about:tor and about:tbupdate fail to load in debug build of Tor Browser

When using a debug build based on acat's 33533+5 branch, trying to open about:tor or about:tbupdate leads to an assertion failure and a tab crash: Assertion failure: foundObjectSrc (about: page must contain a CSP denying object-src), at /.../dom/security/nsContentSecurityUtils.cpp:818

We need to add object-src 'none' to the CSP for those pages.

Trac:
Parent Ticket: legacy/trac#33533 (moved)

added TorBrowserTeam202006R in Legacy / Trac component::applications/tor browser in Legacy / Trac owner::mcs in Legacy / Trac parent::33533 in Legacy / Trac priority::medium in Legacy / Trac reviewer::acat in Legacy / Trac severity::normal in Legacy / Trac sponsor::58-can in Legacy / Trac status::merge-ready in Legacy / Trac type::defect in Legacy / Trac labels

Trac:
Parent: N/A to legacy/trac#33533 (moved)

Mozilla added the assert as part of https://bugzilla.mozilla.org/show_bug.cgi?id=1499354

Here is a patch for Torbutton (about:tor): https://gitweb.torproject.org/user/brade/torbutton.git/commit/?h=bug34209-01&id=1e431540d2adee1adc770e964d6a8b447f4fa470

And here is one for tor-browser (as a fixup for the legacy/trac#16940 (moved) about:tbupdate patch): https://gitweb.torproject.org/user/brade/tor-browser.git/commit/?h=bug34209-01&id=6a7a3d5ffe341d3ea8b02a9508f18dc921f27ae1

Please review.

Trac:
Keywords: TorBrowserTeam202005 deleted, TorBrowserTeam202005R added
Status: assigned to needs_review

Looks good and works for me.

Trac:
Status: needs_review to merge_ready

Trac:
Reviewer: N/A to acat

Moving review tickets.

Trac:
Keywords: TorBrowserTeam202005R deleted, TorBrowserTeam202006R added

mentioned in issue legacy/trac#33533 (moved)

moved from legacy/trac#34209 (moved)

Torbutton changes landed on master (commit ff1557013e1ee3035b45565b96d54e46ef03266a) and as this is essentially affecting esr68 as well, I decided to put the tor-browser fix onto tor-browser-68.9.0esr-10.0-1 (commit 5102454cb075e8435b56e1e948a078864b7c8d5b). We probably could think using the Torbutton part in the next alpha as well and then backport the fix to stable if nothing explodes.

closed

Okay. I moved forward and created maint-10.0-alpha for the Torbutton we use in our next alpha build. And I picked the fix for this bug onto that branch as commit 1a5cedbe6b0a8cb3c9b37954ebda24385c9d9495.

reopened

closed

reopened

Testing the notifications.

Working!

closed

added Bug Merge Ready labels and removed 1 deleted label

mentioned in issue #33533 (closed)

removed 1 deleted label