[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #20043 [Applications/Tor Browser]: SharedWorker uses catchall circuit
#20043: SharedWorker uses catchall circuit
-------------------------------------------------+-------------------------
Reporter: bugzilla | Owner: tbb-
| team
Type: defect | Status:
| needs_review
Priority: High | Milestone:
Component: Applications/Tor Browser | Version:
Severity: Major | Resolution:
Keywords: tbb-linkability, | Actual Points:
TorBrowserTeam201609R |
Parent ID: | Points:
Reviewer: | Sponsor:
-------------------------------------------------+-------------------------
Changes (by arthuredelstein):
* keywords: tbb-linkability => tbb-linkability, TorBrowserTeam201609R
* status: new => needs_review
Comment:
Thanks for discovering and reporting this issue, bugzilla.
Here are patches for review. There are two commits: a fix and a regression
test.
https://github.com/arthuredelstein/tor-browser/commits/20043
When I revert the fix, the regression test fails.
For the record, this problem occurs because SharedWorkers are supposed to
be able to outlive their originating top-level document. So
https://bugzilla.mozilla.org/show_bug.cgi?id=1118845 correctly stops
retaining a pointer to that document in the load request. Unfortunately,
that also means we can't rely on having the top-level document to obtain
the first-party domain. So we use the backup option (also used in Tor
Browser patches for first-party isolation of OCSP, Favicons, and link
rel=preconnect) of GetDocumentURI/SetDocumentURI.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/20043#comment:3>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs