[tor-bugs] #18546 [Applications/Tor Browser]: Review networking code for Firefox 45

[Tor Bug Tracker & Wiki]

#18546: Review networking code for Firefox 45
-------------------------------------------------+-------------------------
 Reporter:  gk                                   |          Owner:
     Type:  task                                 |  mikeperry
 Priority:  Very High                            |         Status:  closed
Component:  Applications/Tor Browser             |      Milestone:
 Severity:  Critical                             |        Version:
 Keywords:  ff45-esr, MikePerry201604,           |     Resolution:  fixed
  TorBrowserTeam201605, tbb-6.0-must             |  Actual Points:
Parent ID:                                       |         Points:
 Reviewer:                                       |        Sponsor:
-------------------------------------------------+-------------------------
Changes (by gk):

 * status:  assigned => closed
 * resolution:   => fixed


Comment:

 Replying to [comment:8 mikeperry]:
 > Ok, I pushed the final review to https://gitweb.torproject.org/tor-
 browser-spec.git/tree/audits/FF45_NETWORK_AUDIT. Head is now
 4e1a7e2cb23a9f6b7f33bf460f48571e771e951b
 >
 > More android stuff for Orfox to check:
 >  * ./dom/media/android/AndroidMediaResourceServer.cpp
 >  * ./build/mobile/sutagent/android/
 >  * Tthe RtspMediaResource stuff in ./dom/media/ is enabled for all
 android. We should disable it, as it can do UDP.

 I created #19076, #19077 and #19078 for them.

 > I found more debugger stuff in the devtools directories, but this is
 redundant to the other stuff, and prefed off.
 >
 > Additional socket stuff is in the gfx layers, but I think this is just
 e10s RPC. Worth a double check:
 >  * ./gfx/layers/LayerScope.cpp

 Actually, that is e10s unrelated. It is a debugging feature for graphics
 issues that is prefed off:
 https://wiki.mozilla.org/Platform/GFX/LayerScope. You need a special
 extension for viewing the LayerScope. And that extension is communicating
 with the browser over WebSockets. I think we are fine here.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/18546#comment:11>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online