1903559 - ShouldResistFingerprinting_dangerous computes private browsing state wrongly

Status: RESOLVED FIXED

(Core :: Privacy: Anti-Tracking, defect)

Description

[Emma Zühlcke [:emz]]

The condition here is wrong: https://searchfox.org/mozilla-central/rev/b11735b86bb4d416c918e2b2413456561beff50c/dom/base/nsContentUtils.cpp#2629-2630
We end up with a flipped logic where isPBM is true for normal browsing. That's because nsIScriptSecurityManager::DEFAULT_PRIVATE_BROWSING_ID=0 is normal browsing.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1851816

Comment 2

[Tim Huang[:timhuang] [PTO 1/31 ~ 2/9]]

Attachment: Bug 1903559 - Fix the isPBM check in nsContentUtils::ShouldResistFingerprinting_dangerous(). r?tschuster!

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/86ebfa1aeae2
Fix the isPBM check in nsContentUtils::ShouldResistFingerprinting_dangerous(). r=tschuster

Comment 4

[Aron Cseh]

https://hg.mozilla.org/mozilla-central/rev/86ebfa1aeae2

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:timhuang, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
• If no, please set status-firefox128 to wontfix.

For more information, please visit BugBot documentation.

Comment 6

[Tim Huang[:timhuang] [PTO 1/31 ~ 2/9]]

Apparently, we need to uplift this fix to beta so that the next ESR version won't miss this.

Comment 7

[Tim Huang[:timhuang] [PTO 1/31 ~ 2/9]]

Attachment: Bug 1903559 - Fix the isPBM check in nsContentUtils::ShouldResistFingerprinting_dangerous(). r?tschuster!

Original Revision: https://phabricator.services.mozilla.com/D214356

Comment 8

[Phabricator Automation]

beta Uplift Approval Request

• User impact if declined: Users will have incorrect fingerprinting resistances for private browsing windows
• Code covered by automated testing: no
• Fix verified in Nightly: yes
• Needs manual QE test: no
• Steps to reproduce for manual QE testing: None
• Risk associated with taking this patch: Low risk
• Explanation of risk level: We only change one line in the patch
• String changes made/needed: nope
• Is Android affected?: yes

Comment 9

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-beta/rev/ddee606b4a9f