- tor-commits - lists.torproject.org

[Git][tpo/applications/mullvad-browser][mullvad-browser-128.7.0esr-14.5-1] BB 29745: Limit remote access to content accessible resources
by ma1 (＠ma1) 03 Feb '25

03 Feb '25

ma1 pushed to branch mullvad-browser-128.7.0esr-14.5-1 at The Tor Project / Applications / Mullvad Browser Commits: 911dbf28 by Henry Wilkes at 2025-02-03T17:56:38+01:00 BB 29745: Limit remote access to content accessible resources - - - - - 1 changed file: - caps/nsScriptSecurityManager.cpp Changes: ===================================== caps/nsScriptSecurityManager.cpp ===================================== @@ -1044,6 +1044,48 @@ nsresult nsScriptSecurityManager::CheckLoadURIFlags( } } + // Only allow some "about:" pages to have access to contentaccessible + // "chrome://branding/" assets. Otherwise web pages could easily and + // consistently detect the differences between channels when their + // branding differs. See tor-browser#43308 and tor-browser#42319. + // NOTE: The same assets under the alternative URI + // "resource:///chrome/browser/content/branding/" should already be + // inaccessible to web content, so we only add a condition for the chrome + // path. + if (targetScheme.EqualsLiteral("chrome")) { + nsAutoCString targetHost; + rv = aTargetBaseURI->GetHost(targetHost); + NS_ENSURE_SUCCESS(rv, rv); + if (targetHost.EqualsLiteral("branding")) { + // Disallow any Principal whose scheme is not "about", or is a + // contentaccessible "about" URI ("about:blank" or "about:srcdoc"). + // NOTE: "about:blank" and "about:srcdoc" would be unexpected here + // since such a document spawned by a web document should inherit the + // same Principal URI. I.e. they would be "http:" or "https:" schemes. + // But we add this condition for extra assurances. + // NOTE: Documents with null Principals, like "about:blank" typed by + // the user, would also be excluded since the Principal URI would be + // "moz-nullprincipal:". + if (!aSourceBaseURI->SchemeIs("about") || + NS_IsContentAccessibleAboutURI(aSourceBaseURI)) { + return NS_ERROR_DOM_BAD_URI; + } + // Also exclude "about:reader" from accessing branding assets. I.e. if + // a web page includes `<img src="chrome://branding/..." />` we do not + // want it to render within "about:reader" either. + // Though it is unknown whether the information within "about:reader" + // would be exploitable by a web page, we also want to exclude + // "about:reader" for consistency: if it does not display in the + // original web page, it should not display in "about:reader" either. + nsAutoCString sourcePath; + rv = aSourceBaseURI->GetFilePath(sourcePath); + NS_ENSURE_SUCCESS(rv, rv); + if (sourcePath.EqualsLiteral("reader")) { + return NS_ERROR_DOM_BAD_URI; + } + } + } + if (targetScheme.EqualsLiteral("resource")) { if (StaticPrefs::security_all_resource_uri_content_accessible()) { return NS_OK; View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/911… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/911… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][base-browser-128.7.0esr-14.5-1] BB 29745: Limit remote access to content accessible resources
by ma1 (＠ma1) 03 Feb '25

03 Feb '25

ma1 pushed to branch base-browser-128.7.0esr-14.5-1 at The Tor Project / Applications / Tor Browser Commits: 41490079 by Henry Wilkes at 2025-02-03T17:56:16+01:00 BB 29745: Limit remote access to content accessible resources - - - - - 1 changed file: - caps/nsScriptSecurityManager.cpp Changes: ===================================== caps/nsScriptSecurityManager.cpp ===================================== @@ -1044,6 +1044,48 @@ nsresult nsScriptSecurityManager::CheckLoadURIFlags( } } + // Only allow some "about:" pages to have access to contentaccessible + // "chrome://branding/" assets. Otherwise web pages could easily and + // consistently detect the differences between channels when their + // branding differs. See tor-browser#43308 and tor-browser#42319. + // NOTE: The same assets under the alternative URI + // "resource:///chrome/browser/content/branding/" should already be + // inaccessible to web content, so we only add a condition for the chrome + // path. + if (targetScheme.EqualsLiteral("chrome")) { + nsAutoCString targetHost; + rv = aTargetBaseURI->GetHost(targetHost); + NS_ENSURE_SUCCESS(rv, rv); + if (targetHost.EqualsLiteral("branding")) { + // Disallow any Principal whose scheme is not "about", or is a + // contentaccessible "about" URI ("about:blank" or "about:srcdoc"). + // NOTE: "about:blank" and "about:srcdoc" would be unexpected here + // since such a document spawned by a web document should inherit the + // same Principal URI. I.e. they would be "http:" or "https:" schemes. + // But we add this condition for extra assurances. + // NOTE: Documents with null Principals, like "about:blank" typed by + // the user, would also be excluded since the Principal URI would be + // "moz-nullprincipal:". + if (!aSourceBaseURI->SchemeIs("about") || + NS_IsContentAccessibleAboutURI(aSourceBaseURI)) { + return NS_ERROR_DOM_BAD_URI; + } + // Also exclude "about:reader" from accessing branding assets. I.e. if + // a web page includes `<img src="chrome://branding/..." />` we do not + // want it to render within "about:reader" either. + // Though it is unknown whether the information within "about:reader" + // would be exploitable by a web page, we also want to exclude + // "about:reader" for consistency: if it does not display in the + // original web page, it should not display in "about:reader" either. + nsAutoCString sourcePath; + rv = aSourceBaseURI->GetFilePath(sourcePath); + NS_ENSURE_SUCCESS(rv, rv); + if (sourcePath.EqualsLiteral("reader")) { + return NS_ERROR_DOM_BAD_URI; + } + } + } + if (targetScheme.EqualsLiteral("resource")) { if (StaticPrefs::security_all_resource_uri_content_accessible()) { return NS_OK; View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/4149007… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/4149007… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/mullvad-browser][mullvad-browser-128.7.0esr-14.0-1] fixup! Add CI for Base Browser
by Pier Angelo Vendrame (＠pierov) 03 Feb '25

03 Feb '25

Pier Angelo Vendrame pushed to branch mullvad-browser-128.7.0esr-14.0-1 at The Tor Project / Applications / Mullvad Browser Commits: 8b25ea05 by Beatriz Rizental at 2025-02-03T16:00:38+01:00 fixup! Add CI for Base Browser - - - - - 1 changed file: - .gitlab/ci/mixins.yml Changes: ===================================== .gitlab/ci/mixins.yml ===================================== @@ -4,7 +4,21 @@ before_script: - git init - git remote add local "$LOCAL_REPO_PATH" - - git fetch --depth 500 local + - | + # Determine the reference of the target branch in the local repository copy. + # + # 1. List all references in the local repository + # 2. Filter the references to the target branch + # 3. Remove tags + # 4. Keep a single line, in case there are too many matches + # 5. Clean up the output + # 6. Remove everything before the last two slashes, because the output is like `refs/heads/...` or `refs/remotes/...` + TARGET_BRANCH=$(git ls-remote local | grep ${CI_COMMIT_BRANCH:-$CI_MERGE_REQUEST_TARGET_BRANCH_NAME} | grep -v 'refs/tags/' | awk '{print $2}' | tail -1 | sed 's|[^/]*/[^/]*/||') + if [ -z "$TARGET_BRANCH" ]; then + echo "Target branch $TARGET_BRANCH is not yet in local repository. Stopping the pipeline." + exit 1 + fi + - git fetch --depth 500 local $TARGET_BRANCH - git remote add origin "$CI_REPOSITORY_URL" - | if [ -z "${CI_COMMIT_BRANCH:-$CI_MERGE_REQUEST_SOURCE_BRANCH_NAME}" ]; then @@ -26,7 +40,16 @@ before_script: - git init - git remote add local $env:LOCAL_REPO_PATH - - git fetch --depth 500 local + - | + $branchName = $env:CI_COMMIT_BRANCH + if ([string]::IsNullOrEmpty($branchName)) { + $branchName = $env:CI_MERGE_REQUEST_TARGET_BRANCH_NAME + } + $TARGET_BRANCH = git ls-remote local | Select-String -Pattern $branchName | Select-String -Pattern -NotMatch 'refs/tags/' | Select-Object -Last 1 | ForEach-Object { $_.ToString().Split()[1] -replace '^[^/]*/[^/]*/', '' } + if ([string]::IsNullOrEmpty($TARGET_BRANCH)) { + Write-Output "Target branch $TARGET_BRANCH is not yet in local repository. Stopping the pipeline." + exit 1 + } - git remote add origin $env:CI_REPOSITORY_URL - | $branchName = $env:CI_COMMIT_BRANCH View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/8b2… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/8b2… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][base-browser-128.7.0esr-14.0-1] fixup! Add CI for Base Browser
by Pier Angelo Vendrame (＠pierov) 03 Feb '25

03 Feb '25

Pier Angelo Vendrame pushed to branch base-browser-128.7.0esr-14.0-1 at The Tor Project / Applications / Tor Browser Commits: 2db79da2 by Beatriz Rizental at 2025-02-03T16:00:19+01:00 fixup! Add CI for Base Browser - - - - - 1 changed file: - .gitlab/ci/mixins.yml Changes: ===================================== .gitlab/ci/mixins.yml ===================================== @@ -4,7 +4,21 @@ before_script: - git init - git remote add local "$LOCAL_REPO_PATH" - - git fetch --depth 500 local + - | + # Determine the reference of the target branch in the local repository copy. + # + # 1. List all references in the local repository + # 2. Filter the references to the target branch + # 3. Remove tags + # 4. Keep a single line, in case there are too many matches + # 5. Clean up the output + # 6. Remove everything before the last two slashes, because the output is like `refs/heads/...` or `refs/remotes/...` + TARGET_BRANCH=$(git ls-remote local | grep ${CI_COMMIT_BRANCH:-$CI_MERGE_REQUEST_TARGET_BRANCH_NAME} | grep -v 'refs/tags/' | awk '{print $2}' | tail -1 | sed 's|[^/]*/[^/]*/||') + if [ -z "$TARGET_BRANCH" ]; then + echo "Target branch $TARGET_BRANCH is not yet in local repository. Stopping the pipeline." + exit 1 + fi + - git fetch --depth 500 local $TARGET_BRANCH - git remote add origin "$CI_REPOSITORY_URL" - | if [ -z "${CI_COMMIT_BRANCH:-$CI_MERGE_REQUEST_SOURCE_BRANCH_NAME}" ]; then @@ -26,7 +40,16 @@ before_script: - git init - git remote add local $env:LOCAL_REPO_PATH - - git fetch --depth 500 local + - | + $branchName = $env:CI_COMMIT_BRANCH + if ([string]::IsNullOrEmpty($branchName)) { + $branchName = $env:CI_MERGE_REQUEST_TARGET_BRANCH_NAME + } + $TARGET_BRANCH = git ls-remote local | Select-String -Pattern $branchName | Select-String -Pattern -NotMatch 'refs/tags/' | Select-Object -Last 1 | ForEach-Object { $_.ToString().Split()[1] -replace '^[^/]*/[^/]*/', '' } + if ([string]::IsNullOrEmpty($TARGET_BRANCH)) { + Write-Output "Target branch $TARGET_BRANCH is not yet in local repository. Stopping the pipeline." + exit 1 + } - git remote add origin $env:CI_REPOSITORY_URL - | $branchName = $env:CI_COMMIT_BRANCH View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/2db79da… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/2db79da… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-128.7.0esr-14.0-1] fixup! Add CI for Base Browser
by Pier Angelo Vendrame (＠pierov) 03 Feb '25

03 Feb '25

Pier Angelo Vendrame pushed to branch tor-browser-128.7.0esr-14.0-1 at The Tor Project / Applications / Tor Browser Commits: 8004ee08 by Beatriz Rizental at 2025-02-03T15:42:55+01:00 fixup! Add CI for Base Browser - - - - - 1 changed file: - .gitlab/ci/mixins.yml Changes: ===================================== .gitlab/ci/mixins.yml ===================================== @@ -4,7 +4,21 @@ before_script: - git init - git remote add local "$LOCAL_REPO_PATH" - - git fetch --depth 500 local + - | + # Determine the reference of the target branch in the local repository copy. + # + # 1. List all references in the local repository + # 2. Filter the references to the target branch + # 3. Remove tags + # 4. Keep a single line, in case there are too many matches + # 5. Clean up the output + # 6. Remove everything before the last two slashes, because the output is like `refs/heads/...` or `refs/remotes/...` + TARGET_BRANCH=$(git ls-remote local | grep ${CI_COMMIT_BRANCH:-$CI_MERGE_REQUEST_TARGET_BRANCH_NAME} | grep -v 'refs/tags/' | awk '{print $2}' | tail -1 | sed 's|[^/]*/[^/]*/||') + if [ -z "$TARGET_BRANCH" ]; then + echo "Target branch $TARGET_BRANCH is not yet in local repository. Stopping the pipeline." + exit 1 + fi + - git fetch --depth 500 local $TARGET_BRANCH - git remote add origin "$CI_REPOSITORY_URL" - | if [ -z "${CI_COMMIT_BRANCH:-$CI_MERGE_REQUEST_SOURCE_BRANCH_NAME}" ]; then @@ -26,7 +40,16 @@ before_script: - git init - git remote add local $env:LOCAL_REPO_PATH - - git fetch --depth 500 local + - | + $branchName = $env:CI_COMMIT_BRANCH + if ([string]::IsNullOrEmpty($branchName)) { + $branchName = $env:CI_MERGE_REQUEST_TARGET_BRANCH_NAME + } + $TARGET_BRANCH = git ls-remote local | Select-String -Pattern $branchName | Select-String -Pattern -NotMatch 'refs/tags/' | Select-Object -Last 1 | ForEach-Object { $_.ToString().Split()[1] -replace '^[^/]*/[^/]*/', '' } + if ([string]::IsNullOrEmpty($TARGET_BRANCH)) { + Write-Output "Target branch $TARGET_BRANCH is not yet in local repository. Stopping the pipeline." + exit 1 + } - git remote add origin $env:CI_REPOSITORY_URL - | $branchName = $env:CI_COMMIT_BRANCH View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/8004ee0… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/8004ee0… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][base-browser-128.7.0esr-14.5-1] fixup! Add CI for Base Browser
by Pier Angelo Vendrame (＠pierov) 03 Feb '25

03 Feb '25

Pier Angelo Vendrame pushed to branch base-browser-128.7.0esr-14.5-1 at The Tor Project / Applications / Tor Browser Commits: 4da10a5e by Beatriz Rizental at 2025-02-03T15:36:36+01:00 fixup! Add CI for Base Browser - - - - - 1 changed file: - .gitlab/ci/mixins.yml Changes: ===================================== .gitlab/ci/mixins.yml ===================================== @@ -4,7 +4,21 @@ before_script: - git init - git remote add local "$LOCAL_REPO_PATH" - - git fetch --depth 500 local ${CI_COMMIT_BRANCH:-$CI_MERGE_REQUEST_TARGET_BRANCH_NAME} + - | + # Determine the reference of the target branch in the local repository copy. + # + # 1. List all references in the local repository + # 2. Filter the references to the target branch + # 3. Remove tags + # 4. Keep a single line, in case there are too many matches + # 5. Clean up the output + # 6. Remove everything before the last two slashes, because the output is like `refs/heads/...` or `refs/remotes/...` + TARGET_BRANCH=$(git ls-remote local | grep ${CI_COMMIT_BRANCH:-$CI_MERGE_REQUEST_TARGET_BRANCH_NAME} | grep -v 'refs/tags/' | awk '{print $2}' | tail -1 | sed 's|[^/]*/[^/]*/||') + if [ -z "$TARGET_BRANCH" ]; then + echo "Target branch $TARGET_BRANCH is not yet in local repository. Stopping the pipeline." + exit 1 + fi + - git fetch --depth 500 local $TARGET_BRANCH - git remote add origin "$CI_REPOSITORY_URL" - | if [ -z "${CI_COMMIT_BRANCH:-$CI_MERGE_REQUEST_SOURCE_BRANCH_NAME}" ]; then @@ -31,7 +45,11 @@ if ([string]::IsNullOrEmpty($branchName)) { $branchName = $env:CI_MERGE_REQUEST_TARGET_BRANCH_NAME } - git fetch --depth 500 local $branchName + $TARGET_BRANCH = git ls-remote local | Select-String -Pattern $branchName | Select-String -Pattern -NotMatch 'refs/tags/' | Select-Object -Last 1 | ForEach-Object { $_.ToString().Split()[1] -replace '^[^/]*/[^/]*/', '' } + if ([string]::IsNullOrEmpty($TARGET_BRANCH)) { + Write-Output "Target branch $TARGET_BRANCH is not yet in local repository. Stopping the pipeline." + exit 1 + } - git remote add origin $env:CI_REPOSITORY_URL - | $branchName = $env:CI_COMMIT_BRANCH View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/4da10a5… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/4da10a5… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/mullvad-browser][mullvad-browser-128.7.0esr-14.5-1] fixup! Add CI for Base Browser
by Pier Angelo Vendrame (＠pierov) 03 Feb '25

03 Feb '25

Pier Angelo Vendrame pushed to branch mullvad-browser-128.7.0esr-14.5-1 at The Tor Project / Applications / Mullvad Browser Commits: 40c8eec9 by Beatriz Rizental at 2025-02-03T15:36:14+01:00 fixup! Add CI for Base Browser - - - - - 1 changed file: - .gitlab/ci/mixins.yml Changes: ===================================== .gitlab/ci/mixins.yml ===================================== @@ -4,7 +4,21 @@ before_script: - git init - git remote add local "$LOCAL_REPO_PATH" - - git fetch --depth 500 local ${CI_COMMIT_BRANCH:-$CI_MERGE_REQUEST_TARGET_BRANCH_NAME} + - | + # Determine the reference of the target branch in the local repository copy. + # + # 1. List all references in the local repository + # 2. Filter the references to the target branch + # 3. Remove tags + # 4. Keep a single line, in case there are too many matches + # 5. Clean up the output + # 6. Remove everything before the last two slashes, because the output is like `refs/heads/...` or `refs/remotes/...` + TARGET_BRANCH=$(git ls-remote local | grep ${CI_COMMIT_BRANCH:-$CI_MERGE_REQUEST_TARGET_BRANCH_NAME} | grep -v 'refs/tags/' | awk '{print $2}' | tail -1 | sed 's|[^/]*/[^/]*/||') + if [ -z "$TARGET_BRANCH" ]; then + echo "Target branch $TARGET_BRANCH is not yet in local repository. Stopping the pipeline." + exit 1 + fi + - git fetch --depth 500 local $TARGET_BRANCH - git remote add origin "$CI_REPOSITORY_URL" - | if [ -z "${CI_COMMIT_BRANCH:-$CI_MERGE_REQUEST_SOURCE_BRANCH_NAME}" ]; then @@ -31,7 +45,11 @@ if ([string]::IsNullOrEmpty($branchName)) { $branchName = $env:CI_MERGE_REQUEST_TARGET_BRANCH_NAME } - git fetch --depth 500 local $branchName + $TARGET_BRANCH = git ls-remote local | Select-String -Pattern $branchName | Select-String -Pattern -NotMatch 'refs/tags/' | Select-Object -Last 1 | ForEach-Object { $_.ToString().Split()[1] -replace '^[^/]*/[^/]*/', '' } + if ([string]::IsNullOrEmpty($TARGET_BRANCH)) { + Write-Output "Target branch $TARGET_BRANCH is not yet in local repository. Stopping the pipeline." + exit 1 + } - git remote add origin $env:CI_REPOSITORY_URL - | $branchName = $env:CI_COMMIT_BRANCH View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/40c… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/40c… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-128.7.0esr-14.5-1] fixup! Add CI for Base Browser
by Pier Angelo Vendrame (＠pierov) 03 Feb '25

03 Feb '25

Pier Angelo Vendrame pushed to branch tor-browser-128.7.0esr-14.5-1 at The Tor Project / Applications / Tor Browser Commits: b05f3350 by Beatriz Rizental at 2025-02-03T15:31:27+01:00 fixup! Add CI for Base Browser - - - - - 1 changed file: - .gitlab/ci/mixins.yml Changes: ===================================== .gitlab/ci/mixins.yml ===================================== @@ -4,7 +4,21 @@ before_script: - git init - git remote add local "$LOCAL_REPO_PATH" - - git fetch --depth 500 local ${CI_COMMIT_BRANCH:-$CI_MERGE_REQUEST_TARGET_BRANCH_NAME} + - | + # Determine the reference of the target branch in the local repository copy. + # + # 1. List all references in the local repository + # 2. Filter the references to the target branch + # 3. Remove tags + # 4. Keep a single line, in case there are too many matches + # 5. Clean up the output + # 6. Remove everything before the last two slashes, because the output is like `refs/heads/...` or `refs/remotes/...` + TARGET_BRANCH=$(git ls-remote local | grep ${CI_COMMIT_BRANCH:-$CI_MERGE_REQUEST_TARGET_BRANCH_NAME} | grep -v 'refs/tags/' | awk '{print $2}' | tail -1 | sed 's|[^/]*/[^/]*/||') + if [ -z "$TARGET_BRANCH" ]; then + echo "Target branch $TARGET_BRANCH is not yet in local repository. Stopping the pipeline." + exit 1 + fi + - git fetch --depth 500 local $TARGET_BRANCH - git remote add origin "$CI_REPOSITORY_URL" - | if [ -z "${CI_COMMIT_BRANCH:-$CI_MERGE_REQUEST_SOURCE_BRANCH_NAME}" ]; then @@ -31,7 +45,11 @@ if ([string]::IsNullOrEmpty($branchName)) { $branchName = $env:CI_MERGE_REQUEST_TARGET_BRANCH_NAME } - git fetch --depth 500 local $branchName + $TARGET_BRANCH = git ls-remote local | Select-String -Pattern $branchName | Select-String -Pattern -NotMatch 'refs/tags/' | Select-Object -Last 1 | ForEach-Object { $_.ToString().Split()[1] -replace '^[^/]*/[^/]*/', '' } + if ([string]::IsNullOrEmpty($TARGET_BRANCH)) { + Write-Output "Target branch $TARGET_BRANCH is not yet in local repository. Stopping the pipeline." + exit 1 + } - git remote add origin $env:CI_REPOSITORY_URL - | $branchName = $env:CI_COMMIT_BRANCH View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/b05f335… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/b05f335… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-128.7.0esr-14.5-1] 2 commits: BB 29745: Limit remote access to content accessible resources
by ma1 (＠ma1) 03 Feb '25

03 Feb '25

ma1 pushed to branch tor-browser-128.7.0esr-14.5-1 at The Tor Project / Applications / Tor Browser Commits: d2be2499 by Henry Wilkes at 2025-02-03T11:53:29+00:00 BB 29745: Limit remote access to content accessible resources - - - - - 7e470c8c by Henry Wilkes at 2025-02-03T11:53:30+00:00 fixup! BB 42716: Disable unwanted about: pages TB 43308: Remove about:logo which exposes a branding asset. - - - - - 2 changed files: - caps/nsScriptSecurityManager.cpp - docshell/base/nsAboutRedirector.cpp Changes: ===================================== caps/nsScriptSecurityManager.cpp ===================================== @@ -1044,6 +1044,48 @@ nsresult nsScriptSecurityManager::CheckLoadURIFlags( } } + // Only allow some "about:" pages to have access to contentaccessible + // "chrome://branding/" assets. Otherwise web pages could easily and + // consistently detect the differences between channels when their + // branding differs. See tor-browser#43308 and tor-browser#42319. + // NOTE: The same assets under the alternative URI + // "resource:///chrome/browser/content/branding/" should already be + // inaccessible to web content, so we only add a condition for the chrome + // path. + if (targetScheme.EqualsLiteral("chrome")) { + nsAutoCString targetHost; + rv = aTargetBaseURI->GetHost(targetHost); + NS_ENSURE_SUCCESS(rv, rv); + if (targetHost.EqualsLiteral("branding")) { + // Disallow any Principal whose scheme is not "about", or is a + // contentaccessible "about" URI ("about:blank" or "about:srcdoc"). + // NOTE: "about:blank" and "about:srcdoc" would be unexpected here + // since such a document spawned by a web document should inherit the + // same Principal URI. I.e. they would be "http:" or "https:" schemes. + // But we add this condition for extra assurances. + // NOTE: Documents with null Principals, like "about:blank" typed by + // the user, would also be excluded since the Principal URI would be + // "moz-nullprincipal:". + if (!aSourceBaseURI->SchemeIs("about") || + NS_IsContentAccessibleAboutURI(aSourceBaseURI)) { + return NS_ERROR_DOM_BAD_URI; + } + // Also exclude "about:reader" from accessing branding assets. I.e. if + // a web page includes `<img src="chrome://branding/..." />` we do not + // want it to render within "about:reader" either. + // Though it is unknown whether the information within "about:reader" + // would be exploitable by a web page, we also want to exclude + // "about:reader" for consistency: if it does not display in the + // original web page, it should not display in "about:reader" either. + nsAutoCString sourcePath; + rv = aSourceBaseURI->GetFilePath(sourcePath); + NS_ENSURE_SUCCESS(rv, rv); + if (sourcePath.EqualsLiteral("reader")) { + return NS_ERROR_DOM_BAD_URI; + } + } + } + if (targetScheme.EqualsLiteral("resource")) { if (StaticPrefs::security_all_resource_uri_content_accessible()) { return NS_OK; ===================================== docshell/base/nsAboutRedirector.cpp ===================================== @@ -123,10 +123,9 @@ static const RedirEntry kRedirMap[] = { nsIAboutModule::IS_SECURE_CHROME_UI}, {"logging", "chrome://global/content/aboutLogging.html", nsIAboutModule::ALLOW_SCRIPT}, - {"logo", "chrome://branding/content/about.png", - nsIAboutModule::URI_SAFE_FOR_UNTRUSTED_CONTENT | - // Linkable for testing reasons. - nsIAboutModule::MAKE_LINKABLE}, + // Do not allow web pages to link to about:logo, which varies between + // channels. See tor-browser#43308. + // Moreover, it exposes firefox-specific branding. {"memory", "chrome://global/content/aboutMemory.xhtml", nsIAboutModule::ALLOW_SCRIPT}, {"certificate", "chrome://global/content/certviewer/certviewer.html", View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/f0b1a9… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/f0b1a9… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser] Pushed new tag FIREFOX_NIGHTLY_128_END
by morgan (＠morgan) 03 Feb '25

03 Feb '25

morgan pushed new tag FIREFOX_NIGHTLY_128_END at The Tor Project / Applications / Tor Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/tree/FIREFOX_N… You're receiving this email because of your account on gitlab.torproject.org.

1 0