Pier Angelo Vendrame pushed to branch tor-browser-153.3.0esr-16.0-1 at The Tor Project / Applications / Tor Browser

Commits:

• a33d5f55
  by Pier Angelo Vendrame at 2026-09-22T09:05:26+02:00

  fixup! TB 23247: Communicating security expectations for .onion
  
  TB 45343: Hide the custom roots warning for onion sites.
  
  At the moment, we allow self-signed certificates for onion services.
  However, tghere are several warnings we need to hide, as they would be
  misleading of the actual situation.
  
  Also, hide any field we get from the certificate, to avoid phishing.
  
  In the future, we may re-evaluate accepting self-certificates from
  onion services.
  

1 changed file:

• browser/base/content/browser-siteIdentity.js

Changes:

       this._updateAttribute(element, "ciphers", ciphers);

       this._updateAttribute(element, "mixedcontent", mixedcontent);

       this._updateAttribute(element, "isbroken", this._isBrokenConnection);

-      element.toggleAttribute("customroot", this._hasCustomRoot());

+      // tor-browser#45343: hide the custom root warning for Onion sites.

+      element.toggleAttribute(

+        "customroot",

+        this._hasCustomRoot() && !this._uriIsOnionHost

+      );

       this._updateAttribute(element, "httpsonlystatus", httpsOnlyStatus);

     }

       }

     }

+    // tor-browser#45343: hide the custom root warning for Onion sites, but also

+    // empty the verifier, since it might be a lie.

+    if (this._uriIsOnionHost && this._hasCustomRoot()) {

+      owner = "";

+      supplemental = "";

+      verifier = "";

+    }

+

     // Push the appropriate strings out to the UI.

     document.l10n.setAttributes(

       this._identityPopupMainViewHeaderLabel,