Opened 5 years ago

Closed 5 years ago

Last modified 5 years ago

#13023 closed defect (fixed)

Disable the Gamepad API

Reported by: mikeperry Owned by: tbb-team
Priority: Very High Milestone:
Component: Applications/Tor Browser Version:
Severity: Keywords: tbb-pref, ff31-esr, tbb-fingerprinting, TorBrowserTeam201409
Cc: Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

The GamePad API allows JS to silently query all attached videogame controlers and extract their USB device IDs and other vendor info strings, without user interaction:
https://developer.mozilla.org/en-US/docs/Web/Guide/API/Gamepad

We should just disable this API via its pref for now.

Child Tickets

Change History (3)

comment:1 Changed 5 years ago by arthuredelstein

Status: newneeds_review

comment:2 Changed 5 years ago by mikeperry

Resolution: fixed
Status: needs_reviewclosed

How come this commit got lost in the branches at tbb-esr31.1.0 and tbb-esr31.1.1?

I merged this back in, but was anything else lost in this rebase?

comment:3 in reply to:  2 Changed 5 years ago by arthuredelstein

Replying to mikeperry:

How come this commit got lost in the branches at tbb-esr31.1.0 and tbb-esr31.1.1?

I merged this back in, but was anything else lost in this rebase?

I believe nothing else was lost. The history of branches was the following:

First I squashed
https://github.com/arthuredelstein/tor-browser/commits/12620
to
https://github.com/arthuredelstein/tor-browser/commits/12620D
and then rebased to
https://github.com/arthuredelstein/tor-browser/commits/tbb-esr31.1.0
and rebased again to
https://github.com/arthuredelstein/tor-browser/commits/tbb-esr31.1.1 .

I think I may have committed the GamePad API patch to 12620 from another machine. Unfortunately (sorry!) it looks like I forgot to git pull to my local copy of 12620 before squashing it into 12620D.

To check if anything else was lost, I first confirmed repository contents in the penultimate commit of 12620 and the last commit of 12620D are identical:

arthur@Arthur /p/t/tor-browser31> git diff 9889ac7 c8e3f08
arthur@Arthur /p/t/tor-browser31> 

So it appears only the GamePad API commit is missing from the squash of 12620->12620D.

Additionally, if I compare the commit messages between 12620D and tor-browser-31.1.1esr-4.x-1 I get:

arthur@Arthur /p/t/tor-browser31> git log 9197ab3..tor-browser-31.1.1esr-4.x-1  --pretty=%s > log_tbb_esr31.1.1.txt 
arthur@Arthur /p/t/tor-browser31> git log c110c3c..12620D  --pretty=%s > log_12620D.txt
arthur@Arthur /p/t/tor-browser31> diff log_12620D.txt log_tbb_esr31.1.1.txt 
0a1,6
> fixup! TB4: Tor Browser's Firefox preference overrides.
> Bug 13021: Prompt before allowing Canvas isPointIn*() calls.
> Bug 1071527 - "dom.performance.enabled" set to "false" shows non-zero values for attributes. r=bz
> Bug 13028: Prevent potential proxy bypass cases.
> Bug #13047: Updater should not send Kernel/GTK version
> Bug #13091: Use "Tor Browser" everywhere (space included)
arthur@Arthur /p/t/tor-browser31> 

which shows that no commits were lost during the rebase from 12620D, and that 6 commits were subsequently added at the HEAD.

Note: See TracTickets for help on using tickets.