[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #21685 [Applications/Tor Browser]: Remote New Tab pages have access to internal browser APIs in Firefox 52
#21685: Remote New Tab pages have access to internal browser APIs in Firefox 52
-------------------------------------------------+-------------------------
Reporter: gk | Owner: tbb-
| team
Type: defect | Status:
| needs_review
Priority: High | Milestone:
Component: Applications/Tor Browser | Version:
Severity: Normal | Resolution:
Keywords: ff52-esr, tbb-7.0-must-alpha, | Actual Points:
TorBrowserTeam201705R |
Parent ID: | Points:
Reviewer: | Sponsor:
| Sponsor4
-------------------------------------------------+-------------------------
Changes (by arthuredelstein):
* status: new => needs_review
* keywords: ff52-esr, tbb-7.0-must-alpha, TorBrowserTeam201705 =>
ff52-esr, tbb-7.0-must-alpha, TorBrowserTeam201705R
Comment:
The `browser.newtabpage.remote` pref is set to false in Firefox 52ESR by
default. I looked at the relevant code and tried toggling the pref
manually and I am convinced that remote pages are disabled in new tabs
when the pref is false. So I don't think we need to worry about these
additional APIs being accessed by remote pages.
We can also set the pref to false ourselves (redundantly) to be sure this
doesn't change in the future. Here's a patch that does that:
https://github.com/arthuredelstein/tor-browser/commit/21685
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/21685#comment:7>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs