Skip to content

BB 41747: Spoof outer and screen measurements.

Pier Angelo Vendrame requested to merge pierov/tor-browser:41747-spoof-outer-screen into tor-browser-128.8.0esr-14.5-1

Merge Info

Issues

Resolves

  • #41747
  • mullvad-browser#xxxxx
  • tor-browser-build#xxxxx

Related

  • tor-browser#xxxxx
  • mullvad-browser#xxxxx
  • tor-browser-build#xxxxx

Merging

Target Branches

  • tor-browser - !fixups to tor-browser-specific commits, new features, security backports
  • base-browser and mullvad-browser - !fixups to base-browser-specific commits, new features to be shared with mullvad-browser, and security backports
    • ⚠️ IMPORTANT: Please list the base-browser-specific commits which need to be cherry-picked to the base-browser and mullvad-browser branches here

Target Channels

  • Alpha: esr128-14.5
  • Stable: esr128-14.0
  • Legacy: esr115-13.5

Backporting

Timeline

  • No Backport (preferred): patchset for the next major stable
  • Immediate: patchset needed as soon as possible (fixes CVEs, 0-days, etc)
  • Next Minor Stable Release: patchset that needs to be verified in nightly before backport
  • Eventually: patchset that needs to be verified in alpha before backport

(Optional) Justification

  • Security update: patchset contains a security fix (be sure to select the correct item in Timeline)
  • Censorship event: patchset enables censorship circumvention
  • Critical bug-fix: patchset fixes a bug in core-functionality
  • Consistency: patchset which would make development easier if it were in both the alpha and release branches; developer tools, build system changes, etc
  • Sponsor required: patchset required for sponsor
  • Localization: typos and other localization changes that should be also in the release branch
  • Other: please explain

Uplifting

  • Patchset is a candidate for uplift to Firefox

Issue Tracking

Review

Request Reviewer

  • Request review from an applications developer depending on modified system:
    • NOTE: if the MR modifies multiple areas, please /cc all the relevant reviewers (since Gitlab only allows 1 reviewer)
    • accessibility : henry
    • android : clairehurst, dan
    • build system : boklm
    • extensions : ma1
    • firefox internals (XUL/JS/XPCOM) : jwilde, ma1
    • fonts : pierov
    • frontend (implementation) : henry
    • frontend (review) : donuts, morgan
    • localization : henry, pierov
    • macOS : clairehurst, dan
    • nightly builds : boklm
    • rebases/release-prep : dan, ma1, pierov, morgan
    • security : jwilde, ma1
    • signing : boklm, morgan
    • updater : pierov
    • windows : jwilde, morgan
    • misc/other : pierov, morgan

Change Description

Break the equation inner == outer == screen == avail screen.

The reasons are:

  • some anti bot script will flag TB as a bot for this
  • we might be able to fool simple fingerprinting scripts

For outer, we add a constant and platform offset to the inner size to account for chrome, and, on Windows, for window decoration.

We measured the sizes on Firefox with DPR = 1: on Linux and macOS, the offset is 85px (the chrome height + the border to divide it from the content). On Windows, it's slightly bigger, and it has also a 16px difference on the horizontal direction.

As for the screen, we lie about it being one of full HD, 4k, or 8k (the smaller that is still bigger than inner window; notice that outer window is normally bigger than screen on maximized windows on Windows).

The available screen is the same, minus a platform-dependent offset: 32px on Linux (GNOME Shell's top bar), 48px (the taskbar on Windows 11, which is slightly bigger than Windows 10), and 110px on macOS (the top bar and the dock; we checked this size on macOS 10.15-14: it was 110px since 11, it's slightly smaller on 10.15, but of course we want to spoof the OS version).

Notice that for screen, we need to spoof both on JS and on CSS. So, I preferred doing math in app units, but it seems to work correctly also for the JS object (after adding the needed conversions). Also, notice that GetFullZoom in nsScreen is actually GetDeviceFullZoom in the media features (using GetFullZoom also there would provide different results).

We don't do anything on Android (so, we expect to keep the aforementioned equation valid).

I hope this doesn't trigger errors such as unused variable because of the various #ifdefs.

How Tested

Tested on Linux, both with DPR = 1, and with some simulated scaling with layout.css.devPixelsPerPx.

Compared the results I got on TZP with Firefox on an actual full HD screen.

Tested both with and without zoom (in particular, tested with values that give imperfect values, such as 110%).

Didn't test on other platforms, but it might make sense to cook a testbuild.

Merge request reports