[tbb-bugs] #16427 [Tor Browser]: Use internal update URL for Torbutton

[Tor Bug Tracker & Wiki]

#16427: Use internal update URL for Torbutton
-------------------------+-------------------------------------------------
     Reporter:  gk       |      Owner:  tbb-team
         Type:           |     Status:  needs_review
  enhancement            |  Milestone:
     Priority:  normal   |    Version:
    Component:  Tor      |   Keywords:  tbb-torbutton,
  Browser                |  TorBrowserTeam201506R
   Resolution:           |  Parent ID:
Actual Points:           |
       Points:           |
-------------------------+-------------------------------------------------

Comment (by mcs):

 Replying to [comment:7 mikeperry]:
 > Is there a reason why we need the comma after the data url? Is that
 related to the XML warnings?

 The comma is required to separate the content type from the data URL
 payload (which in our case is an empty string).  See section 3 of
 https://tools.ietf.org/html/rfc2397.  I think the XML warning occurs
 because the document (text) is empty, which means that request.responseXML
 is null or undefined.  But we do not want a non-empty XML document,
 because then the code will probably get as far as trying to check for a
 signature and try to verify it using the updateKey... which we do not
 have.

 So... I think this is the best we can do without patching the code inside
 toolkit/mozapps/extensions/internal/AddonUpdateChecker.jsm.  If you want
 to follow the execution patch, start at the checkForUpdates() function
 within that file.  If I was going to patch something, I would modify
 UpdateParser.onLoad() to accept (and ignore) a zero-length document
 (request.responseText == "").  I am not sure if Mozilla would like that
 idea or not.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/16427#comment:8>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online