[tor-bugs] #20043 [Applications/Tor Browser]: SharedWorker uses catchall circuit

[Tor Bug Tracker & Wiki]

#20043: SharedWorker uses catchall circuit
-------------------------------------------------+-------------------------
 Reporter:  bugzilla                             |          Owner:  tbb-
                                                 |  team
     Type:  defect                               |         Status:
                                                 |  needs_review
 Priority:  High                                 |      Milestone:
Component:  Applications/Tor Browser             |        Version:
 Severity:  Major                                |     Resolution:
 Keywords:  tbb-linkability,                     |  Actual Points:
  TorBrowserTeam201609R                          |
Parent ID:                                       |         Points:
 Reviewer:                                       |        Sponsor:
-------------------------------------------------+-------------------------
Changes (by arthuredelstein):

 * keywords:  tbb-linkability => tbb-linkability, TorBrowserTeam201609R
 * status:  new => needs_review


Comment:

 Thanks for discovering and reporting this issue, bugzilla.

 Here are patches for review. There are two commits: a fix and a regression
 test.

 https://github.com/arthuredelstein/tor-browser/commits/20043

 When I revert the fix, the regression test fails.

 For the record, this problem occurs because SharedWorkers are supposed to
 be able to outlive their originating top-level document. So
 https://bugzilla.mozilla.org/show_bug.cgi?id=1118845 correctly stops
 retaining a pointer to that document in the load request. Unfortunately,
 that also means we can't rely on having the top-level document to obtain
 the first-party domain. So we use the backup option (also used in Tor
 Browser patches for first-party isolation of OCSP, Favicons, and link
 rel=preconnect) of GetDocumentURI/SetDocumentURI.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/20043#comment:3>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online