Only allow "about:" pages to have access to contentaccessible branding assets

Marking this as confidential, since I'm not sure how critical it is to keep nightly, alpha and release looking the same. But this was the aim of #42319 (closed), but there is a work-around.

Just add to a webpage

<link rel="stylesheet" href="chrome://branding/content/aboutDialog.css">
<div id="rightBox"></div>
<div id="trademark"></div>

and use computed style on #rightBox and #trademark to determine the difference. This works because the CSS is contentaccessible, which means it can be used for anything that isn't a document, including as a stylesheet.

Note this only distinguishes between the stable release and nightly/alpha, because they have different rules for only these two elements.

Technically, alpha has another rule for #rightBox:-moz-locale-dir(rtl) that nightly does not. However, I don't know of a way to access this rule. I think -moz-locale-dir never matches for HTML (rather than XUL), and I don't think it is possible to read the cross-origin CSSStyleSheet.cssRules. But maybe there is some other way.

I guess the solution would be to either:

1. Use the same CSS for each platform.
2. Make this CSS identical/empty on all platforms, but add the differences in some other non contentaccessible package. I.e. somewhere other than chrome://branding/content/. We can then do a similar thing with about-wordmark.svg to avoid the padding and right-to-left corrections.
3. Make all of chrome://branding/content/ non contentaccessible. I asked in the firefox developer chat if there is a good reason not to do this.

And do the same for mullvad in mullvad-browser#312 (closed).

/cc @pierov @thorin

added Desktop Fingerprinting labels

assigned to @henry

marked this issue as related to #42319 (closed)

The idea is that all the chrome:// and resource:// content won't be accessible at a certain point.

We have a MR for it, but we haven't merged it because of #41892.

Basically, leaking some information would help sanity checks on tests... The conditional entropy would be 0 for an attacker (there are other possibilities for feature detection), even though it'd become a way to tell for sure it's one of our browsers.

I don't like it, but it's the only way to have a sanity check.

I'm not sure why the sanity check is important. Couldn't you just select the browser you are testing with as part of the test. Why would it need to be automated?

In any case, we could always add some other contentaccessible resource to play this role directly in a way that doesn't overlap with other things we want to do, and we would have more control over. Then we could change our branding assets without having to worry about the implications.

In any case, we could always add some other contentaccessible resource to play this role directly in a way that doesn't overlap with other things we want to do, and we would have more control over.

Yeah, okay, works for me.

Then we can merge !684.

marked this issue as related to #29745

mentioned in issue mullvad-browser#312 (closed)

closed

mentioned in issue #43323 (closed)

reopened

added Doing label

mentioned in merge request !1333 (merged)

marked this issue as related to #43323 (closed)

marked this issue as related to #43459 (closed)

mentioned in issue #43459 (closed)

changed title from Distinguishing release channels, or branding to contentaccessible access to branding assets

changed title from contentaccessible access to branding assets to access to branding assets

marked this issue as related to #43461 (closed)

marked this issue as related to tor-browser-build#41348 (closed)

marked this issue as related to tor-browser-build#41347 (closed)

closed

added 14.5 stable All Platforms labels and removed Desktop label

made the issue visible to everyone

changed title from access to branding assets to Only allow "about:" pages to have access to contentaccessible branding assets

mentioned in issue #29745