Opened 3 years ago

Closed 2 years ago

#21726 closed defect (fixed)

Get graphite back into the security slider

Reported by: gk Owned by: tbb-team
Priority: Medium Milestone:
Component: Applications/Tor Browser Version:
Severity: Normal Keywords: tbb-torbutton, tbb-security-slider, ff52-esr, tbb-7.0-must, TorBrowserTeam201705R
Cc: fdsfgs@… Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

We removed disabled graphite support in Tor Browser following Mozilla due to security concerns. We should let it be governed again by our security slider (Mozilla's bug is https://bugzilla.mozilla.org/show_bug.cgi?id=1271262).

Child Tickets

Change History (7)

comment:1 Changed 3 years ago by tokotoko

Cc: fdsfgs@… added

comment:2 Changed 2 years ago by gk

Keywords: tbb-7.0-must added

Adding tickets to our 7.0 ticket list

comment:3 Changed 2 years ago by gk

It seems Mozilla found more issues with Graphite. I feel we should wait with getting it back to the slider and just disable it again.

comment:4 Changed 2 years ago by cypherpunks

Nothing should be put into the security slider, if users don't ask to (except to "Low", maybe, if it means "allow everything").

comment:5 Changed 2 years ago by gk

Keywords: TorBrowserTeam201705R added
Status: newneeds_review

Mozilla keep still finding critical bugs in this piece of code. Let's keep it disabled for the time being. bug_21726 (https://gitweb.torproject.org/user/gk/tor-browser.git/commit/?h=bug_21726&id=b3a33a1823f8f7047e9bf53f1cbc8a98e27738a4) has a patch up for review.

comment:6 Changed 2 years ago by mcs

r=brade, r=mcs
Okay.

comment:7 Changed 2 years ago by gk

Resolution: fixed
Status: needs_reviewclosed

commit 9b5324a8bb68e1e8e10d113e087db24aee712fe4 on tor-browser-52.1.0esr-7.0-2 has it (and the typo in the commit message goes away after rebasing, promised ;) ).

Note: See TracTickets for help on using tickets.