Block Components.lookupMethod in TorBrowser

It appears that EMCAScript 5 added official support for hooking JS objects for protection against XSS. However Firefox seems to have left a backdoor to undo these hooks in the form of Components.lookupMethod, which is marked "unconfigurable" (which means it cannot be hooked).

We should remove this bit, and/or neuter this API in TorBrowser. This should allow us to safely write JS hooks to deal with fingerprinting issues in the window object and the DOM.

added MikePerryIterationFires20110529 actualpoints::2 backport-to-mozilla component::firefox patch issues owner::mikeperry parent::2871 points::4 priority::medium resolution::fixed status::closed type::enhancement labels

Trac:
Cc: N/A to g.koppen@jondos.de

Blocking and/or changing the attribute of this should be simple. Will of course need to be tested though. Also, some research on why a website might actually need this to function properly is probably a good plan.

Trac:
Points: N/A to 4

Trac:
Component: Tor bundles/installation to Tor Browser

Trac:
Cc: g.koppen@jondos.de to g.koppen@jondos.de, lunar@debian.org

I think I'm going to try to do this during this iteration. Nickm is going to beat me to stable otherwise! I also expect that just twiddling the property should be simpler than 4 points, but we'll see.

Trac:
Keywords: N/A deleted, MikePerryIterationFires20110529 added

I couldn't figure out where the configurable bit was being set for this, but I did successfully disable it.

No prefs for now. We don't need them. I'm also not sure if this is the exact approach Firefox would prefer. It might break less random script if these were present but configurable for us to neuter via content script instead of fully removing it.

Trac:
Status: new to closed
Resolution: N/A to fixed
Actualpoints: N/A to 2

Trac:
components.diff

Block access to components.lookupMethod and components.interfaces

Trac:
Keywords: N/A deleted, backport-to-mozilla added

closed

changed time estimate to 32h

added 16h of time spent

mentioned in issue #2874 (closed)