[tor-bugs] #13252 [Tor Browser]: Tor Browser on OS X should not store data into the application bundle

[Tor Bug Tracker & Wiki]

#13252: Tor Browser on OS X should not store data into the application bundle
-----------------------------------+------------------------------
 Reporter:  torosx                 |          Owner:  mcs
     Type:  defect                 |         Status:  needs_review
 Priority:  Medium                 |      Milestone:
Component:  Tor Browser            |        Version:
 Severity:  Normal                 |     Resolution:
 Keywords:  TorBrowserTeam201603R  |  Actual Points:
Parent ID:  #6540                  |         Points:
 Reviewer:                         |        Sponsor:  None
-----------------------------------+------------------------------

Comment (by arthuredelstein):

 Replying to [comment:56 gk]:
 > arthuredelstein: could you please have a look at the updated tor-browser
 patch, too?

 `xpcom/io/TorFileUtils.cpp`:

 {{{
 + // When crawling up the hierarchy, components named "." do not count.
 }}}
 Is this a bug in Mozilla's nsILocalFile::GetParent implementation?

 When `useOSLocation`==false, you actively create the "TorBrowser-Data"
 directory:
 {{{
 +    rv = tbDataDir->AppendNative(tbDataLeafName);
 +    NS_ENSURE_SUCCESS(rv, rv);
 +    bool exists = false;
 +    rv = tbDataDir->Exists(&exists);
 +    if (NS_SUCCEEDED(rv) && !exists)
 +      rv = tbDataDir->Create(nsIFile::DIRECTORY_TYPE, 0700);
 }}}
 but it looks like you don't create it when `useOSLocation`==true.

 On a possibly related issue, I found the following line confusing:
 {{{
 +    nsresult rv = NS_NewNativeLocalFile(EmptyCString(), true,
 +                                        getter_AddRefs(tbDataDir));
 }}}
 I guess this is just for checking that it is possible to write to the
 parent directory where the "TorBrowser-Data" directory will be? A comment
 here might help.

 `/toolkit/xre/nsXREDirProvider.cpp`:

 {{{
 +  // Since the TorBrowser-Data directory may be shared among different
 +  // installations of the application, embed the app path in the update
 dir
 +  // so that the update history is partitioned.
 }}}
 Is this potentially true for Linux or Windows as well? If I install `Tor
 Browser (FR)` and `Tor Browser (JA)` in the same directory, for example.
 Perhaps that's a pretty unlikely scenario, though.

 Apart from these issues, this patch looks OK to me.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/13252#comment:57>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online