[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #14205 [Applications/Tor Browser]: Closely review all uses of IsCallerChrome() for e10s
#14205: Closely review all uses of IsCallerChrome() for e10s
-------------------------------------------------+-------------------------
Reporter: mikeperry | Owner: mcs
Type: task | Status:
| assigned
Priority: High | Milestone:
Component: Applications/Tor Browser | Version:
Severity: Normal | Resolution:
Keywords: tbb-fingerprinting, tbb-e10s, tbb- | Actual Points:
rebase, ff52-esr, tbb-7.0-must |
Parent ID: | Points:
Reviewer: | Sponsor:
-------------------------------------------------+-------------------------
Comment (by mcs):
The problem of reviewing the calls to ensure that they are only called
from the tab/comtent process when e10s is enabled is definitely a
challenge. Look here for an interesting comment:
https://dxr.mozilla.org/mozilla-esr52/source/dom/base/nsContentUtils.h#203
One approach would be for us to put breakpoints in `IsCallerChrome()` and
related calls and see what the stack looks like in e10s mode when the
breakpoints are hit while we exercise the code paths we care about. But we
might miss something.
The Mozilla developers are working on this issue as well. See
https://bugzilla.mozilla.org/show_bug.cgi?id=1316480 ("Get rid of
IsCallerChrome and friends") which depends on a bunch of other bugs, many
– but not all – of which have been fixed. In many cases, Mozilla wants to
hide an API from regular web pages, so they can handle the issue at the
webidl level. But in many cases we need to do something more subtle such
as return a different, less fingerprintable result to web pages.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/14205#comment:12>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs