- tor-commits - lists.torproject.org

[torspec] branch main updated: xon/xoff: specify behavior on weird values.
by gitolite role 13 Oct '22

13 Oct '22

This is an automated email from the git hooks/post-receive script. ahf pushed a commit to branch main in repository torspec. The following commit(s) were added to refs/heads/main by this push: new 05b9bac xon/xoff: specify behavior on weird values. new e5cd03e Merge remote-tracking branch 'nickm/xon_xoff_edgecases' 05b9bac is described below commit 05b9bacc4c166f310a673a86ff1b5e92e6f6a6b4 Author: Nick Mathewson <nickm(a)torproject.org> AuthorDate: Thu Aug 11 11:05:46 2022 -0400 xon/xoff: specify behavior on weird values. --- proposals/324-rtt-congestion-control.txt | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/proposals/324-rtt-congestion-control.txt b/proposals/324-rtt-congestion-control.txt index c46fd4e..d529d5c 100644 --- a/proposals/324-rtt-congestion-control.txt +++ b/proposals/324-rtt-congestion-control.txt @@ -747,6 +747,12 @@ struct xon_cell { u32 kbps_ewma; } +Parties SHOULD treat XON or XOFF cells with unrecognized versions as a +protocol violation. + +In `xon_cell`, a zero value for `kbps_ewma` means that the stream's rate is +unlimited. Parties should therefore not send "0" to mean "do not send data". + 4.1.1. XON/XOFF behavior If the length of an edge outbuf queue exceeds the size provided in the -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[torspec] branch main updated (79da008 -> 4b78322)
by gitolite role 13 Oct '22

13 Oct '22

This is an automated email from the git hooks/post-receive script. ahf pushed a change to branch main in repository torspec. from 79da008 Specify the actual relay cmd values for XON and XOFF. new f4411d3 bandwidth-file: Add XOFF KeyValues to RelayLines new 4b78322 bandwidth-file: Remove trailing `=` defining Keys The 2 revisions listed above as "new" are entirely new to this repository and will be described in separate emails. The revisions listed as "add" were already present in the repository and have only been added to this reference. Summary of changes: bandwidth-file-spec.txt | 129 +++++++++++++++++++++++++++--------------------- 1 file changed, 74 insertions(+), 55 deletions(-) -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 2

[builders/tor-browser-build] branch main updated: Bug 40638: Update the update link of nightly builds
by gitolite role 13 Oct '22

13 Oct '22

This is an automated email from the git hooks/post-receive script. boklm pushed a commit to branch main in repository builders/tor-browser-build. The following commit(s) were added to refs/heads/main by this push: new bf61fa9 Bug 40638: Update the update link of nightly builds bf61fa9 is described below commit bf61fa94cb3584537cfa01d4aca361f33f0faf0b Author: Pier Angelo Vendrame <pierov(a)torproject.org> AuthorDate: Wed Oct 12 12:48:22 2022 +0200 Bug 40638: Update the update link of nightly builds --- tools/signing/nightly/update-responses-base-config.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/signing/nightly/update-responses-base-config.yml b/tools/signing/nightly/update-responses-base-config.yml index 4d60565..2f18cd1 100644 --- a/tools/signing/nightly/update-responses-base-config.yml +++ b/tools/signing/nightly/update-responses-base-config.yml @@ -17,7 +17,7 @@ channels: versions: nightly_version: platformVersion: 68.2.0 - detailsURL: http://f4amtbsowhix7rrf.onion/ + detailsURL: http://umj4zbqdfcyevlkgqgpq6foxk3z75zzxsbgt5jqmfxofrbrjh3crbnad.onion/ migrate_langs: pt-PT: pt-BR minSupportedInstructionSet: SSE2 -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[tor-browser] branch tor-browser-102.4.0esr-12.0-1 created (now df868fe98ed5)
by gitolite role 13 Oct '22

13 Oct '22

This is an automated email from the git hooks/post-receive script. pierov pushed a change to branch tor-browser-102.4.0esr-12.0-1 in repository tor-browser. at df868fe98ed5 Bug 1791520: Add some keep alive annotations. r=jandem a=pascalc No new revisions were added by this update. -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[tor-browser] annotated tag FIREFOX_102_4_0esr_BUILD1 created (now 409c65cdec46)
by gitolite role 13 Oct '22

13 Oct '22

This is an automated email from the git hooks/post-receive script. pierov pushed a change to annotated tag FIREFOX_102_4_0esr_BUILD1 in repository tor-browser. at 409c65cdec46 (tag) tagging df868fe98ed5d25b9d6c2994d77f74929c938e78 (commit) replaces FIREFOX_102_3_0esr_RELEASE by Pier Angelo Vendrame on Thu Oct 13 09:50:35 2022 +0200 - Log ----------------------------------------------------------------- Hg tag FIREFOX_102_4_0esr_BUILD1 -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQQCHOE9KLO2f598e8HwdW0XkBKIkQUCY0fDSwAKCRDwdW0XkBKI kZEmAP9gTX8gI5ceJ9AptjSbSTtllVq9zuPQtnJJyjnE+LslRAEAuX8RUtWTzNCp NFt9DPafLPaIpNSH4nFf3CB69OcVGQY= =FoLb -----END PGP SIGNATURE----- ----------------------------------------------------------------------- This annotated tag includes the following new commits: new 038f0a5b9e65 No bug - Tagging c2dd0f1c0adfb1fa1c5d9319fbe023d324c34db6 with FIREFOX_102_3_0esr_BUILD1 a=release CLOSED TREE DONTBUILD new b2d57aa8d7e0 Update configs. IGNORE BROKEN CHANGESETS CLOSED TREE NO BUG a=release ba=release new 3bad715d2155 No Bug, mozilla-esr102 repo-update HSTS HPKP remote-settings tld-suffixes - a=repo-update r=RyanVM new 0520b32a8ad5 No bug - Tagging c2dd0f1c0adfb1fa1c5d9319fbe023d324c34db6 with FIREFOX_102_3_0esr_RELEASE a=release CLOSED TREE DONTBUILD new 6898d15b6cb6 Bug 1786292 - part 2: Switch cron-bouncer-check away from esr91 r=jcristau a=release new a86c6fca966f Bug 1788684 - exclude asus.com from HSTS preload list. r=dveditz, a=RyanVM new d36b48c834eb Bug 1786619 - Use fallback atomic operations on ARM < v7. r=jandem, a=RyanVM new 56dd7073d59e No Bug, mozilla-esr102 repo-update HSTS HPKP remote-settings - a=repo-update r=RyanVM new b3ec8115892a Bug 1791519 - use really non-resolving domain for bug529119 tests. r=MasterWayZ a=test-only DONTBUILD new 6e0190b97e38 No Bug, mozilla-esr102 repo-update HSTS HPKP remote-settings tld-suffixes - a=repo-update r=RyanVM new e0fe7669b684 Bug 1789500 - filename sanitization may cut surrogate pairs when truncating. r=NeilDeakin, a=RyanVM new 2e252b3fae09 Bug 1791744 - stop updating esr-next bouncer aliases from esr102. r=jlorenzo a=RyanVM new d558f4a1c67a Bug 1789128 - Always call LoadInfo::GetPerformanceStorage(). r=smaug, a=RyanVM new 7c72e5abd9ac No Bug, mozilla-esr102 repo-update HSTS HPKP remote-settings tld-suffixes - a=repo-update r=RyanVM new 02caa482963a Bug 1782523 - Update NodeJS to latest versions for the branches on ESR. r=nalexander, a=RyanVM new 6dfb82daf955 Bug 1792227 - Update node to v16.17.1. r=firefox-build-system-reviewers,ahochheiden a=RyanVM new f1fd4e6b8661 Bug 1792882 - test_interfaces.js should not check pref values. r=smaug, a=test-only new 80d14313ffc9 No Bug, mozilla-esr102 repo-update HSTS HPKP remote-settings - a=repo-update new 3e6532cd0aac Bug 1786521 - Fix AppearanceValueAffectsFrames. r=TYLin, a=RyanVM new e2a1f537e938 Bug 1791363 - Process newly added marking work after performing delayed marking r=sfink a=RyanVM new aa76591919e4 Bug 1791363 - Rename GCMarker::color to avoid confusion with local variables r=sfink a=RyanVM new 26b0c88bd2a3 Bug 1771125 - Don't bother trying to start the font-info loader if we're already shutting down. r=lsalzman, a=RyanVM new f0440910d05c Bug 1786259 - Avoid potential deadlock via AddWithLegacyFamilyName when shared-fontlist is disabled (incl. safe mode). r=gfx-reviewers,aosmond a=RyanVM new 4d1d82153e09 Bug 1786910: Ignore 'align-content' when determining the aligned static position of abspos flex children. r=TYLin a=RyanVM new 41a59ed1ffa0 Bug 1773212 - Fix OS authentication checkbox for credit card autofill not wrapping its text. r=sgalich, a=RyanVM new 913a8d6871eb Bug 1789874 - Fix colors used by nsListControlFrame::PaintFocus. r=mstange a=pascalc new 7b585baebb2c Bug 1789439 - Don't allow reentrant programmatic print calls. r=smaug,peterv a=pascalc new 6d5378a68f99 Bug 1789439 - Throw rather than logging an error when tab-modal print is already open. r=mstriemer a=pascalc new 31bcb9ab3723 Bug 1789439 - Fix browser_modal_print.js after previous patch. a=pascalc new 548cefc6653f No Bug, mozilla-esr102 repo-update HSTS HPKP remote-settings tld-suffixes - a=repo-update r=pascalc new 70f4241cddc2 Bug 1792076 - add new hg.mozilla.org certificate fingerprint to run-task. r=dhouse, a=release new 4bc6e9abbce9 Bug 1794064 - Block older crash-prone versions of Avast Antivirus. r=gcp, a=RyanVM new 48a0b7d3e99c Bug 1792041 - Add a value for DEL to kBase64URLDecodeTable and have static asserts for lookup tables' length. r=xpcom-reviewers,nika a=RyanVM new 0fa01d6241a0 Bug 1789729 - Implement webgl.max-size-per-texture-mib r=jgilbert a=RyanVM new e5de4757b46f Bug 1792008 - Check size when mNotLost->mCanvasRenderer is re-used r=lsalzman,gfx-reviewers a=RyanVM new df868fe98ed5 Bug 1791520: Add some keep alive annotations. r=jandem a=pascalc The 36 revisions listed above as "new" are entirely new to this repository and will be described in separate emails. The revisions listed as "add" were already present in the repository and have only been added to this reference. -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 36

[tor-browser] branch tor-browser-91.13.0esr-11.5-1 updated: fixup! Bug 30237: Add v3 onion services client authentication prompt
by gitolite role 12 Oct '22

12 Oct '22

This is an automated email from the git hooks/post-receive script. richard pushed a commit to branch tor-browser-91.13.0esr-11.5-1 in repository tor-browser. The following commit(s) were added to refs/heads/tor-browser-91.13.0esr-11.5-1 by this push: new 12b66ca40d05 fixup! Bug 30237: Add v3 onion services client authentication prompt 12b66ca40d05 is described below commit 12b66ca40d059552825714fd7cfb7563bb59ae45 Author: Richard Pospesel <richard(a)torproject.org> AuthorDate: Sat Oct 8 04:00:00 2022 +0000 fixup! Bug 30237: Add v3 onion services client authentication prompt - strip subdomain off of onion hostname when extracting the onion service id for use with the ONION_CLIENT_AUTH_ADD command --- browser/components/onionservices/content/authPrompt.js | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/browser/components/onionservices/content/authPrompt.js b/browser/components/onionservices/content/authPrompt.js index df609df44e49..1cc298a89a02 100644 --- a/browser/components/onionservices/content/authPrompt.js +++ b/browser/components/onionservices/content/authPrompt.js @@ -16,7 +16,7 @@ const OnionAuthPrompt = (function() { this._browser = aBrowser; this._failedURI = aFailedURI; this._reasonForPrompt = aReason; - this._onionName = aOnionName; + this._onionHostname = aOnionName; } OnionServicesAuthPrompt.prototype = { @@ -93,7 +93,7 @@ const OnionAuthPrompt = (function() { descElem.appendChild(span); span = xulDoc.createElementNS(kHTMLNS, "span"); span.id = OnionAuthUtil.domid.onionNameSpan; - span.textContent = this._onionName; + span.textContent = this._onionHostname; descElem.appendChild(span); span = xulDoc.createElementNS(kHTMLNS, "span"); span.textContent = suffix; @@ -177,10 +177,14 @@ const OnionAuthPrompt = (function() { console.error(controllerFailureMsg, aError); this.show(controllerFailureMsg); }); - let onionAddr = this._onionName.toLowerCase().replace(/\.onion$/, ""); + // ^(subdomain.)*onionserviceid.onion$ (case-insensitive) + const onionServiceIdRegExp = /^(.*\.)*(?<onionServiceId>[a-z2-7]{56})\.onion$/i; + // match() will return null on bad match, causing throw + const onionServiceId = this._onionHostname.match(onionServiceIdRegExp).groups.onionServiceId.toLowerCase(); + let checkboxElem = this._getCheckboxElement(); - let isPermanent = (checkboxElem && checkboxElem.checked); - torController.onionAuthAdd(onionAddr, base64key, isPermanent) + let isPermanent = checkboxElem && checkboxElem.checked; + torController.onionAuthAdd(onionServiceId, base64key, isPermanent) .then(aResponse => { // Success! Reload the page. this._browser.sendMessageToActor( -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[tor-browser] branch tor-browser-102.3.0esr-12.0-2 updated: fixup! Bug 30237: Add v3 onion services client authentication prompt
by gitolite role 12 Oct '22

12 Oct '22

This is an automated email from the git hooks/post-receive script. richard pushed a commit to branch tor-browser-102.3.0esr-12.0-2 in repository tor-browser. The following commit(s) were added to refs/heads/tor-browser-102.3.0esr-12.0-2 by this push: new 400276c6eba4 fixup! Bug 30237: Add v3 onion services client authentication prompt 400276c6eba4 is described below commit 400276c6eba41ada1c93acd7f24a3412e1077961 Author: Richard Pospesel <richard(a)torproject.org> AuthorDate: Sat Oct 8 04:00:00 2022 +0000 fixup! Bug 30237: Add v3 onion services client authentication prompt - strip subdomain off of onion hostname when extracting the onion service id for use with the ONION_CLIENT_AUTH_ADD command --- browser/components/onionservices/content/authPrompt.js | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/browser/components/onionservices/content/authPrompt.js b/browser/components/onionservices/content/authPrompt.js index ba40e9fd464c..f9b92608ed65 100644 --- a/browser/components/onionservices/content/authPrompt.js +++ b/browser/components/onionservices/content/authPrompt.js @@ -18,7 +18,7 @@ const OnionAuthPrompt = (function() { this._browser = aBrowser; this._failedURI = aFailedURI; this._reasonForPrompt = aReason; - this._onionName = aOnionName; + this._onionHostname = aOnionName; } OnionServicesAuthPrompt.prototype = { @@ -103,7 +103,7 @@ const OnionAuthPrompt = (function() { descElem.appendChild(span); span = xulDoc.createElementNS(kHTMLNS, "span"); span.id = OnionAuthUtil.domid.onionNameSpan; - span.textContent = this._onionName; + span.textContent = this._onionHostname; descElem.appendChild(span); span = xulDoc.createElementNS(kHTMLNS, "span"); span.textContent = suffix; @@ -196,11 +196,15 @@ const OnionAuthPrompt = (function() { console.error(controllerFailureMsg, aError); this.show(controllerFailureMsg); }); - let onionAddr = this._onionName.toLowerCase().replace(/\.onion$/, ""); + // ^(subdomain.)*onionserviceid.onion$ (case-insensitive) + const onionServiceIdRegExp = /^(.*\.)*(?<onionServiceId>[a-z2-7]{56})\.onion$/i; + // match() will return null on bad match, causing throw + const onionServiceId = this._onionHostname.match(onionServiceIdRegExp).groups.onionServiceId.toLowerCase(); + let checkboxElem = this._getCheckboxElement(); let isPermanent = checkboxElem && checkboxElem.checked; torController - .onionAuthAdd(onionAddr, base64key, isPermanent) + .onionAuthAdd(onionServiceId, base64key, isPermanent) .then(aResponse => { // Success! Reload the page. this._browser.sendMessageToActor( -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[tor-browser] branch tor-browser-102.3.0esr-12.0-2 updated: fixup! Bug 30237: Add v3 onion services client authentication prompt
by gitolite role 12 Oct '22

12 Oct '22

This is an automated email from the git hooks/post-receive script. richard pushed a commit to branch tor-browser-102.3.0esr-12.0-2 in repository tor-browser. The following commit(s) were added to refs/heads/tor-browser-102.3.0esr-12.0-2 by this push: new caa5988884a3 fixup! Bug 30237: Add v3 onion services client authentication prompt caa5988884a3 is described below commit caa5988884a3dc6e60047ad246abd56d84fa11ad Author: hackademix <giorgio(a)maone.net> AuthorDate: Wed Oct 12 19:17:53 2022 +0200 fixup! Bug 30237: Add v3 onion services client authentication prompt --- .../components/onionservices/content/authPrompt.js | 18 +++++++++++------- browser/components/onionservices/content/authUtil.jsm | 19 ------------------- browser/components/sessionstore/SessionStore.jsm | 5 ----- browser/themes/shared/aboutNetError.css | 7 +++++++ docshell/base/nsDocShell.cpp | 6 ++++-- 5 files changed, 22 insertions(+), 33 deletions(-) diff --git a/browser/components/onionservices/content/authPrompt.js b/browser/components/onionservices/content/authPrompt.js index 14fb334a6206..ba40e9fd464c 100644 --- a/browser/components/onionservices/content/authPrompt.js +++ b/browser/components/onionservices/content/authPrompt.js @@ -225,13 +225,17 @@ const OnionAuthPrompt = (function() { _onCancel() { // Arrange for an error page to be displayed. - this._browser.messageManager.sendAsyncMessage( - OnionAuthUtil.message.authPromptCanceled, - { - failedURI: this._failedURI.spec, - reasonForPrompt: this._reasonForPrompt, - } - ); + const failedURI = this._failedURI.spec; + const errorCode = + this._reasonForPrompt === OnionAuthUtil.topic.clientAuthMissing + ? Cr.NS_ERROR_TOR_ONION_SVC_MISSING_CLIENT_AUTH + : Cr.NS_ERROR_TOR_ONION_SVC_BAD_CLIENT_AUTH; + + const io = `ChromeUtils.import("resource://gre/modules/Services.jsm").Services.io`; + this._browser.messageManager.loadFrameScript(`data:,${encodeURIComponent( + `docShell.displayLoadError(${errorCode}, ${io}.newURI(${JSON.stringify(failedURI)}), undefined, undefined);` + )}`, + false); }, _getKeyElement() { diff --git a/browser/components/onionservices/content/authUtil.jsm b/browser/components/onionservices/content/authUtil.jsm index 82a835359b3e..7157acf2e11d 100644 --- a/browser/components/onionservices/content/authUtil.jsm +++ b/browser/components/onionservices/content/authUtil.jsm @@ -24,23 +24,4 @@ const OnionAuthUtil = { warningElement: "tor-clientauth-warning", checkboxElement: "tor-clientauth-persistkey-checkbox", }, - - addCancelMessageListener(aMessageManager, aDocShell) { - aMessageManager.addMessageListener(this.message.authPromptCanceled, { - receiveMessage(aMessage) { - // Upon cancellation of the client authentication prompt, display - // the appropriate error page. When calling the docShell - // displayLoadError() function, we pass undefined for the failed - // channel so that displayLoadError() can determine that it should - // not display the client authentication prompt a second time. - const failedURI = Services.io.newURI(aMessage.data.failedURI); - const reasonForPrompt = aMessage.data.reasonForPrompt; - const errorCode = - reasonForPrompt === this.topic.clientAuthMissing - ? Cr.NS_ERROR_TOR_ONION_SVC_MISSING_CLIENT_AUTH - : Cr.NS_ERROR_TOR_ONION_SVC_BAD_CLIENT_AUTH; - aDocShell.displayLoadError(errorCode, failedURI, undefined, undefined); - }, - }); - }, }; diff --git a/browser/components/sessionstore/SessionStore.jsm b/browser/components/sessionstore/SessionStore.jsm index 58c5a4fed6ca..4611737ca918 100644 --- a/browser/components/sessionstore/SessionStore.jsm +++ b/browser/components/sessionstore/SessionStore.jsm @@ -234,10 +234,6 @@ ChromeUtils.defineModuleGetter( "resource://gre/modules/sessionstore/SessionHistory.jsm" ); -const { OnionAuthUtil } = ChromeUtils.import( - "chrome://browser/content/onionservices/authUtil.jsm" -); - XPCOMUtils.defineLazyServiceGetters(this, { gScreenManager: ["@mozilla.org/gfx/screenmanager;1", "nsIScreenManager"], }); @@ -1514,7 +1510,6 @@ var SessionStoreInternal = { let listenWhenClosed = CLOSED_MESSAGES.has(msg); mm.addMessageListener(msg, this, listenWhenClosed); }); - OnionAuthUtil.addCancelMessageListener(mm, aWindow.docShell); // Load the frame script after registering listeners. if (!Services.appinfo.sessionHistoryInParent) { diff --git a/browser/themes/shared/aboutNetError.css b/browser/themes/shared/aboutNetError.css index 73f9d2760a15..438cc5782291 100644 --- a/browser/themes/shared/aboutNetError.css +++ b/browser/themes/shared/aboutNetError.css @@ -8,6 +8,13 @@ body { --warning-color: #ffa436; } +body.onionAuthPrompt { + background: white; +} +.onionAuthPrompt > * { + display: none; +} + @media (prefers-color-scheme: dark) { body { --warning-color: #ffbd4f; diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp index 95c68c34fd7f..22577e45643a 100644 --- a/docshell/base/nsDocShell.cpp +++ b/docshell/base/nsDocShell.cpp @@ -3902,8 +3902,10 @@ nsDocShell::DisplayLoadError(nsresult aError, nsIURI* aURI, // if the user cancels the Tor client auth prompt, but in that case we // will not have a failed channel and therefore we will not prompt again. if (isOnionAuthError && aFailedChannel) { - // Display about:blank while the Tor client auth prompt is open. - errorPage.AssignLiteral("blank"); + // Display about:neterror with a style emulating about:blank while the + // Tor client auth prompt is open. Do not use about:blank directly: it + // will mess with the failed channel information persistence! + cssClass.AssignLiteral("onionAuthPrompt"); } } -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[tor-browser] branch tor-browser-102.3.0esr-12.0-2 updated (5293cbaea3eb -> cbb8519e4368)
by gitolite role 12 Oct '22

12 Oct '22

This is an automated email from the git hooks/post-receive script. richard pushed a change to branch tor-browser-102.3.0esr-12.0-2 in repository tor-browser. from 5293cbaea3eb fixup! Base Browser's .mozconfigs. new 04a76db04926 fixup! Base Browser's .mozconfigs. new cbb8519e4368 fixup! Bug 41340: Enable TOR_BROWSER_NIGHTLY_BUILD features for dev and nightly builds The 2 revisions listed above as "new" are entirely new to this repository and will be described in separate emails. The revisions listed as "add" were already present in the repository and have only been added to this reference. Summary of changes: modules/libpref/init/all.js | 2 +- mozconfig-linux-x86_64-dev | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 2

[tor-browser-spec] branch main updated: Bug 40023: FF94 Audit
by gitolite role 12 Oct '22

12 Oct '22

This is an automated email from the git hooks/post-receive script. richard pushed a commit to branch main in repository tor-browser-spec. The following commit(s) were added to refs/heads/main by this push: new 07a365b Bug 40023: FF94 Audit 07a365b is described below commit 07a365bf04def6941ecbcd288b6c8d9fad4e40bf Author: Richard Pospesel <richard(a)torproject.org> AuthorDate: Tue Oct 11 19:58:15 2022 +0000 Bug 40023: FF94 Audit --- audits/FF94_AUDIT | 83 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 83 insertions(+) diff --git a/audits/FF94_AUDIT b/audits/FF94_AUDIT new file mode 100644 index 0000000..b3a48fb --- /dev/null +++ b/audits/FF94_AUDIT @@ -0,0 +1,83 @@ +Tracking Issue: https://gitlab.torproject.org/tpo/applications/tor-browser-spec/-/issues/40… + +# General + +The audit begins at the commit hash where the previous audit ended. Use code_audit.sh for creating the diff and highlighting potentially problematic code. The audit is scoped to a specific language (currently C/C++, Rust, Java/Kotlin, and Javascript). + +The output includes the entire patch where the new problematic code was introduced. Search for `XXX MATCH XXX` to find the next potential violation. + +code_audit.sh contains the list of known problematic APIs. New usage of these functions are documented and analyzed in this audit. + +## Firefox + +### Repo: https://github.com/mozilla/gecko-dev.git + +- Start: `5f4358c1c5bc2ca87d60eadebeab439562c90495` ( `FIREFOX_RELEASE_94_BASE` ) +- End: `6c9b6e1483551f220cd409e4e584349bc74a8231` ( `FIREFOX_RELEASE_95_BASE` ) + +### Languages: +- [x] java +- [x] cpp +- [x] js +- [x] rust + +Nothing of interest (using `code_audit.sh`) + +(mostly) only tests triggered matches or false positives + +--- + +## Application Services + +### Repo: https://github.com/mozilla/application-services.git + +- Start: `b1f371719ca20db642b64a0e860b4ecb0aaf316f` ( v86.1.0 ) +- End: `df1a47fde89f49201b1e839f960e8f16eb95a55d` ( v87.1.0 ) + +### Languages: +- [x] java +- [x] cpp +- [x] js +- [x] rust + +## Android Components + +### Repo: https://github.com/mozilla-mobile/android-components.git + +- Start: `fce7eb5cff2d56acd3195bf1d9a89386c63dc3d5` ( `v94.0.0` ) +- End: `28c1b7db40105dcaea09caa0b5108554a83959cd` ( `v94.0.15` ) + +### Languages: +- [x] java +- [x] cpp +- [x] js +- [x] rust + +Nothing of interest (using `code_audit.sh`) + +## Fenix + +### Repo: https://github.com/mozilla-mobile/fenix.git + +- Start: 54d80751bfc9a4aa4341e78221060940a36e3d17 ( v94.0.0-beta.1 ) +- End: cb5708f88847601426833067f93d16d25d36451f ( v94.1.2 ) + +### Languages: +- [x] java +- [x] cpp +- [x] js +- [x] rust + +Nothing of interest (using `code_audit.sh`) + +## Ticket Review ## + +### Review List + +#### 94 https://bugzilla.mozilla.org/buglist.cgi?query_format=advanced&resolution=F… + +- https://bugzilla.mozilla.org/show_bug.cgi?id=1730418 : @ma1 https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/41123 + - Nothing to do here +- https://bugzilla.mozilla.org/show_bug.cgi?id=1732388: @dan https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/41124 + - Disabled by network.proxy.allow_bypass = false + -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0