GitLab

It looks like there have been several browser security improvements to
prevent CSRF attacks. Chrome and Firefox now require cross-site cookies
to have the secure and samesite attributes set.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#samesite_attribute
https://www.chromium.org/updates/same-site

This clients variable was never updated. The actual counter of clients is the
length of Snowflake.proxyPairs, wich is used in other places to check that we
are not exceeding the maximum number of clients.

Client number is rounded down to 8. Currently the webextension doesn't
support more than one client, and the client counter is actually never
updated internally. So this code effectively always returns 0.

Related to snowflake#40048

From https://github.com/advisories/GHSA-6fc8-4gx4-v693

Only affects ws servers, which aren't used here so a release isn't
necessary.

The breaking changes between major versions 3 - 5 seem fine.

For https://github.com/advisories/GHSA-ww39-953v-wcq6

Only affects a dev dependency.

There's a low severity vuln in one of cldr's deps that needs updating.
The major version bump of cldr is because it drops support for node.js
v8, which is EOL.

The dependencies are packages used in the shim while the node version of
the proxy is running.  cldr is only used when running the build script.

This was done with `npm i cldr --save-dev`

Part of #7

On the next line 'en_US' is pushed unconditionally.

Part of #12

We can always remove this if transifex is ever updated to stop producing
these unnecessary translations.

This consolidates it from either a Set or an object literal to just a
Map in all cases.

Fixes #21

This fixes two bugs in the NAT update process:
- one bug wasn't updating the NAT type we advertize to the broker
- one bug passed an already evaluated function to setTimeout

Only set the NAT type to restricted after we fail to connect to a
restricted client 3 times in a row.

If a previous NAT check has succeeded and we fail to contact the probe
server, do not set the NAT type to unknown. Most proxies will probably
not change their NAT type frequently, so this will prevent an outage of
the probe service from wiping out our unrestricted proxy pool.

Fixes #18

Since this keeps dirtying the tree.

These are taken from,
https://commons.wikimedia.org/wiki/File:Firefox_logo,_2019.svg
https://commons.wikimedia.org/wiki/File:Google_Chrome_icon_(September_2014).svg

which the current project pages on English Wikipedia are referencing.

Issue: #8

Trac is now redirected to gitlab, so the image isn't rendering on
snowflake.tpo

This fixes a bug whether proxies behind unrestricted NATs appeared
restricted because they were sending an offer to the probe service
without any ice candidates.

Make a test connection to the symmetrically NAT'd probe site to
determine NAT type. This replaces the previous method of getting
ICE candidates from two different STUN servers and more
definitively determines compatability with a symmetrically NAT'd
client.

This brings in the bug-reporting instructions from #14 (bbf3629e).

Decrease the wait time between proxy polls and the poll adjustment so
that we have more proxies available for the increased client load.

We need to extract the remote address of the client to pass along to the
bridge. This adds an extra check to see whether the retrieved address is
a remote address (as opposed to local, loopback, or unspecified). It
also expands the SDP regexes to check for addresses in the ice
candidates.

This fixes issue #16