Alex Catarineu authored 5 years ago and Pier Angelo Vendrame committed 1 year ago

Whenever a valid Onion-Location HTTP header (or corresponding HTML
<meta> http-equiv attribute) is found in a document load, we either
redirect to it (if the user opted-in via preference) or notify the
presence of an onionsite alternative with a badge in the urlbar.

Kathleen Brade authored 5 years ago and Pier Angelo Vendrame committed 1 year ago

When Tor informs the browser that client authentication is needed,
temporarily load about:blank instead of about:neterror and prompt
for the user's key.

If a correctly formatted key is entered, use Tor's ONION_CLIENT_AUTH_ADD
control port command to add the key (via Torbutton's control port
module) and reload the page.

If the user cancels the prompt, display the standard about:neterror
"Unable to connect" page. This requires a small change to
browser/actors/NetErrorChild.jsm to account for the fact that the
docShell no longer has the failedChannel information. The failedChannel
is used to extract TLS-related error info, which is not applicable
in the case of a canceled .onion authentication prompt.

Add a leaveOpen option to PopupNotifications.show so we can display
error messages within the popup notification doorhanger without
closing the prompt.

Add support for onion services strings to the TorStrings module.

Add support for Tor extended SOCKS errors (Tor proposal 304) to the
socket transport and SOCKS layers. Improved display of all of these
errors will be implemented as part of bug 30025.

Also fixes bug 19757:
 Add a "Remember this key" checkbox to the client auth prompt.

 Add an "Onion Services Authentication" section within the
 about:preferences "Privacy & Security section" to allow
 viewing and removal of v3 onion client auth keys that have
 been stored on disk.

Also fixes bug 19251: use enhanced error pages for onion service errors.

On macOS we allow both portable mode and system installation.
However, in the latter case, we customize Firefox's directories to
match the hierarchy we use for the portable mode.

Also, display an informative error message if the TorBrowser-Data
directory cannot be created due to an "access denied" or a
"read only volume" error.

This commit makes Firefox look for the default profile directory in a
directory relative to the binary path.
The directory can be specified through the --with-relative-data-dir.
This is relative to the same directory as the firefox main binary for
Linux and Windows.

On macOS, we remove Contents/MacOS from it.
Or, in other words, the directory is relative to the application
bundle.

This behavior can be overriden at runtime, by placing a file called
system-install adjacent to the firefox main binary (also on macOS).

Bug 1796023 - Compare return value of readlink in nsLocalFileUnix::GetNativeTarget r=xpcom-reviewers,nika a=RyanVM

Differential Revision: https://phabricator.services.mozilla.com/D190987

Original Revision: https://phabricator.services.mozilla.com/D192639

Differential Revision: https://phabricator.services.mozilla.com/D192846

I'm guessing that it got moved into the wrong file for the Quantum DOM
split into CCJSContext and CCJSRuntime. The only use is in the latter
so it makes sense to have it there.

Original Revision: https://phabricator.services.mozilla.com/D192638

Differential Revision: https://phabricator.services.mozilla.com/D192845

These telemetry probes have long since expired, so remove them. This
avoids taking unnecessary timestamps in these functions, which we have
seen can be expensive on certain devices.

Original Revision: https://phabricator.services.mozilla.com/D185007

Differential Revision: https://phabricator.services.mozilla.com/D192116

Original Revision: https://phabricator.services.mozilla.com/D188240

Differential Revision: https://phabricator.services.mozilla.com/D188568

Differential Revision: https://phabricator.services.mozilla.com/D184580

Bug 1831467 - Avoid more UB from transmuting a ref to a ref with interior mutability. r=emilio, a=dsmith

aka one specific change in LLVM 16 introducing UB in Rust, take 3? 4?

This time, we have multiple types like:
  #[xpcom(implement(nsISomething))]
  struct Foo {
      foo: RefCell<Something>,
  }

  impl Foo {
      fn from_interface(obj: &nsISomething) -> &Self {
          unsafe { ::std::mem::transmute(obj) }
      }
  }

At first glance, this looks innocuous. But the problem is that
nsISomething, as far as LLVM is informed by Rust, is readonly,
but Foo, via the RefCell, has interious mutability.

LLVM ends up assuming that any mutability that happens to that returned
&Foo can't happen, and removes it.

This is yet another case where https://github.com/rust-lang/rust/issues/111229
would save our feet from this footgun LLVM 16 added and that the rust
compiler doesn't help us prevent the least.

Differential Revision: https://phabricator.services.mozilla.com/D183569
***
Bug 1831467 fix comment a=dsmith

Original Revision: https://phabricator.services.mozilla.com/D182711

Differential Revision: https://phabricator.services.mozilla.com/D183237

Original Revision: https://phabricator.services.mozilla.com/D181082

Differential Revision: https://phabricator.services.mozilla.com/D181365

It's not clear to me why specializing nsCOMPtr<nsISupports> is
particularly useful, and this removes a lot of code, bringing us closer
to unifying nsCOMPtr and RefPtr.

The changes in other places are needed because we used to allow
nsCOMPtr<nsISupports> to implicitly coerce to nsISupports even for
rvalue references.

     0:47.88 /home/emilio/src/moz/gecko-4/netwerk/protocol/http/nsHttpActivityDistributor.cpp:121:11: error: conversion function from 'nsCOMPtr<nsISupports>' to 'nsISupports *' invokes a deleted function
     0:47.88           nsCOMPtr<nsISupports>(do_QueryObject(channel)), aActivityType,
     0:47.88           ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     0:47.88 /home/emilio/src/moz/gecko-4/obj-debug/dist/include/nsCOMPtr.h:764:3: note: 'operator nsISupports *' has been explicitly marked deleted here
     0:47.88   operator T*() const&& = delete;
     0:47.88   ^
     0:47.88 /home/emilio/src/moz/gecko-4/netwerk/protocol/http/nsHttpActivityDistributor.cpp:29:57: note: passing argument to parameter 'aHttpChannel' here
     0:47.88 nsHttpActivityDistributor::ObserveActivity(nsISupports* aHttpChannel,
     0:47.88                                                         ^

Which is not allowed for a good reason, generally.

Differential Revision: https://phabricator.services.mozilla.com/D179124

This is not needed since bug 1363754. I left this as a follow-up
clean-up to mitigate a bit the risk of that change.

Differential Revision: https://phabricator.services.mozilla.com/D179123

Bug 1835135 [Linux] Allow to override DBus application name by MOZ_DBUS_APP_NAME env variable r=emilio

Depends on D179432

Differential Revision: https://phabricator.services.mozilla.com/D179433

Differential Revision: https://phabricator.services.mozilla.com/D179321

Differential Revision: https://phabricator.services.mozilla.com/D178626

The settings must be put into (path depends on architecture and branch):
/var/lib/flatpak/extension/org.mozilla.firefox.systemconfig/x86_64/stable/defaults/pref

Currently policies.json to be placed into:
/var/lib/flatpak/extension/org.mozilla.firefox.systemconfig/x86_64/stable/policies/policies.json

Differential Revision: https://phabricator.services.mozilla.com/D168803

clang is warning that C++20 expects comparison operators to be commutative: `a == b` and `b == a` should resolve to the same comparison operator function. Warnings about the comparison of const and non-const objects can be fixed by making the comparison operator function const.

xpcom/base/AvailableMemoryWatcherMac.cpp:404:14 [-Wambiguous-reversed-operator] ISO C++20 considers use of overloaded operator '==' (with operand types 'mozilla::MacMemoryPressureLevel' and 'mozilla::MacMemoryPressureLevel') to be ambiguous despite there being a unique best viable function
xpcom/base/AvailableMemoryWatcherMac.cpp:568:24 [-Wambiguous-reversed-operator] ISO C++20 considers use of overloaded operator '==' (with operand types 'mozilla::MacMemoryPressureLevel' and 'mozilla::MacMemoryPressureLevel') to be ambiguous despite there being a unique best viable function

Depends on D179024

Differential Revision: https://phabricator.services.mozilla.com/D179025

Differential Revision: https://phabricator.services.mozilla.com/D179097

Not sure whether this gives what we'd want on iOS, but at least it
builds.

Differential Revision: https://phabricator.services.mozilla.com/D179029

Differential Revision: https://phabricator.services.mozilla.com/D179014

Backed out changeset 56d084bfc8b8 (bug 675943)
Backed out changeset 8f514549a81c (bug 675943)
Backed out changeset 33fabcece85d (bug 675943)

Differential Revision: https://phabricator.services.mozilla.com/D175626

Bug 1834326 - Have different error messages for QuotaExceededError in media APIs. r=media-playback-reviewers,padenot

Differential Revision: https://phabricator.services.mozilla.com/D178683

Backed out 3 changesets (bug 1834222, bug 1834176) for causing RemoteProcessMonitor failures. CLOSED TREE

Backed out changeset 346d3a1568dd (bug 1834222)
Backed out changeset ea1d8b634bfc (bug 1834176)
Backed out changeset 74d1880272d3 (bug 1834176)

Bug 1834176 - Convert NetUtil.jsm to be an ES system module. r=arai,webdriver-reviewers,perftest-reviewers,valentin,extension-reviewers,devtools-reviewers,sync-reviewers,cookie-reviewers,robwu,afinder,whimboo

Differential Revision: https://phabricator.services.mozilla.com/D178589

This new API helps execute a function (2nd argument) and ensure that any thrown exception
will be associated against a given global (1st argument).

This is especially handy when any privileged code executes some content code.
Without such helper, the exception is thrown into the privileged global and loose
its original context and can no longer be associated with the content window it originates from.

It can also help associate pure-privileged exception to some particular content window.

Differential Revision: https://phabricator.services.mozilla.com/D167529

Bug 1826530 - Implement MessagePumpForNonMainUIThreads for mac. r=xpcom-reviewers,ipc-reviewers,mstange,nika

The MessagePump implemented here is a MessagePumpCFRunLoopBase that also handles
xpcom events.

Differential Revision: https://phabricator.services.mozilla.com/D175101

Backed out changeset 57876d77a652 (bug 1834176)
Backed out changeset ae2f0837b528 (bug 1834176)

Bug 1834176 - Convert NetUtil.jsm to be an ES system module. r=arai,webdriver-reviewers,perftest-reviewers,valentin,extension-reviewers,devtools-reviewers,sync-reviewers,cookie-reviewers,robwu,afinder,whimboo

Differential Revision: https://phabricator.services.mozilla.com/D178589

Backed out 4 changesets (bug 1826530) for causing build bustages in MessagePump_android.cpp CLOSED TREE

Backed out changeset 027080336f71 (bug 1826530)
Backed out changeset 2174d8d45249 (bug 1826530)
Backed out changeset fe9e6fccc2e6 (bug 1826530)
Backed out changeset 2534ba3f140f (bug 1826530)

Bug 1826530 - Implement MessagePumpForNonMainUIThreads for mac. r=xpcom-reviewers,ipc-reviewers,mstange,nika

The MessagePump implemented here is a MessagePumpCFRunLoopBase that also handles
xpcom events.

Differential Revision: https://phabricator.services.mozilla.com/D175101

Backed out changeset 02068c2fa1bc (bug 1810582) for causing bustages on nsConsoleService.cpp CLOSED TREE

Bug 1821963 part 3: Remove various components supporting the old accessibility architecture based on content process COM proxies. r=nlapre,nalexander

This includes AccessibleHandler, HandlerProvider, IGeckoCustom and the IAccessible2 COM proxy dll.
Even with the new architecture, we still use IAccessible2, but we no longer need a COM proxy because we aren't using COM across processes ourselves.
If clients want to use IAccessible2 across processes, they're responsible for registering a COM proxy themselves as with all other IAccessible2 applications.
Alternatively, they can rely on the IAccessible2 COM proxy which is included with Windows 10 and later.

Differential Revision: https://phabricator.services.mozilla.com/D177963

This new API helps execute a function (2nd argument) and ensure that any thrown exception
will be associated against a given global (1st argument).

This is especially handy when any privileged code executes some content code.
Without such helper, the exception is thrown into the privileged global and loose
its original context and can no longer be associated with the content window it originates from.

It can also help associate pure-privileged exception to some particular content window.

Differential Revision: https://phabricator.services.mozilla.com/D167529

Backed out changeset a92c62e304f0 (bug 1821963)
Backed out changeset da6cba0b0dd4 (bug 1821963)
Backed out changeset 4ed7ca0eb04a (bug 1821963)
Backed out changeset f2fba0ef15d9 (bug 1821963)
Backed out changeset 706e46fc2688 (bug 1821963)
Backed out changeset 6de2b9548dc6 (bug 1821963)

Bug 1821963 part 3: Remove various components supporting the old accessibility architecture based on content process COM proxies. r=nlapre,nalexander

This includes AccessibleHandler, HandlerProvider, IGeckoCustom and the IAccessible2 COM proxy dll.
Even with the new architecture, we still use IAccessible2, but we no longer need a COM proxy because we aren't using COM across processes ourselves.
If clients want to use IAccessible2 across processes, they're responsible for registering a COM proxy themselves as with all other IAccessible2 applications.
Alternatively, they can rely on the IAccessible2 COM proxy which is included with Windows 10 and later.

Differential Revision: https://phabricator.services.mozilla.com/D177963