[tor-bugs] #31985 [Applications/Tor Browser]: Check that Intl.RelativeTimeFormat does no leak the user agent locale

[Tor Bug Tracker & Wiki]

#31985: Check that Intl.RelativeTimeFormat does no leak the user agent locale
-------------------------------------------------+-------------------------
 Reporter:  gk                                   |          Owner:  tbb-
                                                 |  team
     Type:  defect                               |         Status:  closed
 Priority:  Medium                               |      Milestone:
Component:  Applications/Tor Browser             |        Version:
 Severity:  Normal                               |     Resolution:  fixed
 Keywords:  tbb-fingerprinting-locale,           |  Actual Points:  0.25
  TorBrowserTeam201910                           |
Parent ID:                                       |         Points:  0.1
 Reviewer:                                       |        Sponsor:
-------------------------------------------------+-------------------------
Changes (by gk):

 * status:  new => closed
 * resolution:   => fixed
 * actualpoints:   => 0.25


Comment:

 The feature got actually implemented in
 https://bugzilla.mozilla.org/show_bug.cgi?id=1270140.

 We should be good here due to the work that landed in
 https://bugzilla.mozilla.org/show_bug.cgi?id=1409973, where the locale of
 the JS runtime can be spoofed in a way that always `en-US` is given back
 if resist fingerprinting is enabled.

 I double-checked that on Linux by modifying the MDN example a bit, so that
 the code falls back to the default locale:
 {{{
 var rtf1 = new Intl.RelativeTimeFormat({ style: 'narrow' });
 }}}
 gives me a localized value if I don't have spoofing enabled but correctly
 give `en-US` values back otherwise.

 A cursory code inspection showed as well that the locale of the JS context
 is queried (https://searchfox.org/mozilla-
 esr68/source/js/src/builtin/intl/RelativeTimeFormat.cpp#208) which points
 to the JS runtime (https://searchfox.org/mozilla-
 esr68/source/js/src/vm/JSContext.h#262), which in turn gets the proper
 default locale in https://searchfox.org/mozilla-
 esr68/source/js/xpconnect/src/XPCLocale.cpp#117.

 So we are good here.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/31985#comment:1>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online