Opened 6 years ago

Last modified 6 months ago

#13496 assigned task

Write test for spoofed navigator* values in workers

Reported by: gk Owned by: tbb-team
Priority: Medium Milestone:
Component: Applications/Tor Browser Version:
Severity: Normal Keywords: ff38-esr, tbb-testcase
Cc: Actual Points:
Parent ID: Points:
Reviewer: Sponsor:


#13027 fixed the problem with navigator* values not being spoofed. Back then we could not write a Mozmill test as Mozmill itself was affected by the underlying issue ( together with

Child Tickets

Change History (6)

comment:1 Changed 6 years ago by gk

Keywords: tbb-testcase added

A preliminary test is in bug_13496 in my public test repo. Reminder: don't forget to test nested workers.

comment:2 Changed 3 years ago by teor

Severity: Normal

Set all open tickets without a severity to "Normal"

comment:3 in reply to:  1 Changed 12 months ago by Thorin

Replying to gk:

A preliminary test is in bug_13496 in my public test repo. Reminder: don't forget to test nested workers.

I think we can close this. Override prefs are not used anymore see tom's comment - "Yeah all of these should be deleted from tor's js file. With RFP enabled they do nothing"


PS: FYI: I know this is not what the ticket was for, but you can go to which shows web workers return RFP values (although some spoofed values are the real values, e.g Win32 on windows machines) - I might add this to TZP but it's probably a waste of time

PPS: do you want me to test RFP UA spoofing in nested WebWorkers? Or would that also be a waste of time - anyway, feel free to close this

comment:4 Changed 12 months ago by gk

I think we should make a decision about closing that one once we move to a non-ESR Firefox and are sure the regular Firefox tests available for spoofing are enough. If not, we can use this ticket to write missing ones, otherwise close it.

Thorin: It sounds there might be tests missing (reading you PPS)? If so, feel free to go ahead and check it out.

comment:5 Changed 11 months ago by gk

Owner: changed from gk to tbb-team
Status: newassigned


comment:6 Changed 6 months ago by Thorin

@gk: tests you say... ok then (RFP passes every single test I can think of: excluding feature detection)

  • Firefox (use a non-68 release)
  • flip RFP on
  • while I'm still in the process of finishing building these into TZP, you can use kkapsner's test [1]
  • this tests open.window(), iframe, nested iframe, "sneaky" iframe, some other iframe, web worker, shared worker, service worker, nested workers, worker from blob ... etc
  • I've tested kkapsner's test with RFP off and UA spoofing extensions that fail to cover iframes etc
  • for those following along at home: ignore the red line that says headers is different to navigator (that's by design)


As for what tests are upstream, it seems limited

Note: See TracTickets for help on using tickets.