[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

[tor-commits] [Git][tpo/applications/tor-browser][tor-browser-128.2.0esr-14.0-1] fixup! Bug 23247: Communicating security expectations for .onion

Title: GitLab

Pier Angelo Vendrame pushed to branch tor-browser-128.2.0esr-14.0-1 at The Tor Project / Applications / Tor Browser

Commits:

  • df421101
    by Pier Angelo Vendrame at 2024-08-29T10:15:34+02:00 
    fixup! Bug 23247: Communicating security expectations for .onion

Bug 42743: Check for .onion in the actual document URI in pageInfo.

One of our patches checks whether we are in a .onion domain when
showing the security information in pageInfo.xhtml.
However, it checks it in the requested URI rather than doing it on the
actually loaded URI, therefore about:neterror is shown as a secure
Onion service, which is not consistent with failures in loading
clearnet domains with HTTPS.

1 changed file:

Changes:

  • browser/base/content/pageinfo/security.js
    ... ... @@ -53,16 +53,15 @@ var security = {
    53 53 
           (Ci.nsIWebProgressListener.STATE_LOADED_MIXED_ACTIVE_CONTENT |
    54 54 
             Ci.nsIWebProgressListener.STATE_LOADED_MIXED_DISPLAY_CONTENT);
    55 55 
         var isEV = ui.state & Ci.nsIWebProgressListener.STATE_IDENTITY_EV_TOPLEVEL;
    56 
    -    var isOnion = false;
    57 
    -    let hostName;
    58 
    -    try {
    59 
    -      hostName = Services.eTLD.getBaseDomain(this.uri);
    60 
    -    } catch (e) {
    61 
    -      hostName = this.windowInfo.hostName;
    62 
    -    }
    63 
    -    if (hostName && hostName.endsWith(".onion")) {
    64 
    -      isOnion = true;
    56 
    +    let uriInformation = new URL(gDocInfo.documentURIObject.spec);
    57 
    +    // If the Onion site could not be loaded, the view-source will be also be
    58 
    +    // about:neterror.
    59 
    +    if (uriInformation.protocol == "view-source:") {
    60 
    +      uriInformation = new URL(uriInformation.pathname);
    65 61 
         }
    62 
    +    const isOnion =
    63 
    +      ["http:", "https:"].includes(uriInformation.protocol) &&
    64 
    +      uriInformation.hostname.endsWith(".onion");
    66 65
    67 66 
         let retval = {
    68 67 
           cAName: "",

    • —
    View it on GitLab.
    You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications · Help 

    _______________________________________________
tor-commits mailing list
tor-commits@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-commits