[tor-bugs] #18101 [Applications/Tor Browser]: IP leak from Windows UI dialog with URI

[Tor Bug Tracker & Wiki]

#18101: IP leak from Windows UI dialog with URI
-------------------------------------------------+-------------------------
 Reporter:  uileak                               |          Owner:
                                                 |  arthuredelstein
     Type:  defect                               |         Status:
                                                 |  needs_review
 Priority:  Very High                            |      Milestone:
Component:  Applications/Tor Browser             |        Version:
 Severity:  Major                                |     Resolution:
 Keywords:  tbb-proxy-bypass, ip-leak,           |  Actual Points:
  TorBrowserTeam201708R                          |
Parent ID:                                       |         Points:
 Reviewer:                                       |        Sponsor:
-------------------------------------------------+-------------------------
Changes (by arthuredelstein):

 * status:  needs_information => needs_review


Comment:

 Replying to [comment:48 gk]:

 Answering questions in reverse order:

 > And could you verify that other Tor Browser platforms are unaffected?
 comment:7 seems to point this out for Linux. See comment:9 for macOS.

 Here's a patch that covers all platforms:
 https://github.com/arthuredelstein/tor-browser/commit/18101+2

 Unfortunately, I haven't yet been able to test these on old Linux and
 macOS platforms. The current platforms on desktops I tested (XFCE, KDE,
 macOS) do not show a text box in the Open Dialog. Once I have builds
 ready, I will post them on this ticket so that people can test on old
 Mac/Linux platforms if they have them.

 > Arthur: What do we want to do for XP (see comment:10)?

 I am inclined to treat this problem as wontfix, because XP is deprecated
 by Microsoft and is expected to be deprecated in September by Mozilla as
 well. I did spend a little time looking into the problem but I don't see a
 quick solution.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/18101#comment:49>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online