[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
[tor-bugs] #33726 [Applications/Tor Browser]: Fix patch for #23247: Communicating security expectations for .onion
#33726: Fix patch for #23247: Communicating security expectations for .onion
------------------------------------------+--------------------------------
Reporter: acat | Owner: tbb-team
Type: defect | Status: new
Priority: Medium | Milestone:
Component: Applications/Tor Browser | Version:
Severity: Normal | Keywords:
| TorBrowserTeam202003
Actual Points: | Parent ID:
Points: | Reviewer:
Sponsor: |
------------------------------------------+--------------------------------
While working on #33533 I realized that in the switch to ESR68 (#30429)
the patch for #23247 was ported incorrectly. The original patch for ESR60
was `651e4ef7de3e` and the mistake was introduced in revision
https://github.com/acatarineu/tor-browser/commits/30429+6 (see comment in
https://trac.torproject.org/projects/tor/ticket/30429#comment:26).
My understanding is that in the original patch, the block of `if
(isHttpScheme && IsPotentiallyTrustworthyOnion(innerContentLocation)) {`
was moved from https://github.com/acatarineu/tor-
browser/commit/651e4ef7de3e#diff-b6c711bd6646bb39271394da3fc55d0cL754 to
https://github.com/acatarineu/tor-browser/commit/651e4ef7de3e#diff-
b6c711bd6646bb39271394da3fc55d0cR737 in order to allow mixed contents in
workers for the .onion case (which would get disallowed otherwise).
However, in ESR68 there's `IsPotentiallyTrustworthyOrigin` with includes
`IsPotentiallyTrustworthyOnion`. So, I think this block:
https://github.com/acatarineu/tor-
browser/commit/6301359f2742d070b1b4149d13c388e96b1b8080#diff-
b6c711bd6646bb39271394da3fc55d0cL778 should not be removed, since it's not
the same as the one that is added in https://github.com/acatarineu/tor-
browser/commit/6301359f2742d070b1b4149d13c388e96b1b8080#diff-
b6c711bd6646bb39271394da3fc55d0cR771.
I think this is not a security issue, the result of this bug is that we
are not allowing cases that we should (all cases of
`IsPotentiallyTrustworthyOrigin` that are not `.onion`).
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/33726>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs