Opened 3 years ago

Last modified 19 months ago

#18862 assigned defect

Make sure the Presentation API is no risk for our users

Reported by: gk Owned by: tbb-team
Priority: High Milestone:
Component: Applications/Tor Browser Version:
Severity: Normal Keywords: ff60-esr
Cc: Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

The presentation API allows web content to use external presentation-type displays. It comes with own discovery mechanisms (libmdns) and is supposed to be available on desktop and on mobile in the near future (https://wiki.mozilla.org/WebAPI/PresentationAPI). This is a pretty complex beast and we have to make sure that it poses no risk (be into proxy bypass or fingerinting/tracking) to our users.

Child Tickets

Change History (9)

comment:2 Changed 2 years ago by gk

Keywords: tbb-7.0-must added

comment:3 Changed 2 years ago by gk

Keywords: TorBrowserTeam201703 added

Getting those tickets on our March radar as well.

comment:4 Changed 2 years ago by gk

Keywords: tbb-7.0-must-alpha TorBrowserTeam201704 added; tbb-7.0-must TorBrowserTeam201703 removed

From Mike's notes in #21625:

This needs to be disabled even if proxied, because it does ICE-style IP address discovery and advertisement.

comment:5 Changed 2 years ago by gk

Priority: MediumHigh

This is higher prio.

comment:6 Changed 2 years ago by arthuredelstein

In ESR52, the Presentation API is still disabled by prefs (dom.presentation.enabled = false and similar). I manually confirmed, using the consoles, that window.PresentationRequest is not exposed in content or chrome javascript. I also searched on dxr.mozilla.org and didn't find any place where we would expect a PresentationRequest to be activated, except in tests.

We could also potentially try to rip out the DOM Presentation code, but I already feel reasonably comfortable that the Presentation API code won't be running.

comment:7 Changed 2 years ago by arthuredelstein

Keywords: TorBrowserTeam201704R added; TorBrowserTeam201704 removed
Status: newneeds_review

Setting this to Needs Review to check that someone else in the team agrees with my assessment that we don't need to do anything for the ESR52 alpha; if we want to rip out dom/presentation/* we can leave this ticket open and change the target release.

comment:8 Changed 2 years ago by gk

Keywords: ff59-esr added; ff52-esr tbb-7.0-must-alpha TorBrowserTeam201704R removed
Status: needs_reviewassigned

It seems we are fine for Android as well (https://bugzilla.mozilla.org/show_bug.cgi?id=1318214) since Firefox 52 does not have this feature enabled there yet (but Firefox 53 does). I am leaving this open, though, moving it to ff59-esr. If we have lots of time we could rip it out as this is the cleaner approach.

comment:9 Changed 19 months ago by gk

Keywords: ff60-esr added; ff59-esr removed

Firefox 60 is the new ESR.

Note: See TracTickets for help on using tickets.