[tor-bugs] #6546 [Tor]: Replace check.tp.o with internal mapaddress + JSON/XML object

[Tor Bug Tracker & Wiki]

#6546: Replace check.tp.o with internal mapaddress + JSON/XML object
--------------------------------------------------------------------------------+
 Reporter:  ioerror                                                             |          Owner:                    
     Type:  enhancement                                                         |         Status:  new               
 Priority:  normal                                                              |      Milestone:  Tor: 0.2.4.x-final
Component:  Tor                                                                 |        Version:                    
 Keywords:  proposal-needed tbb-usability MikePerry201210d tor-client SponsorJ  |         Parent:                    
   Points:                                                                      |   Actualpoints:                    
--------------------------------------------------------------------------------+

Comment(by mikeperry):

 Bleh. This article makes me think we can't safely include any
 cookies/nonces in the JSON output:
 http://www.hpenterprisesecurity.com/vulncat/en/vulncat/dotnet/javascript_hijacking_vulnerable_framework.html.

 Therefore, XML seems to actually be a safer option than JSON for this
 reason, but we'd still need to be sure you can't access .text or
 .innerHTML of the content to manually read out the cookie for tracking
 purposes. Being sure here is tricky, as script tags aren't the only tags
 that can be cross-origin...

 Also, if exits were to DNS rebind to the local 127.x.x.x IP address, they
 could read out any cookies we use there, too, even in XML.. Tor would need
 to properly parse Host: headers, at minimum, before handing out cookies,
 and/or it would need to make such cookies very short-lived...

 I'll see if I can capture all of this in the proposal, but this is going
 to be a lot trickier than we'd hoped if we want to ensure we don't open up
 holes for tracking users...

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/6546#comment:16>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online