[tor-commits] [tor-browser/tor-browser-80.0b2-10.0-1] Bug 26353: Prevent speculative connect that violated FPI.

[gk@xxxxxxxxxxxxxx]

commit 8c02f913046a9a70ee2a441b92e04a51108737e6
Author: Arthur Edelstein <arthuredelstein@xxxxxxxxx>
Date:   Sat Jul 14 08:50:55 2018 -0700

    Bug 26353: Prevent speculative connect that violated FPI.
    
    Connections were observed in the catch-all circuit when
    the user entered an https or http URL in the URL bar, or
    typed a search term.
---
 toolkit/components/remotebrowserutils/RemoteWebNavigation.jsm | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/toolkit/components/remotebrowserutils/RemoteWebNavigation.jsm b/toolkit/components/remotebrowserutils/RemoteWebNavigation.jsm
index a2867e0ed60f..ad38b9b283e1 100644
--- a/toolkit/components/remotebrowserutils/RemoteWebNavigation.jsm
+++ b/toolkit/components/remotebrowserutils/RemoteWebNavigation.jsm
@@ -77,6 +77,9 @@ class RemoteWebNavigation {
         fixupFlags |= Services.uriFixup.FIXUP_FLAG_PRIVATE_CONTEXT;
       }
       uri = Services.uriFixup.createFixupURI(aURI, fixupFlags);
+/*******************************************************************************
+   TOR BROWSER: Disable the following speculative connect until
+   we can make it properly obey first-party isolation.
 
       // We know the url is going to be loaded, let's start requesting network
       // connection before the content process asks.
@@ -100,6 +103,7 @@ class RemoteWebNavigation {
         }
         Services.io.speculativeConnect(uri, principal, null);
       }
+*******************************************************************************/
     } catch (ex) {
       // Can't setup speculative connection for this uri string for some
       // reason (such as failing to parse the URI), just ignore it.



_______________________________________________
tor-commits mailing list
tor-commits@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-commits