Re: [tor-bugs] #21830 [Applications/Tor Browser]: Copying large text from web console leaks to /tmp

[Tor Bug Tracker & Wiki]

#21830: Copying large text from web console leaks to /tmp
-+-
 Reporter:  gk   |  Owner:  neillm
 Type:  defect   | Status:  closed
 Priority:  Medium   |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:  fixed
 Keywords:  tbb-disk-leak,   |  Actual Points:
  TorBrowserTeam201708R, tbb-backported  |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-
Changes (by gk):

 * keywords:  tbb-disk-leak, TorBrowserTeam201708R, tbb-backport => tbb-
 disk-leak, TorBrowserTeam201708R, tbb-backported


Comment:

 Taking this for the stable (7.0.6). Cherry-picked to `tor-
 browser-52.3.0esr-7.0-1` (commit
 7a1b25245e73051cb724a7eb6a66de18263f88c2).

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #21830 [Applications/Tor Browser]: Copying large text from web console leaks to /tmp

[Tor Bug Tracker & Wiki]

#21830: Copying large text from web console leaks to /tmp
-+-
 Reporter:  gk   |  Owner:  neillm
 Type:  defect   | Status:  closed
 Priority:  Medium   |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:  fixed
 Keywords:  tbb-disk-leak,   |  Actual Points:
  TorBrowserTeam201708R, tbb-backport|
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-
Changes (by gk):

 * keywords:  tbb-disk-leak, TorBrowserTeam201708R => tbb-disk-leak,
 TorBrowserTeam201708R, tbb-backport


--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #21830 [Applications/Tor Browser]: Copying large text from web console leaks to /tmp

[Tor Bug Tracker & Wiki]

#21830: Copying large text from web console leaks to /tmp
--+
 Reporter:  gk|  Owner:  neillm
 Type:  defect| Status:  closed
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:  fixed
 Keywords:  tbb-disk-leak, TorBrowserTeam201708R  |  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+
Changes (by gk):

 * status:  needs_review => closed
 * resolution:   => fixed


Comment:

 Okay, I took the patch for the alpha (commit
 06580161f901dedf60e6dcb9252e7ce6b3e7b37b on `tor-
 browser-52.2.0esr-7.5-1`). I agree, when we want to upstream the patch we
 should try the road Arthur outlined in comment:12.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #21830 [Applications/Tor Browser]: Copying large text from web console leaks to /tmp

[Tor Bug Tracker & Wiki]

#21830: Copying large text from web console leaks to /tmp
-+-
 Reporter:  gk   |  Owner:  neillm
 Type:  defect   | Status:
 |  needs_review
 Priority:  Medium   |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:
 Keywords:  tbb-disk-leak,   |  Actual Points:
  TorBrowserTeam201707R  |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by neillm):

 Replying to [comment:12 arthuredelstein]:
 > Replying to [comment:8 neillm]:
 >
 > > This patch has been applied to tor-browser-52.2.0esr-7.0-1-build1 and
 tested on Ubuntu 16.04.2 LTS.
 >
 > Thanks -- I built with the patch and it worked as described. But the
 `aContext` argument of `nsTransferable::Init()` appears to have only one
 purpose, which is to check for PBM state. So I wonder if you think it
 would make sense to change the signature to `nsTransferable::Init(bool
 isPrivateBrowsingMode)`? Then perhaps the callers could be modified to
 provide PBM state, assuming they have that information:
 >
 > https://dxr.mozilla.org/mozilla-
 
central/search?q=%2Bcallers%3A%22nsTransferable%3A%3AInit%28nsILoadContext+%2A%29%22
 >
 > (I'm not sure if this is a practical idea or not, so feel free to
 disagree.)

 It's a good idea, but I think practically speaking, it would be much more
 complicated.  The reason I say that is because all of those times where
 the nsTransferable is initialized without a context, it's because we
 (likely) don't actually know at that point if it's a private browsing mode
 or not.  After all, if we did, we could have loaded it with the context to
 begin with (although perhaps there are some lazy cases where it could be
 used and isn't).

 So for those remaining cases (without the context), while we may be able
 to load the preference default as this patch does, we would have to do it
 in a lot more places before we know what boolean to pass in to the Init
 (if modified).  Does that make sense?

 Other than that, you're right, it appears that it's only used for that
 reason at this point.  Assuming there are no other future uses of that
 context by the transferable, refactoring could work.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #21830 [Applications/Tor Browser]: Copying large text from web console leaks to /tmp

[Tor Bug Tracker & Wiki]

#21830: Copying large text from web console leaks to /tmp
-+-
 Reporter:  gk   |  Owner:  neillm
 Type:  defect   | Status:
 |  needs_review
 Priority:  Medium   |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:
 Keywords:  tbb-disk-leak,   |  Actual Points:
  TorBrowserTeam201707R  |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by arthuredelstein):

 Replying to [comment:8 neillm]:

 > This patch has been applied to tor-browser-52.2.0esr-7.0-1-build1 and
 tested on Ubuntu 16.04.2 LTS.

 Thanks -- I built with the patch and it worked as described. But the
 `aContext` argument of `nsTransferable::Init()` appears to have only one
 purpose, which is to check for PBM state. So I wonder if you think it
 would make sense to change the signature to `nsTransferable::Init(bool
 isPrivateBrowsingMode)`? Then perhaps the callers could be modified to
 provide PBM state, assuming they have that information:

 https://dxr.mozilla.org/mozilla-
 
central/search?q=%2Bcallers%3A%22nsTransferable%3A%3AInit%28nsILoadContext+%2A%29%22

 (I'm not sure if this is a practical idea or not, so feel free to
 disagree.)

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #21830 [Applications/Tor Browser]: Copying large text from web console leaks to /tmp

[Tor Bug Tracker & Wiki]

#21830: Copying large text from web console leaks to /tmp
-+-
 Reporter:  gk   |  Owner:  neillm
 Type:  defect   | Status:
 |  needs_review
 Priority:  Medium   |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:
 Keywords:  tbb-disk-leak,   |  Actual Points:
  TorBrowserTeam201707R  |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-
Changes (by gk):

 * keywords:  tbb-disk-leak => tbb-disk-leak, TorBrowserTeam201707R
 * status:  needs_information => needs_review


--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #21830 [Applications/Tor Browser]: Copying large text from web console leaks to /tmp

[Tor Bug Tracker & Wiki]

#21830: Copying large text from web console leaks to /tmp
--+---
 Reporter:  gk|  Owner:  neillm
 Type:  defect| Status:  needs_information
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:  tbb-disk-leak |  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+---

Comment (by neillm):

 Replying to [comment:9 gk]:
 > Thanks. Did you build a complete new Tor Browser bundle for that (if so,
 could you make it available for us to test your patch) or just the browser
 part copying the result over in an already existing Tor Browser? Or did
 you something else?

 In the interest of time, I built the gitian-builder/inputs/tor-browser
 source tree alone for testing and configured the SOCKS5 proxy to
 localhost:9050, as I ran into unrelated issues doing the tor-browser-
 bundle/gitian 'make' route.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #21830 [Applications/Tor Browser]: Copying large text from web console leaks to /tmp

[Tor Bug Tracker & Wiki]

#21830: Copying large text from web console leaks to /tmp
--+---
 Reporter:  gk|  Owner:  neillm
 Type:  defect| Status:  needs_information
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:  tbb-disk-leak |  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+---
Changes (by gk):

 * status:  assigned => needs_information


Comment:

 Thanks. Did you build a complete new Tor Browser bundle for that (if so,
 could you make it available for us to test your patch) or just the browser
 part copying the result over in an already existing Tor Browser? Or did
 you something else?

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #21830 [Applications/Tor Browser]: Copying large text from web console leaks to /tmp

[Tor Bug Tracker & Wiki]

#21830: Copying large text from web console leaks to /tmp
--+--
 Reporter:  gk|  Owner:  neillm
 Type:  defect| Status:  assigned
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:  tbb-disk-leak |  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+--

Comment (by neillm):

 After inspecting this issue for some time (very easily reproducible by the
 original reporter's steps), as well as examining the previous solution
 (#9701) and finding the shortcomings, I propose that this issue can be
 addressed as follows:

 {{{
 diff --git a/widget/nsTransferable.cpp b/widget/nsTransferable.cpp
 index e99d454..976180c 100644
 --- a/widget/nsTransferable.cpp
 +++ b/widget/nsTransferable.cpp
 @@ -39,6 +39,7 @@ Notes to self:
  #include "nsIFile.h"
  #include "nsILoadContext.h"
  #include "mozilla/UniquePtr.h"
 +#include "mozilla/Preferences.h"

  NS_IMPL_ISUPPORTS(nsTransferable, nsITransferable)

 @@ -248,6 +249,11 @@ nsTransferable::Init(nsILoadContext* aContext)

if (aContext) {
  mPrivateData = aContext->UsePrivateBrowsing();
 +  } else {
 +// without aContext here to provide PrivateBrowsing information,
 +// we defer to the active configured setting
 +mPrivateData =
 +  mozilla::Preferences::GetBool("browser.privatebrowsing.autostart");
}
  #ifdef DEBUG
mInitialized = true;
 }}}

 There are a number of times a transferable is initialized without a
 context that it can use to determine if we're in private browsing mode or
 not (which dictates the value of mPrivateData as seen above).  Rather than
 assuming that we are not by default (the security leak reported), I think
 the TorBrowser should go with the configured 'privatebrowsing' default
 (which is on by default, though it can be disabled in the preferences,
 which resorts to the current/unpatched behavior).

 This patch has been applied to tor-browser-52.2.0esr-7.0-1-build1 and
 tested on Ubuntu 16.04.2 LTS.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #21830 [Applications/Tor Browser]: Copying large text from web console leaks to /tmp

[Tor Bug Tracker & Wiki]

#21830: Copying large text from web console leaks to /tmp
--+--
 Reporter:  gk|  Owner:  neillm
 Type:  defect| Status:  assigned
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:  tbb-disk-leak |  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+--
Changes (by neillm):

 * owner:  tbb-team => neillm


--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #21830 [Applications/Tor Browser]: Copying large text from web console leaks to /tmp

[Tor Bug Tracker & Wiki]

#21830: Copying large text from web console leaks to /tmp
--+--
 Reporter:  gk|  Owner:  tbb-team
 Type:  defect| Status:  assigned
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:  tbb-disk-leak |  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+--

Comment (by cypherpunks):

 have you heard the good news? this still occurs in tbb 7

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #21830 [Applications/Tor Browser]: Copying large text from web console leaks to /tmp

[Tor Bug Tracker & Wiki]

#21830: Copying large text from web console leaks to /tmp
--+--
 Reporter:  gk|  Owner:  tbb-team
 Type:  defect| Status:  assigned
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:  tbb-disk-leak |  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+--

Comment (by cypherpunks):

 linux
 try a google image search and have javascript enabled, keep hitting page
 down for a while, then go to tools -> web developer -> inspector, go to
 the opening html element and then right click and select 'copy inner
 html', then check to see for the turds.
 and in my opinion, with the same end result, this is the same as bug #9701
 and it felt pointless to rewrite it.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #21830 [Applications/Tor Browser]: Copying large text from web console leaks to /tmp

[Tor Bug Tracker & Wiki]

#21830: Copying large text from web console leaks to /tmp
--+--
 Reporter:  gk|  Owner:  tbb-team
 Type:  defect| Status:  assigned
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:  tbb-disk-leak |  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+--
Changes (by gk):

 * status:  needs_information => assigned


Comment:

 And ideally it would be nice to have steps to reproduce.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #21830 [Applications/Tor Browser]: Copying large text from web console leaks to /tmp

[Tor Bug Tracker & Wiki]

#21830: Copying large text from web console leaks to /tmp
--+---
 Reporter:  gk|  Owner:  tbb-team
 Type:  defect| Status:  needs_information
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:  tbb-disk-leak |  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+---
Changes (by gk):

 * status:  new => needs_information


Comment:

 Which operating system are you using?

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

[tor-bugs] #21830 [Applications/Tor Browser]: Copying large text from web console leaks to /tmp

[Tor Bug Tracker & Wiki]

#21830: Copying large text from web console leaks to /tmp
--+---
 Reporter:  gk|  Owner:  tbb-team
 Type:  defect| Status:  new
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal|   Keywords:  tbb-disk-leak
Actual Points:|  Parent ID:
   Points:|   Reviewer:
  Sponsor:|
--+---
 A user reported using the webconsole copying a large section of de-
 obfuscated html with torbrowser 6.5.1 resulted in those contents being
 available in /tmp.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs