[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

[tor-commits] [Git][tpo/applications/tor-browser-spec][main] 2 commits: Bug 40055: FF108 Audit

Title: GitLab

richard pushed to branch main at The Tor Project / Applications / tor-browser-spec

Commits:

  • e8e6f825
    by Richard Pospesel at 2023-09-11T23:56:52+00:00 
    Bug 40055: FF108 Audit
  • fc74e1ae
    by Richard Pospesel at 2023-09-12T00:41:12+00:00 
    Bug 40061: FF114 Audit

2 changed files:

Changes:

  • audits/FF108_AUDIT
    1 
    +# General
    2 
    +
    3 
    +The audit begins at the commit hash where the previous audit ended. Use code_audit.sh for creating the diff and highlighting potentially problematic code. The audit is scoped to a specific language (currently C/C++, Rust, Java/Kotlin, and _javascript_).
    4 
    +
    5 
    +The output includes the entire patch where the new problematic code was introduced. Search for `XXX MATCH XXX` to find the next potential violation.
    6 
    +
    7 
    +`code_audit.sh` contains the list of known problematic APIs. New usage of these functions are documented and analyzed in this audit.
    8 
    +
    9 
    +## Firefox: https://github.com/mozilla/gecko-dev.git
    10 
    +
    11 
    +- Start: `1187da3c99c93ad941eea0809d3b2c8f81ac5ccf` ( `FIREFOX_107_0_1_RELEASE` )
    12 
    +- End:   `0ae93a27c796bea7836d4b0885c8a1f2c4c18284`  ( `FIREFOX_108_0_2_RELEASE` )
    13 
    +
    14 
    +### Languages:
    15 
    +- [x] java
    16 
    +- [x] cpp
    17 
    +- [x] js
    18 
    +- [x] rust
    19 
    +
    20 
    +Nothing of interest (using `code_audit.sh`)
    21 
    +
    22 
    +---
    23 
    +
    24 
    +## Application Services: https://github.com/mozilla/application-services.git
    25 
    +
    26 
    +- Start: `ce8f1767d991da9d6d26331faecd426210071c7e`  ( `v96.1.0` )
    27 
    +- End:   `d8b5a386936aa156f4c6d93e6645a6d2188aa788`  ( `v96.2.1` )
    28 
    +
    29 
    +### Languages:
    30 
    +- [x] java
    31 
    +- [x] cpp
    32 
    +- [x] js
    33 
    +- [x] rust
    34 
    +
    35 
    +Nothing of interest (using `code_audit.sh`)
    36 
    +
    37 
    +## Firefox Android: https://github.com/mozilla-mobile/firefox-android.git
    38 
    +
    39 
    +- Start: `0486e931b4427d646af1dcf69a53c90efbe60862`
    40 
    +- End:   `55d34bf82ad051e25f15c0d1ef5fb8b3a32a7522`
    41 
    +
    42 
    +### Languages:
    43 
    +- [x] java
    44 
    +- [x] cpp
    45 
    +- [x] js
    46 
    +- [x] rust
    47 
    +
    48 
    +Nothing of interest (using `code_audit.sh`)
    49 
    +
    50 
    +## Fenix: https://github.com/mozilla-mobile/fenix.git
    51 
    +
    52 
    +- Start: `171d8a7aa521676d008bfd98bfae34ce8774e5f5` ( `v108.0b1` )
    53 
    +- End:   `78718ba91dd19f78e94d8f8c462598c29d48069a`  ( `v108.2.0` )
    54 
    +
    55 
    +### Languages:
    56 
    +- [x] java
    57 
    +- [x] cpp
    58 
    +- [x] js
    59 
    +- [x] rust
    60 
    +
    61 
    +Nothing of interest (using `code_audit.sh`)
    62 
    +
    63 
    +## Ticket Review ##
    64 
    +
    65 
    +Bugzilla Query: `https://bugzilla.mozilla.org/buglist.cgi?query_format=advanced&resolution=FIXED&target_milestone=108%20Branch&order=priority%2Cbug_severity&limit=0`
    66 
    +
    67 
    +#### Problematic Issues:
    68 
    +
    69 
    +- **Remove descriptionheightworkaround.** https://bugzilla.mozilla.org/show_bug.cgi?id=1795944
    70 
    +  - https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/41959
    71 
    +  - **RESOLUTOIN** not a security issue, more of a general ESR migration/functionality issue
    72 
    +- **Proxy environment variables should be upper case / case insensitive** https://bugzilla.mozilla.org/show_bug.cgi?id=1797896
    73 
    +  - https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/41960
    74 
    +  - **RESOLUTION**: determined this logic is gated behind our tor configuration settings, and so aren't relevant or a de-anonimisation vector; nothing to do here
    75 
    +- **Hide cookie banner handling UI by default** https://bugzilla.mozilla.org/show_bug.cgi?id=1798868
    76 
    +  - https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/41961
    77 
    +  - **RESOLUTION**: we will hide the UI to enable/disable the feature, and likely enable the feature for everyone
    78 
    +
    79 
    +## Export
    80 
    +- [ ] Export Report and save to `tor-browser-spec/audits`
    \ No newline at end of file

  • audits/FF114_AUDIT
    1 
    +# General
    2 
    +
    3 
    +The audit begins at the commit hash where the previous audit ended. Use code_audit.sh for creating the diff and highlighting potentially problematic code. The audit is scoped to a specific language (currently C/C++, Rust, Java/Kotlin, and _javascript_).
    4 
    +
    5 
    +The output includes the entire patch where the new problematic code was introduced. Search for `XXX MATCH XXX` to find the next potential violation.
    6 
    +
    7 
    +`code_audit.sh` contains the list of known problematic APIs. New usage of these functions are documented and analyzed in this audit.
    8 
    +
    9 
    +## Firefox: https://github.com/mozilla/gecko-dev.git
    10 
    +
    11 
    +- Start: `8a724297d78ba792067a7e4d17d170c6b3af796e` ( `FIREFOX_113_0_2_RELEASE` )
    12 
    +- End:   `b1d2c35b2699a6d77f6a41ae2338d9c370c5172e`  ( `FIREFOX_114_0_2_RELEASE` )
    13 
    +
    14 
    +### Languages:
    15 
    +- [x] java
    16 
    +- [x] cpp
    17 
    +- [x] js
    18 
    +- [x] rust
    19 
    +
    20 
    +Nothing of interest (using `code_audit.sh`)
    21 
    +
    22 
    +---
    23 
    +
    24 
    +## Application Services: https://github.com/mozilla/application-services.git
    25 
    +
    26 
    +- Start: `b126218b17a2273edb2f1ed5806f689440740b23` ( `v114.1` not really, Mozilla created a new branch and there's no tag associated with v114.1 in )
    27 
    +- End:   `78ab4ce85120f45a4b67b055936e401193eabd68`  ( `v115.0` )
    28 
    +
    29 
    +### Languages:
    30 
    +- [x] java
    31 
    +- [x] cpp
    32 
    +- [x] js
    33 
    +- [x] rust
    34 
    +
    35 
    +#### Problematic Commits
    36 
    +
    37 
    +- Add Remote Settings client component `d054f01641a3da94dba4076c3ac8236547e2b3f4`
    38 
    +
    39 
    +## Firefox Android: https://github.com/mozilla-mobile/firefox-android.git
    40 
    +
    41 
    +- Start: `9d87757910437e94a860e1d6f2577d5648ded966`
    42 
    +- End:   `fa28e4ddf82bedaa65153cbc6bac3ce7d8729ef5`
    43 
    +
    44 
    +### Languages:
    45 
    +- [x] java
    46 
    +- [x] cpp
    47 
    +- [x] js
    48 
    +- [x] rust
    49 
    +
    50 
    +Nothing of interest (using `code_audit.sh`)
    51 
    +
    52 
    +## Ticket Review ##
    53 
    +
    54 
    +Bugzilla Query: `https://bugzilla.mozilla.org/buglist.cgi?query_format=advanced&resolution=FIXED&target_milestone=114%20Branch&order=priority%2Cbug_severity&limit=0`
    55 
    +
    56 
    +Nothing of interest (manual inspection)
    57 
    +
    58 
    +## Export
    59 
    +- [x] Export Report and save to `tor-browser-spec/audits`
    \ No newline at end of file

    • —
    View it on GitLab.
    You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications · Help 

    _______________________________________________
tor-commits mailing list
tor-commits@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-commits