1324044 - Fingerprinting resistance in pluginarray/mimetypesarray misses own prop names

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Boris Zbarsky [:bzbarsky]]

The checks added in bug 418986 didn't affect GetSupportedNames.

Comment 1

[Boris Zbarsky [:bzbarsky]]

Attachment: Add fingerprinting resistance in GetSupportedNames in nsMimeTypeArray and nsPluginArray

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/dcc7b0c683ce
Add fingerprinting resistance in GetSupportedNames in nsMimeTypeArray and nsPluginArray.  r=qdot

Comment 3

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/dcc7b0c683ce

Comment 4

[Arthur Edelstein [:arthur]]

[Tracking Requested - why for this release]:
Tor Browser will rely on 52ESR, and we would like to request including this patch (off by default in Firefox but on by default in Tor Browser).

Comment 5

[Boris Zbarsky [:bzbarsky]]

Please don't reopen bugs to request backports.  That's what the approval request flags on patches are for.

Comment 6

[Boris Zbarsky [:bzbarsky]]

In terms of being able to backport this, bug 1316619 _was_ done in time for 52, so that part is there.  But the patches for bug 1324035 aren't on 52, so "nsContentUtils::ResistFingerprinting(mozilla::dom::CallerType aCallerType)" doesn't exist, just the no-args version.  That will require a tiny bit of work to backport.

Comment 7

[Julien Cristau [:jcristau]]

I don't think I need to be tracking this.  Still happy to take an uplift for it up to early beta.

Comment 8

[Boris Zbarsky [:bzbarsky]]

Oh, but more to the point the general design of this patch involves backporting more of bug 1324035 in general....

Comment 9

[Boris Zbarsky [:bzbarsky]]

And that involves backporting some of bug 1316616 or restructuring how the patches in bug 1324035 work a bit.

I won't have time to do this before the uplift, for sure.  I may have time to review someone else's attempts to do this....

Comment 10

[Sylvestre Ledru [:Sylvestre]]

If nothing happens soon here, it is going to be => wontfix.