- tor-commits - lists.torproject.org

[Git][tpo/applications/tor-browser] Pushed new tag FIREFOX_NIGHTLY_144_END
by Pier Angelo Vendrame (＠pierov) 24 Sep '25

24 Sep '25

Pier Angelo Vendrame pushed new tag FIREFOX_NIGHTLY_144_END at The Tor Project / Applications / Tor Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/tree/FIREFOX_N… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/mullvad-browser][mullvad-browser-140.3.0esr-15.0-1] BB 19741: Fix FPI with OpenSearch.
by Pier Angelo Vendrame (＠pierov) 23 Sep '25

23 Sep '25

Pier Angelo Vendrame pushed to branch mullvad-browser-140.3.0esr-15.0-1 at The Tor Project / Applications / Mullvad Browser Commits: 63fc47b1 by Pier Angelo Vendrame at 2025-09-23T22:07:08+02:00 BB 19741: Fix FPI with OpenSearch. - - - - - 4 changed files: - browser/components/search/SearchUIUtils.sys.mjs - toolkit/components/search/OpenSearchLoader.sys.mjs - toolkit/components/search/SearchService.sys.mjs - toolkit/components/search/nsISearchService.idl Changes: ===================================== browser/components/search/SearchUIUtils.sys.mjs ===================================== @@ -181,7 +181,11 @@ export var SearchUIUtils = { */ async addOpenSearchEngine(locationURL, image, browsingContext) { try { - await Services.search.addOpenSearchEngine(locationURL, image); + await Services.search.addOpenSearchEngine( + locationURL, + image, + browsingContext?.originAttributes + ); } catch (ex) { let titleMsgName; let descMsgName; ===================================== toolkit/components/search/OpenSearchLoader.sys.mjs ===================================== @@ -97,10 +97,17 @@ const MOZSEARCH_LOCALNAME = "SearchPlugin"; * The uri from which to load the OpenSearch engine data. * @param {string} [lastModified] * The UTC date when the engine was last updated, if any. + * @param {object} [originAttributes] + * The first party domain of the site loading that manifest. The domain of the + * manifest will be used if not provided. * @returns {Promise<OpenSearchProperties>} * The properties of the loaded OpenSearch engine. */ -export async function loadAndParseOpenSearchEngine(sourceURI, lastModified) { +export async function loadAndParseOpenSearchEngine( + sourceURI, + lastModified, + originAttributes +) { if (!sourceURI) { throw Components.Exception( "Must have URI when calling _install!", @@ -116,7 +123,7 @@ export async function loadAndParseOpenSearchEngine(sourceURI, lastModified) { lazy.logConsole.debug("Downloading OpenSearch engine from:", sourceURI.spec); - let xmlData = await loadEngineXML(sourceURI, lastModified); + let xmlData = await loadEngineXML(sourceURI, lastModified, originAttributes); let xmlDocument = await parseXML(xmlData); lazy.logConsole.debug("Loading search plugin"); @@ -147,11 +154,13 @@ export async function loadAndParseOpenSearchEngine(sourceURI, lastModified) { * The uri from which to load the OpenSearch engine data. * @param {string} [lastModified] * The UTC date when the engine was last updated, if any. + * @param {object} [originAttributes] + * The origin attributes to use to load the manifest. * @returns {Promise} * A promise that is resolved with the data if the engine is successfully loaded * and rejected otherwise. */ -function loadEngineXML(sourceURI, lastModified) { +function loadEngineXML(sourceURI, lastModified, originAttributes = null) { var chan = lazy.SearchUtils.makeChannel( sourceURI, // OpenSearchEngine is loading a definition file for a search engine, @@ -164,6 +173,17 @@ function loadEngineXML(sourceURI, lastModified) { ? Ci.nsILoadInfo.ALREADY_HTTPS : Ci.nsILoadInfo.NO_UPGRADE; + if (!originAttributes) { + originAttributes = {}; + try { + originAttributes.firstPartyDomain = + Services.eTLD.getSchemelessSite(sourceURI); + } catch (ex) { + console.error("Failed to get first party domain for the manifest", ex); + } + } + chan.loadInfo.originAttributes = originAttributes; + if (lastModified && chan instanceof Ci.nsIHttpChannel) { chan.setRequestHeader("If-Modified-Since", lastModified, false); } ===================================== toolkit/components/search/SearchService.sys.mjs ===================================== @@ -762,13 +762,15 @@ export class SearchService { }); } - async addOpenSearchEngine(engineURL, iconURL) { + async addOpenSearchEngine(engineURL, iconURL, originAttributes) { lazy.logConsole.debug("addOpenSearchEngine: Adding", engineURL); await this.init(); let engine; try { let engineData = await lazy.loadAndParseOpenSearchEngine( - Services.io.newURI(engineURL) + Services.io.newURI(engineURL), + null, + originAttributes ); engine = new lazy.OpenSearchEngine({ engineData, faviconURL: iconURL }); } catch (ex) { ===================================== toolkit/components/search/nsISearchService.idl ===================================== @@ -340,10 +340,14 @@ interface nsISearchService : nsISupports * icon. This value may be overridden by an icon specified in the * engine description file. * + * @param originAttributes [optional] + The origin attributes to use to load this manifest. + * * @throws NS_ERROR_FAILURE if the description file cannot be successfully * loaded. */ - Promise addOpenSearchEngine(in AString engineURL, in AString iconURL); + Promise addOpenSearchEngine(in AString engineURL, in AString iconURL, + [optional] in jsval originAttributes); /** * Adds a new search engine defined by the user. View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/63f… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/63f… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][base-browser-140.3.0esr-15.0-1] BB 19741: Fix FPI with OpenSearch.
by Pier Angelo Vendrame (＠pierov) 23 Sep '25

23 Sep '25

Pier Angelo Vendrame pushed to branch base-browser-140.3.0esr-15.0-1 at The Tor Project / Applications / Tor Browser Commits: e4038e7b by Pier Angelo Vendrame at 2025-09-23T22:05:37+02:00 BB 19741: Fix FPI with OpenSearch. - - - - - 4 changed files: - browser/components/search/SearchUIUtils.sys.mjs - toolkit/components/search/OpenSearchLoader.sys.mjs - toolkit/components/search/SearchService.sys.mjs - toolkit/components/search/nsISearchService.idl Changes: ===================================== browser/components/search/SearchUIUtils.sys.mjs ===================================== @@ -181,7 +181,11 @@ export var SearchUIUtils = { */ async addOpenSearchEngine(locationURL, image, browsingContext) { try { - await Services.search.addOpenSearchEngine(locationURL, image); + await Services.search.addOpenSearchEngine( + locationURL, + image, + browsingContext?.originAttributes + ); } catch (ex) { let titleMsgName; let descMsgName; ===================================== toolkit/components/search/OpenSearchLoader.sys.mjs ===================================== @@ -97,10 +97,17 @@ const MOZSEARCH_LOCALNAME = "SearchPlugin"; * The uri from which to load the OpenSearch engine data. * @param {string} [lastModified] * The UTC date when the engine was last updated, if any. + * @param {object} [originAttributes] + * The first party domain of the site loading that manifest. The domain of the + * manifest will be used if not provided. * @returns {Promise<OpenSearchProperties>} * The properties of the loaded OpenSearch engine. */ -export async function loadAndParseOpenSearchEngine(sourceURI, lastModified) { +export async function loadAndParseOpenSearchEngine( + sourceURI, + lastModified, + originAttributes +) { if (!sourceURI) { throw Components.Exception( "Must have URI when calling _install!", @@ -116,7 +123,7 @@ export async function loadAndParseOpenSearchEngine(sourceURI, lastModified) { lazy.logConsole.debug("Downloading OpenSearch engine from:", sourceURI.spec); - let xmlData = await loadEngineXML(sourceURI, lastModified); + let xmlData = await loadEngineXML(sourceURI, lastModified, originAttributes); let xmlDocument = await parseXML(xmlData); lazy.logConsole.debug("Loading search plugin"); @@ -147,11 +154,13 @@ export async function loadAndParseOpenSearchEngine(sourceURI, lastModified) { * The uri from which to load the OpenSearch engine data. * @param {string} [lastModified] * The UTC date when the engine was last updated, if any. + * @param {object} [originAttributes] + * The origin attributes to use to load the manifest. * @returns {Promise} * A promise that is resolved with the data if the engine is successfully loaded * and rejected otherwise. */ -function loadEngineXML(sourceURI, lastModified) { +function loadEngineXML(sourceURI, lastModified, originAttributes = null) { var chan = lazy.SearchUtils.makeChannel( sourceURI, // OpenSearchEngine is loading a definition file for a search engine, @@ -164,6 +173,17 @@ function loadEngineXML(sourceURI, lastModified) { ? Ci.nsILoadInfo.ALREADY_HTTPS : Ci.nsILoadInfo.NO_UPGRADE; + if (!originAttributes) { + originAttributes = {}; + try { + originAttributes.firstPartyDomain = + Services.eTLD.getSchemelessSite(sourceURI); + } catch (ex) { + console.error("Failed to get first party domain for the manifest", ex); + } + } + chan.loadInfo.originAttributes = originAttributes; + if (lastModified && chan instanceof Ci.nsIHttpChannel) { chan.setRequestHeader("If-Modified-Since", lastModified, false); } ===================================== toolkit/components/search/SearchService.sys.mjs ===================================== @@ -762,13 +762,15 @@ export class SearchService { }); } - async addOpenSearchEngine(engineURL, iconURL) { + async addOpenSearchEngine(engineURL, iconURL, originAttributes) { lazy.logConsole.debug("addOpenSearchEngine: Adding", engineURL); await this.init(); let engine; try { let engineData = await lazy.loadAndParseOpenSearchEngine( - Services.io.newURI(engineURL) + Services.io.newURI(engineURL), + null, + originAttributes ); engine = new lazy.OpenSearchEngine({ engineData, faviconURL: iconURL }); } catch (ex) { ===================================== toolkit/components/search/nsISearchService.idl ===================================== @@ -340,10 +340,14 @@ interface nsISearchService : nsISupports * icon. This value may be overridden by an icon specified in the * engine description file. * + * @param originAttributes [optional] + The origin attributes to use to load this manifest. + * * @throws NS_ERROR_FAILURE if the description file cannot be successfully * loaded. */ - Promise addOpenSearchEngine(in AString engineURL, in AString iconURL); + Promise addOpenSearchEngine(in AString engineURL, in AString iconURL, + [optional] in jsval originAttributes); /** * Adds a new search engine defined by the user. View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/e4038e7… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/e4038e7… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-140.3.0esr-15.0-1] 2 commits: fixup! TB 3455: Add DomainIsolator, for isolating circuit by domain.
by Pier Angelo Vendrame (＠pierov) 23 Sep '25

23 Sep '25

Pier Angelo Vendrame pushed to branch tor-browser-140.3.0esr-15.0-1 at The Tor Project / Applications / Tor Browser Commits: a285b441 by Pier Angelo Vendrame at 2025-09-23T19:45:32+02:00 fixup! TB 3455: Add DomainIsolator, for isolating circuit by domain. Improve DomainIsolator logs and fix a linter warning. - - - - - 771d640c by Pier Angelo Vendrame at 2025-09-23T19:46:39+02:00 BB 19741: Fix FPI with OpenSearch. - - - - - 5 changed files: - browser/components/search/SearchUIUtils.sys.mjs - toolkit/components/search/OpenSearchLoader.sys.mjs - toolkit/components/search/SearchService.sys.mjs - toolkit/components/search/nsISearchService.idl - toolkit/components/tor-launcher/TorDomainIsolator.sys.mjs Changes: ===================================== browser/components/search/SearchUIUtils.sys.mjs ===================================== @@ -181,7 +181,11 @@ export var SearchUIUtils = { */ async addOpenSearchEngine(locationURL, image, browsingContext) { try { - await Services.search.addOpenSearchEngine(locationURL, image); + await Services.search.addOpenSearchEngine( + locationURL, + image, + browsingContext?.originAttributes + ); } catch (ex) { let titleMsgName; let descMsgName; ===================================== toolkit/components/search/OpenSearchLoader.sys.mjs ===================================== @@ -97,10 +97,17 @@ const MOZSEARCH_LOCALNAME = "SearchPlugin"; * The uri from which to load the OpenSearch engine data. * @param {string} [lastModified] * The UTC date when the engine was last updated, if any. + * @param {object} [originAttributes] + * The first party domain of the site loading that manifest. The domain of the + * manifest will be used if not provided. * @returns {Promise<OpenSearchProperties>} * The properties of the loaded OpenSearch engine. */ -export async function loadAndParseOpenSearchEngine(sourceURI, lastModified) { +export async function loadAndParseOpenSearchEngine( + sourceURI, + lastModified, + originAttributes +) { if (!sourceURI) { throw Components.Exception( "Must have URI when calling _install!", @@ -116,7 +123,7 @@ export async function loadAndParseOpenSearchEngine(sourceURI, lastModified) { lazy.logConsole.debug("Downloading OpenSearch engine from:", sourceURI.spec); - let xmlData = await loadEngineXML(sourceURI, lastModified); + let xmlData = await loadEngineXML(sourceURI, lastModified, originAttributes); let xmlDocument = await parseXML(xmlData); lazy.logConsole.debug("Loading search plugin"); @@ -147,11 +154,13 @@ export async function loadAndParseOpenSearchEngine(sourceURI, lastModified) { * The uri from which to load the OpenSearch engine data. * @param {string} [lastModified] * The UTC date when the engine was last updated, if any. + * @param {object} [originAttributes] + * The origin attributes to use to load the manifest. * @returns {Promise} * A promise that is resolved with the data if the engine is successfully loaded * and rejected otherwise. */ -function loadEngineXML(sourceURI, lastModified) { +function loadEngineXML(sourceURI, lastModified, originAttributes = null) { var chan = lazy.SearchUtils.makeChannel( sourceURI, // OpenSearchEngine is loading a definition file for a search engine, @@ -164,6 +173,17 @@ function loadEngineXML(sourceURI, lastModified) { ? Ci.nsILoadInfo.ALREADY_HTTPS : Ci.nsILoadInfo.NO_UPGRADE; + if (!originAttributes) { + originAttributes = {}; + try { + originAttributes.firstPartyDomain = + Services.eTLD.getSchemelessSite(sourceURI); + } catch (ex) { + console.error("Failed to get first party domain for the manifest", ex); + } + } + chan.loadInfo.originAttributes = originAttributes; + if (lastModified && chan instanceof Ci.nsIHttpChannel) { chan.setRequestHeader("If-Modified-Since", lastModified, false); } ===================================== toolkit/components/search/SearchService.sys.mjs ===================================== @@ -762,13 +762,15 @@ export class SearchService { }); } - async addOpenSearchEngine(engineURL, iconURL) { + async addOpenSearchEngine(engineURL, iconURL, originAttributes) { lazy.logConsole.debug("addOpenSearchEngine: Adding", engineURL); await this.init(); let engine; try { let engineData = await lazy.loadAndParseOpenSearchEngine( - Services.io.newURI(engineURL) + Services.io.newURI(engineURL), + null, + originAttributes ); engine = new lazy.OpenSearchEngine({ engineData, faviconURL: iconURL }); } catch (ex) { ===================================== toolkit/components/search/nsISearchService.idl ===================================== @@ -340,10 +340,14 @@ interface nsISearchService : nsISupports * icon. This value may be overridden by an icon specified in the * engine description file. * + * @param originAttributes [optional] + The origin attributes to use to load this manifest. + * * @throws NS_ERROR_FAILURE if the description file cannot be successfully * loaded. */ - Promise addOpenSearchEngine(in AString engineURL, in AString iconURL); + Promise addOpenSearchEngine(in AString engineURL, in AString iconURL, + [optional] in jsval originAttributes); /** * Adds a new search engine defined by the user. ===================================== toolkit/components/tor-launcher/TorDomainIsolator.sys.mjs ===================================== @@ -500,7 +500,13 @@ class TorDomainIsolatorImpl { const browsers = channel.loadInfo.browsingContext?.topChromeWindow?.gBrowser?.browsers; if (!browsers || !channel.loadInfo.browsingContext?.browserId) { - logger.debug("Missing data to associate to a browser", channel.loadInfo); + if (channel instanceof Ci.nsIHttpChannel) { + logger.debug( + "Missing data to associate to a browser", + channel.loadInfo.loadingPrincipal?.URI?.spec, + channel.loadInfo + ); + } return null; } for (const browser of browsers) { @@ -593,7 +599,7 @@ class TorDomainIsolatorImpl { // Should we modify the lower layer to send a circuit identifier, instead? if ( circuit.length === data.length && - circuit.every((id, index) => id === data[index].fingerprint) + circuit.every((fp, index) => fp === data[index].fingerprint) ) { return; } View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/3a7132… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/3a7132… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-140.3.0esr-15.0-1] fixup! TB 44032: YEC 2025 assets.
by Pier Angelo Vendrame (＠pierov) 23 Sep '25

23 Sep '25

Pier Angelo Vendrame pushed to branch tor-browser-140.3.0esr-15.0-1 at The Tor Project / Applications / Tor Browser Commits: 3a71327e by Pier Angelo Vendrame at 2025-09-23T11:42:44+02:00 fixup! TB 44032: YEC 2025 assets. TB 44216: Add a workaround to font CSP assertions. - - - - - 1 changed file: - dom/security/nsContentSecurityUtils.cpp Changes: ===================================== dom/security/nsContentSecurityUtils.cpp ===================================== @@ -1883,7 +1883,7 @@ void nsContentSecurityUtils::AssertAboutPageHasCSP(Document* aDocument) { if (dir.EqualsLiteral("default-src") || dir.EqualsLiteral("object-src") || dir.EqualsLiteral("script-src") || dir.EqualsLiteral("style-src") || dir.EqualsLiteral("img-src") || dir.EqualsLiteral("media-src") || - dir.EqualsLiteral("connect-src")) { + dir.EqualsLiteral("connect-src") || dir.EqualsLiteral("font-src")) { continue; } View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/3a71327… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/3a71327… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/mullvad-browser][mullvad-browser-140.3.0esr-15.0-1] fixup! MB 213: Customize the search engines list
by Pier Angelo Vendrame (＠pierov) 23 Sep '25

23 Sep '25

Pier Angelo Vendrame pushed to branch mullvad-browser-140.3.0esr-15.0-1 at The Tor Project / Applications / Mullvad Browser Commits: aaaa4b20 by Pier Angelo Vendrame at 2025-09-23T14:38:53+02:00 fixup! MB 213: Customize the search engines list BB 44153: Add search engine tests. - - - - - 1 changed file: - toolkit/components/search/tests/xpcshell/test_base_browser.js Changes: ===================================== toolkit/components/search/tests/xpcshell/test_base_browser.js ===================================== @@ -9,10 +9,14 @@ "use strict"; const expectedURLs = { - ddg: "https://duckduckgo.com/?q=test", + leta: "https://leta.mullvad.net/?q=test", + ddg: "https://duckduckgo.com/html/?q=test", + "ddg-html": "https://html.duckduckgo.com/html?q=test", + mojeek: "https://www.mojeek.com/search?q=test", + brave: "https://search.brave.com/search?q=test", startpage: "https://www.startpage.com/sp/search?q=test", }; -const defaultEngine = "ddg"; +const defaultEngine = "leta"; add_setup(async function setup() { await Services.search.init(); View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/aaa… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/aaa… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/mullvad-browser][mullvad-browser-140.3.0esr-15.0-1] 3 commits: fixup! BB 43525: Skip Remote Settings for search engine customization.
by Pier Angelo Vendrame (＠pierov) 23 Sep '25

23 Sep '25

Pier Angelo Vendrame pushed to branch mullvad-browser-140.3.0esr-15.0-1 at The Tor Project / Applications / Mullvad Browser Commits: a9f584b7 by Pier Angelo Vendrame at 2025-09-23T14:17:55+02:00 fixup! BB 43525: Skip Remote Settings for search engine customization. BB 44153: Add tests. - - - - - 0d376fac by Pier Angelo Vendrame at 2025-09-23T14:17:56+02:00 fixup! BB 40925: Implemented the Security Level component BB 44153: Add search engine customization tests. - - - - - 5d26d127 by Pier Angelo Vendrame at 2025-09-23T14:17:57+02:00 fixup! BB 31740: Remove some unnecessary RemoteSettings instances BB 44153: Add search engine customization tests. Change where we ignore upstream's block lists as the previous mechanism made tests timeout. - - - - - 4 changed files: - toolkit/components/search/SearchService.sys.mjs - + toolkit/components/search/tests/xpcshell/test_base_browser.js - + toolkit/components/search/tests/xpcshell/test_security_level.js - toolkit/components/search/tests/xpcshell/xpcshell.toml Changes: ===================================== toolkit/components/search/SearchService.sys.mjs ===================================== @@ -4,6 +4,7 @@ /* eslint no-shadow: error, mozilla/no-aArgs: error */ +import { AppConstants } from "resource://gre/modules/AppConstants.sys.mjs"; import { XPCOMUtils } from "resource://gre/modules/XPCOMUtils.sys.mjs"; const lazy = {}; @@ -1426,6 +1427,10 @@ export class SearchService { // start listening straight away. Services.obs.addObserver(this, lazy.Region.REGION_TOPIC); + this.#getIgnoreListAndSubscribe().catch(ex => + console.error(ex, "Search Service could not get the ignore list.") + ); + this.#engineSelector = new lazy.SearchEngineSelector( this.#handleConfigurationUpdated.bind(this) ); @@ -1568,7 +1573,6 @@ export class SearchService { * handled via a sync listener. * */ - // eslint-disable-next-line no-unused-private-class-members async #getIgnoreListAndSubscribe() { let listener = this.#handleIgnoreListUpdated.bind(this); const current = await lazy.IgnoreLists.getAndSubscribe(listener); @@ -1593,6 +1597,10 @@ export class SearchService { * The event in the format received from RemoteSettings. */ async #handleIgnoreListUpdated(eventData) { + if (AppConstants.BASE_BROWSER_VERSION) { + return; + } + lazy.logConsole.debug("#handleIgnoreListUpdated"); const { data: { current }, ===================================== toolkit/components/search/tests/xpcshell/test_base_browser.js ===================================== @@ -0,0 +1,47 @@ +/* Any copyright is dedicated to the Public Domain. + * http://creativecommons.org/publicdomain/zero/1.0/ */ + +/** + * This tests the SearchService to check our override of the remote settings is + * working as expected. + */ + +"use strict"; + +const expectedURLs = { + ddg: "https://duckduckgo.com/?q=test", + startpage: "https://www.startpage.com/sp/search?q=test", +}; +const defaultEngine = "ddg"; + +add_setup(async function setup() { + await Services.search.init(); +}); + +add_task(async function test_listEngines() { + const { engines } = + await Services.search.wrappedJSObject._fetchEngineSelectorEngines(); + const foundIdentifiers = engines.map(e => e.identifier); + Assert.deepEqual(foundIdentifiers, Object.keys(expectedURLs)); +}); + +add_task(async function test_default() { + Assert.equal( + (await Services.search.getDefault()).id, + defaultEngine, + `${defaultEngine} is our default search engine in normal mode.` + ); + Assert.equal( + (await Services.search.getDefaultPrivate()).id, + defaultEngine, + `${defaultEngine} is our default search engine in PBM.` + ); +}); + +add_task(function test_checkSearchURLs() { + for (const [id, url] of Object.entries(expectedURLs)) { + const engine = Services.search.getEngineById(id); + const foundUrl = engine.getSubmission("test").uri.spec; + Assert.equal(foundUrl, url, `The URL of ${engine.name} is not altered.`); + } +}); ===================================== toolkit/components/search/tests/xpcshell/test_security_level.js ===================================== @@ -0,0 +1,22 @@ +/* Any copyright is dedicated to the Public Domain. + * http://creativecommons.org/publicdomain/zero/1.0/ */ + +/** + * This tests that we use the HTML version of DuckDuckGo when in the safest + * security level. + */ + +"use strict"; + +const expectedURLs = { + ddg: "https://html.duckduckgo.com/html?q=test", +}; + +add_task(async function test_securityLevel() { + await Services.search.init(); + for (const [id, url] of Object.entries(expectedURLs)) { + const engine = Services.search.getEngineById(id); + const foundUrl = engine.getSubmission("test").uri.spec; + Assert.equal(foundUrl, url, `${engine.name} is in HTML mode.`); + } +}); ===================================== toolkit/components/search/tests/xpcshell/xpcshell.toml ===================================== @@ -38,6 +38,8 @@ tags = "remote-settings" ["test_async.js"] +["test_base_browser.js"] + ["test_configExpansion.js"] support-files = [ "../../schema/search-config-v2-schema.json", @@ -199,6 +201,9 @@ support-files = [ ["test_searchUrlDomain.js"] +["test_security_level.js"] +prefs = ["browser.security_level.security_slider=1"] + ["test_selectedEngine.js"] ["test_sendSubmissionURL.js"] View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/compare/bb… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/compare/bb… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][base-browser-140.3.0esr-15.0-1] 3 commits: fixup! BB 43525: Skip Remote Settings for search engine customization.
by Pier Angelo Vendrame (＠pierov) 23 Sep '25

23 Sep '25

Pier Angelo Vendrame pushed to branch base-browser-140.3.0esr-15.0-1 at The Tor Project / Applications / Tor Browser Commits: 825dd0b0 by Pier Angelo Vendrame at 2025-09-23T14:15:22+02:00 fixup! BB 43525: Skip Remote Settings for search engine customization. BB 44153: Add tests. - - - - - 53431beb by Pier Angelo Vendrame at 2025-09-23T14:15:36+02:00 fixup! BB 40925: Implemented the Security Level component BB 44153: Add search engine customization tests. - - - - - f9f42b6d by Pier Angelo Vendrame at 2025-09-23T14:15:48+02:00 fixup! BB 31740: Remove some unnecessary RemoteSettings instances BB 44153: Add search engine customization tests. Change where we ignore upstream's block lists as the previous mechanism made tests timeout. - - - - - 4 changed files: - toolkit/components/search/SearchService.sys.mjs - + toolkit/components/search/tests/xpcshell/test_base_browser.js - + toolkit/components/search/tests/xpcshell/test_security_level.js - toolkit/components/search/tests/xpcshell/xpcshell.toml Changes: ===================================== toolkit/components/search/SearchService.sys.mjs ===================================== @@ -4,6 +4,7 @@ /* eslint no-shadow: error, mozilla/no-aArgs: error */ +import { AppConstants } from "resource://gre/modules/AppConstants.sys.mjs"; import { XPCOMUtils } from "resource://gre/modules/XPCOMUtils.sys.mjs"; const lazy = {}; @@ -1426,6 +1427,10 @@ export class SearchService { // start listening straight away. Services.obs.addObserver(this, lazy.Region.REGION_TOPIC); + this.#getIgnoreListAndSubscribe().catch(ex => + console.error(ex, "Search Service could not get the ignore list.") + ); + this.#engineSelector = new lazy.SearchEngineSelector( this.#handleConfigurationUpdated.bind(this) ); @@ -1568,7 +1573,6 @@ export class SearchService { * handled via a sync listener. * */ - // eslint-disable-next-line no-unused-private-class-members async #getIgnoreListAndSubscribe() { let listener = this.#handleIgnoreListUpdated.bind(this); const current = await lazy.IgnoreLists.getAndSubscribe(listener); @@ -1593,6 +1597,10 @@ export class SearchService { * The event in the format received from RemoteSettings. */ async #handleIgnoreListUpdated(eventData) { + if (AppConstants.BASE_BROWSER_VERSION) { + return; + } + lazy.logConsole.debug("#handleIgnoreListUpdated"); const { data: { current }, ===================================== toolkit/components/search/tests/xpcshell/test_base_browser.js ===================================== @@ -0,0 +1,47 @@ +/* Any copyright is dedicated to the Public Domain. + * http://creativecommons.org/publicdomain/zero/1.0/ */ + +/** + * This tests the SearchService to check our override of the remote settings is + * working as expected. + */ + +"use strict"; + +const expectedURLs = { + ddg: "https://duckduckgo.com/?q=test", + startpage: "https://www.startpage.com/sp/search?q=test", +}; +const defaultEngine = "ddg"; + +add_setup(async function setup() { + await Services.search.init(); +}); + +add_task(async function test_listEngines() { + const { engines } = + await Services.search.wrappedJSObject._fetchEngineSelectorEngines(); + const foundIdentifiers = engines.map(e => e.identifier); + Assert.deepEqual(foundIdentifiers, Object.keys(expectedURLs)); +}); + +add_task(async function test_default() { + Assert.equal( + (await Services.search.getDefault()).id, + defaultEngine, + `${defaultEngine} is our default search engine in normal mode.` + ); + Assert.equal( + (await Services.search.getDefaultPrivate()).id, + defaultEngine, + `${defaultEngine} is our default search engine in PBM.` + ); +}); + +add_task(function test_checkSearchURLs() { + for (const [id, url] of Object.entries(expectedURLs)) { + const engine = Services.search.getEngineById(id); + const foundUrl = engine.getSubmission("test").uri.spec; + Assert.equal(foundUrl, url, `The URL of ${engine.name} is not altered.`); + } +}); ===================================== toolkit/components/search/tests/xpcshell/test_security_level.js ===================================== @@ -0,0 +1,22 @@ +/* Any copyright is dedicated to the Public Domain. + * http://creativecommons.org/publicdomain/zero/1.0/ */ + +/** + * This tests that we use the HTML version of DuckDuckGo when in the safest + * security level. + */ + +"use strict"; + +const expectedURLs = { + ddg: "https://html.duckduckgo.com/html?q=test", +}; + +add_task(async function test_securityLevel() { + await Services.search.init(); + for (const [id, url] of Object.entries(expectedURLs)) { + const engine = Services.search.getEngineById(id); + const foundUrl = engine.getSubmission("test").uri.spec; + Assert.equal(foundUrl, url, `${engine.name} is in HTML mode.`); + } +}); ===================================== toolkit/components/search/tests/xpcshell/xpcshell.toml ===================================== @@ -38,6 +38,8 @@ tags = "remote-settings" ["test_async.js"] +["test_base_browser.js"] + ["test_configExpansion.js"] support-files = [ "../../schema/search-config-v2-schema.json", @@ -199,6 +201,9 @@ support-files = [ ["test_searchUrlDomain.js"] +["test_security_level.js"] +prefs = ["browser.security_level.security_slider=1"] + ["test_selectedEngine.js"] ["test_sendSubmissionURL.js"] View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/8893f4… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/8893f4… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-140.3.0esr-15.0-1] 5 commits: dropme! TB 42891: Set the bundled search engine for Tor Browser.
by Pier Angelo Vendrame (＠pierov) 23 Sep '25

23 Sep '25

Pier Angelo Vendrame pushed to branch tor-browser-140.3.0esr-15.0-1 at The Tor Project / Applications / Tor Browser Commits: b17d862b by Pier Angelo Vendrame at 2025-09-23T11:34:13+02:00 dropme! TB 42891: Set the bundled search engine for Tor Browser. Temporarily restore the Base Browser search engine configuration for running tests on it. - - - - - b1f4f5aa by Pier Angelo Vendrame at 2025-09-23T11:34:16+02:00 fixup! BB 43525: Skip Remote Settings for search engine customization. BB 44153: Add tests. - - - - - 030d4788 by Pier Angelo Vendrame at 2025-09-23T11:34:17+02:00 fixup! BB 40925: Implemented the Security Level component BB 44153: Add search engine customization tests. - - - - - cb434512 by Pier Angelo Vendrame at 2025-09-23T11:34:18+02:00 fixup! TB 42891: Set the bundled search engine for Tor Browser. BB 44153: Add search engine customization tests. - - - - - 2901ed30 by Pier Angelo Vendrame at 2025-09-23T11:34:19+02:00 fixup! BB 31740: Remove some unnecessary RemoteSettings instances BB 44153: Add search engine customization tests. Change where we ignore upstream's block lists as the previous mechanism made tests timeout. - - - - - 5 changed files: - toolkit/components/search/SearchService.sys.mjs - toolkit/components/search/content/base-browser-search-engines.json - + toolkit/components/search/tests/xpcshell/test_base_browser.js - + toolkit/components/search/tests/xpcshell/test_security_level.js - toolkit/components/search/tests/xpcshell/xpcshell.toml Changes: ===================================== toolkit/components/search/SearchService.sys.mjs ===================================== @@ -4,6 +4,7 @@ /* eslint no-shadow: error, mozilla/no-aArgs: error */ +import { AppConstants } from "resource://gre/modules/AppConstants.sys.mjs"; import { XPCOMUtils } from "resource://gre/modules/XPCOMUtils.sys.mjs"; const lazy = {}; @@ -1426,6 +1427,10 @@ export class SearchService { // start listening straight away. Services.obs.addObserver(this, lazy.Region.REGION_TOPIC); + this.#getIgnoreListAndSubscribe().catch(ex => + console.error(ex, "Search Service could not get the ignore list.") + ); + this.#engineSelector = new lazy.SearchEngineSelector( this.#handleConfigurationUpdated.bind(this) ); @@ -1568,7 +1573,6 @@ export class SearchService { * handled via a sync listener. * */ - // eslint-disable-next-line no-unused-private-class-members async #getIgnoreListAndSubscribe() { let listener = this.#handleIgnoreListUpdated.bind(this); const current = await lazy.IgnoreLists.getAndSubscribe(listener); @@ -1593,6 +1597,10 @@ export class SearchService { * The event in the format received from RemoteSettings. */ async #handleIgnoreListUpdated(eventData) { + if (AppConstants.BASE_BROWSER_VERSION) { + return; + } + lazy.logConsole.debug("#handleIgnoreListUpdated"); const { data: { current }, ===================================== toolkit/components/search/content/base-browser-search-engines.json ===================================== @@ -37,7 +37,7 @@ }, { "base": { - "aliases": ["startpage"], + "aliases": ["startpage", "sp"], "classification": "general", "name": "Startpage", "urls": { ===================================== toolkit/components/search/tests/xpcshell/test_base_browser.js ===================================== @@ -0,0 +1,52 @@ +/* Any copyright is dedicated to the Public Domain. + * http://creativecommons.org/publicdomain/zero/1.0/ */ + +/** + * This tests the SearchService to check our override of the remote settings is + * working as expected. + */ + +"use strict"; + +const expectedURLs = { + ddg: "https://duckduckgo.com/?q=test", + "ddg-onion": + "https://duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion/?q=t…", + startpage: "https://www.startpage.com/sp/search?q=test", + "startpage-onion": + "http://startpagel6srwcjlue4zgq3zevrujfaow726kjytqbbjyrswwmjzcqd.onion/sp/se…", + wikipedia: "https://en.wikipedia.org/wiki/Special:Search?search=test", +}; +const defaultEngine = "ddg"; + +add_setup(async function setup() { + await Services.search.init(); +}); + +add_task(async function test_listEngines() { + const { engines } = + await Services.search.wrappedJSObject._fetchEngineSelectorEngines(); + const foundIdentifiers = engines.map(e => e.identifier); + Assert.deepEqual(foundIdentifiers, Object.keys(expectedURLs)); +}); + +add_task(async function test_default() { + Assert.equal( + (await Services.search.getDefault()).id, + defaultEngine, + `${defaultEngine} is our default search engine in normal mode.` + ); + Assert.equal( + (await Services.search.getDefaultPrivate()).id, + defaultEngine, + `${defaultEngine} is our default search engine in PBM.` + ); +}); + +add_task(function test_checkSearchURLs() { + for (const [id, url] of Object.entries(expectedURLs)) { + const engine = Services.search.getEngineById(id); + const foundUrl = engine.getSubmission("test").uri.spec; + Assert.equal(foundUrl, url, `The URL of ${engine.name} is not altered.`); + } +}); ===================================== toolkit/components/search/tests/xpcshell/test_security_level.js ===================================== @@ -0,0 +1,24 @@ +/* Any copyright is dedicated to the Public Domain. + * http://creativecommons.org/publicdomain/zero/1.0/ */ + +/** + * This tests that we use the HTML version of DuckDuckGo when in the safest + * security level. + */ + +"use strict"; + +const expectedURLs = { + ddg: "https://html.duckduckgo.com/html?q=test", + "ddg-onion": + "https://duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion/html…", +}; + +add_task(async function test_securityLevel() { + await Services.search.init(); + for (const [id, url] of Object.entries(expectedURLs)) { + const engine = Services.search.getEngineById(id); + const foundUrl = engine.getSubmission("test").uri.spec; + Assert.equal(foundUrl, url, `${engine.name} is in HTML mode.`); + } +}); ===================================== toolkit/components/search/tests/xpcshell/xpcshell.toml ===================================== @@ -38,6 +38,8 @@ tags = "remote-settings" ["test_async.js"] +["test_base_browser.js"] + ["test_configExpansion.js"] support-files = [ "../../schema/search-config-v2-schema.json", @@ -199,6 +201,9 @@ support-files = [ ["test_searchUrlDomain.js"] +["test_security_level.js"] +prefs = ["browser.security_level.security_slider=1"] + ["test_selectedEngine.js"] ["test_sendSubmissionURL.js"] View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/c62f5d… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/c62f5d… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-build][main] 2 commits: Bug 41569: Include the channel name on .desktop files.
by Pier Angelo Vendrame (＠pierov) 22 Sep '25

22 Sep '25

Pier Angelo Vendrame pushed to branch main at The Tor Project / Applications / tor-browser-build Commits: fc1adf49 by Pier Angelo Vendrame at 2025-09-22T18:53:24+02:00 Bug 41569: Include the channel name on .desktop files. But only for alpha/nightly. - - - - - 2f802636 by Pier Angelo Vendrame at 2025-09-22T18:53:24+02:00 Bug 41558: Share descriptions between Linux packages and archives. - - - - - 5 changed files: - projects/browser/RelativeLink/start-browser - projects/browser/RelativeLink/start-browser.desktop - projects/linux-packages/browser.desktop.in - projects/linux-packages/config - rbm.conf Changes: ===================================== projects/browser/RelativeLink/start-browser ===================================== @@ -241,7 +241,7 @@ if test -z "$system_install"; then # Fix up .desktop Icon and Exec Paths, and update the .desktop file from the # canonical version if it was changed by the updater. cp start-[% c('var/project-name') %].desktop ../ - sed -i -e "s,^Name=.*,Name=[% c('var/Project_Name') %],g" ../start-[% c('var/project-name') %].desktop + sed -i -e "s,^Name=.*,Name=[% c('var/display_name') %],g" ../start-[% c('var/project-name') %].desktop sed -i -e "s,^Icon=.*,Icon=$PWD/browser/chrome/icons/default/default128.png,g" ../start-[% c('var/project-name') %].desktop sed -i -e "s,^Icon=.*,Icon=$PWD/browser/chrome/icons/default/default128.png,g" start-[% c('var/project-name') %].desktop sed -i -e "s,^Exec=.*,Exec=sh -c '\"$PWD/start-[% c('var/project-name') %]\" || ([ ! -x \"$PWD/start-[% c('var/project-name') %]\" ] \&\& \"\$(dirname \"\$*\")\"/Browser/start-[% c('var/project-name') %])' dummy %k,g" ../start-[% c('var/project-name') %].desktop ===================================== projects/browser/RelativeLink/start-browser.desktop ===================================== @@ -24,9 +24,9 @@ [Desktop Entry] Type=Application -Name=[% c("var/Project_Name") %] Setup +Name=[% c("var/display_name") %] Setup GenericName=Web Browser -Comment=[% c("var/Project_Name") %] is +1 for privacy and −1 for mass surveillance +Comment=[% c("var/project_description") %] Categories=Network;WebBrowser;Security; Exec=sh -c '"$(dirname "$*")"/Browser/start-[% c("var/project-name") %] || ([ ! -x "$(dirname "$*")"/Browser/start-[% c("var/project-name") %] ] && "$(dirname "$*")"/start-[% c("var/project-name") %])' dummy %k X-[% c("var/ProjectName") %]-ExecShell=./Browser/start-[% c("var/project-name") %] --detach ===================================== projects/linux-packages/browser.desktop.in ===================================== @@ -1,7 +1,7 @@ [Desktop Entry] Version=1.0 Type=Application -Name=[% c("var/Project_Name") %] +Name=[% c("var/display_name") %] GenericName=Web Browser Comment=[% c("var/system_pkg/pkg_description") %] Categories=Network;WebBrowser; ===================================== projects/linux-packages/config ===================================== @@ -11,7 +11,7 @@ var: pkg_name: '[% c("var/project-name") %]-[% c("var/channel") %]' pkg_version: '[% c("var/torbrowser_version") %]' pkg_revision: '1' - pkg_description: '[% c("var/display_name") %]' + pkg_description: '[% c("var/project_description") %]' deb_release_date: '[% USE date; date.format(c("timestamp"), format = "%a, %d %b %Y 01:02:03 +0000", locale = "en_US") %]' # https://spdx.github.io/spdx-spec/v2.3/SPDX-license-expressions/ spdx_license: 'MPL-2.0 AND GPL-3.0-or-later AND OFL-1.1 AND Apache-2.0[% IF c("var/tor-browser") %] AND BSD-3-Clause AND CC0-1.0 AND MIT[% END %]' @@ -122,7 +122,6 @@ targets: var: browser_type: torbrowser system_pkg: - pkg_description: 'Tor Browser is a privacy-focused web browser designed to minimize tracking and fingerprinting, using the Tor network to protect your privacy and anonymity.' pkg_url: 'https://torproject.org/' basebrowser: var: @@ -131,7 +130,6 @@ targets: var: browser_type: mullvadbrowser system_pkg: - pkg_description: 'Mullvad Browser is a privacy-focused web browser designed to minimize tracking and fingerprinting.' pkg_url: 'https://mullvad.net/browser' release: ===================================== rbm.conf ===================================== @@ -348,6 +348,7 @@ targets: Project_Name: 'Tor Browser' ProjectName: TorBrowser project_initials: tb + project_description: 'Tor Browser is a privacy-focused web browser designed to minimize tracking and fingerprinting, using the Tor network to protect your privacy and anonymity.' basebrowser: var: @@ -366,6 +367,7 @@ targets: Project_Name: 'Mullvad Browser' ProjectName: MullvadBrowser project_initials: mb + project_description: 'Mullvad Browser is a privacy-focused web browser designed to minimize tracking and fingerprinting.' exe_name: mullvadbrowser mar_channel_id: '[% c("var/projectname") %]-mullvad-[% c("var/channel") %]' locales: View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/compare/… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/compare/… You're receiving this email because of your account on gitlab.torproject.org.

1 0