ensure that CSS4 system colors are not a fingerprinting vector

From #33534 (closed): Firefox 76 added support for CSS4 system colors. It looks like these were not added to https://searchfox.org/mozilla-central/source/widget/nsXPLookAndFeel.cpp#534 (GetStandinForNativeColor()). We should test the behavior and consider updating the system colors to Windows 10 and MacOS 10.10.x.

https://bugzilla.mozilla.org/show_bug.cgi?id=1590894
"Need to support CSS4 system colors"

changed milestone to %Tor Browser: 10.0

added Fingerprinting + 1 deleted label

removed milestone %Tor Browser: 10.0

edit: updated March 2021: links and info

test: https://arkenfox.github.io/TZP/tzp.html#css .. click the count [7] to see details in the console

3900ddea19449a8174058383c32dc40b2e31b9a2

• Windows TB10.5a11
• Windows FF88 + RFP-on (it's different with RFP off: LinkText:rgb(0, 0, 238) changes)
• Android TB stable + nightly
• Android FF88 + RFP-on

​0: "ActiveText:rgb(238, 0, 0)"
​1: "Canvas:rgb(255, 255, 255)"
​2: "CanvasText:rgb(0, 0, 0)"
​3: "Field:rgb(255, 255, 255)"
​4: "FieldText:rgb(0, 0, 0)"
​5: "LinkText:rgb(0, 102, 204)"
​6: "VisitedText:rgb(85, 26, 139)"
​```

Aliases
```js
#[parse(aliases = "-moz-activehyperlinktext")]
Activetext,
#[parse(aliases = "-moz-default-background-color")]
Canvas,
#[parse(aliases = "-moz-default-color")]
Canvastext,
#[parse(aliases = "-moz-field")]
Field,
#[parse(aliases = "-moz-fieldtext")]
Fieldtext,
#[parse(aliases = "-moz-hyperlinktext")]
Linktext,
#[parse(aliases = "-moz-visitedhyperlinktext")]
Visitedtext,

[1] https://searchfox.org/mozilla-central/rev/1a47a74bd5ba89f2474aa27c40bd478e853f3276/servo/components/style/values/specified/color.rs#151

These are all aliased to RFP protected colors AFAICT. Would be nice for some Linux (to save me firing up some VMs) and Mac results. Just compare to the hash above. You should be all good, and we can close this

@gk for linux , @mcs for mac

Tor Browser 10.0.15 running on macOS 10.15.7 also results in 3900ddea19449a8174058383c32dc40b2e31b9a2.

Hmmm ... so I was just revisiting https://searchfox.org/mozilla-central/source/dom/canvas/test/test_bug1485266.html ...

Five of the nine CCS4 items are configured via Tools -> Options -> Content -> Colors <-- emilio's patch a few days ago

• FF93+ : hardcoded SelectedItem and SelectedItemText 1693222
• hardcoded Field and FieldText (always have been)

But these items below are not "protected" by RFP's stand-ins

	"-moz-activehyperlinktext" = Activetext,
	"-moz-default-background-color" = Canvas
	"-moz-default-color" = Canvastext
	"-moz-hyperlinktext" = Linktext
	"-moz-visitedhyperlinktext" = Visitedtext

I think they're the same for everyone if you don't use system colors (which is the default): which seems to be born out by mac/windows/android being the same

// [SETTING] General>Language and Appearance>Fonts and Colors>Colors>Use system colors
user_pref("browser.display.use_system_colors", false); // [DEFAULT: false]

Maybe emilio could confirm and tom could tighten that up?

added 1 deleted label and removed 1 deleted label

mentioned in issue #40656

removed 1 deleted label

added Icebox label

added Backlog ~95597 + 1 deleted label

removed Icebox label

changed milestone to %Sponsor 131 - Phase 3 - Major ESR 102 Migration

https://www.w3.org/TR/css-color-4/#typedef-system-color ... the list has grown... e.g. AccentColor, AccentColorText were added FF103 - and leaks on Android (and Linux, IDK about the others) but these are not leaked at least with browser.display.use_system_colors = false (they change visually in web content)

added Sponsor 131 label

added Roadmap::Future label and removed Backlog label

removed Roadmap::Future label

assigned to @richard

added Doing Q4 labels

4deab2566e61bb0c91e603b53cca0edbff373a3d on both Linux and macOS. Will post an MR with this pref set to false (default for now but who knows about the future eh?)

the CCS4 spec keeps changing - https://www.w3.org/TR/css-color-4/#typedef-system-color (19 items)

https://arkenfox.github.io/TZP/tzp.html#css - TZP test is currently matches (19 + 5 -moz aliases/equivalents) - see https://github.com/arkenfox/TZP/blob/ed7a018dbdf38d54d9b5773017315c20be89e60b/js/css.js#L16-L21

• the test only reports the colors of those properties supported, so on windows FF107 for example, three of those 19 are missing (ButtonBorder, Mark, MarkText)

I no longer know what is and isn't covered by RFP anymore. The only set I know for sure is covered is the stand-ins set. The rest, I know there are values not covered, and that browser.display.use_system_colors = false helps mitigate this (even beyond RFP I think), but not all: my gut feeling is that there are still just the five, listed way up there in this issue somewhere - oh, here it is - #40057 (comment 2754349)

arkenfox says

/* 4510: disable using system colors
 * [SETTING] General>Language and Appearance>Fonts and Colors>Colors>Use system colors ***/
user_pref("browser.display.use_system_colors", false); // [DEFAULT: false NON-WINDOWS]

default false non-windows ... are we enforcing this in windows in 00prefs.js or wherever ? I hope so @pierov

pushed pref change in 58364b04

// Bug 40057: Ensure system colors are not used for CSS4 colors

I'm not sure that description is entirely accurate, but let's not split hairs

Umm, just noticed this was closed. CSS4 is still fingerprintable, please re-open

Wait I thought that was the whole point of the browser.display.use_system_colors pref ?

I no longer know 100%, TBH. RFP only covers stand-ins. The pref browser.display.use_system_colors from my experience seems to cover the rest: it depends on your OS and theming/system colors, obviously. And I'm kinda stock windows and nothing really changes. For example, RFP off in Firefox, the only change for all colors with the pref = false was LinkText + it's alias -moz-hyperlinktext (which happens to be one of those new CSS4 ones - see, the pref was needed - thank goodness for arkenfox )

The whole thing needs testing. The test is built (TZP). Take each OS, change the system colors to everything a different result, as much as possible. Record results. Then apply RFP + record results. Then apply browser.display.use_system_colors = false and record results. Get numerous TB users on ESR102 to return some css color results. Hopefully we've covered it (except I still think some colors are not covered, sorry - and I think some are CSS4)

If you want to close this one, and open a new ticket to follow up on overall CSS color FPing, go ahead

[1] https://bugzilla.mozilla.org/show_bug.cgi?id=1603332#c2

tl;dr: needs tests

Leaving this open and punting deeper investigation to after FF102-esr

mentioned in merge request !380 (merged)