Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
home:Area51Kacz:branches:home:ungoogled_chromium:testing
firefox-hardened
0004-Bug-1821359-Disable-TLS-Key-Pinning-for-Tw...
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File 0004-Bug-1821359-Disable-TLS-Key-Pinning-for-Twitter-Doma.patch of Package firefox-hardened
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Dennis Jackson <djackson@mozilla.com> Date: Thu, 9 Mar 2023 22:05:17 +0000 Subject: [PATCH] Bug 1821359: Disable TLS Key Pinning for Twitter Domains. r=keeler, a=dmeehan This patch removes Twitter domains from the list of sites we statically pin in Firefox and regenerates the associated headers. Note that the Twitter domains are still imported from Chrome's list of pins, but now have the test flag set, making them inert. Differential Revision: https://phabricator.services.mozilla.com/D172161 --- security/manager/ssl/StaticHPKPins.h | 18 ++++++++-------- security/manager/tools/PreloadedHPKPins.json | 22 ++------------------ 2 files changed, 11 insertions(+), 29 deletions(-) diff --git a/security/manager/ssl/StaticHPKPins.h b/security/manager/ssl/StaticHPKPins.h index 3adda637832a..e558393a3218 100644 --- a/security/manager/ssl/StaticHPKPins.h +++ b/security/manager/ssl/StaticHPKPins.h @@ -602,26 +602,26 @@ static const TransportSecurityPreload kPublicKeyPinningPreloadList[] = { { "admin.google.com", true, false, false, -1, &kPinset_google_root_pems }, { "android.com", true, false, false, -1, &kPinset_google_root_pems }, { "api.accounts.firefox.com", true, false, true, 5, &kPinset_mozilla_services }, - { "api.twitter.com", true, false, false, -1, &kPinset_twitterCDN }, + { "api.twitter.com", true, true, false, -1, &kPinset_twitterCDN }, { "apis.google.com", true, false, false, -1, &kPinset_google_root_pems }, { "appengine.google.com", true, false, false, -1, &kPinset_google_root_pems }, { "apps.facebook.com", true, false, false, -1, &kPinset_facebook }, { "appspot.com", true, false, false, -1, &kPinset_google_root_pems }, { "at.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, { "au.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, { "aus4.mozilla.org", true, true, true, 3, &kPinset_mozilla_services }, { "aus5.mozilla.org", true, true, true, 7, &kPinset_mozilla_services }, { "az.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, { "be.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, { "bi.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, { "blog.torproject.org", true, false, false, -1, &kPinset_tor }, { "blogger.com", true, false, false, -1, &kPinset_google_root_pems }, { "blogspot.com", true, false, false, -1, &kPinset_google_root_pems }, { "br.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, { "bugs.chromium.org", true, false, false, -1, &kPinset_google_root_pems }, { "build.chromium.org", true, false, false, -1, &kPinset_google_root_pems }, { "business.facebook.com", true, false, false, -1, &kPinset_facebook }, - { "business.twitter.com", true, false, false, -1, &kPinset_twitterCom }, + { "business.twitter.com", true, true, false, -1, &kPinset_twitterCom }, { "ca.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, { "calendar.google.com", true, false, false, -1, &kPinset_google_root_pems }, { "cd.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, @@ -661,7 +661,7 @@ static const TransportSecurityPreload kPublicKeyPinningPreloadList[] = { { "ct.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, { "datastudio.google.com", true, false, false, -1, &kPinset_google_root_pems }, { "de.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, - { "dev.twitter.com", true, false, false, -1, &kPinset_twitterCom }, + { "dev.twitter.com", true, true, false, -1, &kPinset_twitterCom }, { "developer.android.com", true, false, false, -1, &kPinset_google_root_pems }, { "developers.facebook.com", true, false, false, -1, &kPinset_facebook }, { "dist.torproject.org", true, false, false, -1, &kPinset_tor }, @@ -973,34 +973,34 @@ static const TransportSecurityPreload kPublicKeyPinningPreloadList[] = { { "mbasic.facebook.com", true, false, false, -1, &kPinset_facebook }, { "meet.google.com", true, false, false, -1, &kPinset_google_root_pems }, { "messenger.com", true, false, false, -1, &kPinset_facebook }, - { "mobile.twitter.com", true, false, false, -1, &kPinset_twitterCom }, + { "mobile.twitter.com", true, true, false, -1, &kPinset_twitterCom }, { "mt.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, { "mtouch.facebook.com", true, false, false, -1, &kPinset_facebook }, { "mu.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, { "mw.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, { "mx.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, { "myaccount.google.com", true, false, false, -1, &kPinset_google_root_pems }, { "myactivity.google.com", true, false, false, -1, &kPinset_google_root_pems }, { "ni.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, { "nl.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, { "no.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, { "np.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, { "nz.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, - { "oauth.twitter.com", true, false, false, -1, &kPinset_twitterCom }, + { "oauth.twitter.com", true, true, false, -1, &kPinset_twitterCom }, { "oauthaccountmanager.googleapis.com", true, false, false, -1, &kPinset_google_root_pems }, { "pa.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, { "passwords.google.com", true, false, false, -1, &kPinset_google_root_pems }, { "passwordsleakcheck-pa.googleapis.com", true, false, false, -1, &kPinset_google_root_pems }, { "payments.google.com", true, false, false, -1, &kPinset_google_root_pems }, { "pe.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, { "ph.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, { "pinning-test.badssl.com", true, false, false, -1, &kPinset_test }, { "pinningtest.appspot.com", true, false, false, -1, &kPinset_test }, { "pixel.facebook.com", true, false, false, -1, &kPinset_facebook }, { "pixel.google.com", true, false, false, -1, &kPinset_google_root_pems }, { "pk.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, { "pl.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, - { "platform.twitter.com", true, false, false, -1, &kPinset_twitterCDN }, + { "platform.twitter.com", true, true, false, -1, &kPinset_twitterCDN }, { "play.google.com", true, false, false, -1, &kPinset_google_root_pems }, { "plus.google.com", true, false, false, -1, &kPinset_google_root_pems }, { "plus.sandbox.google.com", true, false, false, -1, &kPinset_google_root_pems }, @@ -1043,8 +1043,8 @@ static const TransportSecurityPreload kPublicKeyPinningPreloadList[] = { { "tunnel.googlezip.net", true, false, false, -1, &kPinset_google_root_pems }, { "tv.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, { "tw.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, - { "twimg.com", true, false, false, -1, &kPinset_twitterCDN }, - { "twitter.com", true, false, false, -1, &kPinset_twitterCDN }, + { "twimg.com", true, true, false, -1, &kPinset_twitterCDN }, + { "twitter.com", false, true, false, -1, &kPinset_twitterCom }, { "ua.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, { "ua5v.com", true, false, false, -1, &kPinset_google_root_pems }, { "uk.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, @@ -1079,7 +1079,7 @@ static const TransportSecurityPreload kPublicKeyPinningPreloadList[] = { { "www.googlemail.com", false, false, false, -1, &kPinset_google_root_pems }, { "www.messenger.com", true, false, false, -1, &kPinset_facebook }, { "www.torproject.org", true, false, false, -1, &kPinset_tor }, - { "www.twitter.com", true, false, false, -1, &kPinset_twitterCom }, + { "www.twitter.com", true, true, false, -1, &kPinset_twitterCom }, { "xa.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, { "xbrlsuccess.appspot.com", true, false, false, -1, &kPinset_google_root_pems }, { "xn--7xa.google.com", true, false, false, -1, &kPinset_google_root_pems }, diff --git a/security/manager/tools/PreloadedHPKPins.json b/security/manager/tools/PreloadedHPKPins.json index 243625852686..c7c20ea6f680 100644 --- a/security/manager/tools/PreloadedHPKPins.json +++ b/security/manager/tools/PreloadedHPKPins.json @@ -44,29 +44,16 @@ // Dropbox "dropbox.com", "www.dropbox.com", - // Twitter - "api.twitter.com", - "business.twitter.com", - "dev.twitter.com", - "mobile.twitter.com", - "oauth.twitter.com", - "platform.twitter.com", - "twimg.com", - "www.twitter.com", // Tor "torproject.org", "blog.torproject.org", "check.torproject.org", "dist.torproject.org", "www.torproject.org", // SpiderOak "spideroak.com" ], - "exclude_domains" : [ - // Chrome's entry for twitter.com doesn't include subdomains, so replace - // it with our own entry below which also uses an expanded pinset. - "twitter.com" - ] + "exclude_domains" : [] }, "pinsets": [ { @@ -193,12 +180,7 @@ "include_subdomains": false, "pins": "mozilla_test", "test_mode": false }, { "name": "test-mode.pinning.example.com", "include_subdomains": true, - "pins": "mozilla_test", "test_mode": true }, - // Expand twitter's pinset to include all of *.twitter.com and use - // twitterCDN. More specific rules take precedence because we search for - // exact domain name first. - { "name": "twitter.com", "include_subdomains": true, - "pins": "twitterCDN", "test_mode": false } + "pins": "mozilla_test", "test_mode": true } ], // When pinning to non-root certs, like intermediates, // place the PEM of the pinned certificate in this array
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor