[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #31985 [Applications/Tor Browser]: Check that Intl.RelativeTimeFormat does no leak the user agent locale
#31985: Check that Intl.RelativeTimeFormat does no leak the user agent locale
-------------------------------------------------+-------------------------
Reporter: gk | Owner: tbb-
| team
Type: defect | Status: closed
Priority: Medium | Milestone:
Component: Applications/Tor Browser | Version:
Severity: Normal | Resolution: fixed
Keywords: tbb-fingerprinting-locale, | Actual Points: 0.25
TorBrowserTeam201910 |
Parent ID: | Points: 0.1
Reviewer: | Sponsor:
-------------------------------------------------+-------------------------
Changes (by gk):
* status: new => closed
* resolution: => fixed
* actualpoints: => 0.25
Comment:
The feature got actually implemented in
https://bugzilla.mozilla.org/show_bug.cgi?id=1270140.
We should be good here due to the work that landed in
https://bugzilla.mozilla.org/show_bug.cgi?id=1409973, where the locale of
the JS runtime can be spoofed in a way that always `en-US` is given back
if resist fingerprinting is enabled.
I double-checked that on Linux by modifying the MDN example a bit, so that
the code falls back to the default locale:
{{{
var rtf1 = new Intl.RelativeTimeFormat({ style: 'narrow' });
}}}
gives me a localized value if I don't have spoofing enabled but correctly
give `en-US` values back otherwise.
A cursory code inspection showed as well that the locale of the JS context
is queried (https://searchfox.org/mozilla-
esr68/source/js/src/builtin/intl/RelativeTimeFormat.cpp#208) which points
to the JS runtime (https://searchfox.org/mozilla-
esr68/source/js/src/vm/JSContext.h#262), which in turn gets the proper
default locale in https://searchfox.org/mozilla-
esr68/source/js/xpconnect/src/XPCLocale.cpp#117.
So we are good here.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/31985#comment:1>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs