1426413 - Setting privacy.resistFingerprinting changes browser accepted languages without prompting the user

Status: RESOLVED INVALID

(Core :: DOM: Security, defect, P2)

Description

[Eduardo Trápani]

In order to reproduce, download a localized version of Firefox 59 (let's say 'eo') and run it in a clean profile. Go to Wikipedia and you will get the right version, the one corresponding to the chosen localized version.

Now, go to about:config and set privacy.resistFingerprinting to true.

Reload Wikipedia, you will get the English version! On top of that, the accepted language will be set to en, en-US, without ever prompting the user, overwriting whatever the previous value was (either the default from the localized version, or a list modified by the user).

The old "accept languages" settings are now lost for good. And the user has to choose them again.

Comment 1

[François Marier [:francois]]

Ethan, which component do you use for bugs about the Tor patches?

Comment 2

[Ethan Tseng [:ethan]]

(In reply to François Marier [:francois] from comment #1)
> Ethan, which component do you use for bugs about the Tor patches?

There is no centralized component for Tor patches.
It depends on which component the changed code lives in.

Comment 3

[Ethan Tseng [:ethan]]

(In reply to Eduardo Trápani from comment #0)
> Reload Wikipedia, you will get the English version! On top of that, the
> accepted language will be set to en, en-US, without ever prompting the user,

There should be a prompt message based on the patches of bug 1039069.
CS will try to reproduce and investigate the issue here.

Comment 4

[Chung-Sheng Fu [:cfu]]

Attachment: 1.png

Comment 5

[Chung-Sheng Fu [:cfu]]

Attachment: 2.png

Comment 6

[Chung-Sheng Fu [:cfu]]

Attachment: 3.png

Comment 7

[Chung-Sheng Fu [:cfu]]

Attachment: 4.png

Comment 8

[Chung-Sheng Fu [:cfu]]

Attachment: 5.png

Comment 9

[Chung-Sheng Fu [:cfu]]

However I could not figure out the problem.

I downloaded Japanese Nightly 59 (https://download.mozilla.org/?product=firefox-latest-ssl&os=win64&lang=ja), ran with a clean profile, opened twitter, and got the Japanese page.
attachment 8938284 [details]

At this moment the preferred language setting was ja,en-us,en.
attachment 8938285 [details]

After setting privacy.resistFingerprinting to true and refreshing the twitter page, the prompt showed.
attachment 8938286 [details]

I clicked yes and got the English page this time.
attachment 8938287 [details]

The preferred language setting became en-us,en.
attachment 8938288 [details]

It just worked as expected, so could you please try again, and help me observe your preferred language settings? Thank you very much!

Comment 10

[Eduardo Trápani]

I cannot reproduce it now with the latest nightly. I know the preferred languages changed without prompting for my main profile. Maybe it only happens at the transition, for those that already had resistPrivacy. I'll close it. If I can reproduce (going back a couple of nightlies and checking the transition) I will post here.

Comment 11

[Chung-Sheng Fu [:cfu]]

Thank you very much for the help :)
I will also keep tracking on this.