[tor-bugs] #15599 [Applications/Tor Browser]: Range requests used by pdfjs are not isolated to URL bar domain

[Tor Bug Tracker & Wiki]

#15599: Range requests used by pdfjs are not isolated to URL bar domain
-------------------------------------------------+-------------------------
 Reporter:  gk                                   |          Owner:
                                                 |  pospeselr
     Type:  defect                               |         Status:
                                                 |  needs_information
 Priority:  High                                 |      Milestone:
Component:  Applications/Tor Browser             |        Version:
 Severity:  Normal                               |     Resolution:
 Keywords:  tbb-linkability,                     |  Actual Points:
  TorBrowserTeam201802R                          |
Parent ID:                                       |         Points:
 Reviewer:                                       |        Sponsor:
-------------------------------------------------+-------------------------
Changes (by mcs):

 * status:  needs_review => needs_information


Comment:

 Replying to [comment:14 pospeselr]:
 > Unfortunately, the user_pref setting doesn't seem to stick when placed
 in the usual 000-tor-browser.js, and it gets overwritten by pdfjs
 initialization code if specified in the usual fashion (verified with an
 rbm build).

 I assume this is the code that is overriding the settings for
 `pdfjs.disableRange` when placed in `000-tor-browser.js`:
 https://dxr.mozilla.org/mozilla-
 esr52/source/browser/extensions/pdfjs/content/PdfJs.jsm#79

 Maybe we should patch the above code instead and also add the the setting
 to `000-tor-browser.js` as a reminder that we care about the value for
 `pdfjs.disableRange`. Probably gk should decide which approach we want to
 use.

 How bad is performance when loading a large PDF with this change in place?
 I assume "time to first page display" increases significantly.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/15599#comment:17>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online