diff --git a/browser/app/profile/firefox.js b/browser/app/profile/firefox.js index 621900f90fc1b38c2071667e8637649f9e5b2ccf..3eb46374b58230232851d076d04f7eefef3a2ff2 100644 --- a/browser/app/profile/firefox.js +++ b/browser/app/profile/firefox.js @@ -968,7 +968,7 @@ pref("privacy.panicButton.enabled", true); // Time until temporary permissions expire, in ms pref("privacy.temporary_permission_expire_time_ms", 3600000); -// Enables protection mechanism against password spoofing for cross domain auh requests +// Enables protection mechanism against password spoofing for cross domain auth requests // See bug 791594 pref("privacy.authPromptSpoofingProtection", true); @@ -2104,6 +2104,12 @@ pref("privacy.webrtc.sharedTabWarning", false); // before navigating to the actual meeting room page. Doesn't survive tab close. pref("privacy.webrtc.deviceGracePeriodTimeoutMs", 3600000); +// Enable including the content in the window title. +// PBM users might want to disable this to avoid a possible source of disk +// leaks. +pref("privacy.exposeContentTitleInWindow", true); +pref("privacy.exposeContentTitleInWindow.pbm", true); + // Start the browser in e10s mode pref("browser.tabs.remote.autostart", true); pref("browser.tabs.remote.desktopbehavior", true); diff --git a/browser/base/content/tabbrowser.js b/browser/base/content/tabbrowser.js index 678e923d5c86d28371a1dd01fecedeaba049bf76..5a1ab032f3dd039e3a12095a094c5a5f0fcc981d 100644 --- a/browser/base/content/tabbrowser.js +++ b/browser/base/content/tabbrowser.js @@ -102,6 +102,18 @@ true ); }); + XPCOMUtils.defineLazyPreferenceGetter( + this, + "_shouldExposeContentTitle", + "privacy.exposeContentTitleInWindow", + true + ); + XPCOMUtils.defineLazyPreferenceGetter( + this, + "_shouldExposeContentTitlePbm", + "privacy.exposeContentTitleInWindow.pbm", + true + ); if (AppConstants.MOZ_CRASHREPORTER) { ChromeUtils.defineModuleGetter( @@ -1072,6 +1084,19 @@ getWindowTitleForBrowser(aBrowser) { let docElement = document.documentElement; let title = ""; + let dataSuffix = + docElement.getAttribute("privatebrowsingmode") == "temporary" + ? "Private" + : "Default"; + let defaultTitle = docElement.dataset["title" + dataSuffix]; + + if ( + !this._shouldExposeContentTitle || + (PrivateBrowsingUtils.isWindowPrivate(window) && + !this._shouldExposeContentTitlePbm) + ) { + return defaultTitle; + } // If location bar is hidden and the URL type supports a host, // add the scheme and host to the title to prevent spoofing. @@ -1109,10 +1134,6 @@ title += tab.getAttribute("label").replace(/\0/g, ""); } - let dataSuffix = - docElement.getAttribute("privatebrowsingmode") == "temporary" - ? "Private" - : "Default"; if (title) { // We're using a function rather than just using `title` as the // new substring to avoid `$$`, `$'` etc. having a special @@ -1125,7 +1146,7 @@ ); } - return docElement.dataset["title" + dataSuffix]; + return defaultTitle; }, updateTitlebar() { diff --git a/browser/components/privatebrowsing/test/browser/browser_privatebrowsing_windowtitle.js b/browser/components/privatebrowsing/test/browser/browser_privatebrowsing_windowtitle.js index 3f71dd2586a8fbac881cfe12e9ccfa4d334e49a4..91851355bd477c1f004fb638436f0515579eb07e 100644 --- a/browser/components/privatebrowsing/test/browser/browser_privatebrowsing_windowtitle.js +++ b/browser/components/privatebrowsing/test/browser/browser_privatebrowsing_windowtitle.js @@ -107,4 +107,34 @@ add_task(async function test() { true, pb_about_pb_title ); + + await SpecialPowers.pushPrefEnv({ + set: [["privacy.exposeContentTitleInWindow.pbm", false]], + }); + await testTabTitle(await openWin(false), testPageURL, false, page_with_title); + await testTabTitle( + await openWin(true), + testPageURL, + true, + pb_page_without_title + ); + await SpecialPowers.pushPrefEnv({ + set: [ + ["privacy.exposeContentTitleInWindow", false], + ["privacy.exposeContentTitleInWindow.pbm", true], + ], + }); + await testTabTitle( + await openWin(false), + testPageURL, + false, + page_without_title + ); + // The generic preference set to false is intended to override the PBM one + await testTabTitle( + await openWin(true), + testPageURL, + true, + pb_page_without_title + ); });