1709330 - audit PDF.js for RFP and dFPI

Status: UNCONFIRMED

(Firefox :: PDF Viewer, task, P5)

Description

[Thorin [:thorin]]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101 Firefox/78.0

Steps to reproduce:

Bug 1674942 enabled pdf scripting

Perhaps this can be split into two issues.

I do not have a definite list, but PDFs have been given some RFP exemptions [1] in the past as they had no means to exfil any data. There may also be some exemptions or holes in partitioning/isolation - bug 1506693 for example

Downstream: https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/40424

[1] Bug 1537955 does not spoof devicePixelRatio

Comment 1

[Jeronimo Torti (Please send NI request to Brindusa Tot)]

Hi Simon,
Can you provide any steps for QA, in order to reproduce this issue, or is this a dev task only?

Thanks!
Jerónimo.

Comment 2

[Thorin [:thorin]]

Hi Jerónimo, just a ticket logged for further investigation as a reminder: I have tom ni;'d so no QA at this stage, I guess

Comment 3

[Marco Castelluccio [:marco]]

Clearing needinfo, Tom mentioned we should mark this as blocking the uplift tor fingerprinting bug to avoid losing it.