0/release/$0 [last] + # tor-browser-build#41270: make 13.5.7 a watershed update + RewriteRule ^[^/]+/1[12]\.[05].*/.* https://aus1.torproject.org/torbrowser/update_pre14.0/release/$0 [last] + RewriteRule ^[^/]+/13\.0.*/.* https://aus1.torproject.org/torbrowser/update_pre14.0/release/$0 [last] + RewriteRule ^[^/]+/13\.5/.* https://aus1.torproject.org/torbrowser/update_pre14.0/release/$0 [last] + RewriteRule ^[^/]+/13\.5\.[0123456]/.* https://aus1.torproject.org/torbrowser/update_pre14.0/release/$0 [last] [% END -%] ===================================== rbm.conf ===================================== @@ -133,6 +133,9 @@ var: - 14.5a6 mar_channel_id: '[% c("var/projectname") %]-torproject-[% c("var/channel") %]' +# torbrowser_legacy_version: 13.5.22 +# torbrowser_legacy_platform_version: 115.28.0 + # By default, we sort the list of installed packages. This allows sharing # containers with identical list of packages, even if they are not listed # in the same order. In the cases where the installation order is View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/compare/… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/compare/… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-140.4.0esr-15.0-1] fixup! TB 41972: [android] Disable Mozilla onboarding
by Dan Ballard (＠dan) 09 Oct '25

09 Oct '25

Dan Ballard pushed to branch tor-browser-140.4.0esr-15.0-1 at The Tor Project / Applications / Tor Browser Commits: f0d854d4 by clairehurst at 2025-10-09T15:58:58-06:00 fixup! TB 41972: [android] Disable Mozilla onboarding Bug_43735: Fully disable extensions onboarding - - - - - 3 changed files: - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/components/menu/MenuDialogFragment.kt - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/components/menu/compose/ExtensionsSubmenu.kt - mobile/android/fenix/app/src/main/java/org/mozilla/fenix/components/menu/middleware/MenuDialogMiddleware.kt Changes: ===================================== mobile/android/fenix/app/src/main/java/org/mozilla/fenix/components/menu/MenuDialogFragment.kt ===================================== @@ -364,7 +364,7 @@ class MenuDialogFragment : BottomSheetDialogFragment() { } val showExtensionsOnboarding by store.observeAsState(initialValue = false) { state -> - state.extensionMenuState.showExtensionsOnboarding + false } val showDisabledExtensionsOnboarding by store.observeAsState(initialValue = false) { state -> ===================================== mobile/android/fenix/app/src/main/java/org/mozilla/fenix/components/menu/compose/ExtensionsSubmenu.kt ===================================== @@ -66,7 +66,7 @@ internal fun ExtensionsSubmenu( ) }, ) { - if (showExtensionsOnboarding || showDisabledExtensionsOnboarding) { + if (false) { ExtensionsSubmenuBanner( title = if (showExtensionsOnboarding) { stringResource( ===================================== mobile/android/fenix/app/src/main/java/org/mozilla/fenix/components/menu/middleware/MenuDialogMiddleware.kt ===================================== @@ -179,7 +179,7 @@ class MenuDialogMiddleware( store.dispatch(MenuAction.UpdateAvailableAddons(addons.filter { it.isInstalled() && it.isEnabled() })) - if (addons.any { it.isInstalled() }) { + if (true) { store.dispatch(MenuAction.UpdateShowExtensionsOnboarding(false)) store.dispatch(MenuAction.UpdateManageExtensionsMenuItemVisibility(true)) return@launch @@ -190,7 +190,7 @@ class MenuDialogMiddleware( .shuffled() .take(NUMBER_OF_RECOMMENDED_ADDONS_TO_SHOW) - if (recommendedAddons.isNotEmpty()) { + if (false) { store.dispatch( MenuAction.UpdateExtensionState( recommendedAddons = recommendedAddons, View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/f0d854d… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/f0d854d… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/mullvad-browser][mullvad-browser-140.3.0esr-15.0-1] 5 commits: fixup! BB 19741: Fix FPI with OpenSearch.
by Pier Angelo Vendrame (＠pierov) 08 Oct '25

08 Oct '25

Pier Angelo Vendrame pushed to branch mullvad-browser-140.3.0esr-15.0-1 at The Tor Project / Applications / Mullvad Browser Commits: 22bbf08b by Pier Angelo Vendrame at 2025-10-08T21:50:39+02:00 fixup! BB 19741: Fix FPI with OpenSearch. This reverts commit 55015024a190faf1b69c4b7962ae9c6d5a4fed9c. This reverts commit 771d640c9a037885731802bf868addd68fd678a1. - - - - - 6aa07685 by Pier Angelo Vendrame at 2025-10-08T21:50:41+02:00 Bug 1987600 - Add origin attributes to OpenSearch. r=search-reviewers,Standard8 Differential Revision: https://phabricator.services.mozilla.com/D265878 - - - - - c381b8e6 by John M. Schanck at 2025-10-08T21:50:41+02:00 Bug 1989986 - enable mlkem768x25519 in beta and release on Android. r=nkulatova Differential Revision: https://phabricator.services.mozilla.com/D265640 - - - - - ccff7add by Pier Angelo Vendrame at 2025-10-08T21:50:41+02:00 fixup! BB 43664: Automatically check the PBM checkbox when in always-on PBM. This reverts commit 513f129ea336d1e0bd513eb2c1f7d6b029f0dd47. - - - - - cb4aeda9 by Pier Angelo Vendrame at 2025-10-08T21:50:42+02:00 Bug 1987183 - Automatically check the addon PBM checkbox when in always-on PBM. r=robwu Differential Revision: https://phabricator.services.mozilla.com/D263934 - - - - - 9 changed files: - browser/base/content/browser-addons.js - browser/components/extensions/test/browser/browser-private.toml - + browser/components/extensions/test/browser/browser_always_on_pbm_prompt.js - browser/components/search/SearchUIUtils.sys.mjs - browser/modules/ExtensionsUI.sys.mjs - modules/libpref/init/StaticPrefList.yaml - toolkit/components/search/OpenSearchLoader.sys.mjs - toolkit/components/search/SearchUtils.sys.mjs - tools/(a)types/generated/lib.gecko.xpcom.d.ts Changes: ===================================== browser/base/content/browser-addons.js ===================================== @@ -20,7 +20,6 @@ ChromeUtils.defineESModuleGetters(lazy, { ExtensionPermissions: "resource://gre/modules/ExtensionPermissions.sys.mjs", OriginControls: "resource://gre/modules/ExtensionPermissions.sys.mjs", PERMISSION_L10N: "resource://gre/modules/ExtensionPermissionMessages.sys.mjs", - PrivateBrowsingUtils: "resource://gre/modules/PrivateBrowsingUtils.sys.mjs", SITEPERMS_ADDON_TYPE: "resource://gre/modules/addons/siteperms-addon-utils.sys.mjs", }); @@ -467,9 +466,7 @@ customElements.define( this.notification.options.customElementOptions; let checkboxEl = this.ownerDocument.createElement("moz-checkbox"); - checkboxEl.checked = - grantPrivateBrowsingAllowed || - lazy.PrivateBrowsingUtils.permanentPrivateBrowsing; + checkboxEl.checked = grantPrivateBrowsingAllowed; checkboxEl.addEventListener("change", () => { // NOTE: the popupnotification instances will be reused // and so the callback function is destructured here to ===================================== browser/components/extensions/test/browser/browser-private.toml ===================================== @@ -6,6 +6,8 @@ tags = "webextensions" prefs = ["browser.privatebrowsing.autostart=true"] support-files = ["head.js"] +["browser_always_on_pbm_prompt.js"] + ["browser_ext_tabs_cookieStoreId_private.js"] ["browser_ext_tabs_newtab_private.js"] ===================================== browser/components/extensions/test/browser/browser_always_on_pbm_prompt.js ===================================== @@ -0,0 +1,95 @@ +/* Any copyright is dedicated to the Public Domain. + http://creativecommons.org/publicdomain/zero/1.0/ */ + +"use strict"; + +const { AddonTestUtils } = ChromeUtils.importESModule( + "resource://testing-common/AddonTestUtils.sys.mjs" +); + +AddonTestUtils.initMochitest(this); + +const addonId = "test@pbm-checkbox"; +let xpi; + +async function testCheckbox(allowPbm, expectedCheckboxValue) { + const readyPromise = AddonTestUtils.promiseWebExtensionStartup(addonId); + + window.gURLBar.value = xpi.path; + window.gURLBar.focus(); + EventUtils.synthesizeKey("KEY_Enter", {}, window); + + const panel = await promisePopupNotificationShown("addon-webext-permissions"); + const checkbox = panel.querySelector( + "li.webext-perm-privatebrowsing > moz-checkbox" + ); + ok(checkbox, "We found the PBM checkbox"); + + is( + checkbox.checked, + expectedCheckboxValue, + `We expected the PBM checkbox ${expectedCheckboxValue ? "" : "not "}to be checked for this test case.` + ); + + if (checkbox.checked != allowPbm) { + let { promise, resolve } = Promise.withResolvers(); + checkbox.addEventListener("change", resolve, { once: true }); + checkbox.click(); + await promise; + } + + is(checkbox.checked, allowPbm, "The checkbox matches allowPbm."); + + // Accept the installation + panel.button.click(); + + await readyPromise; + + let policy = WebExtensionPolicy.getByID(addonId); + is( + policy.privateBrowsingAllowed, + allowPbm, + `Private browsing permission has ${allowPbm ? "" : "not "}been granted` + ); +} + +async function uninstall() { + const addon = await AddonManager.getAddonByID(addonId); + await addon.uninstall(); +} + +add_task(async function () { + is( + PrivateBrowsingUtils.permanentPrivateBrowsing, + true, + "We are in permanent PBM for this test" + ); + + xpi = AddonTestUtils.createTempWebExtensionFile({ + manifest: { + browser_specific_settings: { gecko: { id: addonId } }, + }, + }); + + await BrowserTestUtils.withNewTab({ gBrowser: window.gBrowser }, async () => { + // First run: install the addon for the first time. We do not let it run in + // PBM. + await testCheckbox(false, true); + // Second run: reinstall the already installed addon, to check the + // permission denial prevails on being in always-on PBM. + await testCheckbox(false, false); + }); + + await uninstall(); + + await BrowserTestUtils.withNewTab({ gBrowser: window.gBrowser }, async () => { + // Third run: install the addon for the first time, and let it run also in + // PBM. + await testCheckbox(true, true); + // Fourth run: reinstall the already installed addon, to check permission + // approval is persisted. + await testCheckbox(true, true); + }); + + await uninstall(); +}); ===================================== browser/components/search/SearchUIUtils.sys.mjs ===================================== @@ -184,7 +184,7 @@ export var SearchUIUtils = { await Services.search.addOpenSearchEngine( locationURL, image, - browsingContext?.originAttributes + browsingContext?.embedderElement?.contentPrincipal?.originAttributes ); } catch (ex) { let titleMsgName; ===================================== browser/modules/ExtensionsUI.sys.mjs ===================================== @@ -15,6 +15,7 @@ ChromeUtils.defineESModuleGetters(lazy, { AppMenuNotifications: "resource://gre/modules/AppMenuNotifications.sys.mjs", ExtensionData: "resource://gre/modules/Extension.sys.mjs", ExtensionPermissions: "resource://gre/modules/ExtensionPermissions.sys.mjs", + PrivateBrowsingUtils: "resource://gre/modules/PrivateBrowsingUtils.sys.mjs", OriginControls: "resource://gre/modules/ExtensionPermissions.sys.mjs", QuarantinedDomains: "resource://gre/modules/ExtensionPermissions.sys.mjs", }); @@ -413,7 +414,8 @@ export var ExtensionsUI = { !!strings.dataCollectionPermissions?.collectsTechnicalAndInteractionData; const incognitoPermissionName = "internal:privateBrowsingAllowed"; - let grantPrivateBrowsingAllowed = false; + let grantPrivateBrowsingAllowed = + lazy.PrivateBrowsingUtils.permanentPrivateBrowsing; if (showIncognitoCheckbox) { let { permissions } = await lazy.ExtensionPermissions.get(addon.id); grantPrivateBrowsingAllowed = permissions.includes( ===================================== modules/libpref/init/StaticPrefList.yaml ===================================== @@ -14999,11 +14999,7 @@ # Has no effect unless security.tls.enable_kyber is true. - name: network.http.http3.enable_kyber type: RelaxedAtomicBool -#ifdef ANDROID - value: @IS_NIGHTLY_BUILD@ -#else value: true -#endif mirror: always rust: true @@ -17061,11 +17057,7 @@ - name: security.tls.enable_kyber type: RelaxedAtomicBool -#ifdef ANDROID - value: @IS_NIGHTLY_BUILD@ -#else value: true -#endif mirror: always rust: true ===================================== toolkit/components/search/OpenSearchLoader.sys.mjs ===================================== @@ -98,8 +98,9 @@ const MOZSEARCH_LOCALNAME = "SearchPlugin"; * @param {string} [lastModified] * The UTC date when the engine was last updated, if any. * @param {object} [originAttributes] - * The first party domain of the site loading that manifest. The domain of the - * manifest will be used if not provided. + * The origin attributes of the site loading the manifest. If none are + * specified, the origin attributes will be formed of the first party domain + * based on the domain of the manifest. * @returns {Promise<OpenSearchProperties>} * The properties of the loaded OpenSearch engine. */ @@ -165,7 +166,8 @@ function loadEngineXML(sourceURI, lastModified, originAttributes = null) { sourceURI, // OpenSearchEngine is loading a definition file for a search engine, // TYPE_DOCUMENT captures that load best. - Ci.nsIContentPolicy.TYPE_DOCUMENT + Ci.nsIContentPolicy.TYPE_DOCUMENT, + originAttributes ); // we collect https telemetry for all top-level (document) loads. @@ -173,17 +175,6 @@ function loadEngineXML(sourceURI, lastModified, originAttributes = null) { ? Ci.nsILoadInfo.ALREADY_HTTPS : Ci.nsILoadInfo.NO_UPGRADE; - if (!originAttributes) { - originAttributes = {}; - try { - originAttributes.firstPartyDomain = - Services.eTLD.getSchemelessSite(sourceURI); - } catch (ex) { - console.error("Failed to get first party domain for the manifest", ex); - } - } - chan.loadInfo.originAttributes = originAttributes; - if (lastModified && chan instanceof Ci.nsIHttpChannel) { chan.setRequestHeader("If-Modified-Since", lastModified, false); } ===================================== toolkit/components/search/SearchUtils.sys.mjs ===================================== @@ -244,19 +244,34 @@ export var SearchUtils = { * The URL string from which to create an nsIChannel. * @param {nsContentPolicyType} contentPolicyType * The type of document being loaded. + * @param {object} [originAttributes] + * The origin attributes to associate to this channel. * @returns {nsIChannel} * an nsIChannel object, or null if the url is invalid. */ - makeChannel(url, contentPolicyType) { + makeChannel(url, contentPolicyType, originAttributes = null) { if (!contentPolicyType) { throw new Error("makeChannel called with invalid content policy type"); } try { let uri = typeof url == "string" ? Services.io.newURI(url) : url; - let principal = - uri.scheme == "moz-extension" - ? Services.scriptSecurityManager.createContentPrincipal(uri, {}) - : Services.scriptSecurityManager.createNullPrincipal({}); + let principal; + if (uri.scheme == "moz-extension") { + principal = Services.scriptSecurityManager.createContentPrincipal( + uri, + {} + ); + } else { + if (!originAttributes) { + originAttributes = {}; + try { + originAttributes.firstPartyDomain = + Services.eTLD.getSchemelessSite(uri); + } catch {} + } + principal = + Services.scriptSecurityManager.createNullPrincipal(originAttributes); + } return Services.io.newChannelFromURI( uri, ===================================== tools/(a)types/generated/lib.gecko.xpcom.d.ts ===================================== @@ -11613,7 +11613,7 @@ interface nsISearchService extends nsISupports, Enums<typeof nsISearchService_Op readonly hasSuccessfullyInitialized: boolean; runBackgroundChecks(): Promise<any>; resetToAppDefaultEngine(): void; - addOpenSearchEngine(engineURL: string, iconURL: string): Promise<any>; + addOpenSearchEngine(engineURL: string, iconURL: string, originAttributes?: any): Promise<any>; addUserEngine(formInfo: any): Promise<any>; addEnginesFromExtension(extension: any): Promise<any>; restoreDefaultEngines(): void; View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/compare/82… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/compare/82… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/mullvad-browser] Pushed new branch mullvad-browser-140.4.0esr-15.0-1
by Pier Angelo Vendrame (＠pierov) 08 Oct '25

08 Oct '25

Pier Angelo Vendrame pushed new branch mullvad-browser-140.4.0esr-15.0-1 at The Tor Project / Applications / Mullvad Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/tree/mullv… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/mullvad-browser] Pushed new tag base-browser-140.4.0esr-15.0-1-build1
by Pier Angelo Vendrame (＠pierov) 08 Oct '25

08 Oct '25

Pier Angelo Vendrame pushed new tag base-browser-140.4.0esr-15.0-1-build1 at The Tor Project / Applications / Mullvad Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/tree/base-… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser] Pushed new tag base-browser-140.4.0esr-15.0-1-build1
by Pier Angelo Vendrame (＠pierov) 08 Oct '25

08 Oct '25

Pier Angelo Vendrame pushed new tag base-browser-140.4.0esr-15.0-1-build1 at The Tor Project / Applications / Tor Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/tree/base-brow… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser] Pushed new branch base-browser-140.4.0esr-15.0-1
by Pier Angelo Vendrame (＠pierov) 08 Oct '25

08 Oct '25

Pier Angelo Vendrame pushed new branch base-browser-140.4.0esr-15.0-1 at The Tor Project / Applications / Tor Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/tree/base-brow… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser] Pushed new tag tor-browser-140.4.0esr-15.0-1-build1
by Pier Angelo Vendrame (＠pierov) 08 Oct '25

08 Oct '25

Pier Angelo Vendrame pushed new tag tor-browser-140.4.0esr-15.0-1-build1 at The Tor Project / Applications / Tor Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/tree/tor-brows… You're receiving this email because of your account on gitlab.torproject.org.

1 0