Backport 1467970 and 1590526

Mozilla landed a defense-in-depth security improvement, but they aren't planning on backporting it for esr68.

1467970 is the original patch and 1590526 corrects some regressions.

1467970: https://hg.mozilla.org/mozilla-central/rev/c8a2c27a1128

1590526 (uplift on 71 beta): https://hg.mozilla.org/releases/mozilla-beta/rev/1542e80327c2

added TorBrowserTeam201911R actualpoints::0.2 component::applications/tor browser owner::gk priority::medium resolution::fixed severity::normal status::closed type::defect labels

We can try squeezing this into the 9.5a3.

Trac:
Keywords: N/A deleted, TorBrowserTeam201911 added

bug_32618 (https://gitweb.torproject.org/user/gk/tor-browser.git/log/?h=bug_32618) has the backports. I did not build the changes yet but I looked at possible parseFromString() calls that might still be problematic AND on esr68 while not being present anymore when the patches landed on Mozilla's branches. We are good here, though.

I also double-checked that the patches for those two bugs are the only ones we need to backport:

Bug 1585769 is relevant here but the picture-in-picture video feature is only enabled in Windows nightlies if the code is esr68, so I think we can avoid backporting that fix. Bug 1585588 is not affecting us as we don't ship that extension and it should be fixed by bug 1590526 anyway (which fixed bug 1576508 as well).

Trac:
Status: new to needs_review
Keywords: TorBrowserTeam201911 deleted, TorBrowserTeam201911R added
Actualpoints: N/A to 0.2

Trac:
Owner: tbb-team to gk
Status: needs_review to assigned
Cc: N/A to tbb-team

Trac:
Status: assigned to needs_review

Thanks! Looks good. Picked these as 1dc18678aa3ae2b604664653cf924671638a0bb6 and 94363e6fcad34c5beaf53ffa4b3a9ae5694dddf8.

Trac:
Resolution: N/A to fixed
Status: needs_review to closed

Maybe something to at least consider for backporting.

Trac:
Keywords: N/A deleted, tbb-backport added

No backport for those tickets/fixes. They will emerge with 9.5.

Trac:
Keywords: tbb-backport deleted, N/A added

closed

added 1h 36m of time spent

moved to tpo/applications/tor-browser#32618 (closed)