commit e5da14c4ae6e3917928b3004bca7bd49e972089e Author: Georg Koppen gk@torproject.org Date: Fri May 26 19:18:32 2017 +0000

Bug 21684: Don't expose navigator.AddonManager to content

With https://bugzilla.mozilla.org/show_bug.cgi?id=1245571 support for websites to learn about installed add-ons landed. Currently, this is only enabled for AMO related sites but we don't think this functionality is something we want for Tor Browser as it might aid in fingerprinting users.

The patch does not outright disable access to the API. Privileged code is still able to use it if needed. This should help with usability issues should they arise while mitigating possible fingerprinting and security problems by having this API available to content.

This fixes bug 21684 by deleting the whitelist of URLs shipped with Firefox 52. --- toolkit/mozapps/extensions/AddonManagerWebAPI.cpp | 23 ++++------------------- 1 file changed, 4 insertions(+), 19 deletions(-)

diff --git a/toolkit/mozapps/extensions/AddonManagerWebAPI.cpp b/toolkit/mozapps/extensions/AddonManagerWebAPI.cpp index ca33f3a..45326fd 100644 --- a/toolkit/mozapps/extensions/AddonManagerWebAPI.cpp +++ b/toolkit/mozapps/extensions/AddonManagerWebAPI.cpp @@ -20,25 +20,10 @@ using namespace mozilla::dom;

static bool IsValidHost(const nsACString& host) { - if (host.Equals("addons.mozilla.org") || - host.Equals("discovery.addons.mozilla.org") || - host.Equals("testpilot.firefox.com")) { - return true; - } - - // When testing allow access to the developer sites. - if (Preferences::GetBool("extensions.webapi.testing", false)) { - if (host.LowerCaseEqualsLiteral("addons.allizom.org") || - host.LowerCaseEqualsLiteral("discovery.addons.allizom.org") || - host.LowerCaseEqualsLiteral("addons-dev.allizom.org") || - host.LowerCaseEqualsLiteral("discovery.addons-dev.allizom.org") || - host.LowerCaseEqualsLiteral("testpilot.stage.mozaws.net") || - host.LowerCaseEqualsLiteral("testpilot.dev.mozaws.net") || - host.LowerCaseEqualsLiteral("example.com")) { - return true; - } - } - + // We don't want to allow content to get information about the state of the + // extensions a user has installed. This might aid in fingerprinting. And + // allowing content at all access to this kind of information seems + // potentially risky from a security point as well. Fixes bug 21684. return false; }