[tor-bugs] #30429 [Applications/Tor Browser]: Rebase Tor Browser patches for Firefox ESR 68

[Tor Bug Tracker & Wiki]

#30429: Rebase Tor Browser patches for Firefox ESR 68
-------------------------------------------------+-------------------------
 Reporter:  gk                                   |          Owner:  tbb-
                                                 |  team
     Type:  task                                 |         Status:
                                                 |  needs_review
 Priority:  Very High                            |      Milestone:
Component:  Applications/Tor Browser             |        Version:
 Severity:  Normal                               |     Resolution:
 Keywords:  ff68-esr, tbb-9.0-must-alpha,        |  Actual Points:
  TorBrowserTeam201909R                          |
Parent ID:                                       |         Points:  1
 Reviewer:                                       |        Sponsor:
                                                 |  Sponsor44-can
-------------------------------------------------+-------------------------
Changes (by acat):

 * keywords:  ff68-esr, tbb-9.0-must-alpha, TorBrowserTeam201909 =>
     ff68-esr, tbb-9.0-must-alpha, TorBrowserTeam201909R
 * status:  needs_revision => needs_review


Comment:

 Replying to [comment:64 gk]:
 > Replying to [comment:8 acat]:
 >
 > [snip]
 >
 > > == [DROP? might not be needed -> check]
 > > {{{
 > > + 988d41acfaca Bug 26456: HTTP .onion sites inherit previous page's
 certificate information
 > > }}}
 >
 > That's not clear yet, probably we don't need it. However, the current
 state of our rebased .onion security expectations needs improvements.
 Right now if you load an http:// .onion (you could pick one from
 https://onion.torproject.org) the proper icon is shown in the URL bar.
 But: clicking on the info box shows that the connection is not secure
 which is a regression to the stable series. `URICanBeConsideredSecure()`
 (in security/manager/ssl/nsSecureBrowserUIImpl.cpp) seems to be suspicious
 here as it does not care about .onion or not.

 Fixup in https://github.com/acatarineu/tor-browser/commit/30429+10. Not
 sure what I saw while rebasing, but clearly changing
 `URICanBeConsideredSecure` was necessary but not sufficient :)

 I also realized that the "mixed onion" icon was not being shown properly
 and marked as secure, so I also had to change
 `nsDocShell::GetAllowMixedContentAndConnectionData`.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/30429#comment:72>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online