[tbb-bugs] #16983 [Tor Browser]: Favicon requests not isolated if one opens the tab list dropdown

[Tor Bug Tracker & Wiki]

#16983: Favicon requests not isolated if one opens the tab list dropdown
-------------------------+-------------------------------------------------
     Reporter:           |      Owner:  tbb-team
  someone_else           |     Status:  needs_review
         Type:  defect   |  Milestone:
     Priority:  major    |    Version:
    Component:  Tor      |   Keywords:  tbb-linkability,
  Browser                |  TorBrowserTeam201509R
   Resolution:           |  Parent ID:
Actual Points:           |
       Points:           |
-------------------------+-------------------------------------------------

Comment (by arthuredelstein):

 Replying to [comment:10 mcs]:
 > I don't understand how we want this to work. Reading Arthur's
 description of the manual test in comment:9, it sounds like the first
 party domain associated with the active tab will be used for all favicon
 fetches when the menu is opened. And from reading the code plus this patch
 I get the same impression.
 >
 > Is that the behavior we want? Or do we want the wikipedia favicon to be
 isolated as wikipedia.org no matter what tab is active?

 The latter behavior is what is intended and what I believe is happening.
 In `browser/base/content/tabbrowser.xml`, there is one menuitem defined
 for each tab. Whenever a tab changes, whether it is active or not,
 `_setMenuitemAttributes` is triggered, to copy the `image` attribute from
 the `tab` to the corresponding `menuitem`. The line I am adding in
 `_setMenuitemAttributes` also copies the `firstparty` attribute from `tab`
 to corresponding `menuitem`.

 Here's new version of the demo that sets each `image` attribute to an URL
 such as
 http://dummyimage.com/16x16/fff/000&text=3.
 That URL generates an image with an integer, like this:
 [[Image(http://dummyimage.com/16x16/fff/000&text=3)]].

 I opened several tabs with different sites. Here is what the drop down
 looked like:

 [[Image(Screen Shot 2015-09-15 at 11.34.57 AM.png)]]

 Then I entered the following code in the Browser Console:

 {{{
 let popup = document.getElementById("alltabs-popup");
 popup.addEventListener("popupshown", function () {
   for (var i = 3; i < popup.children.length; ++i) {
     console.log("firstparty found: " +
 popup.children[i].getAttribute("firstparty"));
     popup.children[i].setAttribute("image",
 "http://dummyimage.com/16x16/fff/000&text=" + i);
   }
 }, false);
 }}}

 The console output was:

 {{{
 "firstparty found: https://www.wikipedia.org/"
 "firstparty found: https://trac.torproject.org/projects/tor"
 "firstparty found: https://github.com/"
 "firstparty found: http://www.gnu.org/"
 "firstparty found: http://elm-lang.org/"
 [09-15 18:35:33] Torbutton INFO: tor SOCKS:
 http://dummyimage.com/16x16/fff/000&text=3 via wikipedia.org:0
 [09-15 18:35:33] Torbutton INFO: tor SOCKS:
 http://dummyimage.com/16x16/fff/000&text=4 via torproject.org:0
 [09-15 18:35:33] Torbutton INFO: tor SOCKS:
 http://dummyimage.com/16x16/fff/000&text=5 via github.com:0
 [09-15 18:35:33] Torbutton INFO: tor SOCKS:
 http://dummyimage.com/16x16/fff/000&text=6 via gnu.org:0
 [09-15 18:35:33] Torbutton INFO: tor SOCKS:
 http://dummyimage.com/16x16/fff/000&text=7 via elm-lang.org:0
 }}}

 And here is the dropdown after the icons loaded (rather slowly):

 [[Image(Screen Shot 2015-09-15 at 11.35.50 AM.png)]]

 So each menu item has loaded a different favicon, through the circuit
 assigned to each tab.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/16983#comment:11>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online