[tor-bugs] #15599 [Applications/Tor Browser]: Range requests used by pdfjs are not isolated to URL bar domain

[Tor Bug Tracker & Wiki]

#15599: Range requests used by pdfjs are not isolated to URL bar domain
-------------------------------------------------+-------------------------
 Reporter:  gk                                   |          Owner:
                                                 |  pospeselr
     Type:  defect                               |         Status:
                                                 |  needs_information
 Priority:  High                                 |      Milestone:
Component:  Applications/Tor Browser             |        Version:
 Severity:  Normal                               |     Resolution:
 Keywords:  tbb-linkability,                     |  Actual Points:
  TorBrowserTeam201802R                          |
Parent ID:                                       |         Points:
 Reviewer:                                       |        Sponsor:
-------------------------------------------------+-------------------------

Comment (by pospeselr):

 Replying to [comment:17 mcs]:
 > I assume this is the code that is overriding the settings for
 `pdfjs.disableRange` when placed in `000-tor-browser.js`:
 > https://dxr.mozilla.org/mozilla-
 esr52/source/browser/extensions/pdfjs/content/PdfJs.jsm#79

 Yep exactly, this code goes in and overwrites the preference unless it's
 been set by a user, so updating the default system preference does nothing
 in 000-tor-browser.js just gets blown away.

 > How bad is performance when loading a large PDF with this change in
 place? I assume "time to first page display" increases significantly.

 Entirely dependent on how large the pdf is that you're trying to download,
 and how fast your circuit is.  Fortunately there is a progress bar in the
 pdf UI indicating the load progress, so it doesn't look like the browser
 is just hanging.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/15599#comment:18>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online