Skip to content
GitLab
  • Menu
Projects Groups Snippets
  • /
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
  • Sign in
  • Tor Browser Tor Browser
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributors
    • Graph
    • Compare
  • Issues 681
    • Issues 681
    • List
    • Boards
    • Service Desk
    • Milestones
  • Merge requests 1
    • Merge requests 1
  • Deployments
    • Deployments
    • Releases
  • Monitor
    • Monitor
    • Incidents
  • Analytics
    • Analytics
    • Value stream
    • Repository
  • Wiki
    • Wiki
  • Activity
  • Graph
  • Create a new issue
  • Commits
  • Issue Boards
Collapse sidebar
  • The Tor Project
  • Applications
  • Tor BrowserTor Browser
  • Issues
  • #18101
Closed
Open
Created Jan 19, 2016 by Trac@tracbot

IP leak from Windows/macOS UI dialog with URI

It is possible for the client IP to leak from the browser and onto the network via the Windows API when prompted with Windows dialog box to select files.

Not entirely sure if this is a bug, but should at least be documented.

Steps to reproduce:

  1. Visit a website that provides an upload box.
  2. Instead of selecting a file, paste a URI as a file name.
  3. The IP is leaked.

This may potentially work with Ctrl+O (Open File) and Ctrl+S (Save Page As).

Tested on Windows 7 and verified with Wireshark.

Trac:
Username: uileak

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information
Assignee
Assign to
Time tracking