[tor-bugs] #26764 [- Select a component]: HTTP proxy bug in Orbot 16.0.2-RC-1

[Tor Bug Tracker & Wiki]

#26764: HTTP proxy bug in Orbot 16.0.2-RC-1
--------------------------------------+--------------------
     Reporter:  soren@…               |      Owner:  (none)
         Type:  defect                |     Status:  new
     Priority:  Medium                |  Milestone:
    Component:  - Select a component  |    Version:
     Severity:  Normal                |   Keywords:
Actual Points:                        |  Parent ID:
       Points:                        |   Reviewer:
      Sponsor:                        |
--------------------------------------+--------------------
 I am the developer of Privacy Browser, a privacy focused Android browser.
 Privacy Browser has the option to proxy through Orbot.  A user recently
 brought to my attention that there is a bug in the HTTP proxy of Orbot
 16.0.2-RC-1 (downloaded from F-Droid) which causes all HTTP requests to
 fail.  HTTPS requests work fine.  Using Orbot in VPN mode works fine as
 long as Privacy Browser is not trying to proxy HTTP requests through port
 8118, otherwise they still fail.

 Downgrading Orbot to 16.0.0-RC-2-multi-SDK23 causes HTTP proxying to work
 correctly.

 Testing was performed using Privacy Browser 2.11 on a Pixel 2 XL running
 Android 8.1.0 (API 27).  Privacy Browser can be downloaded from F-Droid,
 but the current version, 2.11, is not yet available there.  It can be
 downloaded directly from:

 https://www.stoutner.com/privacy-browser/changelog/

 Versions prior to 2.11 used the old WebView proxying code and do not work
 with the changes Google recently made to WebView.  As such, they are not
 useful for testing this bug if the device has recently updated WebView.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/26764>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online