[tor-bugs] #13670 [Tor Browser]: ensure OCSP & favicons respect URL bar domain isolation

[Tor Bug Tracker & Wiki]

#13670: ensure OCSP & favicons respect URL bar domain isolation
---------------------------------+---------------------------------------
     Reporter:  arthuredelstein  |      Owner:  arthuredelstein
         Type:  defect           |     Status:  needs_revision
     Priority:  normal           |  Milestone:
    Component:  Tor Browser      |    Version:
   Resolution:                   |   Keywords:  tbb-linkability, ff38-esr
Actual Points:                   |  Parent ID:
       Points:                   |
---------------------------------+---------------------------------------

Comment (by gk):

 Replying to [comment:28 mikeperry]:
 > The favicon portion of this patch checks and sets an nsINode attribute
 that specifies the first party. I believe this can be abused by content to
 set its own attributes to circumvent our domain isolation.
 >
 > I also feel that the OCSP cache isolation is too invasive - it touches
 too many pieces of the code. This patch seems very unlikely to be taken by
 Mozilla. We need to find a less invasive way of isolating the OCSP cache
 and requests.
 >
 > So that #13766 can still move forward, I pushed a Torbutton commit that
 keeps the circuit dirty timeout at 10 minutes for requests that we can't
 find a first party for.

 That's very unfortunate. While I agree we should not take the patches in
 this bug having different timeouts for different circuits depending on the
 load might reveal quite a bit of information which makes me quite
 uncomfortable. Not sure how much yet though and how serious this is as I
 currently can't think clearly about it due to last minute stress :-/

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/13670#comment:30>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online