[tbb-commits] [tor-browser/tor-browser-52.1.1esr-7.0-1] Bug 21684: Don't expose navigator.AddonManager to content

[gk at torproject.org]

commit 9de9d5a74472423e5a7e5754f5d93b2d89103dfe
Author: Georg Koppen <gk at torproject.org>
Date:   Fri May 26 19:18:32 2017 +0000

    Bug 21684: Don't expose navigator.AddonManager to content
    
    With https://bugzilla.mozilla.org/show_bug.cgi?id=1245571 support for
    websites to learn about installed add-ons landed. Currently, this is
    only enabled for AMO related sites but we don't think this functionality
    is something we want for Tor Browser as it might aid in fingerprinting
    users.
    
    The patch does not outright disable access to the API. Privileged code
    is still able to use it if needed. This should help with usability
    issues should they arise while mitigating possible fingerprinting and
    security problems by having this API available to content.
    
    This fixes bug 21684 by deleting the whitelist of URLs shipped with
    Firefox 52.
---
 toolkit/mozapps/extensions/AddonManagerWebAPI.cpp | 23 ++++-------------------
 1 file changed, 4 insertions(+), 19 deletions(-)

diff --git a/toolkit/mozapps/extensions/AddonManagerWebAPI.cpp b/toolkit/mozapps/extensions/AddonManagerWebAPI.cpp
index ca33f3a..45326fd 100644
--- a/toolkit/mozapps/extensions/AddonManagerWebAPI.cpp
+++ b/toolkit/mozapps/extensions/AddonManagerWebAPI.cpp
@@ -20,25 +20,10 @@ using namespace mozilla::dom;
 
 static bool
 IsValidHost(const nsACString& host) {
-  if (host.Equals("addons.mozilla.org") ||
-      host.Equals("discovery.addons.mozilla.org") ||
-      host.Equals("testpilot.firefox.com")) {
-    return true;
-  }
-
-  // When testing allow access to the developer sites.
-  if (Preferences::GetBool("extensions.webapi.testing", false)) {
-    if (host.LowerCaseEqualsLiteral("addons.allizom.org") ||
-        host.LowerCaseEqualsLiteral("discovery.addons.allizom.org") ||
-        host.LowerCaseEqualsLiteral("addons-dev.allizom.org") ||
-        host.LowerCaseEqualsLiteral("discovery.addons-dev.allizom.org") ||
-        host.LowerCaseEqualsLiteral("testpilot.stage.mozaws.net") ||
-        host.LowerCaseEqualsLiteral("testpilot.dev.mozaws.net") ||
-        host.LowerCaseEqualsLiteral("example.com")) {
-      return true;
-    }
-  }
-
+  // We don't want to allow content to get information about the state of the
+  // extensions a user has installed. This might aid in fingerprinting. And
+  // allowing content at all access to this kind of information seems
+  // potentially risky from a security point as well. Fixes bug 21684.
   return false;
 }