Re: [tor-bugs] #30683 [Applications/Tor Browser]: Properties in dom/locales/$lang/chrome/ allow detecting user locale

[Tor Bug Tracker & Wiki]

#30683: Properties in dom/locales/$lang/chrome/ allow detecting user locale
-+-
 Reporter:  gk   |  Owner:  tbb-
 |  team
 Type:  defect   | Status:  closed
 Priority:  High |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:  fixed
 Keywords:  tbb-fingerprinting-locale|  Actual Points:  1
  TorBrowserTeam201911R  |
Parent ID:   | Points:  0.25
 Reviewer:   |Sponsor:
-+-
Changes (by gk):

 * status:  needs_review => closed
 * resolution:   => fixed


Comment:

 Thanks! Merged to `tor-browser-68.2.0esr-9.5-1` (commit
 cb255f2504b37916160e886a181f1a02f85dba7c and
 79d87f543224b0e9d69a7520e25d9179d4f2c2bc).

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #30683 [Applications/Tor Browser]: Properties in dom/locales/$lang/chrome/ allow detecting user locale

[Tor Bug Tracker & Wiki]

#30683: Properties in dom/locales/$lang/chrome/ allow detecting user locale
-+-
 Reporter:  gk   |  Owner:  tbb-
 |  team
 Type:  defect   | Status:
 |  needs_review
 Priority:  High |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:
 Keywords:  tbb-fingerprinting-locale|  Actual Points:  1
  TorBrowserTeam201911R  |
Parent ID:   | Points:  0.25
 Reviewer:   |Sponsor:
-+-
Changes (by acat):

 * status:  needs_revision => needs_review
 * keywords:  tbb-fingerprinting-locale TorBrowserTeam201911 => tbb-
 fingerprinting-locale TorBrowserTeam201911R


Comment:

 Revised: https://github.com/acatarineu/tor-
 browser/commits/30683_backport+1.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #30683 [Applications/Tor Browser]: Properties in dom/locales/$lang/chrome/ allow detecting user locale

[Tor Bug Tracker & Wiki]

#30683: Properties in dom/locales/$lang/chrome/ allow detecting user locale
-+-
 Reporter:  gk   |  Owner:  tbb-
 |  team
 Type:  defect   | Status:
 |  needs_revision
 Priority:  High |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:
 Keywords:  tbb-fingerprinting-locale|  Actual Points:  1
  TorBrowserTeam201911   |
Parent ID:   | Points:  0.25
 Reviewer:   |Sponsor:
-+-
Changes (by gk):

 * status:  needs_review => needs_revision
 * keywords:  tbb-fingerprinting-locale TorBrowserTeam201911R => tbb-
 fingerprinting-locale TorBrowserTeam201911


Comment:

 acat thinks I am right, marking this as `needs_revision` then.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #30683 [Applications/Tor Browser]: Properties in dom/locales/$lang/chrome/ allow detecting user locale

[Tor Bug Tracker & Wiki]

#30683: Properties in dom/locales/$lang/chrome/ allow detecting user locale
-+-
 Reporter:  gk   |  Owner:  tbb-
 |  team
 Type:  defect   | Status:
 |  needs_review
 Priority:  High |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:
 Keywords:  tbb-fingerprinting-locale|  Actual Points:  1
  TorBrowserTeam201911R  |
Parent ID:   | Points:  0.25
 Reviewer:   |Sponsor:
-+-

Comment (by gk):

 Replying to [comment:26 acat]:
 > Backported in https://github.com/acatarineu/tor-
 browser/commits/30683_backport.

 Looks mostly good. I am a bit confused why we need the
 `FormatMaybeLocalizedString()` version with `const nsTArray&
 aParamArray`. As far as I can see none of the changed code is using that
 one. The patch is already large, thus, could you trim it accordingly if I
 am not being wrong here?

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #30683 [Applications/Tor Browser]: Properties in dom/locales/$lang/chrome/ allow detecting user locale

[Tor Bug Tracker & Wiki]

#30683: Properties in dom/locales/$lang/chrome/ allow detecting user locale
-+-
 Reporter:  gk   |  Owner:  tbb-
 |  team
 Type:  defect   | Status:
 |  needs_review
 Priority:  High |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:
 Keywords:  tbb-fingerprinting-locale|  Actual Points:  1
  TorBrowserTeam201911R  |
Parent ID:   | Points:  0.25
 Reviewer:   |Sponsor:
-+-
Changes (by acat):

 * keywords:  tbb-fingerprinting-locale TorBrowserTeam201911 => tbb-
 fingerprinting-locale TorBrowserTeam201911R
 * status:  reopened => needs_review


Comment:

 Backported in https://github.com/acatarineu/tor-
 browser/commits/30683_backport.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #30683 [Applications/Tor Browser]: Properties in dom/locales/$lang/chrome/ allow detecting user locale

[Tor Bug Tracker & Wiki]

#30683: Properties in dom/locales/$lang/chrome/ allow detecting user locale
-+-
 Reporter:  gk   |  Owner:  tbb-
 |  team
 Type:  defect   | Status:
 |  reopened
 Priority:  High |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:
 Keywords:  tbb-fingerprinting-locale|  Actual Points:  1
  TorBrowserTeam201911   |
Parent ID:   | Points:  0.25
 Reviewer:   |Sponsor:
-+-
Changes (by acat):

 * keywords:  tbb-fingerprinting-locale => tbb-fingerprinting-locale
 TorBrowserTeam201911


--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #30683 [Applications/Tor Browser]: Properties in dom/locales/$lang/chrome/ allow detecting user locale

[Tor Bug Tracker & Wiki]

#30683: Properties in dom/locales/$lang/chrome/ allow detecting user locale
---+--
 Reporter:  gk |  Owner:  tbb-team
 Type:  defect | Status:  reopened
 Priority:  High   |  Milestone:
Component:  Applications/Tor Browser   |Version:
 Severity:  Normal | Resolution:
 Keywords:  tbb-fingerprinting-locale  |  Actual Points:  1
Parent ID: | Points:  0.25
 Reviewer: |Sponsor:
---+--
Changes (by acat):

 * keywords:  tbb-fingerprinting-locale, TorBrowserTeam201909R => tbb-
 fingerprinting-locale
 * status:  closed => reopened
 * resolution:  fixed =>


Comment:

 This landed in https://hg.mozilla.org/mozilla-central/rev/0ed7aa23fde5
 (bugzilla is https://bugzilla.mozilla.org/show_bug.cgi?id=1581537).
 Reusing this for backporting it.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #30683 [Applications/Tor Browser]: Properties in dom/locales/$lang/chrome/ allow detecting user locale

[Tor Bug Tracker & Wiki]

#30683: Properties in dom/locales/$lang/chrome/ allow detecting user locale
-+-
 Reporter:  gk   |  Owner:  tbb-
 |  team
 Type:  defect   | Status:  closed
 Priority:  High |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:  fixed
 Keywords:  tbb-fingerprinting-locale,   |  Actual Points:  1
  TorBrowserTeam201909R  |
Parent ID:   | Points:  0.25
 Reviewer:   |Sponsor:
-+-
Changes (by acat):

 * points:  1 => 0.25
 * actualpoints:   => 1


--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #30683 [Applications/Tor Browser]: Properties in dom/locales/$lang/chrome/ allow detecting user locale

[Tor Bug Tracker & Wiki]

#30683: Properties in dom/locales/$lang/chrome/ allow detecting user locale
-+-
 Reporter:  gk   |  Owner:  tbb-
 |  team
 Type:  defect   | Status:  closed
 Priority:  High |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:  fixed
 Keywords:  tbb-fingerprinting-locale,   |  Actual Points:
  TorBrowserTeam201909R  |
Parent ID:   | Points:  1
 Reviewer:   |Sponsor:
-+-
Changes (by acat):

 * points:  0.25 => 1


--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #30683 [Applications/Tor Browser]: Properties in dom/locales/$lang/chrome/ allow detecting user locale

[Tor Bug Tracker & Wiki]

#30683: Properties in dom/locales/$lang/chrome/ allow detecting user locale
-+-
 Reporter:  gk   |  Owner:  tbb-
 |  team
 Type:  defect   | Status:  closed
 Priority:  High |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:  fixed
 Keywords:  tbb-fingerprinting-locale,   |  Actual Points:
  TorBrowserTeam201909R  |
Parent ID:   | Points:  0.25
 Reviewer:   |Sponsor:
-+-
Changes (by gk):

 * status:  needs_review => closed
 * resolution:   => fixed


Comment:

 Alright, we are done here. The patch for #24056 got reverted on `tor-
 browser-68.1.0esr-9.0-2` and the patch for this bug landed as commit
 262c4677852fd683bd3257427b39fd5accc7b30f with
 80f3dafdd420491e23c22a688d075548480f78a6 as the follow-up Android fixup.
 (Both actually made it into 9.0a6, fwiw.)

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #30683 [Applications/Tor Browser]: Properties in dom/locales/$lang/chrome/ allow detecting user locale

[Tor Bug Tracker & Wiki]

#30683: Properties in dom/locales/$lang/chrome/ allow detecting user locale
-+-
 Reporter:  gk   |  Owner:  tbb-
 |  team
 Type:  defect   | Status:
 |  needs_review
 Priority:  High |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:
 Keywords:  tbb-fingerprinting-locale,   |  Actual Points:
  TorBrowserTeam201909R  |
Parent ID:   | Points:  0.25
 Reviewer:   |Sponsor:
-+-
Changes (by gk):

 * keywords:  tbb-fingerprinting-locale, TorBrowserTeam201909 => tbb-
 fingerprinting-locale, TorBrowserTeam201909R


--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #30683 [Applications/Tor Browser]: Properties in dom/locales/$lang/chrome/ allow detecting user locale

[Tor Bug Tracker & Wiki]

#30683: Properties in dom/locales/$lang/chrome/ allow detecting user locale
-+-
 Reporter:  gk   |  Owner:  tbb-
 |  team
 Type:  defect   | Status:
 |  needs_review
 Priority:  High |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:
 Keywords:  tbb-fingerprinting-locale,   |  Actual Points:
  TorBrowserTeam201909   |
Parent ID:   | Points:  0.25
 Reviewer:   |Sponsor:
-+-

Comment (by acat):

 Replying to [comment:15 gk]:
 > Looks good. I wonder whether the ServiceWorker `ReportToAllClients()`
 messages are detectable from web content actually. Have we ruled that out?
 (while not being enabled in ESR 68 it will be for mobile IIRC).

 I think we are good. [https://searchfox.org/mozilla-
 
esr68/rev/92032fc58f059a475a3f3999741fbd9d3c389b61/dom/serviceworkers/ServiceWorkerManager.cpp#1363
 LocalizeAndReportToAllClients] ends up calling [https://searchfox.org
 /mozilla-
 
esr68/rev/92032fc58f059a475a3f3999741fbd9d3c389b61/dom/console/ConsoleUtils.cpp#134
 ConsoleUtils.cpp] which seems it's only logging to console. I also tested
 a bit with the different error handlers in Service Workers and I could not
 get a localized message.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #30683 [Applications/Tor Browser]: Properties in dom/locales/$lang/chrome/ allow detecting user locale

[Tor Bug Tracker & Wiki]

#30683: Properties in dom/locales/$lang/chrome/ allow detecting user locale
-+-
 Reporter:  gk   |  Owner:  tbb-
 |  team
 Type:  defect   | Status:
 |  needs_review
 Priority:  High |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:
 Keywords:  tbb-fingerprinting-locale,   |  Actual Points:
  TorBrowserTeam201909   |
Parent ID:   | Points:  0.25
 Reviewer:   |Sponsor:
-+-

Comment (by acat):

 Fixup for Android in https://github.com/acatarineu/tor-
 browser/commit/30683_esr68+2.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #30683 [Applications/Tor Browser]: Properties in dom/locales/$lang/chrome/ allow detecting user locale

[Tor Bug Tracker & Wiki]

#30683: Properties in dom/locales/$lang/chrome/ allow detecting user locale
-+-
 Reporter:  gk   |  Owner:  tbb-
 |  team
 Type:  defect   | Status:
 |  needs_review
 Priority:  High |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:
 Keywords:  tbb-fingerprinting-locale,   |  Actual Points:
  TorBrowserTeam201909   |
Parent ID:   | Points:  0.25
 Reviewer:   |Sponsor:
-+-
Changes (by pili):

 * points:   => 0.25


--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #30683 [Applications/Tor Browser]: Properties in dom/locales/$lang/chrome/ allow detecting user locale

[Tor Bug Tracker & Wiki]

#30683: Properties in dom/locales/$lang/chrome/ allow detecting user locale
-+-
 Reporter:  gk   |  Owner:  tbb-
 |  team
 Type:  defect   | Status:
 |  needs_review
 Priority:  High |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:
 Keywords:  tbb-fingerprinting-locale,   |  Actual Points:
  TorBrowserTeam201908   |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by gk):

 Looks good. I wonder whether the ServiceWorker `ReportToAllClients()`
 messages are detectable from web content actually. Have we ruled that out?
 (while not being enabled in ESR 68 it will be for mobile IIRC).

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #30683 [Applications/Tor Browser]: Properties in dom/locales/$lang/chrome/ allow detecting user locale

[Tor Bug Tracker & Wiki]

#30683: Properties in dom/locales/$lang/chrome/ allow detecting user locale
-+-
 Reporter:  gk   |  Owner:  tbb-
 |  team
 Type:  defect   | Status:
 |  needs_review
 Priority:  High |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:
 Keywords:  tbb-fingerprinting-locale,   |  Actual Points:
  TorBrowserTeam201908   |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-
Changes (by acat):

 * status:  needs_revision => needs_review


Comment:

 Yes, fixed in https://github.com/acatarineu/tor-
 browser/commits/30683_esr68+1.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #30683 [Applications/Tor Browser]: Properties in dom/locales/$lang/chrome/ allow detecting user locale

[Tor Bug Tracker & Wiki]

#30683: Properties in dom/locales/$lang/chrome/ allow detecting user locale
-+-
 Reporter:  gk   |  Owner:  tbb-
 |  team
 Type:  defect   | Status:
 |  needs_revision
 Priority:  High |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:
 Keywords:  tbb-fingerprinting-locale,   |  Actual Points:
  TorBrowserTeam201908   |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-
Changes (by gk):

 * status:  needs_review => needs_revision
 * keywords:  tbb-fingerprinting-locale, TorBrowserTeam201908R => tbb-
 fingerprinting-locale, TorBrowserTeam201908


Comment:

 Replying to [comment:12 acat]:
 > More than porting, it's actually rewriting the patch similarly to the
 upstreamed patch for #24056
 (https://bugzilla.mozilla.org/show_bug.cgi?id=1561322).

 It seems my tiny request in comment:6 still applies?

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #30683 [Applications/Tor Browser]: Properties in dom/locales/$lang/chrome/ allow detecting user locale

[Tor Bug Tracker & Wiki]

#30683: Properties in dom/locales/$lang/chrome/ allow detecting user locale
-+-
 Reporter:  gk   |  Owner:  tbb-
 |  team
 Type:  defect   | Status:
 |  needs_review
 Priority:  High |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:
 Keywords:  tbb-fingerprinting-locale,   |  Actual Points:
  TorBrowserTeam201908R  |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by acat):

 More than porting, it's actually rewriting the patch similarly to the
 upstreamed patch for #24056
 (https://bugzilla.mozilla.org/show_bug.cgi?id=1561322).

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #30683 [Applications/Tor Browser]: Properties in dom/locales/$lang/chrome/ allow detecting user locale

[Tor Bug Tracker & Wiki]

#30683: Properties in dom/locales/$lang/chrome/ allow detecting user locale
-+-
 Reporter:  gk   |  Owner:  tbb-
 |  team
 Type:  defect   | Status:
 |  needs_review
 Priority:  High |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:
 Keywords:  tbb-fingerprinting-locale,   |  Actual Points:
  TorBrowserTeam201908R  |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-
Changes (by acat):

 * status:  needs_revision => needs_review
 * keywords:  tbb-fingerprinting-locale, TorBrowserTeam201908 => tbb-
 fingerprinting-locale, TorBrowserTeam201908R


Comment:

 Here is a branch with the patch ported to esr68:
 https://github.com/acatarineu/tor-browser/commits/30683_esr68. I also
 reverted #24056 and backported the upstreamed to Firefox one, since this
 patch depends on those changes. So #31298 should be also fixed here.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #30683 [Applications/Tor Browser]: Properties in dom/locales/$lang/chrome/ allow detecting user locale

[Tor Bug Tracker & Wiki]

#30683: Properties in dom/locales/$lang/chrome/ allow detecting user locale
-+-
 Reporter:  gk   |  Owner:  tbb-
 |  team
 Type:  defect   | Status:
 |  needs_revision
 Priority:  High |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:
 Keywords:  tbb-fingerprinting-locale,   |  Actual Points:
  TorBrowserTeam201908   |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-
Changes (by gk):

 * keywords:  tbb-fingerprinting-locale, TorBrowserTeam201907 => tbb-
 fingerprinting-locale, TorBrowserTeam201908


--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #30683 [Applications/Tor Browser]: Properties in dom/locales/$lang/chrome/ allow detecting user locale

[Tor Bug Tracker & Wiki]

#30683: Properties in dom/locales/$lang/chrome/ allow detecting user locale
-+-
 Reporter:  gk   |  Owner:  tbb-
 |  team
 Type:  defect   | Status:
 |  needs_revision
 Priority:  High |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:
 Keywords:  tbb-fingerprinting-locale,   |  Actual Points:
  TorBrowserTeam201907   |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by cypherpunks):

 > hard-coded a bunch of strings
 Never do that.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #30683 [Applications/Tor Browser]: Properties in dom/locales/$lang/chrome/ allow detecting user locale

[Tor Bug Tracker & Wiki]

#30683: Properties in dom/locales/$lang/chrome/ allow detecting user locale
-+-
 Reporter:  gk   |  Owner:  tbb-
 |  team
 Type:  defect   | Status:
 |  needs_revision
 Priority:  High |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:
 Keywords:  tbb-fingerprinting-locale,   |  Actual Points:
  TorBrowserTeam201907   |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by mcs):

 Replying to [comment:6 gk]:
 > I think this looks mostly good to me. Could you adapt
 > `// When we spoof English, use en-US default strings in HTML forms.` a
 bit as the code that follows is not only about forms anymore?

 Maybe something like:
 `// When we spoof English, use en-US properties in strings that are
 accessible by content.`

 > Have you checked whether the patch is a good upstreaming idea as-is? I
 wonder in particular if the `en-US` strings will always be available in,
 say `fr`, builds that don't come with `fr` lang packs.
 >
 > mcs, brade could you have a second look?

 r=brade,r=mcs
 The patch looks good to us. Regarding upstreaming, it seems like the
 choice is to include the en-US properties files or hard-coded a bunch of
 strings. Including the en-US files seems like a good solution, but I guess
 we will see what the Mozilla engineers say.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #30683 [Applications/Tor Browser]: Properties in dom/locales/$lang/chrome/ allow detecting user locale

[Tor Bug Tracker & Wiki]

#30683: Properties in dom/locales/$lang/chrome/ allow detecting user locale
-+-
 Reporter:  gk   |  Owner:  tbb-
 |  team
 Type:  defect   | Status:
 |  needs_revision
 Priority:  High |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:
 Keywords:  tbb-fingerprinting-locale,   |  Actual Points:
  TorBrowserTeam201907   |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by acat):

 > Have you checked whether the patch is a good upstreaming idea as-is? I
 wonder in particular if the en-US strings will always be available in, say
 fr, builds that don't come with fr lang packs.

 That's a very nice point, I missed this one. Indeed, Firefox localized
 builds do not have these, I only tested with language packs... Good that
 you realized before https://phabricator.services.mozilla.com/D35815
 landed, since it was accepted.

 I'm not sure what's the best way to make this upstreamable. I think it's
 not realistic to try to make the localized messages not accessible to web
 content, so I think making available these en-US locales in localized
 builds is the only way. I will take a look and try to see how difficult it
 is to do this, and update
 https://bugzilla.mozilla.org/show_bug.cgi?id=1561322. The approach is the
 same, so whatever is accepted in that bug should also apply here.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #30683 [Applications/Tor Browser]: Properties in dom/locales/$lang/chrome/ allow detecting user locale

[Tor Bug Tracker & Wiki]

#30683: Properties in dom/locales/$lang/chrome/ allow detecting user locale
-+-
 Reporter:  gk   |  Owner:  tbb-
 |  team
 Type:  defect   | Status:
 |  needs_revision
 Priority:  High |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:
 Keywords:  tbb-fingerprinting-locale,   |  Actual Points:
  TorBrowserTeam201907   |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-
Changes (by gk):

 * cc: mcs, brade (added)
 * status:  needs_review => needs_revision
 * keywords:  tbb-fingerprinting-locale, TorBrowserTeam201907R => tbb-
 fingerprinting-locale, TorBrowserTeam201907


Comment:

 I think this looks mostly good to me. Could you adapt
 `// When we spoof English, use en-US default strings in HTML forms.` a bit
 as the code that follows is not only about forms anymore?

 Have you checked whether the patch is a good upstreaming idea as-is? I
 wonder in particular if the `en-US` strings will always be available in,
 say `fr`, builds that don't come with `fr` lang packs.

 mcs, brade could you have a second look?

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #30683 [Applications/Tor Browser]: Properties in dom/locales/$lang/chrome/ allow detecting user locale

[Tor Bug Tracker & Wiki]

#30683: Properties in dom/locales/$lang/chrome/ allow detecting user locale
-+-
 Reporter:  gk   |  Owner:  tbb-
 |  team
 Type:  defect   | Status:
 |  needs_review
 Priority:  High |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:
 Keywords:  tbb-fingerprinting-locale|  Actual Points:
  TorBrowserTeam201906R  |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by gk):

 fwiw: mik317 reminded us to check for error message because of corrupted
 png images, too (which is available in `MediaDocument.properties`),
 thanks!

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #30683 [Applications/Tor Browser]: Properties in dom/locales/$lang/chrome/ allow detecting user locale

[Tor Bug Tracker & Wiki]

#30683: Properties in dom/locales/$lang/chrome/ allow detecting user locale
-+-
 Reporter:  gk   |  Owner:  tbb-
 |  team
 Type:  defect   | Status:
 |  needs_review
 Priority:  High |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:
 Keywords:  tbb-fingerprinting-locale|  Actual Points:
  TorBrowserTeam201906R  |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by gk):

 Replying to [comment:2 acat]:
 > Here is a small patch for review: https://www.github.com/acatarineu/tor-
 browser/commit/30683. I checked htmlparser.properties just in case, but it
 seems only being used in `view-source:*` pages, which should not be
 accessible from web content.
 >
 > Do we want all these `tbb-fingerprinting-locale` fixed just for next
 esr68 or also for current esr60? I did the patch based on current alpha,
 but it should not be difficult to adapt for esr68.

 We need a patch for esr68 as well be it now or when we rebase, so having
 one version for esr68 (even though we start testing with an esr60 alpha)
 seems good. Ideally, while you are at it you'd file a ticket at bugzilla
 and get the patch upstreamed (and with some luck we can include it that
 way in the esr68 without needing to ship the patch ourselves).

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #30683 [Applications/Tor Browser]: Properties in dom/locales/$lang/chrome/ allow detecting user locale

[Tor Bug Tracker & Wiki]

#30683: Properties in dom/locales/$lang/chrome/ allow detecting user locale
-+-
 Reporter:  gk   |  Owner:  tbb-
 |  team
 Type:  defect   | Status:
 |  needs_review
 Priority:  High |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:
 Keywords:  tbb-fingerprinting-locale|  Actual Points:
  TorBrowserTeam201906R  |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-
Changes (by acat):

 * status:  new => needs_review
 * keywords:  tbb-fingerprinting-locale => tbb-fingerprinting-locale
 TorBrowserTeam201906R


Comment:

 Here is a small patch for review: https://www.github.com/acatarineu/tor-
 browser/commit/30683. I checked htmlparser.properties just in case, but it
 seems only being used in `view-source:*` pages, which should not be
 accessible from web content.

 Do we want all these `tbb-fingerprinting-locale` fixed just for next esr68
 or also for current esr60? I did the patch based on current alpha, but it
 should not be difficult to adapt for esr68.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #30683 [Applications/Tor Browser]: Properties in dom/locales/$lang/chrome/ allow detecting user locale

[Tor Bug Tracker & Wiki]

#30683: Properties in dom/locales/$lang/chrome/ allow detecting user locale
---+--
 Reporter:  gk |  Owner:  tbb-team
 Type:  defect | Status:  new
 Priority:  High   |  Milestone:
Component:  Applications/Tor Browser   |Version:
 Severity:  Normal | Resolution:
 Keywords:  tbb-fingerprinting-locale  |  Actual Points:
Parent ID: | Points:
 Reviewer: |Sponsor:
---+--

Comment (by gk):

 Replying to [ticket:30683 gk]:
 > z3t reported a bunch of issues on HackerOne regarding detection of user
 locale with the help of `dom/locales/$lang/chrome/` properties. PoCs done
 by z3t:
 >
 > `dom/dom.properties`:
 https://people.torproject.org/~gk/tests/tor_form_locale_leak.html

 `` is relevant here as well (thanks to mik317 on
 HackerOne for pointing this out).

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

[tor-bugs] #30683 [Applications/Tor Browser]: Properties in dom/locales/$lang/chrome/ allow detecting user locale

[Tor Bug Tracker & Wiki]

#30683: Properties in dom/locales/$lang/chrome/ allow detecting user locale
-+-
 Reporter:  gk   |  Owner:  tbb-team
 Type:  defect   | Status:  new
 Priority:  High |  Milestone:
Component:  Applications/Tor |Version:
  Browser|   Keywords:  tbb-fingerprinting-
 Severity:  Normal   |  locale
Actual Points:   |  Parent ID:
   Points:   |   Reviewer:
  Sponsor:   |
-+-
 z3t reported a bunch of issues on HackerOne regarding detection of user
 locale with the help of `dom/locales/$lang/chrome/` properties. PoCs done
 by z3t:

 `dom/dom.properties`:
 https://people.torproject.org/~gk/tests/tor_form_locale_leak.html
 `layout/xmlparser.properties`:
 https://people.torproject.org/~gk/tests/tor_domparser_locale_leak.html
 `layout/MediaDocument.properties`:
 https://people.torproject.org/~gk/tests/tor_image_locale_leak.html

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs