Pier Angelo Vendrame pushed to branch tor-browser-151.0a1-16.0-1 at The Tor Project / Applications / Tor Browser Commits: 3bc02e6b by Pier Angelo Vendrame at 2026-05-26T16:54:01+02:00 fixup! TB 40933: Add tor-launcher functionality TB 44991: Improve the no-authentication handling on the control port. - - - - - 2 changed files: - toolkit/components/tor-launcher/TorControlPort.sys.mjs - toolkit/components/tor-launcher/TorProvider.sys.mjs Changes: ===================================== toolkit/components/tor-launcher/TorControlPort.sys.mjs ===================================== @@ -672,6 +672,8 @@ export class TorController { /** * Authenticate to the tor daemon. * Notice that a failure in the authentication makes the connection close. + * This function tolerates empty and false-ish passwords because a client + * needs to authenticate even when all authentication methods are disabled. * * @param {Uint8Array} password The password for the control port, as an array * of bytes @@ -680,7 +682,11 @@ export class TorController { const passwordString = Array.from(password ?? [], b => b.toString(16).padStart(2, "0") ).join(""); - await this.#sendCommandSimple(`authenticate ${passwordString}`); + let command = "AUTHENTICATE"; + if (passwordString) { + command += ` ${passwordString}`; + } + await this.#sendCommandSimple(command); } // Information ===================================== toolkit/components/tor-launcher/TorProvider.sys.mjs ===================================== @@ -834,6 +834,9 @@ export class TorProvider extends TorProviderBase { this.#controlPortSettings.cookieFilePath ); } + // As per the spec, we must always authenticate to the control port, even + // when all authentication methods are disabled. + // https://spec.torproject.org/control-spec/commands.html#authenticate await controlPort.authenticate(password); } catch (e) { try { View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/3bc02e6b... -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/3bc02e6b... You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help