Opened 9 years ago

Closed 3 months ago

Last modified 6 weeks ago

#1623 closed enhancement (fixed)

Block protocol handler enumeration

Reported by: mikeperry Owned by: tbb-team
Priority: High Milestone:
Component: Applications/Tor Browser Version:
Severity: Normal Keywords: tbb-fingerprinting, tbb-torbutton, TorBrowserTeam201810R, tbb-backported
Cc: Actual Points:
Parent ID: Points:
Reviewer: Sponsor:


Torbutton should block remote protocol handler enumeration. We currently wrap the external protocol handler launching components, and install custom protocol handlers to handle tor:// urls. We should see if we can perform any tricks in these components to defeat

Child Tickets

Change History (14)

comment:1 Changed 8 years ago by mikeperry

Component: TorbuttonTorBrowserButton

comment:2 Changed 7 years ago by mikeperry

Milestone: TorBrowserBundle 2.3.x-stable

comment:3 Changed 7 years ago by mikeperry

Keywords: tbb-fingerprinting added

comment:4 Changed 7 years ago by mikeperry

Keywords: MikePerry201206 added

comment:5 Changed 7 years ago by mikeperry

Keywords: MikePerry201206 removed

comment:6 Changed 4 years ago by erinn

Component: TorBrowserButtonTor Browser
Keywords: tbb-torbutton added
Owner: changed from mikeperry to tbb-team

comment:7 Changed 21 months ago by tom

Severity: Blocker

We ran across this in the mozilla bugtracker, and Jonathan updated the POC to work again:

comment:8 Changed 21 months ago by tom

Severity: BlockerNormal

comment:9 Changed 8 months ago by gk

Milestone: TorBrowserBundle 2.3.x-stable

comment:10 Changed 4 months ago by arthuredelstein

Tim landed patches in, so we can backport them for TBB/ESR60.

comment:11 Changed 4 months ago by arthuredelstein

Keywords: TorBrowserTeam201809R added
Status: newneeds_review

Here is a branch with Tim's 3 commits cherry-picked on top of tor-browser-60.2.0esr-8.5-1

We could also consider including these backported patches in 8.0.x.

comment:12 Changed 4 months ago by gk

Keywords: TorBrowserTeam201810R added; TorBrowserTeam201809R removed

Moving review tickets to October

comment:13 Changed 3 months ago by gk

Keywords: tbb-backport added
Resolution: fixed
Status: needs_reviewclosed

Looks good. Cherry-picked to tor-browser-60.2.1esr-8.5-1 (commits 8ac83f77ae144a3063c57099c250a340fd4bf0ac, 0a5a1991dec543177e78283f27407e2a6d4892d8, and d098b183150a7feb83f159ad731fc42537252863) and marked for possible backport. This should be available starting with Tor Browser 8.5a4.

comment:14 Changed 6 weeks ago by gk

Keywords: tbb-backported added; tbb-backport removed

Backported to tor-browser-60.3.0esr-8.0-1 (commits d0571f8b98a5a98e59974b4868c0fcccaea17748, 818556471232f9a9a4caebc3c37cae387a43bbd7, and bec054919416df19648702f2af0b9a0be1c384b8)

Note: See TracTickets for help on using tickets.