[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #19048 [Applications/Tor Browser]: Review Firefox Developer Docs and Undocumented bugs since FF45esr
#19048: Review Firefox Developer Docs and Undocumented bugs since FF45esr
-------------------------------------------------+-------------------------
Reporter: gk | Owner: tbb-
| team
Type: task | Status: new
Priority: Medium | Milestone:
Component: Applications/Tor Browser | Version:
Severity: Normal | Resolution:
Keywords: ff52-esr, TorBrowserTeam201702, | Actual Points:
tbb-7.0-must |
Parent ID: | Points:
Reviewer: | Sponsor:
| Sponsor4
-------------------------------------------------+-------------------------
Comment (by mcs):
Replying to [comment:15 gk]:
> Replying to [comment:9 mcs]:
> > a) `DateTimeFormat.formatToParts`. We should verify that timezone
and/or locale not leaked to web content by new API.
> > https://bugzilla.mozilla.org/show_bug.cgi?id=1289340
> > https://developer.mozilla.org/en-
US/docs/Web/JavaScript/Reference/Global_Objects/DateTimeFormat/formatToParts
>
> That's in mozill52, right? But, yes, we should double-check that. I
opened #21608.
Thanks. That bug and the docs say it is in mozilla51, but in any case we
should take a look.
> ...
> > e) window.showModalDialog() is not available when e10s is enabled.
Should we always make it unavailable (even when e10s is disabled)? Or
maybe we don't care because we will probably enable e10s for all Tor
Browser users or none.
> > https://bugzilla.mozilla.org/show_bug.cgi?id=1234700
>
> I think we should not care. Besides that it seems that non of our code
is using `showModalDialog()` anyway.
Okay. Kathy and I were thinking about regular web pages using that API
and/or detecting that it is not available. But there are probably other
ways to detect that e10s is enabled.
> > f) Looking through the bug lists reminded us about Web Animations
possibly providing a high resolution timing source. But we do have #18273
for that issue.
>
> I guess you mean #16337?
Yes; thanks.
> > h) We will need to set `network.dns.blockDotOnion = false`.
>
> Hm. You mean for the transparent proxying option?
I was thinking that the Firefox code would block .onion requests even when
they go through the SOCKS proxy. But you may be correct.
> > k) Is the Fetch API safe? It includes fetch events with mode=navigate,
and Kathy and I are not sure if there are any linkability concerns with
that API.
> > https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API
>
> This is already #16326. Or did you find something new we should look at?
No, I don't think we found anything new. Kathy and I forgot that we had
looked at this API before. There were some small changes since Firefox 45,
but if I remember correctly they are not significant.
Thanks for making another pass at this and filing tickets!
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/19048#comment:17>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs