nagai/fune
3
0
Fork 0
forked from mirrors/gecko-dev
Code Pull requests Activity

Bug 1894958: Let's name this page more accurately r=timhuang

Browse source 
The purpose of this page is to improve the fingerprinting protections
in Firefox.

Differential Revision: https://phabricator.services.mozilla.com/D209599
This commit is contained in:
Tom Ritter 2024-06-04 20:02:26 +00:00
parent 8e1d0b5319
commit e26694557f
7 changed files with 25 additions and 20 deletions
repo.diff.show_diff_stats Download patch file Download diff file Expand all files Collapse all files

2
docshell/base/nsAboutRedirector.cpp
View file

@ -108,7 +108,7 @@ static const RedirEntry kRedirMap[] = {
{"credits", "https://www.mozilla.org/credits/", {"credits", "https://www.mozilla.org/credits/",
nsIAboutModule::URI_SAFE_FOR_UNTRUSTED_CONTENT | nsIAboutModule::URI_SAFE_FOR_UNTRUSTED_CONTENT |
nsIAboutModule::URI_MUST_LOAD_IN_CHILD}, nsIAboutModule::URI_MUST_LOAD_IN_CHILD},
{"fingerprinting", {"fingerprintingprotection",
"chrome://global/content/usercharacteristics/usercharacteristics.html", "chrome://global/content/usercharacteristics/usercharacteristics.html",
nsIAboutModule::URI_SAFE_FOR_UNTRUSTED_CONTENT | nsIAboutModule::URI_SAFE_FOR_UNTRUSTED_CONTENT |
nsIAboutModule::HIDE_FROM_ABOUTABOUT | nsIAboutModule::ALLOW_SCRIPT | nsIAboutModule::HIDE_FROM_ABOUTABOUT | nsIAboutModule::ALLOW_SCRIPT |

2
docshell/build/components.conf
View file

@ -16,7 +16,7 @@ about_pages = [
'crashgpu', 'crashgpu',
'crashextensions', 'crashextensions',
'credits', 'credits',
'fingerprinting', 'fingerprintingprotection',
'httpsonlyerror', 'httpsonlyerror',
'license', 'license',
'logging', 'logging',

28
dom/security/nsContentSecurityUtils.cpp
View file

@ -1363,20 +1363,20 @@ void nsContentSecurityUtils::AssertAboutPageHasCSP(Document* aDocument) {
"about: page must contain a CSP denying object-src"); "about: page must contain a CSP denying object-src");
// preferences and downloads allow legacy inline scripts through hash src. // preferences and downloads allow legacy inline scripts through hash src.
MOZ_ASSERT(!foundScriptSrc || MOZ_ASSERT(
StringBeginsWith(aboutSpec, "about:preferences"_ns) || !foundScriptSrc || StringBeginsWith(aboutSpec, "about:preferences"_ns) ||
StringBeginsWith(aboutSpec, "about:settings"_ns) || StringBeginsWith(aboutSpec, "about:settings"_ns) ||
StringBeginsWith(aboutSpec, "about:downloads"_ns) || StringBeginsWith(aboutSpec, "about:downloads"_ns) ||
StringBeginsWith(aboutSpec, "about:fingerprinting"_ns) || StringBeginsWith(aboutSpec, "about:fingerprintingprotection"_ns) ||
StringBeginsWith(aboutSpec, "about:asrouter"_ns) || StringBeginsWith(aboutSpec, "about:asrouter"_ns) ||
StringBeginsWith(aboutSpec, "about:newtab"_ns) || StringBeginsWith(aboutSpec, "about:newtab"_ns) ||
StringBeginsWith(aboutSpec, "about:logins"_ns) || StringBeginsWith(aboutSpec, "about:logins"_ns) ||
StringBeginsWith(aboutSpec, "about:compat"_ns) || StringBeginsWith(aboutSpec, "about:compat"_ns) ||
StringBeginsWith(aboutSpec, "about:welcome"_ns) || StringBeginsWith(aboutSpec, "about:welcome"_ns) ||
StringBeginsWith(aboutSpec, "about:profiling"_ns) || StringBeginsWith(aboutSpec, "about:profiling"_ns) ||
StringBeginsWith(aboutSpec, "about:studies"_ns) || StringBeginsWith(aboutSpec, "about:studies"_ns) ||
StringBeginsWith(aboutSpec, "about:home"_ns), StringBeginsWith(aboutSpec, "about:home"_ns),
"about: page must not contain a CSP including script-src"); "about: page must not contain a CSP including script-src");
MOZ_ASSERT(!foundWorkerSrc, MOZ_ASSERT(!foundWorkerSrc,
"about: page must not contain a CSP including worker-src"); "about: page must not contain a CSP including worker-src");

7
toolkit/components/resistfingerprinting/RFPHelper.sys.mjs
View file

@ -118,7 +118,7 @@ class _RFPHelper {
UserCharacteristicsDataDone: { wantUntrusted: true }, UserCharacteristicsDataDone: { wantUntrusted: true },
}, },
}, },
matches: ["about:fingerprinting"], matches: ["about:fingerprintingprotection"],
remoteTypes: ["privilegedabout"], remoteTypes: ["privilegedabout"],
}); });
} }
@ -324,6 +324,11 @@ class _RFPHelper {
} }
_registerLetterboxingActor() { _registerLetterboxingActor() {
/*
* It turns out that this triggers a warning that we're registering a Desktop-only actor
* in toolkit (which will also run on mobile.) It just happens this actor only handles
* letterboxing, which isn't used on mobile, but we should resolve this.
*/
ChromeUtils.registerWindowActor("RFPHelper", { ChromeUtils.registerWindowActor("RFPHelper", {
parent: { parent: {
esModuleURI: "resource:///actors/RFPHelperParent.sys.mjs", esModuleURI: "resource:///actors/RFPHelperParent.sys.mjs",

2
toolkit/components/resistfingerprinting/UserCharacteristicsPageService.sys.mjs
View file

@ -169,7 +169,7 @@ export class UserCharacteristicsPageService {
}; };
let userCharacteristicsPageURI = Services.io.newURI( let userCharacteristicsPageURI = Services.io.newURI(
"about:fingerprinting" "about:fingerprintingprotection"
); );
browser.loadURI(userCharacteristicsPageURI, loadURIOptions); browser.loadURI(userCharacteristicsPageURI, loadURIOptions);

2
toolkit/components/resistfingerprinting/content/usercharacteristics.html
View file

@ -10,7 +10,7 @@
http-equiv="Content-Security-Policy" http-equiv="Content-Security-Policy"
content="default-src data: resource:; style-src-elem chrome:; object-src 'none'; script-src chrome:" content="default-src data: resource:; style-src-elem chrome:; object-src 'none'; script-src chrome:"
/> />
<title>about:fingerprinting</title> <title>about:fingerprintingprotection</title>
<link <link
href="chrome://global/content/usercharacteristics/usercharacteristics.css" href="chrome://global/content/usercharacteristics/usercharacteristics.css"

2
toolkit/components/resistfingerprinting/tests/browser/browser_usercharacteristics.js
View file

@ -16,7 +16,7 @@ function promiseObserverNotification() {
GleanPings.userCharacteristics.testBeforeNextSubmit(_ => { GleanPings.userCharacteristics.testBeforeNextSubmit(_ => {
submitted = true; submitted = true;
// Did we assign a value we got out of about:fingerprinting? // Did we assign a value we got out of about:fingerprintingprotection?
Assert.notEqual("", Glean.characteristics.canvasdata1.testGetValue()); Assert.notEqual("", Glean.characteristics.canvasdata1.testGetValue());
}); });
GleanPings.userCharacteristics.submit(); GleanPings.userCharacteristics.submit();