[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

[tor-commits] [Git][tpo/applications/mullvad-browser][mullvad-browser-149.0a1-16.0-2] 4 commits: BB 44772: Disable efficient randomization for canvases.

Title: GitLab

Pier Angelo Vendrame pushed to branch mullvad-browser-149.0a1-16.0-2 at The Tor Project / Applications / Mullvad Browser

Commits:

  • f8c9c503
    by Pier Angelo Vendrame at 2026-03-24T18:49:28+01:00 
    BB 44772: Disable efficient randomization for canvases.

Always use the regular randomization algorithm, instead.
  • 899e00ed
    by Pier Angelo Vendrame at 2026-03-24T18:49:35+01:00 
    fixup! BB 43525: Skip Remote Settings for search engine customization.

BB 44757: Fix search engine tests for Firefox 149.
  • d09b8270
    by Pier Angelo Vendrame at 2026-03-24T18:49:43+01:00 
    fixup! BB 40925: Implemented the Security Level component

BB 44757: Fix search engine tests for Firefox 149.
  • 43a1de0d
    by Pier Angelo Vendrame at 2026-03-24T18:49:49+01:00 
    fixup! Firefox preference overrides.

BB 44763: Disable WebGPU until audited.

4 changed files:

Changes:

  • browser/app/profile/001-base-profile.js
    ... ... @@ -492,6 +492,8 @@ pref("privacy.resistFingerprinting.skipEarlyBlankFirstPaint", true);
    492 492 
     pref("webgl.disable-fail-if-major-performance-caveat", true);
    493 493 
     // tor-browser#16404: disable until we investigate it further (#22333)
    494 494 
     pref("webgl.enable-webgl2", false);
    495 
    +// tor-browser#44763: disable WebGPU until audited.
    496 
    +pref("dom.webgpu.enabled", false);
    495 497 
     pref("browser.link.open_newwindow.restriction", 0); // Bug 9881: Open popups in new tabs (to avoid fullscreen popups)
    496 498 
     // tor-browser#42767: Disable offscreen canvas until verified it is not fingerprintable
    497 499 
     pref("gfx.offscreencanvas.enabled", false);

  • dom/canvas/CanvasUtils.cpp
    ... ... @@ -382,14 +382,9 @@ ImageExtraction ImageExtractionResult(dom::HTMLCanvasElement* aCanvasElement,
    382 382 
         return ImageExtraction::Placeholder;
    383 383 
       }
    384 384
    385 
    -  if (ownerDoc->ShouldResistFingerprinting(
    386 
    -          RFPTarget::EfficientCanvasRandomization) &&
    387 
    -      GetCanvasExtractDataPermission(aPrincipal) !=
    388 
    -          nsIPermissionManager::ALLOW_ACTION) {
    389 
    -    return ImageExtraction::EfficientRandomize;
    390 
    -  }
    391 
    -
    392 
    -  if ((ownerDoc->ShouldResistFingerprinting(RFPTarget::CanvasRandomization) ||
    385 
    +  if ((ownerDoc->ShouldResistFingerprinting(
    386 
    +           RFPTarget::EfficientCanvasRandomization) ||
    387 
    +       ownerDoc->ShouldResistFingerprinting(RFPTarget::CanvasRandomization) ||
    393 388 
            ownerDoc->ShouldResistFingerprinting(RFPTarget::WebGLRandomization)) &&
    394 389 
           GetCanvasExtractDataPermission(aPrincipal) !=
    395 390 
               nsIPermissionManager::ALLOW_ACTION) {

  • toolkit/components/search/tests/xpcshell/test_base_browser.js
    ... ... @@ -10,6 +10,10 @@
    10 10
    11 11 
     "use strict";
    12 12
    13 
    +const { SearchService } = ChromeUtils.importESModule(
    14 
    +  "moz-src:///toolkit/components/search/SearchService.sys.mjs"
    15 
    +);
    16 
    +
    13 17 
     const expectedURLs = {
    14 18 
       ddg: "https://duckduckgo.com/?q=test",
    15 19 
       "ddg-html": "https://html.duckduckgo.com/html/?q=test",
    ... ... @@ -21,24 +25,23 @@ const expectedURLs = {
    21 25 
     const defaultEngine = "ddg";
    22 26
    23 27 
     add_setup(async function setup() {
    24 
    -  await Services.search.init();
    28 
    +  await SearchService.init();
    25 29 
     });
    26 30
    27 31 
     add_task(async function test_listEngines() {
    28 
    -  const { engines } =
    29 
    -    await Services.search.wrappedJSObject._fetchEngineSelectorEngines();
    32 
    +  const { engines } = await SearchService._fetchEngineSelectorEngines();
    30 33 
       const foundIdentifiers = engines.map(e => e.identifier);
    31 34 
       Assert.deepEqual(foundIdentifiers, Object.keys(expectedURLs));
    32 35 
     });
    33 36
    34 37 
     add_task(async function test_default() {
    35 38 
       Assert.equal(
    36 
    -    (await Services.search.getDefault()).id,
    39 
    +    (await SearchService.getDefault()).id,
    37 40 
         defaultEngine,
    38 41 
         `${defaultEngine} is our default search engine in normal mode.`
    39 42 
       );
    40 43 
       Assert.equal(
    41 
    -    (await Services.search.getDefaultPrivate()).id,
    44 
    +    (await SearchService.getDefaultPrivate()).id,
    42 45 
         defaultEngine,
    43 46 
         `${defaultEngine} is our default search engine in PBM.`
    44 47 
       );
    ... ... @@ -46,7 +49,7 @@ add_task(async function test_default() {
    46 49
    47 50 
     add_task(function test_checkSearchURLs() {
    48 51 
       for (const [id, url] of Object.entries(expectedURLs)) {
    49 
    -    const engine = Services.search.getEngineById(id);
    52 
    +    const engine = SearchService.getEngineById(id);
    50 53 
         const foundUrl = engine.getSubmission("test").uri.spec;
    51 54 
         Assert.equal(foundUrl, url, `The URL of ${engine.name} is not altered.`);
    52 55 
       }
    ... ... @@ -54,7 +57,7 @@ add_task(function test_checkSearchURLs() {
    54 57
    55 58 
     add_task(async function test_iconsDoesNotFail() {
    56 59 
       for (const id of Object.keys(expectedURLs)) {
    57 
    -    const engine = Services.search.getEngineById(id);
    60 
    +    const engine = SearchService.getEngineById(id);
    58 61 
         // No need to assert anything, as in case of error this method should throw.
    59 62 
         await engine.getIconURL();
    60 63 
       }

  • toolkit/components/search/tests/xpcshell/test_security_level.js
    ... ... @@ -8,14 +8,18 @@
    8 8
    9 9 
     "use strict";
    10 10
    11 
    +const { SearchService } = ChromeUtils.importESModule(
    12 
    +  "moz-src:///toolkit/components/search/SearchService.sys.mjs"
    13 
    +);
    14 
    +
    11 15 
     const expectedURLs = {
    12 16 
       ddg: "https://html.duckduckgo.com/html?q=test",
    13 17 
     };
    14 18
    15 19 
     add_task(async function test_securityLevel() {
    16 
    -  await Services.search.init();
    20 
    +  await SearchService.init();
    17 21 
       for (const [id, url] of Object.entries(expectedURLs)) {
    18 
    -    const engine = Services.search.getEngineById(id);
    22 
    +    const engine = SearchService.getEngineById(id);
    19 23 
         const foundUrl = engine.getSubmission("test").uri.spec;
    20 24 
         Assert.equal(foundUrl, url, `${engine.name} is in HTML mode.`);
    21 25 
       }

    • —
    View it on GitLab.
    You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications · Help Notification message regarding https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/compare/1d8625c5dc7433bd6d0632afc70b00aaaeca4751...43a1de0dfaa6890b03e30694aedce309aeecf9cf at 1774374597 

    _______________________________________________
tor-commits mailing list -- tor-commits@xxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to tor-commits-leave@xxxxxxxxxxxxxxxxxxxx