[tor-bugs] #9308 [Firefox Patch Issues]: JavaScript's BrowserFeedWriter() leaks installation paths on OS X and Windows

[Tor Bug Tracker & Wiki]

#9308: JavaScript's BrowserFeedWriter() leaks installation paths on OS X and
Windows
-------------------------------------+-------------------------------------
     Reporter:  cypherpunks          |      Owner:  mikeperry
         Type:  defect               |     Status:  needs_review
     Priority:  critical             |  Milestone:
    Component:  Firefox Patch        |    Version:
  Issues                             |   Keywords:  tbb-fingerprinting,
   Resolution:                       |  tbb-easy, interview,
Actual Points:                       |  GeorgKoppen201404R
       Points:                       |  Parent ID:
-------------------------------------+-------------------------------------

Comment (by arthuredelstein):

 Replying to [comment:14 gk]:
 > Replying to [comment:11 arthuredelstein]:
 > > 1. In the former patch, I was trying to turn on precompilation of the
 startup cache, a step in `make package`. When the startup cache is
 precompiled, it masks file:// URLs and provides resource:// URLs instead.
 Unfortunately, I discovered that precompilation simply doesn't work when
 the build is cross compiled, because in order to cross compile, we need a
 native version of xpcshell. In order to get this native version, we would
 need to run a separate native linux build of mozilla-central. This seemed
 awkward and unnecessarily slow.
 >
 > Why mozilla-central?

 Sorry, I should have said tor-browser.git

 > So, if we are building a new release we compile linux builds anyway.
 Wouldn't it be much easier if we would save xpcshell from there and use
 that one for precompilation of the startup cache? I we could get that to
 work I'd be very happy as we like to get all patches somehow merged into
 mozilla-central and I fear it would be really hard to convince Mozilla to
 take your latest patch given a) that they don't have the problem and b)
 that the issue is not really providing that information in the exception
 but rather that we miss a sanitizing step due to our build setup.

 I think you're absolutely right. I'm going to try to get the native
 xpcshell approach to work. Thanks for pointing me in the right direction.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/9308#comment:15>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online