Re: [tor-bugs] #18101 [Applications/Tor Browser]: IP leak from Windows UI dialog with URI

[Tor Bug Tracker & Wiki]

#18101: IP leak from Windows UI dialog with URI
-+-
 Reporter:  uileak   |  Owner:
 |  arthuredelstein
 Type:  defect   | Status:
 |  needs_revision
 Priority:  Medium   |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Major| Resolution:
 Keywords:  tbb-disk-leak, tbb-proxy-bypass, |  Actual Points:
  TorBrowserTeam201805   |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by ericlaw):

 This bug still leaks the user's IP to the remote server and full HTTP urls
 (including .onion urls) to any network intermediaries.

 Unsetting FOS_FORCEFILESYSTEM and setting FOS_SUPPORTSTREAMABLEITEMS
 appears to resolve the worst of this problem by returning unretrieved URLs
 to the browser instead of instructing the Windows Shell to download them.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #18101 [Applications/Tor Browser]: IP leak from Windows UI dialog with URI

[Tor Bug Tracker & Wiki]

#18101: IP leak from Windows UI dialog with URI
-+-
 Reporter:  uileak   |  Owner:
 |  arthuredelstein
 Type:  defect   | Status:
 |  needs_revision
 Priority:  Very High|  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Major| Resolution:
 Keywords:  tbb-disk-leak, tbb-proxy-bypass, |  Actual Points:
  TorBrowserTeam201711   |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by cypherpunks):

 Georg, you as a team lead should stop this time wasting attempt to "fix"
 Windows. (And, maybe, file a ticket on Bugzilla about converting file
 dialogs to tabs as e.g. Options.)

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #18101 [Applications/Tor Browser]: IP leak from Windows UI dialog with URI

[Tor Bug Tracker & Wiki]

#18101: IP leak from Windows UI dialog with URI
-+-
 Reporter:  uileak   |  Owner:
 |  arthuredelstein
 Type:  defect   | Status:
 |  needs_revision
 Priority:  Very High|  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Major| Resolution:
 Keywords:  tbb-disk-leak, tbb-proxy-bypass, |  Actual Points:
  TorBrowserTeam201711   |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by arthuredelstein):

 Replying to [comment:70 pospeselr]:

 Thanks for the review and the very helpful comments.

 > We might be able to detour whichever root offending function is causing
 the DNS request to happen but that will require more investigation, and
 would be inherently fragile and would need to be tested on every Windows
 SKU.

 I think this is a good idea, even if it's fragile. (Of course automated
 regression tests would help.) I'd like to pursue this instead of my
 earlier patch.

 I managed to obtain a stack trace responsible for the DNS leak when I
 enter an https:// URL and click the Open button:
 {{{
 06eae9d4 731034ae davclnt!NPGetResourceInformation
 06eaea2c 731035a6 MPR!WNetEnumResourceW+0x456
 06eaea68 73103558 MPR!WNetEnumResourceW+0x54e
 06eaea74 731038c3 MPR!WNetEnumResourceW+0x500
 *** ERROR: Symbol file could not be found.  Defaulted to export symbols
 for C:\Windows\syswow64\SHELL32.dll -
 06eaeab4 76b3b8e2 MPR!WNetGetResourceInformationW+0x26
 06eaeaf8 76b3b83d SHELL32!SHQueryUserNotificationState+0x56a
 06eaeb1c 76e276b2 SHELL32!SHQueryUserNotificationState+0x4c5
 06eaef78 76e280c9 SHELL32!StgMakeUniqueName+0x78d0a
 06eaf50c 76d0d2d1 SHELL32!StgMakeUniqueName+0x79721
 06eaf75c 76bb7a03 SHELL32!Ordinal733+0x2db33
 06eaf7e0 76da48a1 SHELL32!InternalExtractIconListA+0xb06
 06eaf82c 76da4945 SHELL32!Ordinal262+0x1d5f
 06eaf874 76bb9d83 SHELL32!Ordinal262+0x1e03
 06eaf8b4 76bb804b SHELL32!Ordinal866+0x1b14
 06eaf930 76bb7a03 SHELL32!SHParseDisplayName+0x1d0
 06eaf9b4 76bb7f24 SHELL32!InternalExtractIconListA+0xb06
 *** ERROR: Symbol file could not be found.  Defaulted to export symbols
 for C:\Windows\SysWOW64\comdlg32.dll -
 06eafa00 7660c9b9 SHELL32!SHParseDisplayName+0xa9
 06eafa48 7660b14f comdlg32!PrintDlgExW+0x7e23
 06eafeb4 7660aecb comdlg32!PrintDlgExW+0x65b9
 }}}

 Then I confirmed that WNetGetResourceInformation causes a DNS leak by
 running the `CheckServer()` example at https://msdn.microsoft.com/en-
 us/library/windows/desktop/aa385369(v=vs.85).aspx .

 So next I will look into how we can use Mozilla's detour utility.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #18101 [Applications/Tor Browser]: IP leak from Windows UI dialog with URI

[Tor Bug Tracker & Wiki]

#18101: IP leak from Windows UI dialog with URI
-+-
 Reporter:  uileak   |  Owner:
 |  arthuredelstein
 Type:  defect   | Status:
 |  needs_revision
 Priority:  Very High|  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Major| Resolution:
 Keywords:  tbb-disk-leak, tbb-proxy-bypass, |  Actual Points:
  TorBrowserTeam201711   |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-
Changes (by gk):

 * status:  needs_review => needs_revision
 * keywords:  tbb-disk-leak, tbb-proxy-bypass, TorBrowserTeam201711R => tbb-
 disk-leak, tbb-proxy-bypass, TorBrowserTeam201711


Comment:

 Thanks for the review! Let's talk about SMB in a different bug, though.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #18101 [Applications/Tor Browser]: IP leak from Windows UI dialog with URI

[Tor Bug Tracker & Wiki]

#18101: IP leak from Windows UI dialog with URI
-+-
 Reporter:  uileak   |  Owner:
 |  arthuredelstein
 Type:  defect   | Status:
 |  needs_review
 Priority:  Very High|  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Major| Resolution:
 Keywords:  tbb-disk-leak, tbb-proxy-bypass, |  Actual Points:
  TorBrowserTeam201711R  |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by pospeselr):

 Wow, this is janky.  Definitely agree with cypherpunks that eventually
 firefox should probably handle file-dialogs internally the same way
 everywhere.  Otherwise we're just waiting for GTK/KDE/MacOS/Windows devs
 to break us.

 === Code Fixes:

 ::GetDlgItemText truncates the requested string based on the nMaxCount
 provided.  Given that scheme part of the URI (http, https, ftp, etc) is
 going to be short, does it make sense to have a smaller buffer?

 messageBuffer ought to just be an HLOCAL (which is just a typedef'd HANDLE
 which itself is a typede'd void*) rather than LPTSTR.  The memory
 allocated by ::FormatMessageW is done so using ::LocalAlloc.  You also
 need to add a ::LocalFree(messageBuffer) call after we're finished with
 messageBuffer.

 === Approach in General:

 Checking the URI string for ':^^/^^/' is not sufficient.  Playing around
 in a Win10 VM, you can access SMB shares via strings like:

 * {{{ \\Hostname\Path\To\File.txt }}}
 * {{{ \\192.168.50.123\Path\To\File.txt }}}

 However, this is sort of irrelevant because (on Win10 at least) the file
 explorer does DNS and LLMNR (for local shares) queries AS YOU TYPE for
 SMB.  So for instance, if you have an SMB share of the form
 {{{\\other\shared}}} as soon as you type that '\' before shared an LLMNR
 request is sent out.  Same story if you query {{{\\.cnn.com\shared}}}
 a DNS request gets sent out.  The requests will also be triggered on
 paste.

 This auto-lookup does not occur with https/http/ftp URIs, only windows SMB
 strings starting with ^^\^^\ .

 After a fair amount of digging today it doesn't look like there's an easy
 way to fix this.  I'd hoped a fix would be as easy as detouring the
 relevant DNS API, but the DNS request doesn't appear to be coming from the
 process which opens the file dialog.  The URL string does get passed
 through RPC APIs several times (which makes me think some service is doing
 the request).

 We might be able to detour whichever root offending function is causing
 the DNS request to happen but that will require more investigation, and
 would be inherently fragile and would need to be tested on every Windows
 SKU.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #18101 [Applications/Tor Browser]: IP leak from Windows UI dialog with URI

[Tor Bug Tracker & Wiki]

#18101: IP leak from Windows UI dialog with URI
-+-
 Reporter:  uileak   |  Owner:
 |  arthuredelstein
 Type:  defect   | Status:
 |  needs_review
 Priority:  Very High|  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Major| Resolution:
 Keywords:  tbb-disk-leak, tbb-proxy-bypass, |  Actual Points:
  TorBrowserTeam201711R  |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-
Changes (by gk):

 * cc: pospeselr (added)


Comment:

 Thanks for that. I guess Richard could help with reviewing the patch? :)

 Arthur: what about verifying the Mac part as mentioned in comment:56?

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #18101 [Applications/Tor Browser]: IP leak from Windows UI dialog with URI

[Tor Bug Tracker & Wiki]

#18101: IP leak from Windows UI dialog with URI
-+-
 Reporter:  uileak   |  Owner:
 |  arthuredelstein
 Type:  defect   | Status:
 |  needs_review
 Priority:  Very High|  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Major| Resolution:
 Keywords:  tbb-disk-leak, tbb-proxy-bypass, |  Actual Points:
  TorBrowserTeam201711R  |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-
Changes (by arthuredelstein):

 * status:  needs_revision => needs_review
 * keywords:  tbb-disk-leak, tbb-proxy-bypass, TorBrowserTeam201711 => tbb-
 disk-leak, tbb-proxy-bypass, TorBrowserTeam201711R


Comment:

 Replying to [comment:66 arthuredelstein]:
 > Anyway, the next step will be to turn this into a patch in Tor Browser.

 Here's my patch for review. The way it erases the URL from the text box is
 not ideal, but I still haven't found a better option and I think it is
 better to have this patch until something better is found. And I don't
 think I should spend much more time on it if possible. :)

 https://github.com/arthuredelstein/tor-browser/commit/18101_windows

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #18101 [Applications/Tor Browser]: IP leak from Windows UI dialog with URI

[Tor Bug Tracker & Wiki]

#18101: IP leak from Windows UI dialog with URI
-+-
 Reporter:  uileak   |  Owner:
 |  arthuredelstein
 Type:  defect   | Status:
 |  needs_revision
 Priority:  Very High|  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Major| Resolution:
 Keywords:  tbb-disk-leak, tbb-proxy-bypass, |  Actual Points:
  TorBrowserTeam201711   |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by cypherpunks):

 Replying to [comment:66 arthuredelstein]:
 > I foraged through the Windows API
 Have you foraged em'all? :)
 > In this hack
 As it's a hack, could you make it disableable via a pref?
 > just before the file dialog is created, I set a hook function for window
 creation. I use some heuristics to identify the File Dialog window, and
 then I add a second hook that listens for the "Open" command from the user
 (by button click, enter key, or keyboard shortcut).
 and button tap ;)
 > Before the "Open" command can propagate, I check the text in the
 dialog's filename text field to see if it looks like a URI, and if so, I
 clear the text and show an error message to the user explaining that URIs
 are not allowed.
 In the "Open File..." dialog, you can grab that URI and open it, because
 it's a browser! :)
 > I confirmed this approach prevents any DNS leak.
 What DNS leak? You use OS's feature to load URIs using system proxy
 settings or you don't.
 > Instead of clearing the text, it would be better to cancel the "Open"
 command and leave the text unchanged
 and user would say WTF?!
 > but so far I haven't found a way to do that. But I think the usability
 awkwardness is acceptable, especially given that we explain to the user
 what has gone wrong.
 Until TBB can handle URIs...
 > Anyway, the next step will be to turn this into a patch in Tor Browser.
 And check the security suites wouldn't mind.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #18101 [Applications/Tor Browser]: IP leak from Windows UI dialog with URI

[Tor Bug Tracker & Wiki]

#18101: IP leak from Windows UI dialog with URI
-+-
 Reporter:  uileak   |  Owner:
 |  arthuredelstein
 Type:  defect   | Status:
 |  needs_revision
 Priority:  Very High|  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Major| Resolution:
 Keywords:  tbb-disk-leak, tbb-proxy-bypass, |  Actual Points:
  TorBrowserTeam201711   |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by arthuredelstein):

 I foraged through the Windows API and came up with what I think is a
 reasonable solution that works with the modern file dialog. Here's the
 PoC:

 https://gist.github.com/arthuredelstein/376e33ce8d4482561593657036db32e8

 In this hack, just before the file dialog is created, I set a hook
 function for window creation. I use some heuristics to identify the File
 Dialog window, and then I add a second hook that listens for the "Open"
 command from the user (by button click, enter key, or keyboard shortcut).
 Before the "Open" command can propagate, I check the text in the dialog's
 filename text field to see if it looks like a URI, and if so, I clear the
 text and show an error message to the user explaining that URIs are not
 allowed. I confirmed this approach prevents any DNS leak.

 Instead of clearing the text, it would be better to cancel the "Open"
 command and leave the text unchanged, but so far I haven't found a way to
 do that. But I think the usability awkwardness is acceptable, especially
 given that we explain to the user what has gone wrong.

 Anyway, the next step will be to turn this into a patch in Tor Browser.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #18101 [Applications/Tor Browser]: IP leak from Windows UI dialog with URI

[Tor Bug Tracker & Wiki]

#18101: IP leak from Windows UI dialog with URI
-+-
 Reporter:  uileak   |  Owner:
 |  arthuredelstein
 Type:  defect   | Status:
 |  needs_revision
 Priority:  Very High|  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Major| Resolution:
 Keywords:  tbb-disk-leak, tbb-proxy-bypass, |  Actual Points:
  TorBrowserTeam201711   |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by mcs):

 My opinion is that the old dialog is so primitive as to be somewhat
 alarming. I am not sure what to do about that, except that it would be
 nice if there was a way to turn off this "feature" OS-wide.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #18101 [Applications/Tor Browser]: IP leak from Windows UI dialog with URI

[Tor Bug Tracker & Wiki]

#18101: IP leak from Windows UI dialog with URI
-+-
 Reporter:  uileak   |  Owner:
 |  arthuredelstein
 Type:  defect   | Status:
 |  needs_revision
 Priority:  Very High|  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Major| Resolution:
 Keywords:  tbb-disk-leak, tbb-proxy-bypass, |  Actual Points:
  TorBrowserTeam201711   |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by arthuredelstein):

 Replying to [comment:63 teor]:
 > Does a network leak happen when you click "Network" in the old style
 dialog?
 > (If it does, at least that's obvious.)

 Turns out I can remove the Network button in the old style dialog using
 `OFN_NONETWORKBUTTON` in `OPENFILENAME.Flags`. So at least that's one
 problem solved. :)

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #18101 [Applications/Tor Browser]: IP leak from Windows UI dialog with URI

[Tor Bug Tracker & Wiki]

#18101: IP leak from Windows UI dialog with URI
-+-
 Reporter:  uileak   |  Owner:
 |  arthuredelstein
 Type:  defect   | Status:
 |  needs_revision
 Priority:  Very High|  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Major| Resolution:
 Keywords:  tbb-disk-leak, tbb-proxy-bypass, |  Actual Points:
  TorBrowserTeam201711   |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by teor):

 Does a network leak happen when you click "Network" in the old style
 dialog?
 (If it does, at least that's obvious.)

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #18101 [Applications/Tor Browser]: IP leak from Windows UI dialog with URI

[Tor Bug Tracker & Wiki]

#18101: IP leak from Windows UI dialog with URI
-+-
 Reporter:  uileak   |  Owner:
 |  arthuredelstein
 Type:  defect   | Status:
 |  needs_revision
 Priority:  Very High|  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Major| Resolution:
 Keywords:  tbb-disk-leak, tbb-proxy-bypass, |  Actual Points:
  TorBrowserTeam201711   |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by arthuredelstein):

 Replying to [comment:54 gk]:
 > With the patch for Windows I still see DNS leaks. Here is what I did:

 I was able to reproduce this on Windows 7, but not on Windows 8 Server or
 Windows 10.

 To attempt to fix this on Windows 7, I tried using both IFileDialog and
 GetOpenFileName. Both show the same modern file dialog. It's possible to
 hook some UI events in both, using IFileDialogEvents and
 OPENFILENAME.lpfnHook respectively. But, unfortunately, there is no event
 that occurs after the user clicks the "Open" button (or presses enter),
 and before the DNS leak occurs, that could allow us to cancel the event
 and prevent the leak.

 As an experiment, I tried using the Windows Firewall to block internet
 connections from firefox.exe. While browsing the web is blocked as
 expected, the file dialog still causes DNS leaks! So it seems the leak may
 be happening outside the browser process.

 I also looked into `IFileDialogCustomize::RemoveControlItem`, but as far
 as I could tell, this function only applies to custom control items added
 to the dialog by the application; default control items cannot be removed.

 So, finally, I did find one method that works. It involves:
 1. Use GetOpenFileName
 2. Exclude `OFN_EXPLORER` from OPENFileName.Flags;
 3. Use an "Old-Style" hook function

 The result is an "old-style" file dialog. No DNS leaks occur when the user
 enters a remote URL. And the dialog says "The file name is not valid."

 The main drawback is the dialog is the design from Windows 3.1 (no joke).
 Here it is:

 [[Image(ye_old_file_dialogue.png)]]

 I guess this dialog is so primitive it doesn't know how to process URLs.

 So we could force Windows 7 and earlier to use this dialog. It's a rather
 stark usability/privacy tradeoff. What do people think? I'll post a patch
 if people think this UI is acceptable. I'm also very open to other
 suggestions for fixing this.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #18101 [Applications/Tor Browser]: IP leak from Windows UI dialog with URI

[Tor Bug Tracker & Wiki]

#18101: IP leak from Windows UI dialog with URI
-+-
 Reporter:  uileak   |  Owner:
 |  arthuredelstein
 Type:  defect   | Status:
 |  needs_revision
 Priority:  Very High|  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Major| Resolution:
 Keywords:  tbb-disk-leak, tbb-proxy-bypass, |  Actual Points:
  TorBrowserTeam201711   |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-
Changes (by arthuredelstein):

 * Attachment "ye_old_file_dialogue.png" added.


--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #18101 [Applications/Tor Browser]: IP leak from Windows UI dialog with URI

[Tor Bug Tracker & Wiki]

#18101: IP leak from Windows UI dialog with URI
-+-
 Reporter:  uileak   |  Owner:
 |  arthuredelstein
 Type:  defect   | Status:
 |  needs_revision
 Priority:  Very High|  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Major| Resolution:
 Keywords:  tbb-disk-leak, tbb-proxy-bypass, |  Actual Points:
  TorBrowserTeam201709   |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-
Changes (by gk):

 * keywords:  tbb-disk-leak, tbb-proxy-bypass, TorBrowserTeam201709R => tbb-
 disk-leak, tbb-proxy-bypass, TorBrowserTeam201709
 * status:  needs_review => needs_revision


Comment:

 Replying to [comment:58 mcs]:
 > Replying to [comment:57 gk]:
 > > Looks still good to me. mcs/brade: Could you have a second look? I'd
 like to get that one included into the upcoming alphas.
 >
 > r=brade,r=mcs
 > The patch from comment:56 looks good to us.

 Thanks. Pushed this as commit eb7cb8fe69de4ca08b8aa2ece0faeb7ea6217004 and
 setting the status back to `needs_revision`.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #18101 [Applications/Tor Browser]: IP leak from Windows UI dialog with URI

[Tor Bug Tracker & Wiki]

#18101: IP leak from Windows UI dialog with URI
-+-
 Reporter:  uileak   |  Owner:
 |  arthuredelstein
 Type:  defect   | Status:
 |  needs_review
 Priority:  Very High|  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Major| Resolution:
 Keywords:  tbb-disk-leak, tbb-proxy-bypass, |  Actual Points:
  TorBrowserTeam201709R  |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by mcs):

 Replying to [comment:57 gk]:
 > Looks still good to me. mcs/brade: Could you have a second look? I'd
 like to get that one included into the upcoming alphas.

 r=brade,r=mcs
 The patch from comment:56 looks good to us.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #18101 [Applications/Tor Browser]: IP leak from Windows UI dialog with URI

[Tor Bug Tracker & Wiki]

#18101: IP leak from Windows UI dialog with URI
-+-
 Reporter:  uileak   |  Owner:
 |  arthuredelstein
 Type:  defect   | Status:
 |  needs_review
 Priority:  Very High|  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Major| Resolution:
 Keywords:  tbb-disk-leak, tbb-proxy-bypass, |  Actual Points:
  TorBrowserTeam201709R  |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by gk):

 Looks still good to me. mcs/brade: Could you have a second look? I'd like
 to get that one included into the upcoming alphas.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #18101 [Applications/Tor Browser]: IP leak from Windows UI dialog with URI

[Tor Bug Tracker & Wiki]

#18101: IP leak from Windows UI dialog with URI
-+-
 Reporter:  uileak   |  Owner:
 |  arthuredelstein
 Type:  defect   | Status:
 |  needs_review
 Priority:  Very High|  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Major| Resolution:
 Keywords:  tbb-disk-leak, tbb-proxy-bypass, |  Actual Points:
  TorBrowserTeam201709R  |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-
Changes (by arthuredelstein):

 * keywords:  tbb-disk-leak, tbb-proxy-bypass, TorBrowserTeam201709 => tbb-
 disk-leak, tbb-proxy-bypass, TorBrowserTeam201709R
 * status:  needs_revision => needs_review


Comment:

 Thanks for the review, gk. Here's a patch for the Linux fix only in case
 we want to put that into the alpha. I'll be testing Mac next by Georg's
 method and then go back to Windows.

 https://github.com/arthuredelstein/tor-browser/commit/18101_linux

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #18101 [Applications/Tor Browser]: IP leak from Windows UI dialog with URI

[Tor Bug Tracker & Wiki]

#18101: IP leak from Windows UI dialog with URI
-+-
 Reporter:  uileak   |  Owner:
 |  arthuredelstein
 Type:  defect   | Status:
 |  needs_revision
 Priority:  Very High|  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Major| Resolution:
 Keywords:  tbb-disk-leak, tbb-proxy-bypass, |  Actual Points:
  TorBrowserTeam201709   |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-
Changes (by gk):

 * keywords:  tbb-disk-leak, tbb-proxy-bypass, TorBrowserTeam201709R => tbb-
 disk-leak, tbb-proxy-bypass, TorBrowserTeam201709


--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #18101 [Applications/Tor Browser]: IP leak from Windows UI dialog with URI

[Tor Bug Tracker & Wiki]

#18101: IP leak from Windows UI dialog with URI
-+-
 Reporter:  uileak   |  Owner:
 |  arthuredelstein
 Type:  defect   | Status:
 |  needs_revision
 Priority:  Very High|  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Major| Resolution:
 Keywords:  tbb-disk-leak, tbb-proxy-bypass, |  Actual Points:
  TorBrowserTeam201709R  |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-
Changes (by gk):

 * cc: mcs, brade (added)
 * status:  needs_review => needs_revision


Comment:

 Replying to [comment:49 arthuredelstein]:
 > Replying to [comment:48 gk]:
 >
 > Answering questions in reverse order:
 >
 > > And could you verify that other Tor Browser platforms are unaffected?
 comment:7 seems to point this out for Linux. See comment:9 for macOS.
 >
 > Here's a patch that covers all platforms:
 > https://github.com/arthuredelstein/tor-browser/commit/18101+2
 >
 > Unfortunately, I haven't yet been able to test these on old Linux and
 macOS platforms. The current platforms on desktops I tested (XFCE, KDE,
 macOS) do not show a text box in the Open Dialog. Once I have builds
 ready, I will post them on this ticket so that people can test on old
 Mac/Linux platforms if they have them.

 I built own bundles and this was a PITA to test. I can confirm that the
 patch for Linux fixes the problem and it looks good to me. After trying to
 reproduce the problem for quite a while I wrote custom extension code
 using the example on https://developer.mozilla.org/en-
 US/docs/Mozilla/Tech/XPCOM/Reference/Interface/nsIFilePicker but with
 `modSave` (this is important, I could not find a way to reproduce the
 issue and test the fix with `modOpen`) and, obviously,
 `nsIFilePicker.filterAllowURLs` added to the filters.

 Arthur/Mark/Kathy: that might be a way to test the fix on a Mac as well
 (which I don't have atm).

 With the patch for Windows I still see DNS leaks. Here is what I did:

 1) Open the patched Tor Browser
 2) Go to https://bugs.torproject.org/18101
 3) Copy the URL of the Tor logo
 4) Open https://bug711654.bmoattachments.org/attachment.cgi?id=582460 in a
 new tab
 5) Start Wireshark
 6) Click on the "Browse" button and paste the URL for the Tor log and
 click on "Open"
 7) Wait a while and a DNS query for trac.torproject.org will be in the
 Wireshark log.

 Marking this as `needs_revision` for this problem. Arthur, let me know
 whether you can reproduce that. This happens on a Windows 7 machine (in
 case that matters).

 > > Arthur: What do we want to do for XP (see comment:10)?
 >
 > I am inclined to treat this problem as wontfix, because XP is deprecated
 by Microsoft and is expected to be deprecated in September by Mozilla as
 well. I did spend a little time looking into the problem but I don't see a
 quick solution.

 Well, we certainly would take a patch if someone came up with one. So,
 let's open a follow-up ticket for that case and set `ff59-esr-will-have`
 as keyword once we are done here.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #18101 [Applications/Tor Browser]: IP leak from Windows UI dialog with URI

[Tor Bug Tracker & Wiki]

#18101: IP leak from Windows UI dialog with URI
-+-
 Reporter:  uileak   |  Owner:
 |  arthuredelstein
 Type:  defect   | Status:
 |  needs_review
 Priority:  Very High|  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Major| Resolution:
 Keywords:  tbb-disk-leak, tbb-proxy-bypass, |  Actual Points:
  TorBrowserTeam201709R  |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by gk):

 Replying to [comment:51 cypherpunks]:
 > Is this ticket about protection for noobs who can't distinguish between
 shell and browser? If so, shouldn't we make this feature obey TBB's design
 requirements? Something like "Firefox should handle URLs (instead of
 system shell)".

 I am fine opening a follow-up ticket for that idea - after we plugged that
 hole in this ticket.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #18101 [Applications/Tor Browser]: IP leak from Windows UI dialog with URI

[Tor Bug Tracker & Wiki]

#18101: IP leak from Windows UI dialog with URI
-+-
 Reporter:  uileak   |  Owner:
 |  arthuredelstein
 Type:  defect   | Status:
 |  needs_review
 Priority:  Very High|  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Major| Resolution:
 Keywords:  tbb-disk-leak, tbb-proxy-bypass, |  Actual Points:
  TorBrowserTeam201708R  |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-
Changes (by cypherpunks):

 * keywords:  tbb-proxy-bypass, ip-leak, TorBrowserTeam201708R => tbb-disk-
 leak, tbb-proxy-bypass, TorBrowserTeam201708R


Comment:

 Why is so much attention being paid for this `NOTABUG`? Feature was
 requested and discussed in
 https://bugzilla.mozilla.org/show_bug.cgi?id=711654. Pros and cons are
 well known for years.
 Is this ticket about protection for noobs who can't distinguish between
 shell and browser? If so, shouldn't we make this feature obey TBB's design
 requirements? Something like "Firefox should handle URLs (instead of
 system shell)".
 What is needed to pass URLs to Firefox, `FOS_ALLNONSTORAGEITEMS` and
 `FOS_SUPPORTSTREAMABLEITEMS` (with `FOS_FORCEFILESYSTEM` removed), from
 https://msdn.microsoft.com/en-
 us/library/windows/desktop/dn457282(v=vs.85).aspx?
 There is no IP leak or proxy bypass. But there is `tbb-disk-leak` without
 `FOS_DONTADDTORECENT`.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #18101 [Applications/Tor Browser]: IP leak from Windows UI dialog with URI

[Tor Bug Tracker & Wiki]

#18101: IP leak from Windows UI dialog with URI
-+-
 Reporter:  uileak   |  Owner:
 |  arthuredelstein
 Type:  defect   | Status:
 |  needs_review
 Priority:  Very High|  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Major| Resolution:
 Keywords:  tbb-proxy-bypass, ip-leak,   |  Actual Points:
  TorBrowserTeam201708R  |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by teor):

 Replying to [comment:49 arthuredelstein]:
 > Unfortunately, I haven't yet been able to test these on old Linux and
 macOS platforms. The current platforms on desktops I tested (XFCE, KDE,
 macOS) do not show a text box in the Open Dialog

 I can find 3 text boxes in the macOS 10.12 Open Dialog:
 * command-shift-G shows the "Go to the folder" dialog, but doesn't seem to
 allow URLs
 * the share button (square with upward arrow) allows loading arbitrary
 share extensions, which can access the network, but they require user
 action
 * the search field queries the local spotlight database, and stores
 anything typed into it in the find pasteboard and shares it with other
 apps (#14139)

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #18101 [Applications/Tor Browser]: IP leak from Windows UI dialog with URI

[Tor Bug Tracker & Wiki]

#18101: IP leak from Windows UI dialog with URI
-+-
 Reporter:  uileak   |  Owner:
 |  arthuredelstein
 Type:  defect   | Status:
 |  needs_review
 Priority:  Very High|  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Major| Resolution:
 Keywords:  tbb-proxy-bypass, ip-leak,   |  Actual Points:
  TorBrowserTeam201708R  |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-
Changes (by arthuredelstein):

 * status:  needs_information => needs_review


Comment:

 Replying to [comment:48 gk]:

 Answering questions in reverse order:

 > And could you verify that other Tor Browser platforms are unaffected?
 comment:7 seems to point this out for Linux. See comment:9 for macOS.

 Here's a patch that covers all platforms:
 https://github.com/arthuredelstein/tor-browser/commit/18101+2

 Unfortunately, I haven't yet been able to test these on old Linux and
 macOS platforms. The current platforms on desktops I tested (XFCE, KDE,
 macOS) do not show a text box in the Open Dialog. Once I have builds
 ready, I will post them on this ticket so that people can test on old
 Mac/Linux platforms if they have them.

 > Arthur: What do we want to do for XP (see comment:10)?

 I am inclined to treat this problem as wontfix, because XP is deprecated
 by Microsoft and is expected to be deprecated in September by Mozilla as
 well. I did spend a little time looking into the problem but I don't see a
 quick solution.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #18101 [Applications/Tor Browser]: IP leak from Windows UI dialog with URI

[Tor Bug Tracker & Wiki]

#18101: IP leak from Windows UI dialog with URI
-+-
 Reporter:  uileak   |  Owner:
 |  arthuredelstein
 Type:  defect   | Status:
 |  needs_information
 Priority:  Very High|  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Major| Resolution:
 Keywords:  tbb-proxy-bypass, ip-leak,   |  Actual Points:
  TorBrowserTeam201708R  |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-
Changes (by gk):

 * status:  needs_review => needs_information


Comment:

 Arthur: What do we want to do for XP (see comment:10)? And could you
 verify that other Tor Browser platforms are unaffected? comment:7 seems to
 point this out for Linux. See comment:9 for macOS.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #18101 [Applications/Tor Browser]: IP leak from Windows UI dialog with URI

[Tor Bug Tracker & Wiki]

#18101: IP leak from Windows UI dialog with URI
-+-
 Reporter:  uileak   |  Owner:
 |  arthuredelstein
 Type:  defect   | Status:
 |  needs_review
 Priority:  Very High|  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Major| Resolution:
 Keywords:  tbb-proxy-bypass, ip-leak,   |  Actual Points:
  TorBrowserTeam201708R  |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by arthuredelstein):

 I should mention, in the patch in comment:46, I use `perfmon /res` to
 confirm that no network requests were made. Without the patch, in
 unpatched Tor Browser, I see a network request corresponding to the remote
 URL entered in the open dialog box.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #18101 [Applications/Tor Browser]: IP leak from Windows UI dialog with URI

[Tor Bug Tracker & Wiki]

#18101: IP leak from Windows UI dialog with URI
-+-
 Reporter:  uileak   |  Owner:
 |  arthuredelstein
 Type:  defect   | Status:
 |  needs_review
 Priority:  Very High|  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Major| Resolution:
 Keywords:  tbb-proxy-bypass, ip-leak,   |  Actual Points:
  TorBrowserTeam201708R  |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-
Changes (by arthuredelstein):

 * status:  assigned => needs_review
 * keywords:  tbb-proxy-bypass, ip-leak, TorBrowserTeam201708 => tbb-proxy-
 bypass, ip-leak, TorBrowserTeam201708R


--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #18101 [Applications/Tor Browser]: IP leak from Windows UI dialog with URI

[Tor Bug Tracker & Wiki]

#18101: IP leak from Windows UI dialog with URI
-+-
 Reporter:  uileak   |  Owner:
 |  arthuredelstein
 Type:  defect   | Status:
 |  assigned
 Priority:  Very High|  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Major| Resolution:
 Keywords:  tbb-proxy-bypass, ip-leak,   |  Actual Points:
  TorBrowserTeam201708   |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by arthuredelstein):

 Here's a patch that blocks the use of remote URLs in the open file dialog
 on Windows:

 https://github.com/arthuredelstein/tor-browser/commit/18101

 (It essentially reverses the change in
 https://bugzilla.mozilla.org/show_bug.cgi?id=711654.)

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #18101 [Applications/Tor Browser]: IP leak from Windows UI dialog with URI

[Tor Bug Tracker & Wiki]

#18101: IP leak from Windows UI dialog with URI
-+-
 Reporter:  uileak   |  Owner:
 |  arthuredelstein
 Type:  defect   | Status:
 |  assigned
 Priority:  Very High|  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Major| Resolution:
 Keywords:  tbb-proxy-bypass, ip-leak,   |  Actual Points:
  TorBrowserTeam201708   |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by gk):

 https://bugzilla.mozilla.org/show_bug.cgi?id=711654
 https://bugzilla.mozilla.org/show_bug.cgi?id=661991

 and the test on
 https://bug711654.bmoattachments.org/attachment.cgi?id=582460
 seem relevant and potentially helpful here.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #18101 [Applications/Tor Browser]: IP leak from Windows UI dialog with URI

[Tor Bug Tracker & Wiki]

#18101: IP leak from Windows UI dialog with URI
-+-
 Reporter:  uileak   |  Owner:  Arthur
 |  Edelstein
 Type:  defect   | Status:
 |  assigned
 Priority:  Very High|  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Major| Resolution:
 Keywords:  tbb-proxy-bypass, ip-leak,   |  Actual Points:
  TorBrowserTeam201708   |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-
Changes (by Arthur Edelstein):

 * keywords:  tbb-proxy-bypass, ip-leak, TorBrowserTeam201708,
 GeorgKoppen201708 => tbb-proxy-bypass, ip-leak, TorBrowserTeam201708
 * owner:  gk => Arthur Edelstein


--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #18101 [Applications/Tor Browser]: IP leak from Windows UI dialog with URI

[Tor Bug Tracker & Wiki]

#18101: IP leak from Windows UI dialog with URI
-+-
 Reporter:  uileak   |  Owner:  gk
 Type:  defect   | Status:
 |  assigned
 Priority:  Very High|  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Major| Resolution:
 Keywords:  tbb-proxy-bypass, ip-leak,   |  Actual Points:
  TorBrowserTeam201708, GeorgKoppen201708|
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-
Changes (by gk):

 * keywords:  tbb-proxy-bypass, ip-leak, TorBrowserTeam201702,
 GeorgKoppen201702 => tbb-proxy-bypass, ip-leak, TorBrowserTeam201708,
 GeorgKoppen201708
 * priority:  High => Very High


--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #18101 [Applications/Tor Browser]: IP leak from Windows UI dialog with URI

[Tor Bug Tracker & Wiki]

#18101: IP leak from Windows UI dialog with URI
-+-
 Reporter:  uileak   |  Owner:  gk
 Type:  defect   | Status:
 |  assigned
 Priority:  High |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Major| Resolution:
 Keywords:  tbb-proxy-bypass, ip-leak,   |  Actual Points:
  TorBrowserTeam201702, GeorgKoppen201702|
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by elisebenine):

 could it be something related to browser's File API? noticed the same on
 http://internetvergelijken.nl/ today.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #18101 [Applications/Tor Browser]: IP leak from Windows UI dialog with URI

[Tor Bug Tracker & Wiki]

#18101: IP leak from Windows UI dialog with URI
-+-
 Reporter:  uileak   |  Owner:  gk
 Type:  defect   | Status:
 |  assigned
 Priority:  High |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Major| Resolution:
 Keywords:  tbb-proxy-bypass, ip-leak,   |  Actual Points:
  TorBrowserTeam201701, GeorgKoppen201701|
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-
Changes (by gk):

 * keywords:  tbb-proxy-bypass, ip-leak, TorBrowserTeam201611,
 GeorgKoppen201701 => tbb-proxy-bypass, ip-leak, TorBrowserTeam201701,
 GeorgKoppen201701


--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs