[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

[tor-commits] [Git][tpo/applications/tor-browser][tor-browser-153.3.0esr-16.0-1] fixup! TB 23247: Communicating security expectations for .onion

Title: GitLab

Pier Angelo Vendrame pushed to branch tor-browser-153.3.0esr-16.0-1 at The Tor Project / Applications / Tor Browser

Commits:

  • a33d5f55
    by Pier Angelo Vendrame at 2026-09-22T09:05:26+02:00 
    fixup! TB 23247: Communicating security expectations for .onion

TB 45343: Hide the custom roots warning for onion sites.

At the moment, we allow self-signed certificates for onion services.
However, tghere are several warnings we need to hide, as they would be
misleading of the actual situation.

Also, hide any field we get from the certificate, to avoid phishing.

In the future, we may re-evaluate accepting self-certificates from
onion services.

1 changed file:

Changes:

  • browser/base/content/browser-siteIdentity.js
    ... ... @@ -1192,7 +1192,11 @@ var gIdentityHandler = {
    1192 1192 
           this._updateAttribute(element, "ciphers", ciphers);
    1193 1193 
           this._updateAttribute(element, "mixedcontent", mixedcontent);
    1194 1194 
           this._updateAttribute(element, "isbroken", this._isBrokenConnection);
    1195 
    -      element.toggleAttribute("customroot", this._hasCustomRoot());
    1195 
    +      // tor-browser#45343: hide the custom root warning for Onion sites.
    1196 
    +      element.toggleAttribute(
    1197 
    +        "customroot",
    1198 
    +        this._hasCustomRoot() && !this._uriIsOnionHost
    1199 
    +      );
    1196 1200 
           this._updateAttribute(element, "httpsonlystatus", httpsOnlyStatus);
    1197 1201 
         }
    1198 1202
    ... ... @@ -1237,6 +1241,14 @@ var gIdentityHandler = {
    1237 1241 
           }
    1238 1242 
         }
    1239 1243
    1244 
    +    // tor-browser#45343: hide the custom root warning for Onion sites, but also
    1245 
    +    // empty the verifier, since it might be a lie.
    1246 
    +    if (this._uriIsOnionHost && this._hasCustomRoot()) {
    1247 
    +      owner = "";
    1248 
    +      supplemental = "";
    1249 
    +      verifier = "";
    1250 
    +    }
    1251 
    +
    1240 1252 
         // Push the appropriate strings out to the UI.
    1241 1253 
         document.l10n.setAttributes(
    1242 1254 
           this._identityPopupMainViewHeaderLabel,

    • —
    View it on GitLab.
    You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications · Help Notification message regarding https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/a33d5f5562310463d298d809d3eaa7331c663526 at 1790063449 

    _______________________________________________
tor-commits mailing list -- tor-commits@xxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to tor-commits-leave@xxxxxxxxxxxxxxxxxxxx