[tbb-commits] [torbutton/maint-1.9.5] Bug 18589: Clear site security settings during New Identity

[gk at torproject.org]

commit 3c04ec4654270f2896db0efffc4bc72edc2e3018
Author: Georg Koppen <gk at torproject.org>
Date:   Fri Aug 26 11:30:19 2016 +0000

    Bug 18589: Clear site security settings during New Identity
    
    We need to clear site security settings (like HSTS) explicitely now
    as they don't belong to the permissions manager anymore.
---
 src/chrome/content/torbutton.js | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/src/chrome/content/torbutton.js b/src/chrome/content/torbutton.js
index 3256335..311c6f6 100644
--- a/src/chrome/content/torbutton.js
+++ b/src/chrome/content/torbutton.js
@@ -1696,7 +1696,8 @@ function torbutton_new_identity() {
  *      h. last open location url
  *      i. clear content prefs
  *      j. permissions
- *      k. IndexedDB and asmjscache storage
+ *      k. site security settings (e.g. HSTS)
+ *      l. IndexedDB and asmjscache storage
  *   3. Sends tor the NEWNYM signal to get a new circuit
  *   4. Opens a new window with the default homepage
  *   5. Closes this window
@@ -1799,16 +1800,21 @@ function torbutton_do_new_identity() {
   m_tb_prefs.setIntPref("security.OCSP.enabled", 0);
   m_tb_prefs.setIntPref("security.OCSP.enabled", ocsp);
 
-  // This clears the STS cache and site permissions on Tor Browser
+  // This clears the site permissions on Tor Browser
   // XXX: Tie to some kind of disk-ok pref?
   try {
       Services.perms.removeAll();
   } catch(e) {
       // Actually, this catch does not appear to be needed. Leaving it in for
       // safety though.
-      torbutton_log(3, "Can't clear STS/Permissions: Not Tor Browser: "+e);
+      torbutton_log(3, "Can't clear permissions: Not Tor Browser: "+e);
   }
 
+   // Clear site security settings
+   let sss = Cc["@mozilla.org/ssservice;1"].
+     getService(Ci.nsISiteSecurityService);
+   sss.clearAll();
+
   // This clears the undo tab history.
   var tabs = m_tb_prefs.getIntPref("browser.sessionstore.max_tabs_undo");
   m_tb_prefs.setIntPref("browser.sessionstore.max_tabs_undo", 0);