[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #8725 [Applications/Tor Browser]: resource:// URIs leak information
#8725: resource:// URIs leak information
-------------------------------------------------+-------------------------
Reporter: holizz | Owner: tbb-
Type: defect | team
Priority: Very High | Status:
Component: Applications/Tor Browser | needs_review
Severity: Major | Milestone:
Keywords: tbb-fingerprinting, tbb-rebase- | Version:
regression, tbb-testcase, tbb-firefox-patch, | Resolution:
TorBrowserTeam201606R | Actual Points:
Parent ID: | Points:
Reviewer: | Sponsor:
-------------------------------------------------+-------------------------
Comment (by arthuredelstein):
I also made a test to see if I could use redirects from content to load
resource:// or chrome:// URIs into <script> elements:
https://arthuredelstein.github.io/tordemos/resource-locale.html
In unpatched Firefox or TorBrowser, the redirects fail and the following
error is shown in the Browser Console:
{{{
Security Error: Content at https://arthuredelstein.github.io/tordemos
/resource-locale.html may not load or link to
jar:file:///Applications/Firefox.app/Contents/Resources/browser/omni.ja!/defaults/preferences
/webide-prefs.js.
Security Error: Content at https://arthuredelstein.github.io/tordemos
/resource-locale.html may not load or link to
jar:file:///Applications/Firefox.app/Contents/Resources/browser/omni.ja!/chrome/browser/content/browser/browser.xul.
}}}
Direct loading of any prefs.js file succeeds.
But with Yawning's branch, the direct loading is blocked as well. I also
read over the patches and the code looks good to me, so I would be
inclined to include it in torbutton. It would be nice to have the git
subject line start with `Bug 8725:`.
Regarding Yawning's `XXX` comment, I think it is nice to have resource:///
URIs load in tabs for debugging purposes. So unless this introduces a
vulnerability I would be inclined to leave it as is.
Ideally we would come up with a C++ Firefox patch that could be
upstreamed. But to avoid delay I think this torbutton patch is a good
stopgap.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/8725#comment:32>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs