richard pushed to branch main at The Tor Project / Applications / tor-browser-spec
Commits:
885c79fd by Richard Pospesel at 2023-09-20T20:58:45+00:00
Bug 40052: FF105 Audit
- - - - -
1 changed file:
- + audits/FF105_AUDIT
Changes:
=====================================
audits/FF105_AUDIT
=====================================
@@ -0,0 +1,86 @@
+# General
+
+The audit begins at the commit hash where the previous audit ended. Use code_audit.sh for creating the diff and highlighting potentially problematic code. The audit is scoped to a specific language (currently C/C++, Rust, Java/Kotlin, and Javascript).
+
+The output includes the entire patch where the new problematic code was introduced. Search for `XXX MATCH XXX` to find the next potential violation.
+
+`code_audit.sh` contains the list of known problematic APIs. New usage of these functions are documented and analyzed in this audit.
+
+## Firefox: https://github.com/mozilla/gecko-dev.git
+
+- Start: `a8c31da1c243a855de8c3b241a437dd1b65684d5` ( `FIREFOX_104_0_2_RELEASE` )
+- End: `2dd649f09f70ec5b9304d62daeb427a86bbc5a36` ( `FIREFOX_105_0_3_RELEASE` )
+
+### Languages:
+- [x] java
+- [x] cpp
+- [x] js
+- [x] rust
+
+Nothing of interest (using `code_audit.sh`)
+
+---
+
+## Application Services: https://github.com/mozilla/application-services.git
+
+- Start: `78b165b798118e9b5fa62af07aa44d663f386492` ( `v94.1.0` )
+- End: `be8254df118b2fc2aae726e1d13ca4c982bec920` ( `v94.3.1` )
+
+### Languages:
+- [x] java
+- [x] cpp
+- [x] js
+- [x] rust
+
+Nothing of interest (using `code_audit.sh`)
+
+## Android Components: https://github.com/mozilla-mobile/android-components.git
+
+- Start: `b3e0289b3f07929c0403ac6e672c88b5db079748`
+- End: `658c2d239f9aef5927f654aa36a0b0739b116d92` ( `v105.0.8` )
+
+### Languages:
+- [x] java
+- [x] cpp
+- [x] js
+- [x] rust
+
+Nothing of interest (using `code_audit.sh`)
+
+## Fenix: https://github.com/mozilla-mobile/fenix.git
+
+- Start: `a5d13e2ef26d4eb98a32c94b6c6530771e90cd56` ( `v105.0b1` )
+- End: `01fbfd63743f30ebca31bbfb775bddef94a01a3e` ( `v105.2.0` )
+
+### Languages:
+- [x] java
+- [x] cpp
+- [x] js
+- [x] rust
+
+Nothing of interest (using `code_audit.sh`)
+
+## Ticket Review ##
+
+Bugzilla Query: `https://bugzilla.mozilla.org/buglist.cgi?query_format=advanced&resolution=FIXED&target_milestone=105%20Branch&order=priority%2Cbug_severity&limit=0`
+
+#### Problematic Issues
+
+- **Use the WER runtime exception module to catch early crashes** https://bugzilla.mozilla.org/show_bug.cgi?id=1682520
+ - *RESOLUTION*: no new functionality here, just making it work better by moving the registration earlier in the Firefox boot process
+- **Add a pref to disable Spectre mitigations for Fission web content processes** https://bugzilla.mozilla.org/show_bug.cgi?id=1774178
+- **Add Surrogate COM Server to handle native Windows notifications when Firefox is closed.** https://bugzilla.mozilla.org/show_bug.cgi?id=1774083
+ - *RESOLUTOIN* COM sever registration happens in the official firefox installer which we do not use, so nothing to do here
+- **Add a cookie banner service to automatically handle website cookie banners** https://bugzilla.mozilla.org/show_bug.cgi?id=1783019
+ - *RESOLUTION* disabled this feature until fully audit, may bring back in the 13.5 time-frame
+- **Add a locale parameter to the text recognition API** https://bugzilla.mozilla.org/show_bug.cgi?id=1782579
+ - *RESOLUTION* we'v diabled this system entirely in https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/42057
+- **Broken since Firefox 102.0: no instant fallback to direct connection when proxy became unreachable while runtime** https://bugzilla.mozilla.org/show_bug.cgi?id=1779005
+ - *RESOLUTION*: Tor Browser uses explicitly configured proxy settings so this auto-detect system is no used/does not apply to us
+- **On systems with IPv6 preferred DNS resolution clients will fail to connect when "localhost" is used as host for the WebSocket server** https://bugzilla.mozilla.org/show_bug.cgi?id=1769994
+- **Hide the text recognition context menu if the macOS version doesn't support APIs** https://bugzilla.mozilla.org/show_bug.cgi?id=1782981
+ - *RESOLUTION* we'v diabled this system entirely in https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/42057
+- **Implement a context menu modal for text recognition** https://bugzilla.mozilla.org/show_bug.cgi?id=1782578
+ - *RESOLUTION* we've disabled this system entirely in https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/42057
+## Export
+- [ ] Export Report and save to `tor-browser-spec/audits`
\ No newline at end of file
View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-spec/-/commit/88…
--
View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-spec/-/commit/88…
You're receiving this email because of your account on gitlab.torproject.org.
richard pushed to branch base-browser-115.3.0esr-13.0-1 at The Tor Project / Applications / Tor Browser
Commits:
d4ff59bc by Pier Angelo Vendrame at 2023-09-20T19:57:49+00:00
fixup! Firefox preference overrides.
Bug 41884: Disable browser.tabs.searchclipboardfor.middleclick.
- - - - -
1 changed file:
- browser/app/profile/001-base-profile.js
Changes:
=====================================
browser/app/profile/001-base-profile.js
=====================================
@@ -536,6 +536,11 @@ pref("browser.menu.share_url.allow", false, locked);
// Disable special URL bar behaviors
pref("browser.urlbar.suggest.topsites", false);
+// tor-browser#41884: Do not start a search when clicking on the new tab button
+// with the middle mouse button (to prevent searching for anything you might
+// have selected or already in your clipboard).
+pref("browser.tabs.searchclipboardfor.middleclick", false);
+
// Skip checking omni.ja and other files for corruption since the result
// is only reported via telemetry (which is disabled). See tor-browser#40048.
pref("corroborator.enabled", false);
View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/d4ff59b…
--
View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/d4ff59b…
You're receiving this email because of your account on gitlab.torproject.org.
richard pushed to branch tor-browser-115.3.0esr-13.0-1 at The Tor Project / Applications / Tor Browser
Commits:
33432bfe by Pier Angelo Vendrame at 2023-09-20T19:54:17+00:00
fixup! Firefox preference overrides.
Bug 41884: Disable browser.tabs.searchclipboardfor.middleclick.
- - - - -
1 changed file:
- browser/app/profile/001-base-profile.js
Changes:
=====================================
browser/app/profile/001-base-profile.js
=====================================
@@ -536,6 +536,11 @@ pref("browser.menu.share_url.allow", false, locked);
// Disable special URL bar behaviors
pref("browser.urlbar.suggest.topsites", false);
+// tor-browser#41884: Do not start a search when clicking on the new tab button
+// with the middle mouse button (to prevent searching for anything you might
+// have selected or already in your clipboard).
+pref("browser.tabs.searchclipboardfor.middleclick", false);
+
// Skip checking omni.ja and other files for corruption since the result
// is only reported via telemetry (which is disabled). See tor-browser#40048.
pref("corroborator.enabled", false);
View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/33432bf…
--
View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/33432bf…
You're receiving this email because of your account on gitlab.torproject.org.
ma1 pushed to branch base-browser-115.3.0esr-13.0-1 at The Tor Project / Applications / Tor Browser
Commits:
1c325548 by hackademix at 2023-09-20T19:24:35+02:00
fixup! Firefox preference overrides.
Bug 41945: disable cookie banner automatic dismissal.
- - - - -
1 changed file:
- browser/app/profile/001-base-profile.js
Changes:
=====================================
browser/app/profile/001-base-profile.js
=====================================
@@ -203,6 +203,12 @@ pref("browser.newtabpage.activity-stream.default.sites", "");
pref("browser.newtabpage.activity-stream.feeds.telemetry", false);
pref("browser.newtabpage.activity-stream.telemetry", false);
+// tor-browser#41945 - disable automatic cookie banners dismissal until
+// we're sure it does not causes fingerprinting risks or other issues.
+pref("cookiebanners.service.mode", 0);
+pref("cookiebanners.service.mode.privateBrowsing", 0);
+pref("cookiebanners.ui.desktop.enabled", false);
+
// tor-browser#40788: disable AS's calls to home.
// Notice that null is between quotes because it is a JSON string.
// Keep checked firefox.js to see if new entries are added.
View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/1c32554…
--
View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/1c32554…
You're receiving this email because of your account on gitlab.torproject.org.
ma1 pushed to branch tor-browser-115.3.0esr-13.0-1 at The Tor Project / Applications / Tor Browser
Commits:
37ddf133 by hackademix at 2023-09-20T17:19:01+00:00
fixup! Firefox preference overrides.
Bug 41945: disable cookie banner automatic dismissal.
- - - - -
1 changed file:
- browser/app/profile/001-base-profile.js
Changes:
=====================================
browser/app/profile/001-base-profile.js
=====================================
@@ -203,6 +203,12 @@ pref("browser.newtabpage.activity-stream.default.sites", "");
pref("browser.newtabpage.activity-stream.feeds.telemetry", false);
pref("browser.newtabpage.activity-stream.telemetry", false);
+// tor-browser#41945 - disable automatic cookie banners dismissal until
+// we're sure it does not causes fingerprinting risks or other issues.
+pref("cookiebanners.service.mode", 0);
+pref("cookiebanners.service.mode.privateBrowsing", 0);
+pref("cookiebanners.ui.desktop.enabled", false);
+
// tor-browser#40788: disable AS's calls to home.
// Notice that null is between quotes because it is a JSON string.
// Keep checked firefox.js to see if new entries are added.
View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/37ddf13…
--
View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/37ddf13…
You're receiving this email because of your account on gitlab.torproject.org.
richard pushed to branch base-browser-115.3.0esr-13.0-1 at The Tor Project / Applications / Tor Browser
Commits:
62bc13e5 by Richard Pospesel at 2023-09-20T16:19:53+00:00
fixup! Tweaks to the build system
- - - - -
2 changed files:
- browser/app/moz.build
- browser/installer/package-manifest.in
Changes:
=====================================
browser/app/moz.build
=====================================
@@ -70,7 +70,8 @@ if CONFIG["CC_TYPE"] == "clang-cl":
if CONFIG["OS_ARCH"] == "WINNT":
RCINCLUDE = "splash.rc"
DIRS += [
- "pbproxy",
+ # tor-browser#41798 don't build private_browsing.exe on Windows
+ # "pbproxy",
"winlauncher",
]
USE_LIBS += [
=====================================
browser/installer/package-manifest.in
=====================================
@@ -137,10 +137,10 @@
@BINPATH@/firefox.VisualElementsManifest.xml
@BINPATH@/browser/VisualElements/VisualElements_150.png
@BINPATH@/browser/VisualElements/VisualElements_70.png
-@BINPATH@/private_browsing.exe
-@BINPATH@/private_browsing.VisualElementsManifest.xml
-@BINPATH@/browser/VisualElements/PrivateBrowsing_150.png
-@BINPATH@/browser/VisualElements/PrivateBrowsing_70.png
+; @BINPATH@/private_browsing.exe
+; @BINPATH@/private_browsing.VisualElementsManifest.xml
+; @BINPATH@/browser/VisualElements/PrivateBrowsing_150.png
+; @BINPATH@/browser/VisualElements/PrivateBrowsing_70.png
#else
@BINPATH@/@MOZ_APP_NAME@-bin
@BINPATH@/@MOZ_APP_NAME@
View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/62bc13e…
--
View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/62bc13e…
You're receiving this email because of your account on gitlab.torproject.org.
richard pushed to branch tor-browser-115.3.0esr-13.0-1 at The Tor Project / Applications / Tor Browser
Commits:
b666c1c1 by Richard Pospesel at 2023-09-20T15:52:15+00:00
fixup! Tweaks to the build system
- - - - -
953539a4 by Richard Pospesel at 2023-09-20T15:52:15+00:00
fixup! Bug 2176: Rebrand Firefox to TorBrowser
- - - - -
12 changed files:
- browser/app/moz.build
- browser/branding/branding-common.mozbuild
- − browser/branding/tb-alpha/PrivateBrowsing_150.png
- − browser/branding/tb-alpha/PrivateBrowsing_70.png
- − browser/branding/tb-alpha/private_browsing.VisualElementsManifest.xml
- − browser/branding/tb-nightly/PrivateBrowsing_150.png
- − browser/branding/tb-nightly/PrivateBrowsing_70.png
- − browser/branding/tb-nightly/private_browsing.VisualElementsManifest.xml
- − browser/branding/tb-release/PrivateBrowsing_150.png
- − browser/branding/tb-release/PrivateBrowsing_70.png
- − browser/branding/tb-release/private_browsing.VisualElementsManifest.xml
- browser/installer/package-manifest.in
Changes:
=====================================
browser/app/moz.build
=====================================
@@ -70,7 +70,8 @@ if CONFIG["CC_TYPE"] == "clang-cl":
if CONFIG["OS_ARCH"] == "WINNT":
RCINCLUDE = "splash.rc"
DIRS += [
- "pbproxy",
+ # tor-browser#41798 don't build private_browsing.exe on Windows
+ # "pbproxy",
"winlauncher",
]
USE_LIBS += [
=====================================
browser/branding/branding-common.mozbuild
=====================================
@@ -18,11 +18,8 @@ def FirefoxBranding():
if CONFIG['MOZ_WIDGET_TOOLKIT'] == 'windows':
FINAL_TARGET_FILES['..'] += [
'firefox.VisualElementsManifest.xml',
- 'private_browsing.VisualElementsManifest.xml',
]
FINAL_TARGET_FILES.VisualElements += [
- 'PrivateBrowsing_150.png',
- 'PrivateBrowsing_70.png',
'VisualElements_150.png',
'VisualElements_70.png',
]
=====================================
browser/branding/tb-alpha/PrivateBrowsing_150.png deleted
=====================================
Binary files a/browser/branding/tb-alpha/PrivateBrowsing_150.png and /dev/null differ
=====================================
browser/branding/tb-alpha/PrivateBrowsing_70.png deleted
=====================================
Binary files a/browser/branding/tb-alpha/PrivateBrowsing_70.png and /dev/null differ
=====================================
browser/branding/tb-alpha/private_browsing.VisualElementsManifest.xml deleted
=====================================
@@ -1,12 +0,0 @@
-<!-- This Source Code Form is subject to the terms of the Mozilla Public
- - License, v. 2.0. If a copy of the MPL was not distributed with this file,
- - You can obtain one at http://mozilla.org/MPL/2.0/. -->
-
-<Application xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'>
- <VisualElements
- ShowNameOnSquare150x150Logo='on'
- Square150x150Logo='browser\VisualElements\PrivateBrowsing_150.png'
- Square70x70Logo='browser\VisualElements\PrivateBrowsing_70.png'
- ForegroundText='light'
- BackgroundColor='#1c191d'/>
-</Application>
=====================================
browser/branding/tb-nightly/PrivateBrowsing_150.png deleted
=====================================
Binary files a/browser/branding/tb-nightly/PrivateBrowsing_150.png and /dev/null differ
=====================================
browser/branding/tb-nightly/PrivateBrowsing_70.png deleted
=====================================
Binary files a/browser/branding/tb-nightly/PrivateBrowsing_70.png and /dev/null differ
=====================================
browser/branding/tb-nightly/private_browsing.VisualElementsManifest.xml deleted
=====================================
@@ -1,12 +0,0 @@
-<!-- This Source Code Form is subject to the terms of the Mozilla Public
- - License, v. 2.0. If a copy of the MPL was not distributed with this file,
- - You can obtain one at http://mozilla.org/MPL/2.0/. -->
-
-<Application xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'>
- <VisualElements
- ShowNameOnSquare150x150Logo='on'
- Square150x150Logo='browser\VisualElements\PrivateBrowsing_150.png'
- Square70x70Logo='browser\VisualElements\PrivateBrowsing_70.png'
- ForegroundText='light'
- BackgroundColor='#1c191d'/>
-</Application>
=====================================
browser/branding/tb-release/PrivateBrowsing_150.png deleted
=====================================
Binary files a/browser/branding/tb-release/PrivateBrowsing_150.png and /dev/null differ
=====================================
browser/branding/tb-release/PrivateBrowsing_70.png deleted
=====================================
Binary files a/browser/branding/tb-release/PrivateBrowsing_70.png and /dev/null differ
=====================================
browser/branding/tb-release/private_browsing.VisualElementsManifest.xml deleted
=====================================
@@ -1,12 +0,0 @@
-<!-- This Source Code Form is subject to the terms of the Mozilla Public
- - License, v. 2.0. If a copy of the MPL was not distributed with this file,
- - You can obtain one at http://mozilla.org/MPL/2.0/. -->
-
-<Application xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'>
- <VisualElements
- ShowNameOnSquare150x150Logo='on'
- Square150x150Logo='browser\VisualElements\PrivateBrowsing_150.png'
- Square70x70Logo='browser\VisualElements\PrivateBrowsing_70.png'
- ForegroundText='light'
- BackgroundColor='#420c5e'/>
-</Application>
=====================================
browser/installer/package-manifest.in
=====================================
@@ -137,10 +137,10 @@
@BINPATH@/firefox.VisualElementsManifest.xml
@BINPATH@/browser/VisualElements/VisualElements_150.png
@BINPATH@/browser/VisualElements/VisualElements_70.png
-@BINPATH@/private_browsing.exe
-@BINPATH@/private_browsing.VisualElementsManifest.xml
-@BINPATH@/browser/VisualElements/PrivateBrowsing_150.png
-@BINPATH@/browser/VisualElements/PrivateBrowsing_70.png
+; @BINPATH@/private_browsing.exe
+; @BINPATH@/private_browsing.VisualElementsManifest.xml
+; @BINPATH@/browser/VisualElements/PrivateBrowsing_150.png
+; @BINPATH@/browser/VisualElements/PrivateBrowsing_70.png
#else
@BINPATH@/@MOZ_APP_NAME@-bin
@BINPATH@/@MOZ_APP_NAME@
View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/c6b08b…
--
View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/c6b08b…
You're receiving this email because of your account on gitlab.torproject.org.