window.external.AddSearchProvider request goes through catch-all-circuit

Calling external.AddSearchProvider(someURL) does a request that does not follow FPI and goes through the catch-all circuit.

added TorBrowserTeam202001R component::applications/tor browser owner::acat priority::medium resolution::fixed reviewer::richard severity::normal status::closed tbb-linkability type::defect labels

This allows a website to find out the catch-all circuit IP, so I assume it's serious enough to set it for next month (not aware this is currently possible in any other way).

Trac:
Keywords: tbb-linkability deleted, tbb-linkability TorBrowserTeam201912 added

Assigning more tickets to acat for the next few months

Trac:
Cc: N/A to tbb-team
Status: new to assigned
Owner: tbb-team to acat

acat is afk in December

Trac:
Keywords: tbb-linkability TorBrowserTeam201912 deleted, tbb-linkability, TorBrowserTeam202001 added

Patch for review in https://github.com/acatarineu/tor-browser/commit/32414.

The requests that were not respecting FPI were the .xml and icons fetches when Services.search.addEngine is used to add an engine. From web content, this can be via the (deprecated) API external.AddSearchProvider or via the page action that is added when a page has a <link rel="search" type="application/opensearchdescription+xml"... tag.

Trac:
Status: assigned to needs_review
Keywords: TorBrowserTeam202001 deleted, TorBrowserTeam202001R added

Trac:
Reviewer: N/A to pospeselr

These changes look good to me.

I cherry-picket the patch to branch tor-browser-68.4.1esr-9.5-1 as commit 2197dad64e5c3752b1daeab0c676fda07880144c.

Trac:
Resolution: N/A to fixed
Keywords: N/A deleted, tbb-backport added
Status: needs_review to closed

No backport for those tickets/fixes. They will emerge with 9.5.

Trac:
Keywords: tbb-backport deleted, N/A added

closed

mentioned in issue #34055 (moved)

moved to tpo/applications/tor-browser#32414 (closed)