[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
[tor-bugs] #25672 [Applications/Tor Browser]: Debugger in delevoper tools is fetching website over catch-all circuit
#25672: Debugger in delevoper tools is fetching website over catch-all circuit
------------------------------------------+-----------------------------
Reporter: gk | Owner: tbb-team
Type: defect | Status: new
Priority: Medium | Milestone:
Component: Applications/Tor Browser | Version:
Severity: Normal | Keywords: tbb-linkability
Actual Points: | Parent ID:
Points: | Reviewer:
Sponsor: |
------------------------------------------+-----------------------------
Go to https://sorry.google.com/sorry/misc and you'll see the exit IP
address of the circuit bound to the google.com domain.
Now, open the delevoper tools (Ctrl + Shift + K) and select the debugger
pane and you see that
1) The page is fetched again (which is a Firefox bug)
2) The catch-all-circuit is used as the debugger does not seem to
understand the concept of first party isolation.
See: #15555 for a similar problem.
Found by Rbcafe and reported to HackerOne.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/25672>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs