1507280 - Ensure the reporting URI respects Resist Fingerprinting wrt locale

Status: RESOLVED FIXED

(Core :: DOM: Security, enhancement, P3)

Description

[Tom Ritter [:tjr]]

There was a comment on irc that the Reporting API will send localized strings; so we should ensure that this respects Resist Fingerprinting's locale stuff.

Comment 1

[Fatih Kilic [:fkilic] (OOO -> Aug 12)]

This seems to be true, I set my language to Turkish and visited https://mdn.github.io/dom-examples/reporting-api/deprecation_report.html, and it does show the error in turkish

Comment 2

[Fatih Kilic [:fkilic] (OOO -> Aug 12)]

Attachment: Bug 1507280: Change GetLocalizedString to GetMaybeLocalizedString in deprecation warnings. r?tjr

Comment 3

[Fatih Kilic [:fkilic] (OOO -> Aug 12)]

This patch only covers DeprecationReportBody, because only DeprecationReportBody and InterventionReportBody has a message property and InterventionReportBody is not implemented. So it covers everything.

Comment 4

[Thorin [:thorin]]

This seems to be true, I set my language to Turkish and visited https://mdn.github.io/dom-examples/reporting-api/deprecation_report.html, and it does show the error in turkish

because you said you were turkish (navigator, lang accept header). The real test would be if you were turkish app language, but spoofed as english (which is broken in Firefox, you will need to use TB)

Comment 5

[Fatih Kilic [:fkilic] (OOO -> Aug 12)]

which is broken in Firefox

Oh I didn't know sorry.

Now I tried Tor with spoof english=2 (basically agreed to spoof to english prompt), media.navigator.enabled=true and turkish and still got turkish error message. So seems like Tor is affected as well.

Comment 6

[Thorin [:thorin]]

I can't replicate: using TB alpha (based on ESR128)

control

• english app lang (apply and restart if required)
• spoof english = 1 (or 0)
• page: show reports - clicking it does nothing
• console: Uncaught ReferenceError: ReportingObserver is not defined - Learn more link is in english

test

• turkish app lang (apply and restart)
• spoof english = 2
• page: show reports - clicking it does nothing
• console: Uncaught ReferenceError: ReportingObserver is not defined - Learn more link is in turkish

also, because tor browser is built without webrtc, media.navigator.enabled will cause enumeration of devices to never resolve (yup, I had it set to true)

how do I replicate getting a report? And I tried playing the media file

Comment 7

[Fatih Kilic [:fkilic] (OOO -> Aug 12)]

Oh yeah sorry, I forgot to mention, you also have to enable dom.reporting.enabled to enable ReportingObserver API.

Comment 8

[Thorin [:thorin]]

so TB is not affected since dom.reporting.enabled = false? Actually dom.reporting.enabled is false in FF by default as well, including Nightly.

Comment 9

[Fatih Kilic [:fkilic] (OOO -> Aug 12)]

Yes true, I think it is set to false because of some thread/process issues. I don't know if it is under development or not and whether it will be enabled soon.

Comment 10

[Thorin [:thorin]]

Attachment: app lang leak.png

confirmed app language leak when Reporting Observer is enabled

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/60e835b2bf26
Change GetLocalizedString to GetMaybeLocalizedString in deprecation warnings. r=tjr

Comment 12

[Cristina Horotan [:chorotan]]

https://hg.mozilla.org/mozilla-central/rev/60e835b2bf26