[tor-bugs] #12827 [Tor Browser]: Create preference to disable SVG

[Tor Bug Tracker & Wiki]

#12827: Create preference to disable SVG
-------------------------+-------------------------------------------------
     Reporter:           |      Owner:  mcs
  mikeperry              |     Status:  assigned
         Type:           |  Milestone:
  enhancement            |    Version:
     Priority:  major    |   Keywords:  tbb-security, tbb-isec-report,
    Component:  Tor      |  tbb-4.5-alpha
  Browser                |  Parent ID:  #9387
   Resolution:           |
Actual Points:           |
       Points:           |
-------------------------+-------------------------------------------------
Changes (by mcs):

 * cc: brade, mcs (added)
 * status:  new => assigned
 * owner:  tbb-team => mcs


Comment:

 Kathy and I started working on this yesterday. When support for SVG was
 first added by Mozilla, and for some years afterward, Firefox included
 support for a Boolean pref named svg.enabled. It has been helpful to look
 at how that pref was implemented; here is the change set that removed
 support for it:

 http://hg.mozilla.org/mozilla-central/rev/9e3b27acb9ef

 We are in the process of reintroducing that pref using as similar approach
 to the old, removed Mozilla code as possible. In fact, we were able to get
 the basic "turn SVG on/off" feature working with not too much difficulty.
 We are now in the process of making changes so that SVG is enabled for
 chrome but not for content (the new pref. should probably be named
 something like svg.inContent.enabled or svg.inContent.disabled).

 Using nsContentUtils::IsChromeDoc(doc) to decide whether to allow SVG
 seems like an OK approach but unfortunately for some internal uses of SVG
 there is no associated document.  Specifically, this seems to be the case
 for portions of the browser tab images. We should have a solution in a day
 or two.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/12827#comment:10>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online