[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #15502 [Tor Browser]: URI.createObjectURL() considered harmful (was: Blob URIs considered harmful)
#15502: URI.createObjectURL() considered harmful
-------------------------+-------------------------------------------------
Reporter: | Owner: arthuredelstein
mikeperry | Status: assigned
Type: defect | Milestone:
Priority: major | Version:
Component: Tor | Keywords: tbb-linkability, tbb-newnym,
Browser | tbb-4.5-alpha, TorBrowserTeam201504
Resolution: | Parent ID:
Actual Points: |
Points: |
-------------------------+-------------------------------------------------
Comment (by mikeperry):
Unfortunately, there's another case where this will bite us. The
mediasource: scheme was created alongside VP9, and is currently used by
youtube to play VP9 videos. mediasource URIs contain javascript handlers
created by the MediaSource API, and are created by URI.createObject():
https://html5-mediasource-api.googlecode.com/svn/tags/0.1/draft-spec
/mediasource-draft-spec.html#examples
It's not clear if URI.createObject() in that example is a typo for
URL.createObjectURL(), or another API. Firefox 37 does not have a
URI.createObject() or a URL.createObject().
MediaSource support is currently present but disabled by default in
Firefox 31. You need to set the prefs 'media.mediasource.enabled' and
'media.mediasource.webm.enabled' to true in order for mediasource: URIs to
be created. This means we may be able to get away with disabling
URI.createObjectURL() for now, but once we hit FF38-ESR, we'll need to
enable+isolate it, or Youtube will break.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/15502#comment:9>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs