Commit graph

86 commits

Author SHA1 Message Date
wolfbeast
363a47c4c1 Make opportunistic encryption configurable.
This adds a pref "network.http.opportunistic-encryption" that controls whether
we send an "Upgrade-Insecure-Requests : 1" header on document navigation or not.
This patch modifies the platform network parts. Default for the platform is "true".
Part 1 for #863
2019-02-16 00:18:51 +08:00
wolfbeast
a85f7277af Make HTTP/2 compressor more resilient to bad data. 2019-02-16 00:18:21 +08:00
Gaming4JC
30797d4da8 backport mozbug 1334776 - CVE-2017-7797 Header name interning leaks across origins
Potential attack: session supercookie.

[Moz Notes](https://bugzilla.mozilla.org/show_bug.cgi?id=1334776#c5):
"The problem is that for unknown header names we store the first one we see and then later we case-insensitively match against that name *globally*. That means you can track if a user agent has already seen a certain header name used (by using a different casing and observing whether it gets normalized). This would allow you to see if a user has used a sensitive service that uses custom header names, or allows you to track a user across sites, by teaching the browser about a certain header case once and then observing if different casings get normalized to that.

What we should do instead is only store the casing for a header name for each header list and not globally. That way it only leaks where it's expected (and necessary) to leak."

[Moz fix note](https://bugzilla.mozilla.org/show_bug.cgi?id=1334776#c8):
"nsHttpAtom now holds the old nsHttpAtom and a string that is case sensitive (only for not standard headers).
So nsHttpAtom holds a pointer to a header name. (header names are store on a static structure). This is how it used to be. I left that part the same but added a nsCString which holds a string that was used to resoled the header name. So when we parse headers we call ResolveHeader with a char*. If it is a new header name the char* will be stored in a HttpHeapAtom, nsHttpAtom::_val will point to HttpHeapAtom::value and the same strings will be stored in mLocalCaseSensitiveHeader. For the first resolve request they will be the same but for the following maybe not. At the end this nsHttpAtom will be stored in nsHttpHeaderArray. For all operation we will used the old char* except when we are returning it to a script using VisitHeaders."
2019-02-16 00:14:28 +08:00
Gaming4JC
de28886722 backport mozbug 1444532 - fix a leak in SHA256 in nsHttpConnectionInfo.cpp r=mayhemer
The original code (from bug 1200802) declared an XPCOM object as a static bare pointer,
which for future reference is probably never the right thing to do. It might have worked if
it was cleared before shutdown but it never was.
2019-02-16 00:14:27 +08:00
wolfbeast
07df2cf12a Add a null check in nsHttpTransaction::Close.
This resolves #776.
2019-02-16 00:14:04 +08:00
wolfbeast
8c8145e620 Remove all C++ Telemetry Accumulation calls.
This creates a number of stubs and leaves some surrounding code that may be irrelevant (eg. recorded time stamps, status variables).
Stub resolution/removal should be a follow-up to this.
2019-02-16 00:12:32 +08:00
JustOff
16820f40ac Refresh nsStringBundleService and nsHttpHandler when the browser locale is changed 2019-02-16 00:12:09 +08:00
SpockMan02
d330e7e8fc Issue #686: Un-deprecate the Application Cache API 2019-02-16 00:10:43 +08:00
janekptacijarabaci
acb5d5839b Fixed misleading console error message for multiple CORS headers 2019-02-16 00:10:27 +08:00
wolfbeast
7b82a2ece4 Remove SSL Error Reporting telemetry 2019-02-16 00:06:16 +08:00
janekptacijarabaci
4a6ce109b1 Build - throws a warning: 'rv': unreferenced local variable
PR #412
2019-02-15 23:59:49 +08:00
Gaming4JC
d4ac94cf3e Remove support and tests for HSTS priming from the tree. Fixes #384 2019-02-15 23:59:39 +08:00
JustOff
0aeb4a7e15 Revert incorrect UAO optimization that broke SSUAO 2019-02-15 23:57:29 +08:00
wolfbeast
2531de02eb Remove MOZ_WIDGET_GONK [2/2]
Tag #288
2019-02-15 23:57:10 +08:00
janekptacijarabaci
6885700c5b moebius#158: The Performance Resource Timing (added support for "workerStart")
https://github.com/MoonchildProductions/moebius/pull/158
2019-02-15 23:53:25 +08:00
trav90
55b7eeecbf Fix GCC -Wreorder warnings. 2019-02-15 23:45:51 +08:00
janekptacijarabaci
8f4e22e819 Bug 1431095 - Change Content-Type-Options: nosniff allowed script MIME types to match the spec 2019-02-15 23:42:44 +08:00
Ben Kelly
94a68d86a9 Bug 1440775 - Make fetch API force-cache and only-if-cached use VALIDATE_NEVER instead of LOAD_FROM_CACHE. r=mayhemer, a=RyanVM
--HG--
extra : source : 60fb09de57ec145923da102f856399d3323f632b
extra : amend_source : b42db87defcc5615773cfa4659af9ff5b9cd4b72
extra : intermediate-source : 599641c7992def734cb352d9413aa51bf0e9793f
extra : histedit_source : 1d42c837225bdf000d3a68bef46a862be87d4044
2019-02-15 23:37:25 +08:00
Valentin Gosu
2022008a84 Bug 1334465 - Set mIPCClosed to true before calling SendDeleteSelf in order to avoid race. r=bagder, a=ritu
In the previous code, a race condition could cause us to call SendSetPriority() after calling SendDeleteSelf.

For example:
T1: SendDeleteSelf()
T2: if (!mIPCClosed) SendSetPriority()
T1: mIPCClosed = true

MozReview-Commit-ID: 3XOwCaphb2o

--HG--
extra : rebase_source : d6e6886402d1e0b0afed23c25a9fb18d8ca29ad6
extra : intermediate-source : cfc9afe916091e6449f7d748991e2a19187dc817
extra : source : 4ebdab0e332892378558817e30d0138c95199ce5
2019-02-15 23:37:08 +08:00
Valentin Gosu
c82a62a1ac Bug 1334465 - Make HttpChannelParent::mIPCClosed atomic. r=bagder, a=ritu
MozReview-Commit-ID: 6irCJMAjzjW

--HG--
extra : rebase_source : 2357ab0b9d1d693dac9e5f4f16f34f370c6591b5
extra : intermediate-source : 48b9f6671588c3c2b8d3b4ea6ba1267f5e297f83
extra : source : bd315ae86709c3459a3dbf0778022ff3b1908723
2019-02-15 23:37:06 +08:00
Nicholas Hurley
b49b2afc58 Bug 1416529. r=mcmanus, a=ritu
MozReview-Commit-ID: CD1l5vLB4yy

--HG--
extra : rebase_source : d74f8ca96dab4e0d25d79948fcddbf8dab98bb36
2019-02-15 23:37:02 +08:00
janekptacijarabaci
54f2e6eafd DevTools - network - implement the secureConnectionStart property for the PerformanceTiming
https://github.com/MoonchildProductions/moebius/pull/116
("/testing" and "/toolkit" in in the previous commit)
2019-02-15 23:34:40 +08:00
janekptacijarabaci
6ba7168a9c Style clean up 2019-02-15 23:33:54 +08:00
janekptacijarabaci
a7f276d915 Bug 1328955 - When a client tries TLS1.3 with EarlyData and a server falls back to tls1.2,we should reconnect using tls1.3 without EarlyData 2019-02-15 23:33:51 +08:00
janekptacijarabaci
8b37136dc4 Bug 1351392 - Fix transport status events for http2 and ftp 2019-02-15 23:33:48 +08:00
janekptacijarabaci
62dc2168b0 Bug 1344890 - h2 tls 1.3 early data problem with https://echo.filippo.io/foo 2019-02-15 23:33:46 +08:00
janekptacijarabaci
202ca6d067 Bug 1322373 - TLS 1.3 early-data for http/2 2019-02-15 23:33:44 +08:00
janekptacijarabaci
0f08cb0c4f Bug 1345240 - h2 stalls on failed early data hard reload 2019-02-15 23:33:43 +08:00
janekptacijarabaci
c7e0248d2d Bug 1343600 - Add TLS handshake Start/Stop events 2019-02-15 23:33:41 +08:00
janekptacijarabaci
e8af99be6e Fix socket transport status events
Bug(s):
https://bugzilla.mozilla.org/show_bug.cgi?id=1340164
(native in moebius)
2019-02-15 23:33:40 +08:00
wolfbeast
6e9110ce90 Identify as Goanna + set Goanna platform version. 2019-02-15 23:33:02 +08:00
wolfbeast
14b6e5e8f2 Read Firefox UA compatmode from a pref instead of hard-coded.
In case of a missing pref, a hard-coded value is still used from the ctor.
2019-02-15 23:32:59 +08:00
wolfbeast
b3ce96c6d7 Update UA construction. 2019-02-15 23:32:56 +08:00
janekptacijarabaci
6bc6b34976 Two (and more) extensions together - http resume - basilisk crashes 2019-02-15 23:32:29 +08:00
wolfbeast
49676c9254 Limit displayed user/host strings to sane lengths. 2019-02-15 23:29:56 +08:00
Roy Tam
dcd9973243 import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00