[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: [tor-bugs] #12827 [Tor Browser]: Create preference to disable SVG

#12827: Create preference to disable SVG
-------------------------+-------------------------------------------------
     Reporter:           |      Owner:  mcs
  mikeperry              |     Status:  needs_review
         Type:           |  Milestone:
  enhancement            |    Version:
     Priority:  major    |   Keywords:  tbb-security, tbb-isec-report,
    Component:  Tor      |  tbb-4.5-alpha, TorBrowserTeam201503R
  Browser                |  Parent ID:  #9387
   Resolution:           |
Actual Points:           |
       Points:           |
-------------------------+-------------------------------------------------

Comment (by mcs):

 Replying to [comment:13 mikeperry]:
 > Ok, I looked over this for general safety and it seems good to me, so I
 went ahead and merged it in the 4.5 branch. I am not sure it covers all of
 the cases, or how I would even tell that for sure. Did you test things
 like SVG images encoded data URIs, for example?

 Yes. We made a messy HTML file that tests a bunch of scenarios. One of us
 will attach it this ticket soon.

 > I also changed the name of the pref to be svg.in-content.enabled, to be
 consistent with the other existing svg prefs already in about:config. I
 did this in a fixup commit on the 4.5 branch.

 I think that is a good change. We found some other pref that used
 inContent but consistency with other SVG prefs is more important.

 > Finally, out of curiosity, do you know why the ImageFactory code has
 this bizarre pattern of returning already_addReffed pointers, while *also*
 calling .forget() before returning anything? I saw your cut+paste of
 BadImage() and was about to get worried, before I realized that it was a
 pre-existing utility function that followed the same pattern as the rest
 of the ImageFactory code...

 I guess it is just thought of as the safest / most clear way to do things.
 Kathy and I found this old bug where forget() was introduced that explains
 some of the motivation:
 https://bugzilla.mozilla.org/show_bug.cgi?id=392493
 Or maybe I misunderstand your question?

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/12827#comment:15>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs