Opened 3 years ago

Closed 3 years ago

#18802 closed defect (fixed)

remove Shumway (JS-based Flash VM)

Reported by: mcs Owned by: mcs
Priority: Medium Milestone:
Component: Applications/Tor Browser Version:
Severity: Normal Keywords: ff45-esr, tbb-6.0a5, TorBrowserTeam201604
Cc: brade, gk, arthuredelstein Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

In #18546, Mike said:

Shumway (the flash previewer/player) can bypass proxy settings. If it is compiled in, we should rip it out/disable it at build time, so nobody enables it.

Child Tickets

Change History (6)

comment:1 Changed 3 years ago by mcs

After ESR45, the Shumway files were removed from the Mozilla tree. See https://bugzilla.mozilla.org/show_bug.cgi?id=1250046

Kathy and I still need to verify that it is not included in ESR45-based browsers.

comment:2 Changed 3 years ago by mcs

Cc: arthuredelstein added

It looks like Shumway will be included in our nightly builds, which is not good (search for shumway inside browser/installer/package-manifest.in).

Kathy and I think the best solution is to backport the three patches that are mentioned here:
https://bugzilla.mozilla.org/show_bug.cgi?id=1250046#c8

Arthur, is this something you can do?

It looks like the patches apply fairly cleanly with the exception of the third patch. The problem there is that toolkit/components/telemetry/histogram-whitelists.json does not exist in the ESR45 tree; I think that part of the patch can just be skipped.

comment:3 in reply to:  2 Changed 3 years ago by arthuredelstein

Replying to mcs:

It looks like Shumway will be included in our nightly builds, which is not good (search for shumway inside browser/installer/package-manifest.in).

Kathy and I think the best solution is to backport the three patches that are mentioned here:
https://bugzilla.mozilla.org/show_bug.cgi?id=1250046#c8

Arthur, is this something you can do?

Thanks for finding these patches -- I have cherry-picked/backported all three to
https://github.com/arthuredelstein/tor-browser/commits/15197+11
Hash: 1c110015f724eb69b9d0597aab20c2e43de44479

comment:4 Changed 3 years ago by gk

Status: newneeds_revision

It seems you got the nsBrowserGlue.js part wrong. And is there a reason to have

-browser/fuel/**

?

comment:5 in reply to:  4 Changed 3 years ago by arthuredelstein

Replying to gk:

It seems you got the nsBrowserGlue.js part wrong. And is there a reason to have

-browser/fuel/**

?

Thanks for catching those. I applied a fixup:
https://github.com/arthuredelstein/tor-browser/commits/15197+11
Hash: c734da3fde70f8818a94a5e3b93d34f0602d2cec

comment:6 Changed 3 years ago by gk

Resolution: fixed
Status: needs_revisionclosed
#ifdef NIGHTLY_BUILD
    // Registering Shumway bootstrap script the child processes.
    Services.ppmm.loadProcessScript("chrome://shumway/content/bootstrap-content.js", true);
    // Initializing Shumway (shall be run after child script registration).
    ShumwayUtils.init();
#endif

Was still there. I removed that one before rebasing to 45.0.2esr (the result is visible in tor-browser-45.0.2esr-6.x-1 which is currently still pushed).

Note: See TracTickets for help on using tickets.