1382499 - Touch API leaks absolute screen coordinates

Status: RESOLVED FIXED

(Core :: DOM: Events, enhancement, P3)

Description

[Arthur Edelstein [:arthur]]

In Tor Browser we currently disable the Touch API, but we also have defense-in-depth patches to prevent absolute screen coordinates from being leaked to scripts. Here are the current patches:

https://torpat.ch/10286

We would like to propose uplifting these patches.

Comment 1

[Chung-Sheng Fu [:cfu]]

Attachment: Bug 1382499 - Enhance fingerprinting resistance for Touch API

Review commit: https://reviewboard.mozilla.org/r/162970/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/162970/

Comment 2

[Chung-Sheng Fu [:cfu]]

According to the Tor patch, I modified RadiusX, RadiusY, RotationAngle, Force, and the webidl with the same implementation as ScreenX, ScreenY.
However, they are not only accessed through webidl so there is not always a caller type.

For equality test,
- mozilla::dom::Touch::Equals
http://searchfox.org/mozilla-central/source/dom/events/Touch.cpp#187-190
I compare the members directly.

For other accesses,
- DispatchPointerFromMouseOrTouch
http://searchfox.org/mozilla-central/source/layout/base/PresShell.cpp#7101-7102
- mozilla::MultiTouchInput::MultiTouchInput
http://searchfox.org/mozilla-central/source/widget/InputData.cpp#133-136
I just pass CallerType::System.

Will this cause any problem?

Comment 3

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 8891935 [details]
Bug 1382499 - Enhance fingerprinting resistance for Touch API

https://reviewboard.mozilla.org/r/162970/#review168354

::: dom/events/Touch.cpp:167
(Diff revision 1)
>  
> +int32_t
> +Touch::RadiusX(CallerType aCallerType) const
> +{
> +  if (nsContentUtils::ResistFingerprinting(aCallerType)) {
> +    return 1;

Why 1 and not 0?  The spec seems to call out 0 as the "not known" value...

Someone familiar with the touch API should probably review this value.

Comment 4

[Chung-Sheng Fu [:cfu]]

We need your expertise to help us clarify if it is proper to use the value 1 for radiusX/radiusY in order to resist fingerprinting.
Thank you very much.

Comment 5

[Olli Pettay [:smaug][[e-mail]]]

0 should be used when radius isn't known.
https://w3c.github.io/touch-events/#dom-touch-radiusx

Comment 6

[Chung-Sheng Fu [:cfu]]

Attachment: Bug 1382499 - Fix typo in testing/mochitest/tests/SimpleTest/EventUtils.js

Review commit: https://reviewboard.mozilla.org/r/164312/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/164312/

Comment 7

[Chung-Sheng Fu [:cfu]]

Attachment: Bug 1382499 - Add test cases

Review commit: https://reviewboard.mozilla.org/r/164314/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/164314/

Comment 8

[Chung-Sheng Fu [:cfu]]

Comment on attachment 8891935 [details]
Bug 1382499 - Enhance fingerprinting resistance for Touch API

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/162970/diff/1-2/

Comment 9

[Chung-Sheng Fu [:cfu]]

Arthur also agrees with that it is more reasonable to spoof radiusX/radiusY with 0, so I updated the patch and changed the return values.

The test is ready as well.
Please note that in the original Tor patch, it compares touch.radiusX/radiusY to touchParams.rx/ry when privacy.resistFingerprinting = false.
In my local test, however, I always get different values.
For example, we have rx = 2 and ry = 3 in touchParams but in the Touch object, the values are radiusX = 4 and radiusY = 6.
It seems that AppUnitsPerDevPixel leads to this result.
So I guess it is machine-dependent and modified the test so that it only checks if radiusX and radiusY are correctly spoofed when privacy.resistFingerprinting = true.

Comment 10

[Olli Pettay [:smaug][[e-mail]]]

Comment on attachment 8893269 [details]
Bug 1382499 - Fix typo in testing/mochitest/tests/SimpleTest/EventUtils.js

https://reviewboard.mozilla.org/r/164312/#review169898

Comment 11

[Arthur Edelstein [:arthur]]

Comment on attachment 8891935 [details]
Bug 1382499 - Enhance fingerprinting resistance for Touch API

https://reviewboard.mozilla.org/r/162970/#review171930

Comment 12

[Arthur Edelstein [:arthur]]

Comment on attachment 8893270 [details]
Bug 1382499 - Add test cases

https://reviewboard.mozilla.org/r/164314/#review171934

Comment 13

[Olli Pettay [:smaug][[e-mail]]]

Comment on attachment 8893270 [details]
Bug 1382499 - Add test cases

https://reviewboard.mozilla.org/r/164314/#review172240

Comment 14

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/1dcdc22d4919
Enhance fingerprinting resistance for Touch API r=arthuredelstein,bz
https://hg.mozilla.org/integration/autoland/rev/c25b50b0edc5
Fix typo in testing/mochitest/tests/SimpleTest/EventUtils.js r=smaug
https://hg.mozilla.org/integration/autoland/rev/0ebb9924affa
Add test cases r=arthuredelstein,smaug

Comment 15

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

Backed out for eslint failures like https://treeherder.mozilla.org/logviewer.html#?job_id=122635957&repo=autoland

https://hg.mozilla.org/integration/autoland/rev/c4965deefa3b5946753796c10388ff2b48242c4b

Comment 16

[Chung-Sheng Fu [:cfu]]

Comment on attachment 8893270 [details]
Bug 1382499 - Add test cases

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/164314/diff/1-2/

Comment 17

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/0175751964b5
Enhance fingerprinting resistance for Touch API r=arthuredelstein,bz
https://hg.mozilla.org/integration/autoland/rev/927e576d7971
Fix typo in testing/mochitest/tests/SimpleTest/EventUtils.js r=smaug
https://hg.mozilla.org/integration/autoland/rev/79d10d864775
Add test cases r=arthuredelstein,smaug

Comment 18

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/0175751964b5
https://hg.mozilla.org/mozilla-central/rev/927e576d7971
https://hg.mozilla.org/mozilla-central/rev/79d10d864775