#25635 closed defect (fixed)

Firefox Mobile(and Orfox) allows the user to copy the url to another app

Reported by: igt0 Owned by: tbb-team
Priority: Medium Milestone:
Component: Applications/Tor Browser Version:
Severity: Normal Keywords: tbb-torbutton, tbb-mobile, TorBrowserTeam201812
Cc: gk, sysrqb, mcs, arthuredelstein, igt0 Actual Points:
Parent ID: Points:
Reviewer: Sponsor:


An user is able to copy URL from the web browser URL bar to another app when both apps are diving the screen(multi window support), violating the no-proxy-bypass rule.

This bug is reproducible just on Samsung Galaxy Note devices.

Child Tickets

Change History (11)

comment:1 Changed 21 months ago by gk

Cc: gk added; geko removed
Component: Applications/TorbuttonApplications/Tor Browser
Keywords: tbb-torbutton added
Owner: set to tbb-team

What do you mean with "proxy bypass" in this case? The user is able to copy a URL and then they paste it in another app and the requested page shows up? That's okay I think and "happening" on desktop as well: If I copy a URL in Tor Browser and open my Firefox then I am able to paste and load it.

comment:2 Changed 21 months ago by gk

Keywords: tbb-mobile added

comment:3 Changed 21 months ago by igt0

Indeed, it copies the url that has the text/html format, however it filters out the Mozilla URL Object(text/x-moz-url) that has more information about the site. At least it is what the log message says:

[03-27 10:55:30] Torbutton INFO: The DataTransfer is available
[03-27 10:55:30] Torbutton INFO: Inspecting the data transfer: 0
[03-27 10:55:30] Torbutton INFO: Type is: text/plain
[03-27 10:55:30] Torbutton INFO: Type is: text/x-moz-url
[03-27 10:55:30] Torbutton INFO: Removing text/x-moz-url

and the drag and drop filter code as well:

        if (type == "text/x-moz-url" ||
            type == "text/x-moz-url-data" ||
            type == "text/uri-list" ||
            type == "application/x-moz-file-promise-url") {
          this.logger.log(3, "Removing " + type);

comment:4 Changed 20 months ago by igt0

Parent ID: #25703

comment:5 Changed 17 months ago by gk

Status: newneeds_information

igt0: So, is that bug still an issue we think should get fixed? If so, what exactly is the problem? (As I indicated in comment:1 that's the behavior on the desktop and I think it's okay)

comment:6 Changed 17 months ago by igt0

It is fixed by the dragDropFilter.js in TorButton. About the problem:

When the Android multi window is enabled[1] and the user drags and drop the URL to other window, the data contains not just the URL but the current tab title.

[1] https://developer.android.com/guide/topics/ui/multi-window

comment:7 Changed 17 months ago by gk

Okay, so we get this fixed once we ship Tor Browser for Mobile with Torbutton, good.

comment:8 Changed 15 months ago by gk

Parent ID: #25703

So, we do include Torbutton now, igt0, can you verify if we are good here now?

comment:9 Changed 12 months ago by gk

Cc: igt0 added
Keywords: TorBrowserTeam201812 added

igt0: Are we good here now?

comment:10 Changed 12 months ago by igt0

yes, torbutton already has the needed code to handle this.

comment:11 Changed 12 months ago by gk

Resolution: fixed
Status: needs_informationclosed

Okay, then we can close this ticket, thanks.

Note: See TracTickets for help on using tickets.