Bug #9558

Tor Browser confinement allows downloading to /tmp

Added by mercedes508 2015-06-11 10:01:47 . Updated 2015-08-11 10:48:29 .

Status:
Resolved
Priority:
Normal
Assignee:
Category:
Target version:
Tails_1.5
Start date:
2015-06-11
Due date:
% Done:

100%

Feature Branch:
bugfix/9558-deny-tmp-to-tor-browser
Type of work:
Code
Blueprint:

Starter:
Affected tool:
Browser
Deliverable for:

Description

By settings the path (e.g. /tmp/file) it’s possible to download files from Tor Browser to /tmp directory. It’s expected because our torbrowser profile loads the gnome abstraction, that itself loads the user-tmp one. Do we want that? Can we do differently without breaking the browser?

Subtasks

Related issues

Related to Tails - Bug #10141: Document how to workaround the fact that the TBB 'Print preview' is blank Resolved 2015-09-01

History

#1 Updated by intrigeri 2015-06-11 10:22:12

  • Target version set to Tails_1.5
  • Affected tool set to Browser

#2 Updated by intrigeri 2015-06-11 10:23:59

  • Description updated

#3 Updated by intrigeri 2015-06-11 22:17:51

  • Subject changed from Tor Browser confinement allow downloading to /tmp to Tor Browser confinement allows downloading to /tmp

#4 Updated by intrigeri 2015-07-11 15:39:33

  • Status changed from Confirmed to In Progress

Applied in changeset commit:51c00606aa84b580124ea9082d5b1a84a25364fe.

#5 Updated by intrigeri 2015-07-11 15:39:33

Applied in changeset commit:a1fd1f0f4df38465855e08db287b0410b47b4806.

#6 Updated by intrigeri 2015-07-11 15:43:45

  • % Done changed from 0 to 50
  • Feature Branch set to bugfix/9558-deny-tmp-to-tor-browser
  • Type of work changed from Research to Code

#7 Updated by intrigeri 2015-07-13 01:40:59

  • Assignee deleted (intrigeri)
  • QA Check set to Ready for QA

Passes these automated tests: torified_browsing.feature tor_stream_isolation.feature windows_camouflage.feature usb_install.feature pidgin.feature. Please review’n’merge. Some manual testing would be welcome, though: exporting a custom TMPDIR might have unexpected adverse consequences.

#8 Updated by bertagaz 2015-07-15 01:33:31

  • Assignee set to bertagaz

#9 Updated by bertagaz 2015-07-15 06:01:16

  • Status changed from In Progress to Fix committed
  • % Done changed from 50 to 100

Applied in changeset commit:e2b338cc6c224d49929edfda17184d82a4b48900.

#10 Updated by bertagaz 2015-07-15 06:08:46

  • Assignee deleted (bertagaz)
  • QA Check changed from Ready for QA to Pass

Run the features that use the Tor Browser, and they all passed.

Manually tested the Tor Browser, with different TMPDIR settings, and it works as expected.

Merged, thanks!

#11 Updated by intrigeri 2015-07-18 07:59:34

#12 Updated by BitingBird 2015-08-11 10:48:29

  • Status changed from Fix committed to Resolved

#13 Updated by intrigeri 2015-09-17 01:22:29

  • related to Bug #10141: Document how to workaround the fact that the TBB 'Print preview' is blank added