From 2aa4a82499d4becd2284cdb482213d541b8804dd Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Sun, 28 Apr 2024 16:29:10 +0200 Subject: Adding upstream version 86.0.1. Signed-off-by: Daniel Baumann --- browser/app/Makefile.in | 106 + browser/app/firefox.exe.manifest | 53 + browser/app/macbuild/Contents/Info.plist.in | 263 ++ browser/app/macbuild/Contents/MacOS-files-copy.in | 11 + browser/app/macbuild/Contents/MacOS-files.in | 23 + .../Resources/English.lproj/InfoPlist.strings.in | 5 + browser/app/macbuild/Contents/moz.build | 25 + browser/app/macversion.py | 47 + browser/app/module.ver | 8 + browser/app/moz.build | 151 ++ browser/app/no-pie/NoPie.c | 26 + browser/app/no-pie/moz.build | 24 + browser/app/nsBrowserApp.cpp | 364 +++ browser/app/permissions | 25 + browser/app/profile/channel-prefs.js | 9 + browser/app/profile/firefox.js | 2530 ++++++++++++++++++++ browser/app/splash.rc | 19 + browser/app/winlauncher/DllBlocklistInit.cpp | 213 ++ browser/app/winlauncher/DllBlocklistInit.h | 25 + browser/app/winlauncher/ErrorHandler.cpp | 781 ++++++ browser/app/winlauncher/ErrorHandler.h | 54 + browser/app/winlauncher/LaunchUnelevated.cpp | 243 ++ browser/app/winlauncher/LaunchUnelevated.h | 32 + browser/app/winlauncher/LauncherProcessWin.cpp | 412 ++++ browser/app/winlauncher/LauncherProcessWin.h | 39 + browser/app/winlauncher/NtLoaderAPI.cpp | 30 + browser/app/winlauncher/ProcThreadAttributes.h | 159 ++ browser/app/winlauncher/SameBinary.h | 142 ++ .../app/winlauncher/freestanding/CheckForCaller.h | 36 + .../app/winlauncher/freestanding/DllBlocklist.cpp | 483 ++++ .../app/winlauncher/freestanding/DllBlocklist.h | 38 + .../app/winlauncher/freestanding/Freestanding.h | 67 + .../winlauncher/freestanding/LoaderPrivateAPI.cpp | 287 +++ .../winlauncher/freestanding/LoaderPrivateAPI.h | 62 + .../winlauncher/freestanding/ModuleLoadFrame.cpp | 139 ++ .../app/winlauncher/freestanding/ModuleLoadFrame.h | 95 + .../app/winlauncher/freestanding/SafeThreadLocal.h | 96 + .../app/winlauncher/freestanding/SharedSection.cpp | 267 +++ .../app/winlauncher/freestanding/SharedSection.h | 118 + .../freestanding/gen_ntdll_freestanding_lib.py | 30 + browser/app/winlauncher/freestanding/moz.build | 56 + .../freestanding/ntdll_freestanding.def | 25 + browser/app/winlauncher/moz.build | 51 + .../app/winlauncher/test/TestCrossProcessWin.cpp | 365 +++ .../app/winlauncher/test/TestSafeThreadLocal.cpp | 74 + browser/app/winlauncher/test/TestSameBinary.cpp | 255 ++ browser/app/winlauncher/test/moz.build | 30 + 47 files changed, 8393 insertions(+) create mode 100644 browser/app/Makefile.in create mode 100644 browser/app/firefox.exe.manifest create mode 100644 browser/app/macbuild/Contents/Info.plist.in create mode 100644 browser/app/macbuild/Contents/MacOS-files-copy.in create mode 100644 browser/app/macbuild/Contents/MacOS-files.in create mode 100644 browser/app/macbuild/Contents/Resources/English.lproj/InfoPlist.strings.in create mode 100644 browser/app/macbuild/Contents/moz.build create mode 100644 browser/app/macversion.py create mode 100644 browser/app/module.ver create mode 100644 browser/app/moz.build create mode 100644 browser/app/no-pie/NoPie.c create mode 100644 browser/app/no-pie/moz.build create mode 100644 browser/app/nsBrowserApp.cpp create mode 100644 browser/app/permissions create mode 100644 browser/app/profile/channel-prefs.js create mode 100644 browser/app/profile/firefox.js create mode 100644 browser/app/splash.rc create mode 100644 browser/app/winlauncher/DllBlocklistInit.cpp create mode 100644 browser/app/winlauncher/DllBlocklistInit.h create mode 100644 browser/app/winlauncher/ErrorHandler.cpp create mode 100644 browser/app/winlauncher/ErrorHandler.h create mode 100644 browser/app/winlauncher/LaunchUnelevated.cpp create mode 100644 browser/app/winlauncher/LaunchUnelevated.h create mode 100644 browser/app/winlauncher/LauncherProcessWin.cpp create mode 100644 browser/app/winlauncher/LauncherProcessWin.h create mode 100644 browser/app/winlauncher/NtLoaderAPI.cpp create mode 100644 browser/app/winlauncher/ProcThreadAttributes.h create mode 100644 browser/app/winlauncher/SameBinary.h create mode 100644 browser/app/winlauncher/freestanding/CheckForCaller.h create mode 100644 browser/app/winlauncher/freestanding/DllBlocklist.cpp create mode 100644 browser/app/winlauncher/freestanding/DllBlocklist.h create mode 100644 browser/app/winlauncher/freestanding/Freestanding.h create mode 100644 browser/app/winlauncher/freestanding/LoaderPrivateAPI.cpp create mode 100644 browser/app/winlauncher/freestanding/LoaderPrivateAPI.h create mode 100644 browser/app/winlauncher/freestanding/ModuleLoadFrame.cpp create mode 100644 browser/app/winlauncher/freestanding/ModuleLoadFrame.h create mode 100644 browser/app/winlauncher/freestanding/SafeThreadLocal.h create mode 100644 browser/app/winlauncher/freestanding/SharedSection.cpp create mode 100644 browser/app/winlauncher/freestanding/SharedSection.h create mode 100644 browser/app/winlauncher/freestanding/gen_ntdll_freestanding_lib.py create mode 100644 browser/app/winlauncher/freestanding/moz.build create mode 100644 browser/app/winlauncher/freestanding/ntdll_freestanding.def create mode 100644 browser/app/winlauncher/moz.build create mode 100644 browser/app/winlauncher/test/TestCrossProcessWin.cpp create mode 100644 browser/app/winlauncher/test/TestSafeThreadLocal.cpp create mode 100644 browser/app/winlauncher/test/TestSameBinary.cpp create mode 100644 browser/app/winlauncher/test/moz.build (limited to 'browser/app') diff --git a/browser/app/Makefile.in b/browser/app/Makefile.in new file mode 100644 index 0000000000..54d6b43fe1 --- /dev/null +++ b/browser/app/Makefile.in @@ -0,0 +1,106 @@ +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, You can obtain one at http://mozilla.org/MPL/2.0/. + +dist_dest = $(DIST)/$(MOZ_MACBUNDLE_NAME) + +# hardcode en-US for the moment +AB_CD = en-US + +# Build a binary bootstrapping with XRE_main + +ifndef MOZ_WINCONSOLE +ifneq (,$(MOZ_DEBUG)$(MOZ_ASAN)) +MOZ_WINCONSOLE = 1 +else +MOZ_WINCONSOLE = 0 +endif +endif + +include $(topsrcdir)/config/config.mk + +# If we are trying to show an error dialog about the lack of SSE2 support, +# make sure that code itself doesn't use SSE2. +ifdef MOZ_LINUX_32_SSE2_STARTUP_ERROR +CXX := $(filter-out -march=% -msse -msse2 -mfpmath=sse,$(CXX)) +CXX += -march=pentiumpro +endif + +ifeq ($(OS_ARCH),WINNT) +# Rebuild firefox.exe if the manifest changes - it's included by splash.rc. +# (this dependency should really be just for firefox.exe, not other targets) +# Note the manifest file exists in the tree, so we use the explicit filename +# here. +EXTRA_DEPS += $(srcdir)/firefox.exe.manifest +endif + +PROGRAMS_DEST = $(DIST)/bin +objdir = $(topobjdir)/browser/app + +include $(topsrcdir)/config/rules.mk + +ifneq (,$(filter-out WINNT,$(OS_ARCH))) + +ifdef COMPILE_ENVIRONMENT +ifndef MOZ_NO_PIE_COMPAT +libs:: + cp -p $(DIST)/bin/$(MOZ_APP_NAME)$(BIN_SUFFIX) $(DIST)/bin/$(MOZ_APP_NAME)-bin$(BIN_SUFFIX) +endif +endif + +endif + +# channel-prefs.js is handled separate from other prefs due to bug 756325 +# DO NOT change the content of channel-prefs.js without taking the appropriate +# steps. See bug 1431342. +libs:: $(srcdir)/profile/channel-prefs.js + $(NSINSTALL) -D $(DIST)/bin/defaults/pref + $(call py_action,preprocessor,-Fsubstitution $(PREF_PPFLAGS) $(ACDEFINES) $^ -o $(DIST)/bin/defaults/pref/channel-prefs.js) + +ifeq (cocoa,$(MOZ_WIDGET_TOOLKIT)) + +MAC_APP_NAME = $(MOZ_APP_DISPLAYNAME) + +ifdef MOZ_DEBUG +MAC_APP_NAME := $(MAC_APP_NAME)Debug +endif + +AB_CD = $(MOZ_UI_LOCALE) + +ifeq (zh-TW,$(AB_CD)) +LPROJ_ROOT := $(subst -,_,$(AB_CD)) +else +LPROJ_ROOT := $(firstword $(subst -, ,$(AB_CD))) +endif +LPROJ := Contents/Resources/$(LPROJ_ROOT).lproj + +repackage:: + $(RM) -r $(dist_dest) + +MAC_BUNDLE_VERSION = $(shell $(PYTHON3) $(srcdir)/macversion.py --version=$(MOZ_APP_VERSION) --buildid=$(DEPTH)/buildid.h) + +.PHONY: repackage +tools repackage:: $(DIST)/bin/$(MOZ_APP_NAME) $(objdir)/macbuild/Contents/MacOS-files.txt + rm -rf $(dist_dest) + $(MKDIR) -p '$(dist_dest)/Contents/MacOS' + $(MKDIR) -p '$(dist_dest)/$(LPROJ)' + rsync -a --exclude '*.in' $(srcdir)/macbuild/Contents '$(dist_dest)' --exclude English.lproj + rsync -a --exclude '*.in' $(srcdir)/macbuild/Contents/Resources/English.lproj/ '$(dist_dest)/$(LPROJ)' + $(call py_action,preprocessor,-Fsubstitution -DAPP_VERSION='$(MOZ_APP_VERSION)' -DMOZ_APP_NAME='$(MOZ_APP_NAME)' -DMAC_APP_NAME='$(MAC_APP_NAME)' -DMOZ_MACBUNDLE_ID='$(MOZ_MACBUNDLE_ID)' -DMAC_BUNDLE_VERSION='$(MAC_BUNDLE_VERSION)' -DMOZ_DEVELOPER_REPO_PATH='$(topsrcdir)' -DMOZ_DEVELOPER_OBJ_PATH='$(topobjdir)' $(srcdir)/macbuild/Contents/Info.plist.in -o '$(dist_dest)/Contents/Info.plist') + $(call py_action,preprocessor,-Fsubstitution --output-encoding utf-16 -DMAC_APP_NAME='$(MAC_APP_NAME)' $(srcdir)/macbuild/Contents/Resources/English.lproj/InfoPlist.strings.in -o '$(dist_dest)/$(LPROJ)/InfoPlist.strings') + rsync -a --exclude-from='$(objdir)/macbuild/Contents/MacOS-files.txt' $(DIST)/bin/ '$(dist_dest)/Contents/Resources' + rsync -a --include-from='$(objdir)/macbuild/Contents/MacOS-files.txt' --exclude '*' $(DIST)/bin/ '$(dist_dest)/Contents/MacOS' + # MacOS-files-copy.in is a list of files that should be copies rather + # than symlinks and placed in .app/Contents/MacOS. + rsync -aL --include-from='$(srcdir)/macbuild/Contents/MacOS-files-copy.in' --exclude '*' $(DIST)/bin/ '$(dist_dest)/Contents/MacOS' + $(RM) '$(dist_dest)/Contents/MacOS/$(MOZ_APP_NAME)' + rsync -aL $(DIST)/bin/$(MOZ_APP_NAME) '$(dist_dest)/Contents/MacOS' + cp -RL $(topsrcdir)/$(MOZ_BRANDING_DIRECTORY)/firefox.icns '$(dist_dest)/Contents/Resources/firefox.icns' + cp -RL $(topsrcdir)/$(MOZ_BRANDING_DIRECTORY)/document.icns '$(dist_dest)/Contents/Resources/document.icns' + $(MKDIR) -p '$(dist_dest)/Contents/Library/LaunchServices' +ifdef MOZ_UPDATER + mv -f '$(dist_dest)/Contents/MacOS/updater.app/Contents/MacOS/org.mozilla.updater' '$(dist_dest)/Contents/Library/LaunchServices' + ln -s ../../../../Library/LaunchServices/org.mozilla.updater '$(dist_dest)/Contents/MacOS/updater.app/Contents/MacOS/org.mozilla.updater' +endif + printf APPLMOZB > '$(dist_dest)/Contents/PkgInfo' +endif diff --git a/browser/app/firefox.exe.manifest b/browser/app/firefox.exe.manifest new file mode 100644 index 0000000000..1e1d6f651d --- /dev/null +++ b/browser/app/firefox.exe.manifest @@ -0,0 +1,53 @@ + + + +Firefox + + + + + + + + + + + + + + + + + + + + True/PM + PerMonitorV2,PerMonitor + + + + + + + + + + + diff --git a/browser/app/macbuild/Contents/Info.plist.in b/browser/app/macbuild/Contents/Info.plist.in new file mode 100644 index 0000000000..fb5e6993ea --- /dev/null +++ b/browser/app/macbuild/Contents/Info.plist.in @@ -0,0 +1,263 @@ + + + + + CFBundleDevelopmentRegion + English + CFBundleDocumentTypes + + + CFBundleTypeExtensions + + html + htm + shtml + xht + xhtml + + CFBundleTypeIconFile + document.icns + CFBundleTypeName + HTML Document + CFBundleTypeOSTypes + + HTML + + CFBundleTypeRole + Viewer + + + CFBundleTypeExtensions + + json + + CFBundleTypeIconFile + document.icns + CFBundleTypeMIMETypes + + application/json + + CFBundleTypeName + JSON File + CFBundleTypeOSTypes + + TEXT + + CFBundleTypeRole + Viewer + + + CFBundleTypeExtensions + + svg + + CFBundleTypeIconFile + document.icns + CFBundleTypeMIMETypes + + image/svg+xml + + CFBundleTypeName + SVG document + CFBundleTypeOSTypes + + TEXT + + CFBundleTypeRole + Viewer + NSDocumentClass + BrowserDocument + + + CFBundleTypeExtensions + + text + txt + js + log + css + xul + rdf + + CFBundleTypeIconFile + document.icns + CFBundleTypeName + Text Document + CFBundleTypeOSTypes + + TEXT + utxt + + CFBundleTypeRole + Viewer + + + CFBundleTypeExtensions + + jpeg + jpg + png + gif + + CFBundleTypeIconFile + fileBookmark.icns + CFBundleTypeName + document.icns + CFBundleTypeOSTypes + + GIFf + JPEG + PNGf + + CFBundleTypeRole + Viewer + + + CFBundleTypeExtensions + + oga + ogg + + CFBundleTypeIconFile + document.icns + CFBundleTypeMIMETypes + + audio/ogg + + CFBundleTypeName + HTML5 Audio (Ogg) + CFBundleTypeRole + Viewer + + + CFBundleTypeExtensions + + ogv + + CFBundleTypeIconFile + document.icns + CFBundleTypeMIMETypes + + video/ogg + + CFBundleTypeName + HTML5 Video (Ogg) + CFBundleTypeRole + Viewer + + + CFBundleTypeExtensions + + webm + + CFBundleTypeIconFile + document.icns + CFBundleTypeMIMETypes + + video/webm + + CFBundleTypeName + HTML5 Video (WebM) + CFBundleTypeRole + Viewer + + + CFBundleExecutable + @MOZ_APP_NAME@ + CFBundleGetInfoString + @MAC_APP_NAME@ @APP_VERSION@ + CFBundleIconFile + firefox.icns + CFBundleIdentifier + @MOZ_MACBUNDLE_ID@ + CFBundleInfoDictionaryVersion + 6.0 + CFBundleName + @MAC_APP_NAME@ + CFBundlePackageType + APPL + CFBundleShortVersionString + @APP_VERSION@ + CFBundleSignature + MOZB + CFBundleURLTypes + + + CFBundleURLIconFile + document.icns + CFBundleURLName + http URL + CFBundleURLSchemes + + http + + + + CFBundleURLIconFile + document.icns + CFBundleURLName + https URL + CFBundleURLSchemes + + https + + + + CFBundleURLName + ftp URL + CFBundleURLSchemes + + ftp + + + + CFBundleURLName + file URL + CFBundleURLSchemes + + file + + + + CFBundleVersion + @MAC_BUNDLE_VERSION@ + NSUserActivityTypes + + NSUserActivityTypeBrowsingWeb + + NSAppleScriptEnabled + + LSApplicationCategoryType + public.app-category.productivity + LSEnvironment + + MallocNanoZone + 0 + + LSFileQuarantineEnabled + + LSMinimumSystemVersion + 10.12.0 + NSSupportsAutomaticGraphicsSwitching + + NSRequiresAquaSystemAppearance + + NSPrincipalClass + GeckoNSApplication + SMPrivilegedExecutables + + org.mozilla.updater + identifier "org.mozilla.updater" and ((anchor apple generic and certificate leaf[field.1.2.840.113635.100.6.1.9]) or (anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] and certificate leaf[field.1.2.840.113635.100.6.1.13] and certificate leaf[subject.OU] = "43AQ936H96")) + + MozillaDeveloperRepoPath + @MOZ_DEVELOPER_REPO_PATH@ + MozillaDeveloperObjPath + @MOZ_DEVELOPER_OBJ_PATH@ + + NSCameraUsageDescription + Only sites you allow within @MAC_APP_NAME@ will be able to use the camera. + + NSMicrophoneUsageDescription + Only sites you allow within @MAC_APP_NAME@ will be able to use the microphone. + + diff --git a/browser/app/macbuild/Contents/MacOS-files-copy.in b/browser/app/macbuild/Contents/MacOS-files-copy.in new file mode 100644 index 0000000000..e9d0f0efb9 --- /dev/null +++ b/browser/app/macbuild/Contents/MacOS-files-copy.in @@ -0,0 +1,11 @@ +# Specifies files that should be copied (via deep copy, resolving symlinks) +# from dist/bin to the .app/Contents/MacOS directory. Linking is preferred to +# reduce disk I/O during builds, so just include dylibs which need to be in the +# same directory as returned by dladddr(3). +# +# Some of these dylibs load other dylibs which are assumed to be siblings in +# the same directory obtained from dladdr(3). With macOS 10.15, dladdr returns +# absolute resolved paths which breaks this assumption if symlinks are used +# because the symlink targets are in different directories. Hence the need for +# them to be copied to the same directory. +/*.dylib diff --git a/browser/app/macbuild/Contents/MacOS-files.in b/browser/app/macbuild/Contents/MacOS-files.in new file mode 100644 index 0000000000..3c6a1db5d6 --- /dev/null +++ b/browser/app/macbuild/Contents/MacOS-files.in @@ -0,0 +1,23 @@ +#if 0 +; Specifies files that should be copied (preserving symlinks) from dist/bin +; to the .app/Contents/MacOS directory. +#endif +#filter substitution +/*.app/*** +/certutil +/@MOZ_APP_NAME@-bin +#if defined(MOZ_GECKODRIVER) +/geckodriver +#endif +/gtest/*** +#if defined(MOZ_ASAN) || defined(MOZ_TSAN) +/llvm-symbolizer +#endif +#if defined(MOZ_CRASHREPORTER) +/minidump-analyzer +#endif +/pingsender +/pk12util +/ssltunnel +/xpcshell +/XUL diff --git a/browser/app/macbuild/Contents/Resources/English.lproj/InfoPlist.strings.in b/browser/app/macbuild/Contents/Resources/English.lproj/InfoPlist.strings.in new file mode 100644 index 0000000000..c84535de6a --- /dev/null +++ b/browser/app/macbuild/Contents/Resources/English.lproj/InfoPlist.strings.in @@ -0,0 +1,5 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +CFBundleName = "@MAC_APP_NAME@"; diff --git a/browser/app/macbuild/Contents/moz.build b/browser/app/macbuild/Contents/moz.build new file mode 100644 index 0000000000..b8b28926de --- /dev/null +++ b/browser/app/macbuild/Contents/moz.build @@ -0,0 +1,25 @@ +# -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*- +# vim: set filetype=python: +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, You can obtain one at http://mozilla.org/MPL/2.0/. + +defs = [] + +for s in ( + "MOZ_GECKODRIVER", + "MOZ_ASAN", + "MOZ_TSAN", + "MOZ_CRASHREPORTER", + "MOZ_APP_NAME", +): + if CONFIG[s]: + defs.append("-D%s=%s" % (s, "1" if CONFIG[s] is True else CONFIG[s])) + +GeneratedFile( + "MacOS-files.txt", + script="/python/mozbuild/mozbuild/action/preprocessor.py", + entry_point="generate", + inputs=["MacOS-files.in"], + flags=defs, +) diff --git a/browser/app/macversion.py b/browser/app/macversion.py new file mode 100644 index 0000000000..3d9aaaa94a --- /dev/null +++ b/browser/app/macversion.py @@ -0,0 +1,47 @@ +#!/usr/bin/python +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, You can obtain one at http://mozilla.org/MPL/2.0/. + +from __future__ import absolute_import, print_function, unicode_literals +import io +from optparse import OptionParser +import sys +import re + +o = OptionParser() +o.add_option("--buildid", dest="buildid") +o.add_option("--version", dest="version") + +(options, args) = o.parse_args() + +if not options.buildid: + print("--buildid is required", file=sys.stderr) + sys.exit(1) + +if not options.version: + print("--version is required", file=sys.stderr) + sys.exit(1) + +# We want to build a version number that matches the format allowed for +# CFBundleVersion (nnnnn[.nn[.nn]]). We'll incorporate both the version +# number as well as the date, so that it changes at least daily (for nightly +# builds), but also so that newly-built older versions (e.g. beta build) aren't +# considered "newer" than previously-built newer versions (e.g. a trunk nightly) + +define, MOZ_BUILDID, buildid = ( + io.open(options.buildid, "r", encoding="utf-8").read().split() +) + +# extract only the major version (i.e. "14" from "14.0b1") +majorVersion = re.match(r"^(\d+)[^\d].*", options.version).group(1) +# last two digits of the year +twodigityear = buildid[2:4] +month = buildid[4:6] +if month[0] == "0": + month = month[1] +day = buildid[6:8] +if day[0] == "0": + day = day[1] + +print("%s.%s.%s" % (majorVersion + twodigityear, month, day)) diff --git a/browser/app/module.ver b/browser/app/module.ver new file mode 100644 index 0000000000..5ef8d2a02a --- /dev/null +++ b/browser/app/module.ver @@ -0,0 +1,8 @@ +WIN32_MODULE_COMPANYNAME=Mozilla Corporation +WIN32_MODULE_COPYRIGHT=©Firefox and Mozilla Developers; available under the MPL 2 license. +WIN32_MODULE_PRODUCTVERSION=@MOZ_APP_WINVERSION@ +WIN32_MODULE_PRODUCTVERSION_STRING=@MOZ_APP_VERSION@ +WIN32_MODULE_TRADEMARKS=Firefox is a Trademark of The Mozilla Foundation. +WIN32_MODULE_DESCRIPTION=@MOZ_APP_DISPLAYNAME@ +WIN32_MODULE_PRODUCTNAME=@MOZ_APP_DISPLAYNAME@ +WIN32_MODULE_NAME=@MOZ_APP_DISPLAYNAME@ diff --git a/browser/app/moz.build b/browser/app/moz.build new file mode 100644 index 0000000000..9da2da3376 --- /dev/null +++ b/browser/app/moz.build @@ -0,0 +1,151 @@ +# -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*- +# vim: set filetype=python: +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, You can obtain one at http://mozilla.org/MPL/2.0/. + +with Files("**"): + BUG_COMPONENT = ("Firefox", "General") + +with Files("firefox.exe.manifest"): + BUG_COMPONENT = ("Core", "Widget: Win32") +with Files("module.ver"): + BUG_COMPONENT = ("Core", "Widget: Win32") +with Files("splash.rc"): + BUG_COMPONENT = ("Core", "Widget: Win32") + +with Files("macversion.py"): + BUG_COMPONENT = ("Core", "Widget: Cocoa") +with Files("macbuild/**"): + BUG_COMPONENT = ("Core", "Widget: Cocoa") + +with Files("moz.build"): + BUG_COMPONENT = ("Firefox Build System", "General") +with Files("Makefile.in"): + BUG_COMPONENT = ("Firefox Build System", "General") + +with Files("profile/channel-prefs.js"): + BUG_COMPONENT = ("Firefox", "Installer") +with Files("profile/firefox.js"): + BUG_COMPONENT = ("Firefox", "General") + +if CONFIG["MOZ_MACBUNDLE_NAME"]: + DIRS += ["macbuild/Contents"] + +if CONFIG["MOZ_NO_PIE_COMPAT"]: + GeckoProgram(CONFIG["MOZ_APP_NAME"] + "-bin") + + DIRS += ["no-pie"] +else: + GeckoProgram(CONFIG["MOZ_APP_NAME"]) + +SOURCES += [ + "nsBrowserApp.cpp", +] + +# Neither channel-prefs.js nor firefox.exe want to end up in dist/bin/browser. +DIST_SUBDIR = "" + +LOCAL_INCLUDES += [ + "!/build", + "/toolkit/xre", + "/xpcom/base", + "/xpcom/build", +] + +if CONFIG["LIBFUZZER"]: + USE_LIBS += ["fuzzer"] + LOCAL_INCLUDES += [ + "/tools/fuzzing/libfuzzer", + ] + +if CONFIG["ENABLE_GECKODRIVER"]: + DEFINES["MOZ_GECKODRIVER"] = True + +if CONFIG["CC_TYPE"] == "clang-cl": + # Always enter a Windows program through wmain, whether or not we're + # a console application. + WIN32_EXE_LDFLAGS += ["-ENTRY:wmainCRTStartup"] + +if CONFIG["OS_ARCH"] == "WINNT": + RCINCLUDE = "splash.rc" + DIRS += [ + "winlauncher", + ] + USE_LIBS += [ + "winlauncher", + ] + LOCAL_INCLUDES += [ + "/browser/app/winlauncher", + ] + DELAYLOAD_DLLS += [ + "oleaut32.dll", + "ole32.dll", + "rpcrt4.dll", + "version.dll", + ] + + if CONFIG["CC_TYPE"] == "clang-cl": + libpath_flag = "-LIBPATH:" + else: + libpath_flag = "-L" + + WIN32_EXE_LDFLAGS += [ + libpath_flag + OBJDIR + "/winlauncher/freestanding", + ] + +if CONFIG["MOZ_SANDBOX"] and CONFIG["OS_ARCH"] == "Darwin": + USE_LIBS += [ + "mozsandbox", + ] + +if CONFIG["MOZ_SANDBOX"] and CONFIG["OS_ARCH"] == "WINNT": + # For sandbox includes and the include dependencies those have + LOCAL_INCLUDES += [ + "/security/sandbox/chromium", + "/security/sandbox/chromium-shim", + ] + + USE_LIBS += [ + "sandbox_s", + ] + + DELAYLOAD_DLLS += [ + "winmm.dll", + "user32.dll", + ] + +# Control the default heap size. +# This is the heap returned by GetProcessHeap(). +# As we use the CRT heap, the default size is too large and wastes VM. +# +# The default heap size is 1MB on Win32. +# The heap will grow if need be. +# +# Set it to 256k. See bug 127069. +if CONFIG["OS_ARCH"] == "WINNT" and CONFIG["CC_TYPE"] not in ("clang", "gcc"): + LDFLAGS += ["/HEAP:0x40000"] + +DisableStlWrapping() + +if CONFIG["HAVE_CLOCK_MONOTONIC"]: + OS_LIBS += CONFIG["REALTIME_LIBS"] + +if CONFIG["MOZ_LINUX_32_SSE2_STARTUP_ERROR"]: + DEFINES["MOZ_LINUX_32_SSE2_STARTUP_ERROR"] = True + COMPILE_FLAGS["OS_CXXFLAGS"] = [ + f + for f in COMPILE_FLAGS.get("OS_CXXFLAGS", []) + if not f.startswith("-march=") and f not in ("-msse", "-msse2", "-mfpmath=sse") + ] + [ + "-mno-sse", + "-mno-sse2", + "-mfpmath=387", + ] + +for icon in ("firefox", "document", "newwindow", "newtab", "pbmode"): + DEFINES[icon.upper() + "_ICO"] = '"%s/%s/%s.ico"' % ( + TOPSRCDIR, + CONFIG["MOZ_BRANDING_DIRECTORY"], + icon, + ) diff --git a/browser/app/no-pie/NoPie.c b/browser/app/no-pie/NoPie.c new file mode 100644 index 0000000000..39b206e0af --- /dev/null +++ b/browser/app/no-pie/NoPie.c @@ -0,0 +1,26 @@ +/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#include +#include +#include +#include +#include + +int main(int argc, char* argv[]) { + // Ideally, we'd use mozilla::BinaryPath, but that pulls in stdc++compat, + // and further causes trouble linking with LTO. + char path[PATH_MAX + 4]; + ssize_t len = readlink("/proc/self/exe", path, PATH_MAX - 1); + if (len < 0) { + fprintf(stderr, "Couldn't find the application directory.\n"); + return 255; + } + strcpy(path + len, "-bin"); + execv(path, argv); + // execv never returns. If it did, there was an error. + fprintf(stderr, "Exec failed with error: %s\n", strerror(errno)); + return 255; +} diff --git a/browser/app/no-pie/moz.build b/browser/app/no-pie/moz.build new file mode 100644 index 0000000000..74aa89409d --- /dev/null +++ b/browser/app/no-pie/moz.build @@ -0,0 +1,24 @@ +# -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*- +# vim: set filetype=python: +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, You can obtain one at http://mozilla.org/MPL/2.0/. + +Program(CONFIG["MOZ_APP_NAME"]) + +SOURCES += [ + "NoPie.c", +] + +# For some reason, LTO messes things up. We don't care anyways. +CFLAGS += [ + "-fno-lto", +] + +# Use OS_LIBS instead of LDFLAGS to "force" the flag to come after -pie +# from MOZ_PROGRAM_LDFLAGS. +if CONFIG["CC_TYPE"] == "clang": + # clang < 5.0 doesn't support -no-pie. + OS_LIBS += ["-nopie"] +else: + OS_LIBS += ["-no-pie"] diff --git a/browser/app/nsBrowserApp.cpp b/browser/app/nsBrowserApp.cpp new file mode 100644 index 0000000000..de7bd4d94a --- /dev/null +++ b/browser/app/nsBrowserApp.cpp @@ -0,0 +1,364 @@ +/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#include "nsXULAppAPI.h" +#include "mozilla/CmdLineAndEnvUtils.h" +#include "mozilla/XREAppData.h" +#include "XREShellData.h" +#include "application.ini.h" +#include "mozilla/Bootstrap.h" +#if defined(XP_WIN) +# include +# include +# include "mozilla/PreXULSkeletonUI.h" +#elif defined(XP_UNIX) +# include +# include +#endif + +#include +#include +#include + +#include "nsCOMPtr.h" + +#ifdef XP_WIN +# include "freestanding/SharedSection.h" +# include "LauncherProcessWin.h" +# include "mozilla/WindowsDllBlocklist.h" + +# define XRE_WANT_ENVIRON +# define strcasecmp _stricmp +# ifdef MOZ_SANDBOX +# include "mozilla/sandboxing/SandboxInitialization.h" +# endif +#endif +#include "BinaryPath.h" + +#include "nsXPCOMPrivate.h" // for MAXPATHLEN and XPCOM_DLL + +#include "mozilla/Sprintf.h" +#include "mozilla/StartupTimeline.h" +#include "BaseProfiler.h" + +#ifdef LIBFUZZER +# include "FuzzerDefs.h" +#endif + +#ifdef MOZ_LINUX_32_SSE2_STARTUP_ERROR +# include +# include "mozilla/Unused.h" + +static bool IsSSE2Available() { + // The rest of the app has been compiled to assume that SSE2 is present + // unconditionally, so we can't use the normal copy of SSE.cpp here. + // Since SSE.cpp caches the results and we need them only transiently, + // instead of #including SSE.cpp here, let's just inline the specific check + // that's needed. + unsigned int level = 1u; + unsigned int eax, ebx, ecx, edx; + unsigned int bits = (1u << 26); + unsigned int max = __get_cpuid_max(0, nullptr); + if (level > max) { + return false; + } + __cpuid_count(level, 0, eax, ebx, ecx, edx); + return (edx & bits) == bits; +} + +static const char sSSE2Message[] = + "This browser version requires a processor with the SSE2 instruction " + "set extension.\nYou may be able to obtain a version that does not " + "require SSE2 from your Linux distribution.\n"; + +__attribute__((constructor)) static void SSE2Check() { + if (IsSSE2Available()) { + return; + } + // Using write() in order to avoid jemalloc-based buffering. Ignoring return + // values, since there isn't much we could do on failure and there is no + // point in trying to recover from errors. + MOZ_UNUSED( + write(STDERR_FILENO, sSSE2Message, MOZ_ARRAY_LENGTH(sSSE2Message) - 1)); + // _exit() instead of exit() to avoid running the usual "at exit" code. + _exit(255); +} +#endif + +#if !defined(MOZ_WIDGET_COCOA) && !defined(MOZ_WIDGET_ANDROID) +# define MOZ_BROWSER_CAN_BE_CONTENTPROC +# include "../../ipc/contentproc/plugin-container.cpp" +#endif + +using namespace mozilla; + +#ifdef XP_MACOSX +# define kOSXResourcesFolder "Resources" +#endif +#define kDesktopFolder "browser" + +static MOZ_FORMAT_PRINTF(1, 2) void Output(const char* fmt, ...) { + va_list ap; + va_start(ap, fmt); + +#ifndef XP_WIN + vfprintf(stderr, fmt, ap); +#else + char msg[2048]; + vsnprintf_s(msg, _countof(msg), _TRUNCATE, fmt, ap); + + wchar_t wide_msg[2048]; + MultiByteToWideChar(CP_UTF8, 0, msg, -1, wide_msg, _countof(wide_msg)); +# if MOZ_WINCONSOLE + fwprintf_s(stderr, wide_msg); +# else + // Linking user32 at load-time interferes with the DLL blocklist (bug 932100). + // This is a rare codepath, so we can load user32 at run-time instead. + HMODULE user32 = LoadLibraryW(L"user32.dll"); + if (user32) { + decltype(MessageBoxW)* messageBoxW = + (decltype(MessageBoxW)*)GetProcAddress(user32, "MessageBoxW"); + if (messageBoxW) { + messageBoxW(nullptr, wide_msg, L"Firefox", + MB_OK | MB_ICONERROR | MB_SETFOREGROUND); + } + FreeLibrary(user32); + } +# endif +#endif + + va_end(ap); +} + +/** + * Return true if |arg| matches the given argument name. + */ +static bool IsArg(const char* arg, const char* s) { + if (*arg == '-') { + if (*++arg == '-') ++arg; + return !strcasecmp(arg, s); + } + +#if defined(XP_WIN) + if (*arg == '/') return !strcasecmp(++arg, s); +#endif + + return false; +} + +Bootstrap::UniquePtr gBootstrap; + +static int do_main(int argc, char* argv[], char* envp[]) { + // Allow firefox.exe to launch XULRunner apps via -app + // Note that -app must be the *first* argument. + const char* appDataFile = getenv("XUL_APP_FILE"); + if ((!appDataFile || !*appDataFile) && (argc > 1 && IsArg(argv[1], "app"))) { + if (argc == 2) { + Output("Incorrect number of arguments passed to -app"); + return 255; + } + appDataFile = argv[2]; + + char appEnv[MAXPATHLEN]; + SprintfLiteral(appEnv, "XUL_APP_FILE=%s", argv[2]); + if (putenv(strdup(appEnv))) { + Output("Couldn't set %s.\n", appEnv); + return 255; + } + argv[2] = argv[0]; + argv += 2; + argc -= 2; + } else if (argc > 1 && IsArg(argv[1], "xpcshell")) { + for (int i = 1; i < argc; i++) { + argv[i] = argv[i + 1]; + } + + XREShellData shellData; +#if defined(XP_WIN) && defined(MOZ_SANDBOX) + shellData.sandboxBrokerServices = + sandboxing::GetInitializedBrokerServices(); +#endif + + return gBootstrap->XRE_XPCShellMain(--argc, argv, envp, &shellData); + } + + BootstrapConfig config; + + if (appDataFile && *appDataFile) { + config.appData = nullptr; + config.appDataPath = appDataFile; + } else { + // no -app flag so we use the compiled-in app data + config.appData = &sAppData; + config.appDataPath = kDesktopFolder; + } + +#if defined(XP_WIN) && defined(MOZ_SANDBOX) + sandbox::BrokerServices* brokerServices = + sandboxing::GetInitializedBrokerServices(); + sandboxing::PermissionsService* permissionsService = + sandboxing::GetPermissionsService(); + if (!brokerServices) { + Output("Couldn't initialize the broker services.\n"); + return 255; + } + config.sandboxBrokerServices = brokerServices; + config.sandboxPermissionsService = permissionsService; +#endif + +#ifdef LIBFUZZER + if (getenv("FUZZER")) + gBootstrap->XRE_LibFuzzerSetDriver(fuzzer::FuzzerDriver); +#endif + + // Note: keep in sync with LauncherProcessWin. + const char* acceptableParams[] = {"url", nullptr}; + EnsureCommandlineSafe(argc, argv, acceptableParams); + + return gBootstrap->XRE_main(argc, argv, config); +} + +static nsresult InitXPCOMGlue(LibLoadingStrategy aLibLoadingStrategy) { + if (gBootstrap) { + return NS_OK; + } + + UniqueFreePtr exePath = BinaryPath::Get(); + if (!exePath) { + Output("Couldn't find the application directory.\n"); + return NS_ERROR_FAILURE; + } + + gBootstrap = mozilla::GetBootstrap(exePath.get(), aLibLoadingStrategy); + if (!gBootstrap) { + Output("Couldn't load XPCOM.\n"); + return NS_ERROR_FAILURE; + } + + // This will set this thread as the main thread. + gBootstrap->NS_LogInit(); + + return NS_OK; +} + +#ifdef HAS_DLL_BLOCKLIST +// NB: This must be extern, as this value is checked elsewhere +uint32_t gBlocklistInitFlags = eDllBlocklistInitFlagDefault; +#endif + +int main(int argc, char* argv[], char* envp[]) { +#if defined(MOZ_ENABLE_FORKSERVER) + if (strcmp(argv[argc - 1], "forkserver") == 0) { + nsresult rv = InitXPCOMGlue(LibLoadingStrategy::NoReadAhead); + if (NS_FAILED(rv)) { + return 255; + } + + // Run a fork server in this process, single thread. When it + // returns, it means the fork server have been stopped or a new + // content process is created. + // + // For the later case, XRE_ForkServer() will return false, running + // in a content process just forked from the fork server process. + // argc & argv will be updated with the values passing from the + // chrome process. With the new values, this function + // continues the reset of the code acting as a content process. + if (gBootstrap->XRE_ForkServer(&argc, &argv)) { + // Return from the fork server in the fork server process. + // Stop the fork server. + gBootstrap->NS_LogTerm(); + return 0; + } + // In a content process forked from the fork server. + // Start acting as a content process. + } +#endif + + mozilla::TimeStamp start = mozilla::TimeStamp::Now(); + + AUTO_BASE_PROFILER_INIT; + AUTO_BASE_PROFILER_LABEL("nsBrowserApp main", OTHER); + +#ifdef MOZ_BROWSER_CAN_BE_CONTENTPROC + // We are launching as a content process, delegate to the appropriate + // main + if (argc > 1 && IsArg(argv[1], "contentproc")) { +# ifdef HAS_DLL_BLOCKLIST + DllBlocklist_Initialize(gBlocklistInitFlags | + eDllBlocklistInitFlagIsChildProcess); +# endif +# if defined(XP_WIN) && defined(MOZ_SANDBOX) + // We need to initialize the sandbox TargetServices before InitXPCOMGlue + // because we might need the sandbox broker to give access to some files. + if (IsSandboxedProcess() && !sandboxing::GetInitializedTargetServices()) { + Output("Failed to initialize the sandbox target services."); + return 255; + } +# endif + + nsresult rv = InitXPCOMGlue(LibLoadingStrategy::NoReadAhead); + if (NS_FAILED(rv)) { + return 255; + } + + int result = content_process_main(gBootstrap.get(), argc, argv); + +# if defined(DEBUG) && defined(HAS_DLL_BLOCKLIST) + DllBlocklist_Shutdown(); +# endif + + // InitXPCOMGlue calls NS_LogInit, so we need to balance it here. + gBootstrap->NS_LogTerm(); + + return result; + } +#endif + +#ifdef HAS_DLL_BLOCKLIST + DllBlocklist_Initialize(gBlocklistInitFlags); +#endif + +#if defined(XP_WIN) + // Once the browser process hits the main function, we no longer need + // a writable section handle because all dependent modules have been + // loaded. + mozilla::freestanding::gSharedSection.ConvertToReadOnly(); + ::RtlRunOnceInitialize(&mozilla::freestanding::gK32ExportsResolveOnce); + + mozilla::CreateAndStorePreXULSkeletonUI(GetModuleHandle(nullptr), argc, argv); +#endif + + nsresult rv = InitXPCOMGlue(LibLoadingStrategy::ReadAhead); + if (NS_FAILED(rv)) { + return 255; + } + + gBootstrap->XRE_StartupTimelineRecord(mozilla::StartupTimeline::START, start); + +#ifdef MOZ_BROWSER_CAN_BE_CONTENTPROC + gBootstrap->XRE_EnableSameExecutableForContentProc(); +#endif + + int result = do_main(argc, argv, envp); + + gBootstrap->NS_LogTerm(); + +#if defined(DEBUG) && defined(HAS_DLL_BLOCKLIST) + DllBlocklist_Shutdown(); +#endif + +#ifdef XP_MACOSX + // Allow writes again. While we would like to catch writes from static + // destructors to allow early exits to use _exit, we know that there is + // at least one such write that we don't control (see bug 826029). For + // now we enable writes again and early exits will have to use exit instead + // of _exit. + gBootstrap->XRE_StopLateWriteChecks(); +#endif + + gBootstrap.reset(); + + return result; +} diff --git a/browser/app/permissions b/browser/app/permissions new file mode 100644 index 0000000000..991284081d --- /dev/null +++ b/browser/app/permissions @@ -0,0 +1,25 @@ +# This file has default permissions for the permission manager. +# The file-format is strict: +# * matchtype \t type \t permission \t host +# * "origin" should be used for matchtype, "host" is supported for legacy reasons +# * type is a string that identifies the type of permission (e.g. "cookie") +# * permission is an integer between 1 and 15 +# See PermissionManager.cpp for more... + +# UITour +# Bug 1557153: www.mozilla.org gets a special workaround in UITourChild.jsm +origin uitour 1 https://www.mozilla.org +origin uitour 1 https://monitor.firefox.com +origin uitour 1 https://screenshots.firefox.com +origin uitour 1 https://support.mozilla.org +origin uitour 1 about:home +origin uitour 1 about:newtab + +# XPInstall +origin install 1 https://addons.mozilla.org + +# Remote troubleshooting +origin remote-troubleshooting 1 https://support.mozilla.org + +# addon install +origin install 1 https://fpn.firefox.com diff --git a/browser/app/profile/channel-prefs.js b/browser/app/profile/channel-prefs.js new file mode 100644 index 0000000000..eed6e634c2 --- /dev/null +++ b/browser/app/profile/channel-prefs.js @@ -0,0 +1,9 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ +// +// This pref is in its own file for complex reasons. See the comment in +// browser/app/Makefile.in, bug 756325, and bug 1431342 for details. Do not add +// other prefs to this file. + +pref("app.update.channel", "@MOZ_UPDATE_CHANNEL@"); diff --git a/browser/app/profile/firefox.js b/browser/app/profile/firefox.js new file mode 100644 index 0000000000..5aad2ddcf4 --- /dev/null +++ b/browser/app/profile/firefox.js @@ -0,0 +1,2530 @@ +#filter dumbComments emptyLines substitution + +// -*- indent-tabs-mode: nil; js-indent-level: 2 -*- +// This Source Code Form is subject to the terms of the Mozilla Public +// License, v. 2.0. If a copy of the MPL was not distributed with this +// file, You can obtain one at http://mozilla.org/MPL/2.0/. + +// Non-static prefs that are specific to desktop Firefox belong in this file +// (unless there is a compelling and documented reason for them to belong in +// another file). +// +// Please indent all prefs defined within #ifdef/#ifndef conditions. This +// improves readability, particular for conditional blocks that exceed a single +// screen. + +#ifdef XP_UNIX + #ifndef XP_MACOSX + #define UNIX_BUT_NOT_MAC + #endif +#endif + +pref("browser.hiddenWindowChromeURL", "chrome://browser/content/hiddenWindowMac.xhtml"); + +// Enables some extra Extension System Logging (can reduce performance) +pref("extensions.logging.enabled", false); + +// Disables strict compatibility, making addons compatible-by-default. +pref("extensions.strictCompatibility", false); + +// Temporary preference to forcibly make themes more safe with Australis even if +// extensions.checkCompatibility=false has been set. +pref("extensions.checkCompatibility.temporaryThemeOverride_minAppVersion", "29.0a1"); + +pref("extensions.webextPermissionPrompts", true); +pref("extensions.webextOptionalPermissionPrompts", true); +// If enabled, install origin permission verification happens after addons are downloaded. +pref("extensions.postDownloadThirdPartyPrompt", true); + +// Preferences for AMO integration +pref("extensions.getAddons.cache.enabled", true); +pref("extensions.getAddons.get.url", "https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%"); +pref("extensions.getAddons.search.browseURL", "https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%"); +pref("extensions.getAddons.link.url", "https://addons.mozilla.org/%LOCALE%/firefox/"); +pref("extensions.getAddons.langpacks.url", "https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversion=%VERSION%"); +pref("extensions.getAddons.discovery.api_url", "https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%"); + +// Use bloomfilters for the addons blocklist, instead of JSON only. +pref("extensions.blocklist.useMLBF", true); +pref("extensions.blocklist.useMLBF.stashes", true); + +// The URL for the privacy policy related to recommended extensions. +pref("extensions.recommendations.privacyPolicyUrl", "https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=privacy-policy-link#addons"); +// The URL for Firefox Color, recommended on the theme page in about:addons. +pref("extensions.recommendations.themeRecommendationUrl", "https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-footer-link"); + +pref("extensions.update.autoUpdateDefault", true); + +// Check AUS for system add-on updates. +pref("extensions.systemAddon.update.url", "https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VERSION%/%DISTRIBUTION%/%DISTRIBUTION_VERSION%/update.xml"); +pref("extensions.systemAddon.update.enabled", true); + +// Disable add-ons that are not installed by the user in all scopes by default. +// See the SCOPE constants in AddonManager.jsm for values to use here. +pref("extensions.autoDisableScopes", 15); +// Scopes to scan for changes at startup. +pref("extensions.startupScanScopes", 0); + +pref("extensions.geckoProfiler.acceptedExtensionIds", "geckoprofiler@mozilla.com,quantum-foxfooding@mozilla.com,raptor@mozilla.org"); + + +pref("extensions.webextensions.remote", true); +pref("extensions.webextensions.background-delayed-startup", true); + +// Require signed add-ons by default +pref("extensions.langpacks.signatures.required", true); +pref("xpinstall.signatures.required", true); +pref("xpinstall.signatures.devInfoURL", "https://wiki.mozilla.org/Addons/Extension_Signing"); + +// Enable extensionStorage storage actor by default +pref("devtools.storage.extensionStorage.enabled", true); + +// Dictionary download preference +pref("browser.dictionaries.download.url", "https://addons.mozilla.org/%LOCALE%/firefox/language-tools/"); + +// At startup, should we check to see if the installation +// date is older than some threshold +pref("app.update.checkInstallTime", true); + +// The number of days a binary is permitted to be old without checking is defined in +// firefox-branding.js (app.update.checkInstallTime.days) + +// The minimum delay in seconds for the timer to fire between the notification +// of each consumer of the timer manager. +// minimum=30 seconds, default=120 seconds, and maximum=300 seconds +pref("app.update.timerMinimumDelay", 120); + +// The minimum delay in milliseconds for the first firing after startup of the timer +// to notify consumers of the timer manager. +// minimum=10 seconds, default=30 seconds, and maximum=120 seconds +pref("app.update.timerFirstInterval", 30000); + +// App-specific update preferences + +// The interval to check for updates (app.update.interval) is defined in +// firefox-branding.js + +// Enables some extra Application Update Logging (can reduce performance) +pref("app.update.log", false); +// Causes Application Update Logging to be sent to a file in the profile +// directory. This preference is automatically disabled on application start to +// prevent it from being left on accidentally. Turning this pref on enables +// logging, even if app.update.log is false. +pref("app.update.log.file", false); + +// The number of general background check failures to allow before notifying the +// user of the failure. User initiated update checks always notify the user of +// the failure. +pref("app.update.backgroundMaxErrors", 10); + +// Ids of the links to the "What's new" update documentation +pref("app.update.link.updateAvailableWhatsNew", "update-available-whats-new"); +pref("app.update.link.updateManualWhatsNew", "update-manual-whats-new"); + +// How many times we should let downloads fail before prompting the user to +// download a fresh installer. +pref("app.update.download.promptMaxAttempts", 2); + +// How many times we should let an elevation prompt fail before prompting the user to +// download a fresh installer. +pref("app.update.elevation.promptMaxAttempts", 2); + +// If set to true, a message will be displayed in the hamburger menu while +// an update is being downloaded. +pref("app.update.notifyDuringDownload", false); + +// If set to true, the Update Service will automatically download updates if the +// user can apply updates. This pref is no longer used on Windows, except as the +// default value to migrate to the new location that this data is now stored +// (which is in a file in the update directory). Because of this, this pref +// should no longer be used directly. Instead, getAppUpdateAutoEnabled and +// getAppUpdateAutoEnabled from UpdateUtils.jsm should be used. +#ifndef XP_WIN + pref("app.update.auto", true); +#endif + +// If set to true, the Update Service will apply updates in the background +// when it finishes downloading them. +pref("app.update.staging.enabled", true); + +// Update service URL: +// app.update.url was removed in Bug 1568994 +// app.update.url.manual is in branding section +// app.update.url.details is in branding section + +// app.update.badgeWaitTime is in branding section +// app.update.interval is in branding section +// app.update.promptWaitTime is in branding section + +// Whether or not to attempt using the service for updates. +#ifdef MOZ_MAINTENANCE_SERVICE + pref("app.update.service.enabled", true); +#endif + +#ifdef MOZ_BITS_DOWNLOAD + // If set to true, the Update Service will attempt to use Windows BITS to + // download updates and will fallback to downloading internally if that fails. + pref("app.update.BITS.enabled", true); +#endif + +pref("app.update.langpack.enabled", true); + +// Symmetric (can be overridden by individual extensions) update preferences. +// e.g. +// extensions.{GUID}.update.enabled +// extensions.{GUID}.update.url +// .. etc .. +// +pref("extensions.update.enabled", true); +pref("extensions.update.url", "https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID%&version=%ITEM_VERSION%&maxAppVersion=%ITEM_MAXAPPVERSION%&status=%ITEM_STATUS%&appID=%APP_ID%&appVersion=%APP_VERSION%&appOS=%APP_OS%&appABI=%APP_ABI%&locale=%APP_LOCALE%¤tAppVersion=%CURRENT_APP_VERSION%&updateType=%UPDATE_TYPE%&compatMode=%COMPATIBILITY_MODE%"); +pref("extensions.update.background.url", "https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID%&version=%ITEM_VERSION%&maxAppVersion=%ITEM_MAXAPPVERSION%&status=%ITEM_STATUS%&appID=%APP_ID%&appVersion=%APP_VERSION%&appOS=%APP_OS%&appABI=%APP_ABI%&locale=%APP_LOCALE%¤tAppVersion=%CURRENT_APP_VERSION%&updateType=%UPDATE_TYPE%&compatMode=%COMPATIBILITY_MODE%"); +pref("extensions.update.interval", 86400); // Check for updates to Extensions and + // Themes every day + +pref("lightweightThemes.getMoreURL", "https://addons.mozilla.org/%LOCALE%/firefox/themes"); + +#if defined(MOZ_WIDEVINE_EME) + pref("browser.eme.ui.enabled", true); +#else + pref("browser.eme.ui.enabled", false); +#endif + +// UI tour experience. +pref("browser.uitour.enabled", true); +pref("browser.uitour.loglevel", "Error"); +pref("browser.uitour.requireSecure", true); +pref("browser.uitour.themeOrigin", "https://addons.mozilla.org/%LOCALE%/firefox/themes/"); +pref("browser.uitour.url", "https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/"); +// How long to show a Hearbeat survey (two hours, in seconds) +pref("browser.uitour.surveyDuration", 7200); + +pref("keyword.enabled", true); + +// Fixup whitelists, the urlbar won't try to search for these words, but will +// instead consider them valid TLDs. Don't check these directly, use +// Services.uriFixup.isDomainKnown() instead. +pref("browser.fixup.domainwhitelist.localhost", true); +// https://tools.ietf.org/html/rfc2606 +pref("browser.fixup.domainsuffixwhitelist.test", true); +pref("browser.fixup.domainsuffixwhitelist.example", true); +pref("browser.fixup.domainsuffixwhitelist.invalid", true); +pref("browser.fixup.domainsuffixwhitelist.localhost", true); +// https://tools.ietf.org/html/draft-wkumari-dnsop-internal-00 +pref("browser.fixup.domainsuffixwhitelist.internal", true); +// https://tools.ietf.org/html/rfc6762 +pref("browser.fixup.domainsuffixwhitelist.local", true); + +// Whether to always go through the DNS server before sending a single word +// search string, that may contain a valid host, to a search engine. +pref("browser.fixup.dns_first_for_single_words", false); + +#ifdef UNIX_BUT_NOT_MAC + pref("general.autoScroll", false); +#else + pref("general.autoScroll", true); +#endif + +// UI density of the browser chrome. This mostly affects toolbarbutton +// and urlbar spacing. The possible values are 0=normal, 1=compact, 2=touch. +pref("browser.uidensity", 0); +// Whether Firefox will automatically override the uidensity to "touch" +// while the user is in a touch environment (such as Windows tablet mode). +pref("browser.touchmode.auto", true); + +// At startup, check if we're the default browser and prompt user if not. +pref("browser.shell.checkDefaultBrowser", true); +pref("browser.shell.shortcutFavicons",true); +pref("browser.shell.mostRecentDateSetAsDefault", ""); +pref("browser.shell.skipDefaultBrowserCheckOnFirstRun", true); +pref("browser.shell.didSkipDefaultBrowserCheckOnFirstRun", false); +pref("browser.shell.defaultBrowserCheckCount", 0); +#ifdef EARLY_BETA_OR_EARLIER +pref("browser.defaultbrowser.notificationbar", true); +#else +pref("browser.defaultbrowser.notificationbar", false); +#endif +pref("browser.defaultbrowser.notificationbar.checkcount", 0); +pref("browser.defaultbrowser.notificationbar.checklimit", 10000); + +// 0 = blank, 1 = home (browser.startup.homepage), 2 = last visited page, 3 = resume previous browser session +// The behavior of option 3 is detailed at: http://wiki.mozilla.org/Session_Restore +pref("browser.startup.page", 1); +pref("browser.startup.homepage", "about:home"); +#ifdef NIGHTLY_BUILD +pref("browser.startup.homepage.abouthome_cache.enabled", true); +#else +pref("browser.startup.homepage.abouthome_cache.enabled", false); +#endif +pref("browser.startup.homepage.abouthome_cache.loglevel", "Warn"); + +// Whether we should skip the homepage when opening the first-run page +pref("browser.startup.firstrunSkipsHomepage", true); + +// Show an about:blank window as early as possible for quick startup feedback. +// Held to nightly on Linux due to bug 1450626. +// Disabled on Mac because the bouncing dock icon already provides feedback. +#if defined(XP_WIN) || defined(MOZ_WIDGET_GTK) && defined(NIGHTLY_BUILD) + pref("browser.startup.blankWindow", true); +#else + pref("browser.startup.blankWindow", false); +#endif + +// Show a skeleton UI window prior to loading libxul. Only visible for windows +// users as it is not implemented anywhere else. +#if defined(XP_WIN) +#ifdef NIGHTLY_BUILD +pref("browser.startup.preXulSkeletonUI", true); +#else +pref("browser.startup.preXulSkeletonUI", false); +#endif +#endif + +// Don't create the hidden window during startup on +// platforms that don't always need it (Win/Linux). +pref("toolkit.lazyHiddenWindow", true); + +pref("browser.slowStartup.notificationDisabled", false); +pref("browser.slowStartup.timeThreshold", 20000); +pref("browser.slowStartup.maxSamples", 5); + +pref("browser.chrome.site_icons", true); +// browser.warnOnQuit == false will override all other possible prompts when quitting or restarting +pref("browser.warnOnQuit", true); +pref("browser.fullscreen.autohide", true); +pref("browser.overlink-delay", 80); + +// Whether using `ctrl` when hitting return/enter in the URL bar +// (or clicking 'go') should prefix 'www.' and suffix +// browser.fixup.alternate.suffix to the URL bar value prior to +// navigating. +pref("browser.urlbar.ctrlCanonizesURLs", true); + +// Whether we announce to screen readers when tab-to-search results are +// inserted. +pref("browser.urlbar.accessibility.tabToSearch.announceResults", true); + +// Control autoFill behavior +pref("browser.urlbar.autoFill", true); + +// Whether to warm up network connections for autofill or search results. +pref("browser.urlbar.speculativeConnect.enabled", true); + +// Whether bookmarklets should be filtered out of Address Bar matches. +// This is enabled for security reasons, when true it is still possible to +// search for bookmarklets typing "javascript: " followed by the actual query. +pref("browser.urlbar.filter.javascript", true); + +// Enable a certain level of urlbar logging to the Browser Console. See Log.jsm. +pref("browser.urlbar.loglevel", "Error"); + +// the maximum number of results to show in autocomplete when doing richResults +pref("browser.urlbar.maxRichResults", 10); + +// The maximum number of historical search results to show. +pref("browser.urlbar.maxHistoricalSearchSuggestions", 2); + +// The default behavior for the urlbar can be configured to use any combination +// of the match filters with each additional filter adding more results (union). +pref("browser.urlbar.suggest.bookmark", true); +pref("browser.urlbar.suggest.history", true); +pref("browser.urlbar.suggest.openpage", true); +pref("browser.urlbar.suggest.searches", true); +pref("browser.urlbar.suggest.topsites", true); +pref("browser.urlbar.suggest.engines", true); + +// As a user privacy measure, don't fetch search suggestions if a pasted string +// is longer than this. +pref("browser.urlbar.maxCharsForSearchSuggestions", 100); + +pref("browser.urlbar.trimURLs", true); + +// If changed to true, copying the entire URL from the location bar will put the +// human readable (percent-decoded) URL on the clipboard. +pref("browser.urlbar.decodeURLsOnCopy", false); + +// Whether or not to move tabs into the active window when using the "Switch to +// Tab" feature of the awesomebar. +pref("browser.urlbar.switchTabs.adoptIntoActiveWindow", false); + +// Whether addresses and search results typed into the address bar +// should be opened in new tabs by default. +pref("browser.urlbar.openintab", false); + +// If true, we show tail suggestions when available. +pref("browser.urlbar.richSuggestions.tail", true); + +// Controls the empty search behavior in Search Mode: +// 0 - Show nothing +// 1 - Show search history +// 2 - Show search and browsing history +pref("browser.urlbar.update2.emptySearchBehavior", 0); + +// Whether the urlbar displays one-offs to filter searches to history, +// bookmarks, or tabs. +pref("browser.urlbar.shortcuts.bookmarks", true); +pref("browser.urlbar.shortcuts.tabs", true); +pref("browser.urlbar.shortcuts.history", true); + +pref("browser.urlbar.eventTelemetry.enabled", false); + +// When we send events to Urlbar extensions, we wait this amount of time in +// milliseconds for them to respond before timing out. +pref("browser.urlbar.extension.timeout", 400); + +// Controls when to DNS resolve single word search strings, after they were +// searched for. If the string is resolved as a valid host, show a +// "Did you mean to go to 'host'" prompt. +// 0 - never resolve; 1 - use heuristics (default); 2 - always resolve +pref("browser.urlbar.dnsResolveSingleWordsAfterSearch", 1); + +// Whether IME composition should close the results panel. +// The default value is true because some IME open a picker panel, and we end +// up with two panels on top of each other. Since for now we can't detect that +// we leave this choice to the user, hopefully in the future this can be flipped +// for everyone. +pref("browser.urlbar.imeCompositionClosesPanel", true); + +pref("browser.altClickSave", false); + +// Enable logging downloads operations to the Console. +pref("browser.download.loglevel", "Error"); + +// Number of milliseconds to wait for the http headers (and thus +// the Content-Disposition filename) before giving up and falling back to +// picking a filename without that info in hand so that the user sees some +// feedback from their action. +pref("browser.download.saveLinkAsFilenameTimeout", 4000); + +pref("browser.download.useDownloadDir", true); +pref("browser.download.folderList", 1); +pref("browser.download.manager.addToRecentDocs", true); +pref("browser.download.manager.resumeOnWakeDelay", 10000); + +// This allows disabling the animated notifications shown by +// the Downloads Indicator when a download starts or completes. +pref("browser.download.animateNotifications", true); + +// This records whether or not the panel has been shown at least once. +pref("browser.download.panel.shown", false); + +// This records whether or not to show the 'Open in system viewer' context menu item when appropriate +pref("browser.download.openInSystemViewerContextMenuItem", true); + +// This records whether or not to show the 'Always open...' context menu item when appropriate +pref("browser.download.alwaysOpenInSystemViewerContextMenuItem", true); + +// Open downloaded file types internally for the given types. +// This is a comma-separated list, the empty string ("") means no types are +// viewable internally. +pref("browser.download.viewableInternally.enabledTypes", "xml,svg,webp,avif"); + + +// This controls whether the button is automatically shown/hidden depending +// on whether there are downloads to show. +pref("browser.download.autohideButton", true); + +#ifndef XP_MACOSX + pref("browser.helperApps.deleteTempFileOnExit", true); +#endif + +// This controls the visibility of the radio button in the +// Unknown Content Type (Helper App) dialog that will open +// the content in the browser for PDF and for other +// Viewable Internally types +// (see browser.download.viewableInternally.enabledTypes) +pref("browser.helperApps.showOpenOptionForPdfJS", true); +pref("browser.helperApps.showOpenOptionForViewableInternally", true); + +// search engines URL +pref("browser.search.searchEnginesURL", "https://addons.mozilla.org/%LOCALE%/firefox/search-engines/"); + +// search bar results always open in a new tab +pref("browser.search.openintab", false); + +// context menu searches open in the foreground +pref("browser.search.context.loadInBackground", false); + +// comma seperated list of of engines to hide in the search panel. +pref("browser.search.hiddenOneOffs", ""); + +// Mirrors whether the search-container widget is in the navigation toolbar. +pref("browser.search.widget.inNavBar", false); + +// Enables display of the options for the user using a separate default search +// engine in private browsing mode. +pref("browser.search.separatePrivateDefault.ui.enabled", false); +// The maximum amount of times the private default banner is shown. +pref("browser.search.separatePrivateDefault.ui.banner.max", 0); + +// Enables the display of the Mozilla VPN banner in private browsing windows +pref("browser.privatebrowsing.vpnpromourl", "https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaign=private-browsing-vpn-link"); + +pref("browser.sessionhistory.max_entries", 50); + +// Built-in default permissions. +pref("permissions.manager.defaultsUrl", "resource://app/defaults/permissions"); + +// Set default fallback values for site permissions we want +// the user to be able to globally change. +pref("permissions.default.camera", 0); +pref("permissions.default.microphone", 0); +pref("permissions.default.geo", 0); +pref("permissions.default.xr", 0); +pref("permissions.default.desktop-notification", 0); +pref("permissions.default.shortcuts", 0); + +pref("permissions.desktop-notification.postPrompt.enabled", true); +pref("permissions.desktop-notification.notNow.enabled", false); + +pref("permissions.fullscreen.allowed", false); + +// handle links targeting new windows +// 1=current window/tab, 2=new window, 3=new tab in most recent window +pref("browser.link.open_newwindow", 3); + +// handle external links (i.e. links opened from a different application) +// default: use browser.link.open_newwindow +// 1-3: see browser.link.open_newwindow for interpretation +pref("browser.link.open_newwindow.override.external", -1); + +// 0: no restrictions - divert everything +// 1: don't divert window.open at all +// 2: don't divert window.open with features +pref("browser.link.open_newwindow.restriction", 2); + +// If true, this pref causes windows opened by window.open to be forced into new +// tabs (rather than potentially opening separate windows, depending on +// window.open arguments) when the browser is in fullscreen mode. +// We set this differently on Mac because the fullscreen implementation there is +// different. +#ifdef XP_MACOSX + pref("browser.link.open_newwindow.disabled_in_fullscreen", true); +#else + pref("browser.link.open_newwindow.disabled_in_fullscreen", false); +#endif + +// Tabbed browser +pref("browser.tabs.closeTabByDblclick", false); +pref("browser.tabs.closeWindowWithLastTab", true); +pref("browser.tabs.allowTabDetach", true); +// Open related links to a tab, e.g., link in current tab, at next to the +// current tab if |insertRelatedAfterCurrent| is true. Otherwise, always +// append new tab to the end. +pref("browser.tabs.insertRelatedAfterCurrent", true); +// Open all links, e.g., bookmarks, history items at next to current tab +// if |insertAfterCurrent| is true. Otherwise, append new tab to the end +// for non-related links. Note that if this is set to true, it will trump +// the value of browser.tabs.insertRelatedAfterCurrent. +pref("browser.tabs.insertAfterCurrent", false); +pref("browser.tabs.warnOnClose", true); +pref("browser.tabs.warnOnCloseOtherTabs", true); +pref("browser.tabs.warnOnOpen", true); +pref("browser.tabs.maxOpenBeforeWarn", 15); +pref("browser.tabs.loadInBackground", true); +pref("browser.tabs.opentabfor.middleclick", true); +pref("browser.tabs.loadDivertedInBackground", false); +pref("browser.tabs.loadBookmarksInBackground", false); +pref("browser.tabs.loadBookmarksInTabs", false); +pref("browser.tabs.tabClipWidth", 140); +pref("browser.tabs.tabMinWidth", 76); +// Initial titlebar state is managed by -moz-gtk-csd-hide-titlebar-by-default +// on Linux. +#ifndef UNIX_BUT_NOT_MAC + pref("browser.tabs.drawInTitlebar", true); +#endif + +//Control the visibility of Tab Manager Menu. +pref("browser.tabs.tabmanager.enabled", false); + +// Offer additional drag space to the user. The drag space +// will only be shown if browser.tabs.drawInTitlebar is true. +pref("browser.tabs.extraDragSpace", false); + +// When tabs opened by links in other tabs via a combination of +// browser.link.open_newwindow being set to 3 and target="_blank" etc are +// closed: +// true return to the tab that opened this tab (its owner) +// false return to the adjacent tab (old default) +pref("browser.tabs.selectOwnerOnClose", true); + +// This should match Chromium's audio indicator delay. +pref("browser.tabs.delayHidingAudioPlayingIconMS", 3000); + +// Pref to control whether we use a separate privileged content process +// for about: pages. This pref name did not age well: we will have multiple +// types of privileged content processes, each with different privileges. +// types of privleged content processes, each with different privleges. +pref("browser.tabs.remote.separatePrivilegedContentProcess", true); + +#if defined(NIGHTLY_BUILD) && !defined(MOZ_ASAN) + // This pref will cause assertions when a remoteType triggers a process switch + // to a new remoteType it should not be able to trigger. + pref("browser.tabs.remote.enforceRemoteTypeRestrictions", true); +#endif + +// Pref to control whether we use a separate privileged content process +// for certain mozilla webpages (which are listed in the pref +// browser.tabs.remote.separatedMozillaDomains). +pref("browser.tabs.remote.separatePrivilegedMozillaWebContentProcess", true); + +#ifdef NIGHTLY_BUILD +pref("browser.tabs.tooltipsShowPidAndActiveness", true); +#else +pref("browser.tabs.tooltipsShowPidAndActiveness", false); +#endif + +// allow_eval_* is enabled on Firefox Desktop only at this +// point in time +pref("security.allow_eval_with_system_principal", false); +pref("security.allow_eval_in_parent_process", false); + +#if defined(NIGHTLY_BUILD) + pref("security.allow_parent_unrestricted_js_loads", false); +#endif + +// Unload tabs when available memory is running low +pref("browser.tabs.unloadOnLowMemory", false); + +pref("browser.ctrlTab.recentlyUsedOrder", true); + +// By default, do not export HTML at shutdown. +// If true, at shutdown the bookmarks in your menu and toolbar will +// be exported as HTML to the bookmarks.html file. +pref("browser.bookmarks.autoExportHTML", false); + +// The maximum number of daily bookmark backups to +// keep in {PROFILEDIR}/bookmarkbackups. Special values: +// -1: unlimited +// 0: no backups created (and deletes all existing backups) +pref("browser.bookmarks.max_backups", 15); + +// Whether menu should close after Ctrl-click, middle-click, etc. +pref("browser.bookmarks.openInTabClosesMenu", true); + +// Where new bookmarks go by default. +// Use PlacesUIUtils.defaultParentGuid to read this; do NOT read the pref +// directly. +// The pref is ignored if the browser.toolbars.bookmarks.2h2020 pref is false, +// in which case bookmarks always go in the "Other bookmarks" folder. +// The value is one of: +// - a bookmarks guid +// - "toolbar", "menu" or "unfiled" for those folders. +// If we use the pref but the value isn't any of these, we'll fall back to +// the bookmarks toolbar as a default. +pref("browser.bookmarks.defaultLocation", "toolbar"); + +// Scripts & Windows prefs +pref("dom.disable_open_during_load", true); +pref("javascript.options.showInConsole", true); + +// allow JS to move and resize existing windows +pref("dom.disable_window_move_resize", false); +// prevent JS from monkeying with window focus, etc +pref("dom.disable_window_flip", true); + +// popups.policy 1=allow,2=reject +pref("privacy.popups.policy", 1); +pref("privacy.popups.usecustom", true); +pref("privacy.popups.showBrowserMessage", true); + +pref("privacy.item.cookies", false); + +pref("privacy.clearOnShutdown.history", true); +pref("privacy.clearOnShutdown.formdata", true); +pref("privacy.clearOnShutdown.downloads", true); +pref("privacy.clearOnShutdown.cookies", true); +pref("privacy.clearOnShutdown.cache", true); +pref("privacy.clearOnShutdown.sessions", true); +pref("privacy.clearOnShutdown.offlineApps", false); +pref("privacy.clearOnShutdown.siteSettings", false); +pref("privacy.clearOnShutdown.openWindows", false); + +pref("privacy.cpd.history", true); +pref("privacy.cpd.formdata", true); +pref("privacy.cpd.passwords", false); +pref("privacy.cpd.downloads", true); +pref("privacy.cpd.cookies", true); +pref("privacy.cpd.cache", true); +pref("privacy.cpd.sessions", true); +pref("privacy.cpd.offlineApps", false); +pref("privacy.cpd.siteSettings", false); +pref("privacy.cpd.openWindows", false); + +pref("privacy.history.custom", false); + +// What default should we use for the time span in the sanitizer: +// 0 - Clear everything +// 1 - Last Hour +// 2 - Last 2 Hours +// 3 - Last 4 Hours +// 4 - Today +// 5 - Last 5 minutes +// 6 - Last 24 hours +pref("privacy.sanitize.timeSpan", 1); + +pref("privacy.sanitize.migrateFx3Prefs", false); + +pref("privacy.panicButton.enabled", true); + +// Time until temporary permissions expire, in ms +pref("privacy.temporary_permission_expire_time_ms", 3600000); + +pref("network.proxy.share_proxy_settings", false); // use the same proxy settings for all protocols + +// simple gestures support +pref("browser.gesture.swipe.left", "Browser:BackOrBackDuplicate"); +pref("browser.gesture.swipe.right", "Browser:ForwardOrForwardDuplicate"); +pref("browser.gesture.swipe.up", "cmd_scrollTop"); +pref("browser.gesture.swipe.down", "cmd_scrollBottom"); +pref("browser.gesture.pinch.latched", false); +pref("browser.gesture.pinch.threshold", 25); +#if defined(XP_WIN) || defined(MOZ_WIDGET_GTK) + // Enabled for touch input display zoom. + pref("browser.gesture.pinch.out", "cmd_fullZoomEnlarge"); + pref("browser.gesture.pinch.in", "cmd_fullZoomReduce"); + pref("browser.gesture.pinch.out.shift", "cmd_fullZoomReset"); + pref("browser.gesture.pinch.in.shift", "cmd_fullZoomReset"); +#else + // Disabled by default due to issues with track pad input. + pref("browser.gesture.pinch.out", ""); + pref("browser.gesture.pinch.in", ""); + pref("browser.gesture.pinch.out.shift", ""); + pref("browser.gesture.pinch.in.shift", ""); +#endif +pref("browser.gesture.twist.latched", false); +pref("browser.gesture.twist.threshold", 0); +pref("browser.gesture.twist.right", "cmd_gestureRotateRight"); +pref("browser.gesture.twist.left", "cmd_gestureRotateLeft"); +pref("browser.gesture.twist.end", "cmd_gestureRotateEnd"); +pref("browser.gesture.tap", "cmd_fullZoomReset"); + +pref("browser.history_swipe_animation.disabled", false); + +// 0: Nothing happens +// 1: Scrolling contents +// 2: Go back or go forward, in your history +// 3: Zoom in or out (reflowing zoom). +// 4: Treat vertical wheel as horizontal scroll +// 5: Zoom in or out (pinch zoom). +#ifdef XP_MACOSX + // On macOS, if the wheel has one axis only, shift+wheel comes through as a + // horizontal scroll event. Thus, we can't assign anything other than normal + // scrolling to shift+wheel. + pref("mousewheel.with_shift.action", 1); + pref("mousewheel.with_alt.action", 2); + // On MacOS X, control+wheel is typically handled by system and we don't + // receive the event. So, command key which is the main modifier key for + // acceleration is the best modifier for zoom-in/out. However, we should keep + // the control key setting for backward compatibility. + pref("mousewheel.with_meta.action", 3); // command key on Mac + // Disable control-/meta-modified horizontal wheel events, since those are + // used on Mac as part of modified swipe gestures (e.g. Left swipe+Cmd is + // "go back" in a new tab). + pref("mousewheel.with_control.action.override_x", 0); + pref("mousewheel.with_meta.action.override_x", 0); +#else + // On the other platforms (non-macOS), user may use legacy mouse which + // supports only vertical wheel but want to scroll horizontally. For such + // users, we should provide horizontal scroll with shift+wheel (same as + // Chrome). However, shift+wheel was used for navigating history. For users + // who want to keep using this feature, let's enable it with alt+wheel. This + // is better for consistency with macOS users. + pref("mousewheel.with_shift.action", 4); + pref("mousewheel.with_alt.action", 2); + pref("mousewheel.with_meta.action", 1); // win key on Win, Super/Hyper on Linux +#endif +pref("mousewheel.with_control.action",3); +pref("mousewheel.with_win.action", 1); + +pref("browser.xul.error_pages.expert_bad_cert", false); +pref("browser.xul.error_pages.show_safe_browsing_details_on_load", false); + +// Enable captive portal detection. +pref("network.captive-portal-service.enabled", true); + +// If true, network link events will change the value of navigator.onLine +pref("network.manage-offline-status", true); + +// We want to make sure mail URLs are handled externally... +pref("network.protocol-handler.external.mailto", true); // for mail +pref("network.protocol-handler.external.news", true); // for news +pref("network.protocol-handler.external.snews", true); // for secure news +pref("network.protocol-handler.external.nntp", true); // also news +#ifdef XP_WIN + pref("network.protocol-handler.external.ms-windows-store", true); +#endif + +// ...without warning dialogs +pref("network.protocol-handler.warn-external.mailto", false); +pref("network.protocol-handler.warn-external.news", false); +pref("network.protocol-handler.warn-external.snews", false); +pref("network.protocol-handler.warn-external.nntp", false); +#ifdef XP_WIN + pref("network.protocol-handler.warn-external.ms-windows-store", false); +#endif + +// By default, all protocol handlers are exposed. This means that +// the browser will respond to openURL commands for all URL types. +// It will also try to open link clicks inside the browser before +// failing over to the system handlers. +pref("network.protocol-handler.expose-all", true); +pref("network.protocol-handler.expose.mailto", false); +pref("network.protocol-handler.expose.news", false); +pref("network.protocol-handler.expose.snews", false); +pref("network.protocol-handler.expose.nntp", false); + +pref("accessibility.typeaheadfind", false); +pref("accessibility.typeaheadfind.timeout", 5000); +pref("accessibility.typeaheadfind.linksonly", false); +pref("accessibility.typeaheadfind.flashBar", 1); + +// Accessibility indicator preferences such as support URL, enabled flag. +pref("accessibility.support.url", "https://support.mozilla.org/%LOCALE%/kb/accessibility-services"); +pref("accessibility.indicator.enabled", false); + +pref("plugins.testmode", false); + +// Should plugins that are hidden show the infobar UI? +pref("plugins.show_infobar", false); + +#if defined(_ARM64_) && defined(XP_WIN) + pref("plugin.default.state", 0); +#else + pref("plugin.default.state", 1); +#endif + +// Enables the download and use of the flash blocklists. +pref("plugins.flashBlock.enabled", true); + +// Prefer HTML5 video over Flash content, and don't +// load plugin instances with no src declared. +// These prefs are documented in details on all.js. +// With the "follow-ctp" setting, this will only +// apply to users that have plugin.state.flash = 1. +pref("plugins.favorfallback.mode", "follow-ctp"); +pref("plugins.favorfallback.rules", "nosrc,video"); + +#ifdef XP_WIN + pref("browser.preferences.instantApply", false); +#else + pref("browser.preferences.instantApply", true); +#endif + +// Toggling Search bar on and off in about:preferences +pref("browser.preferences.search", true); +#if defined(NIGHTLY_BUILD) +pref("browser.preferences.experimental", true); +#else +pref("browser.preferences.experimental", false); +#endif +pref("browser.preferences.experimental.hidden", false); +pref("browser.preferences.defaultPerformanceSettings.enabled", true); + +pref("browser.preferences.exposeHTTPSOnly", true); + +pref("browser.proton.enabled", false); + +// Backspace and Shift+Backspace behavior +// 0 goes Back/Forward +// 1 act like PgUp/PgDown +// 2 and other values, nothing +#ifdef UNIX_BUT_NOT_MAC + pref("browser.backspace_action", 2); +#else + pref("browser.backspace_action", 0); +#endif + +pref("intl.regional_prefs.use_os_locales", false); + +// this will automatically enable inline spellchecking (if it is available) for +// editable elements in HTML +// 0 = spellcheck nothing +// 1 = check multi-line controls [default] +// 2 = check multi/single line controls +pref("layout.spellcheckDefault", 1); + +pref("browser.send_pings", false); + +// At startup, if the handler service notices that the version number in the +// region.properties file is newer than the version number in the handler +// service datastore, it will add any new handlers it finds in the prefs (as +// seeded by this file) to its datastore. +pref("gecko.handlerService.defaultHandlersVersion", "chrome://browser-region/locale/region.properties"); + +// The default set of web-based protocol handlers shown in the application +// selection dialog for webcal: ; I've arbitrarily picked 4 default handlers +// per protocol, but if some locale wants more than that (or defaults for some +// protocol not currently listed here), we should go ahead and add those. + +// webcal +pref("gecko.handlerService.schemes.webcal.0.name", "chrome://browser-region/locale/region.properties"); +pref("gecko.handlerService.schemes.webcal.0.uriTemplate", "chrome://browser-region/locale/region.properties"); +pref("gecko.handlerService.schemes.webcal.1.name", "chrome://browser-region/locale/region.properties"); +pref("gecko.handlerService.schemes.webcal.1.uriTemplate", "chrome://browser-region/locale/region.properties"); +pref("gecko.handlerService.schemes.webcal.2.name", "chrome://browser-region/locale/region.properties"); +pref("gecko.handlerService.schemes.webcal.2.uriTemplate", "chrome://browser-region/locale/region.properties"); +pref("gecko.handlerService.schemes.webcal.3.name", "chrome://browser-region/locale/region.properties"); +pref("gecko.handlerService.schemes.webcal.3.uriTemplate", "chrome://browser-region/locale/region.properties"); + +// mailto +pref("gecko.handlerService.schemes.mailto.0.name", "chrome://browser-region/locale/region.properties"); +pref("gecko.handlerService.schemes.mailto.0.uriTemplate", "chrome://browser-region/locale/region.properties"); +pref("gecko.handlerService.schemes.mailto.1.name", "chrome://browser-region/locale/region.properties"); +pref("gecko.handlerService.schemes.mailto.1.uriTemplate", "chrome://browser-region/locale/region.properties"); +pref("gecko.handlerService.schemes.mailto.2.name", "chrome://browser-region/locale/region.properties"); +pref("gecko.handlerService.schemes.mailto.2.uriTemplate", "chrome://browser-region/locale/region.properties"); +pref("gecko.handlerService.schemes.mailto.3.name", "chrome://browser-region/locale/region.properties"); +pref("gecko.handlerService.schemes.mailto.3.uriTemplate", "chrome://browser-region/locale/region.properties"); + +// irc +pref("gecko.handlerService.schemes.irc.0.name", "chrome://browser-region/locale/region.properties"); +pref("gecko.handlerService.schemes.irc.0.uriTemplate", "chrome://browser-region/locale/region.properties"); +pref("gecko.handlerService.schemes.irc.1.name", "chrome://browser-region/locale/region.properties"); +pref("gecko.handlerService.schemes.irc.1.uriTemplate", "chrome://browser-region/locale/region.properties"); +pref("gecko.handlerService.schemes.irc.2.name", "chrome://browser-region/locale/region.properties"); +pref("gecko.handlerService.schemes.irc.2.uriTemplate", "chrome://browser-region/locale/region.properties"); +pref("gecko.handlerService.schemes.irc.3.name", "chrome://browser-region/locale/region.properties"); +pref("gecko.handlerService.schemes.irc.3.uriTemplate", "chrome://browser-region/locale/region.properties"); + +// ircs +pref("gecko.handlerService.schemes.ircs.0.name", "chrome://browser-region/locale/region.properties"); +pref("gecko.handlerService.schemes.ircs.0.uriTemplate", "chrome://browser-region/locale/region.properties"); +pref("gecko.handlerService.schemes.ircs.1.name", "chrome://browser-region/locale/region.properties"); +pref("gecko.handlerService.schemes.ircs.1.uriTemplate", "chrome://browser-region/locale/region.properties"); +pref("gecko.handlerService.schemes.ircs.2.name", "chrome://browser-region/locale/region.properties"); +pref("gecko.handlerService.schemes.ircs.2.uriTemplate", "chrome://browser-region/locale/region.properties"); +pref("gecko.handlerService.schemes.ircs.3.name", "chrome://browser-region/locale/region.properties"); +pref("gecko.handlerService.schemes.ircs.3.uriTemplate", "chrome://browser-region/locale/region.properties"); + +pref("browser.geolocation.warning.infoURL", "https://www.mozilla.org/%LOCALE%/firefox/geolocation/"); +pref("browser.xr.warning.infoURL", "https://www.mozilla.org/%LOCALE%/firefox/xr/"); + +pref("browser.sessionstore.resume_from_crash", true); +pref("browser.sessionstore.resume_session_once", false); +pref("browser.sessionstore.resuming_after_os_restart", false); + +// Minimal interval between two save operations in milliseconds (while the user is active). +pref("browser.sessionstore.interval", 15000); // 15 seconds + +// Minimal interval between two save operations in milliseconds (while the user is idle). +pref("browser.sessionstore.interval.idle", 3600000); // 1h + +// Time (ms) before we assume that the user is idle and that we don't need to +// collect/save the session quite as often. +pref("browser.sessionstore.idleDelay", 180000); // 3 minutes + +// on which sites to save text data, POSTDATA and cookies +// 0 = everywhere, 1 = unencrypted sites, 2 = nowhere +pref("browser.sessionstore.privacy_level", 0); +// how many tabs can be reopened (per window) +pref("browser.sessionstore.max_tabs_undo", 25); +// how many windows can be reopened (per session) - on non-OS X platforms this +// pref may be ignored when dealing with pop-up windows to ensure proper startup +pref("browser.sessionstore.max_windows_undo", 3); +// number of crashes that can occur before the about:sessionrestore page is displayed +// (this pref has no effect if more than 6 hours have passed since the last crash) +pref("browser.sessionstore.max_resumed_crashes", 1); +// number of back button session history entries to restore (-1 = all of them) +pref("browser.sessionstore.max_serialize_back", 10); +// number of forward button session history entries to restore (-1 = all of them) +pref("browser.sessionstore.max_serialize_forward", -1); +// restore_on_demand overrides MAX_CONCURRENT_TAB_RESTORES (sessionstore constant) +// and restore_hidden_tabs. When true, tabs will not be restored until they are +// focused (also applies to tabs that aren't visible). When false, the values +// for MAX_CONCURRENT_TAB_RESTORES and restore_hidden_tabs are respected. +// Selected tabs are always restored regardless of this pref. +pref("browser.sessionstore.restore_on_demand", true); +// Whether to automatically restore hidden tabs (i.e., tabs in other tab groups) or not +pref("browser.sessionstore.restore_hidden_tabs", false); +// If restore_on_demand is set, pinned tabs are restored on startup by default. +// When set to true, this pref overrides that behavior, and pinned tabs will only +// be restored when they are focused. +pref("browser.sessionstore.restore_pinned_tabs_on_demand", false); +// The version at which we performed the latest upgrade backup +pref("browser.sessionstore.upgradeBackup.latestBuildID", ""); +// How many upgrade backups should be kept +pref("browser.sessionstore.upgradeBackup.maxUpgradeBackups", 3); +// End-users should not run sessionstore in debug mode +pref("browser.sessionstore.debug", false); +// Causes SessionStore to ignore non-final update messages from +// browser tabs that were not caused by a flush from the parent. +// This is a testing flag and should not be used by end-users. +pref("browser.sessionstore.debug.no_auto_updates", false); +// Forget closed windows/tabs after two weeks +pref("browser.sessionstore.cleanup.forget_closed_after", 1209600000); +// Amount of failed SessionFile writes until we restart the worker. +pref("browser.sessionstore.max_write_failures", 5); + +// Whether to warn the user when quitting, even though their tabs will be restored. +pref("browser.sessionstore.warnOnQuit", false); + +// allow META refresh by default +pref("accessibility.blockautorefresh", false); + +// Whether history is enabled or not. +pref("places.history.enabled", true); + +// Whether or not diacritics must match in history text searches. +pref("places.search.matchDiacritics", false); + +// the (maximum) number of the recent visits to sample +// when calculating frecency +pref("places.frecency.numVisits", 10); + +// buckets (in days) for frecency calculation +pref("places.frecency.firstBucketCutoff", 4); +pref("places.frecency.secondBucketCutoff", 14); +pref("places.frecency.thirdBucketCutoff", 31); +pref("places.frecency.fourthBucketCutoff", 90); + +// weights for buckets for frecency calculations +pref("places.frecency.firstBucketWeight", 100); +pref("places.frecency.secondBucketWeight", 70); +pref("places.frecency.thirdBucketWeight", 50); +pref("places.frecency.fourthBucketWeight", 30); +pref("places.frecency.defaultBucketWeight", 10); + +// bonus (in percent) for visit transition types for frecency calculations +pref("places.frecency.embedVisitBonus", 0); +pref("places.frecency.framedLinkVisitBonus", 0); +pref("places.frecency.linkVisitBonus", 100); +pref("places.frecency.typedVisitBonus", 2000); +// The bookmarks bonus is always added on top of any other bonus, including +// the redirect source and the typed ones. +pref("places.frecency.bookmarkVisitBonus", 75); +// The redirect source bonus overwrites any transition bonus. +// 0 would hide these pages, instead we want them low ranked. Thus we use +// linkVisitBonus - bookmarkVisitBonus, so that a bookmarked source is in par +// with a common link. +pref("places.frecency.redirectSourceVisitBonus", 25); +pref("places.frecency.downloadVisitBonus", 0); +// The perm/temp redirects here relate to redirect targets, not sources. +pref("places.frecency.permRedirectVisitBonus", 50); +pref("places.frecency.tempRedirectVisitBonus", 40); +pref("places.frecency.reloadVisitBonus", 0); +pref("places.frecency.defaultVisitBonus", 0); + +// bonus (in percent) for place types for frecency calculations +pref("places.frecency.unvisitedBookmarkBonus", 140); +pref("places.frecency.unvisitedTypedBonus", 200); + +// Controls behavior of the "Add Exception" dialog launched from SSL error pages +// 0 - don't pre-populate anything +// 1 - pre-populate site URL, but don't fetch certificate +// 2 - pre-populate site URL and pre-fetch certificate +pref("browser.ssl_override_behavior", 2); + +// if true, use full page zoom instead of text zoom +pref("browser.zoom.full", true); + +// Whether or not to save and restore zoom levels on a per-site basis. +pref("browser.zoom.siteSpecific", true); + +// Whether or not to update background tabs to the current zoom level. +pref("browser.zoom.updateBackgroundTabs", true); + +// The breakpad report server to link to in about:crashes +pref("breakpad.reportURL", "https://crash-stats.mozilla.org/report/index/"); + +// URL for "Learn More" for DataCollection +pref("toolkit.datacollection.infoURL", + "https://www.mozilla.org/legal/privacy/firefox.html"); + +// URL for "Learn More" for Crash Reporter +pref("toolkit.crashreporter.infoURL", + "https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter"); + +// base URL for web-based support pages +pref("app.support.baseURL", "https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/"); + +// base url for web-based feedback pages +#ifdef MOZ_DEV_EDITION + pref("app.feedback.baseURL", "https://input.mozilla.org/%LOCALE%/feedback/firefoxdev/%VERSION%/"); +#else + pref("app.feedback.baseURL", "https://input.mozilla.org/%LOCALE%/feedback/%APP%/%VERSION%/"); +#endif + +// Name of alternate about: page for certificate errors (when undefined, defaults to about:neterror) +pref("security.alternate_certificate_error_page", "certerror"); + +pref("security.certerrors.recordEventTelemetry", true); +pref("security.certerrors.permanentOverride", true); +pref("security.certerrors.mitm.priming.enabled", true); +pref("security.certerrors.mitm.priming.endpoint", "https://mitmdetection.services.mozilla.com/"); +pref("security.certerrors.mitm.auto_enable_enterprise_roots", true); + +// Whether the bookmark panel should be shown when bookmarking a page. +pref("browser.bookmarks.editDialog.showForNewBookmarks", true); + +// Don't try to alter this pref, it'll be reset the next time you use the +// bookmarking dialog +pref("browser.bookmarks.editDialog.firstEditField", "namePicker"); + +// The number of recently selected folders in the edit bookmarks dialog. +pref("browser.bookmarks.editDialog.maxRecentFolders", 7); + +pref("dom.ipc.plugins.flash.disable-protected-mode", false); + +// Feature-disable the protected-mode auto-flip +pref("browser.flash-protected-mode-flip.enable", false); + +// Whether we've already flipped protected mode automatically +pref("browser.flash-protected-mode-flip.done", false); + +pref("dom.ipc.shims.enabledWarnings", false); + +#if defined(XP_WIN) && defined(MOZ_SANDBOX) + // Controls whether and how the Windows NPAPI plugin process is sandboxed. + // To get a different setting for a particular plugin replace "default", with + // the plugin's nice file name, see: nsPluginTag::GetNiceFileName. + // On windows these levels are: + // 0 - no sandbox + // 1 - sandbox with USER_NON_ADMIN access token level + // 2 - a more strict sandbox, which might cause functionality issues. This now + // includes running at low integrity. + // 3 - the strongest settings we seem to be able to use without breaking + // everything, but will probably cause some functionality restrictions + pref("dom.ipc.plugins.sandbox-level.default", 0); + #if defined(_AMD64_) + // The base sandbox level in nsPluginTag::InitSandboxLevel must be + // updated to keep in sync with this value. + pref("dom.ipc.plugins.sandbox-level.flash", 3); + #else + pref("dom.ipc.plugins.sandbox-level.flash", 0); + #endif + + // This controls the strength of the Windows content process sandbox for + // testing purposes. This will require a restart. + // On windows these levels are: + // See - security/sandbox/win/src/sandboxbroker/sandboxBroker.cpp + // SetSecurityLevelForContentProcess() for what the different settings mean. + pref("security.sandbox.content.level", 6); + + // This controls the strength of the Windows GPU process sandbox. Changes + // will require restart. + // For information on what the level number means, see + // SetSecurityLevelForGPUProcess() in + // security/sandbox/win/src/sandboxbroker/sandboxBroker.cpp + pref("security.sandbox.gpu.level", 0); +#endif + +#if defined(XP_MACOSX) && defined(MOZ_SANDBOX) + // This pref is discussed in bug 1083344, the naming is inspired from its + // Windows counterpart, but on Mac it's an integer which means: + // 0 -> "no sandbox" (nightly only) + // 1 -> "preliminary content sandboxing enabled: write access to + // home directory is prevented" + // 2 -> "preliminary content sandboxing enabled with profile protection: + // write access to home directory is prevented, read and write access + // to ~/Library and profile directories are prevented (excluding + // $PROFILE/{extensions,chrome})" + // 3 -> "no global read/write access, read access permitted to + // $PROFILE/{extensions,chrome}" + // This setting is read when the content process is started. On Mac the + // content process is killed when all windows are closed, so a change will + // take effect when the 1st window is opened. + pref("security.sandbox.content.level", 3); + + // Prefs for controlling whether and how the Mac NPAPI Flash plugin process is + // sandboxed. On Mac these levels are: + // 0 - "no sandbox" + // 1 - "global read access, limited write access for Flash functionality" + // 2 - "read access triggered by file dialog activity, limited read/write" + // "access for Flash functionality" + // 3 - "limited read/write access for Flash functionality" + pref("dom.ipc.plugins.sandbox-level.flash", 1); + // Controls the level used on older OS X versions. Is overriden when the + // "dom.ipc.plugins.sandbox-level.flash" is set to 0. + pref("dom.ipc.plugins.sandbox-level.flash.legacy", 1); + // The max OS minor version where we use the above legacy sandbox level. + pref("dom.ipc.plugins.sandbox-level.flash.max-legacy-os-minor", 10); + // Controls the sandbox level used by plugins other than Flash. On Mac, + // no other plugins are supported and this pref is only used for test + // plugins used in automated tests. + pref("dom.ipc.plugins.sandbox-level.default", 1); +#endif + +#if defined(XP_LINUX) && defined(MOZ_SANDBOX) + // This pref is introduced as part of bug 742434, the naming is inspired from + // its Windows/Mac counterpart, but on Linux it's an integer which means: + // 0 -> "no sandbox" + // 1 -> "content sandbox using seccomp-bpf when available" + ipc restrictions + // 2 -> "seccomp-bpf + write file broker" + // 3 -> "seccomp-bpf + read/write file brokering" + // 4 -> all of the above + network/socket restrictions + chroot + // + // The purpose of this setting is to allow Linux users or distros to disable + // the sandbox while we fix their problems, or to allow running Firefox with + // exotic configurations we can't reasonably support out of the box. + // + pref("security.sandbox.content.level", 4); + // Introduced as part of bug 1608558. Linux is currently the only platform + // that uses a sandbox level for the socket process. There are currently + // only 2 levels: + // 0 -> "no sandbox" + // 1 -> "sandboxed, allows socket operations and reading necessary certs" + pref("security.sandbox.socket.process.level", 1); + pref("security.sandbox.content.write_path_whitelist", ""); + pref("security.sandbox.content.read_path_whitelist", ""); + pref("security.sandbox.content.syscall_whitelist", ""); +#endif + +#if defined(XP_OPENBSD) && defined(MOZ_SANDBOX) + pref("security.sandbox.content.level", 1); +#endif + +#if defined(MOZ_SANDBOX) + // ID (a UUID when set by gecko) that is used to form the name of a + // sandbox-writable temporary directory to be used by content processes + // when a temporary writable file is required in a level 1 sandbox. + pref("security.sandbox.content.tempDirSuffix", ""); + pref("security.sandbox.plugin.tempDirSuffix", ""); + + // This pref determines if messages relevant to sandbox violations are + // logged. + #if defined(XP_WIN) || defined(XP_MACOSX) + pref("security.sandbox.logging.enabled", false); + #endif +#endif + +// This pref governs whether we attempt to work around problems caused by +// plugins using OS calls to manipulate the cursor while running out-of- +// process. These workarounds all involve intercepting (hooking) certain +// OS calls in the plugin process, then arranging to make certain OS calls +// in the browser process. Eventually plugins will be required to use the +// NPAPI to manipulate the cursor, and these workarounds will be removed. +// See bug 621117. +#ifdef XP_MACOSX + pref("dom.ipc.plugins.nativeCursorSupport", true); +#endif + +#ifdef XP_WIN + pref("browser.taskbar.previews.enable", false); + pref("browser.taskbar.previews.max", 20); + pref("browser.taskbar.previews.cachetime", 5); + pref("browser.taskbar.lists.enabled", true); + pref("browser.taskbar.lists.frequent.enabled", true); + pref("browser.taskbar.lists.recent.enabled", false); + pref("browser.taskbar.lists.maxListItemCount", 7); + pref("browser.taskbar.lists.tasks.enabled", true); + pref("browser.taskbar.lists.refreshInSeconds", 120); +#endif + +// Preferences to be synced by default +pref("services.sync.prefs.sync.accessibility.blockautorefresh", true); +pref("services.sync.prefs.sync.accessibility.browsewithcaret", true); +pref("services.sync.prefs.sync.accessibility.typeaheadfind", true); +pref("services.sync.prefs.sync.accessibility.typeaheadfind.linksonly", true); +pref("services.sync.prefs.sync.addons.ignoreUserEnabledChanges", true); +pref("services.sync.prefs.sync.app.shield.optoutstudies.enabled", true); +// The addons prefs related to repository verification are intentionally +// not synced for security reasons. If a system is compromised, a user +// could weaken the pref locally, install an add-on from an untrusted +// source, and this would propagate automatically to other, +// uncompromised Sync-connected devices. +pref("services.sync.prefs.sync.browser.contentblocking.category", true); +pref("services.sync.prefs.sync.browser.contentblocking.features.strict", true); +pref("services.sync.prefs.sync.browser.crashReports.unsubmittedCheck.autoSubmit2", true); +pref("services.sync.prefs.sync.browser.ctrlTab.recentlyUsedOrder", true); +pref("services.sync.prefs.sync.browser.discovery.enabled", true); +pref("services.sync.prefs.sync.browser.download.useDownloadDir", true); +pref("services.sync.prefs.sync.browser.formfill.enable", true); +pref("services.sync.prefs.sync.browser.link.open_newwindow", true); +pref("services.sync.prefs.sync.browser.newtabpage.activity-stream.asrouter.userprefs.cfr.addons", true); +pref("services.sync.prefs.sync.browser.newtabpage.activity-stream.asrouter.userprefs.cfr.features", true); +pref("services.sync.prefs.sync.browser.newtabpage.activity-stream.showSearch", true); +pref("services.sync.prefs.sync.browser.newtabpage.activity-stream.showSponsored", true); +pref("services.sync.prefs.sync.browser.newtabpage.activity-stream.showSponsoredTopSites", true); +pref("services.sync.prefs.sync.browser.newtabpage.activity-stream.feeds.topsites", true); +pref("services.sync.prefs.sync.browser.newtabpage.activity-stream.topSitesRows", true); +pref("services.sync.prefs.sync.browser.newtabpage.activity-stream.feeds.snippets", true); +pref("services.sync.prefs.sync.browser.newtabpage.activity-stream.feeds.section.topstories", true); +pref("services.sync.prefs.sync.browser.newtabpage.activity-stream.section.topstories.rows", true); +pref("services.sync.prefs.sync.browser.newtabpage.activity-stream.feeds.section.highlights", true); +pref("services.sync.prefs.sync.browser.newtabpage.activity-stream.section.highlights.includeVisited", true); +pref("services.sync.prefs.sync.browser.newtabpage.activity-stream.section.highlights.includeBookmarks", true); +pref("services.sync.prefs.sync.browser.newtabpage.activity-stream.section.highlights.includeDownloads", true); +pref("services.sync.prefs.sync.browser.newtabpage.activity-stream.section.highlights.includePocket", true); +pref("services.sync.prefs.sync.browser.newtabpage.activity-stream.section.highlights.rows", true); +pref("services.sync.prefs.sync.browser.newtabpage.enabled", true); +pref("services.sync.prefs.sync.browser.newtabpage.pinned", true); +pref("services.sync.prefs.sync.browser.offline-apps.notify", true); +pref("services.sync.prefs.sync.browser.safebrowsing.downloads.enabled", true); +pref("services.sync.prefs.sync.browser.safebrowsing.downloads.remote.block_potentially_unwanted", true); +pref("services.sync.prefs.sync.browser.safebrowsing.malware.enabled", true); +pref("services.sync.prefs.sync.browser.safebrowsing.phishing.enabled", true); +pref("services.sync.prefs.sync.browser.search.update", true); +pref("services.sync.prefs.sync.browser.search.widget.inNavBar", true); +pref("services.sync.prefs.sync.browser.sessionstore.warnOnQuit", true); +pref("services.sync.prefs.sync.browser.startup.homepage", true); +pref("services.sync.prefs.sync.browser.startup.page", true); +pref("services.sync.prefs.sync.browser.tabs.loadInBackground", true); +pref("services.sync.prefs.sync.browser.tabs.warnOnClose", true); +pref("services.sync.prefs.sync.browser.tabs.warnOnOpen", true); +pref("services.sync.prefs.sync.browser.taskbar.previews.enable", true); +pref("services.sync.prefs.sync.browser.urlbar.matchBuckets", true); +pref("services.sync.prefs.sync.browser.urlbar.maxRichResults", true); +pref("services.sync.prefs.sync.browser.urlbar.suggest.bookmark", true); +pref("services.sync.prefs.sync.browser.urlbar.suggest.history", true); +pref("services.sync.prefs.sync.browser.urlbar.suggest.openpage", true); +pref("services.sync.prefs.sync.browser.urlbar.suggest.searches", true); +pref("services.sync.prefs.sync.browser.urlbar.suggest.topsites", true); +pref("services.sync.prefs.sync.browser.urlbar.suggest.engines", true); +pref("services.sync.prefs.sync.dom.disable_open_during_load", true); +pref("services.sync.prefs.sync.dom.disable_window_flip", true); +pref("services.sync.prefs.sync.dom.disable_window_move_resize", true); +pref("services.sync.prefs.sync.dom.event.contextmenu.enabled", true); +pref("services.sync.prefs.sync.dom.security.https_only_mode", true); +pref("services.sync.prefs.sync.dom.security.https_only_mode_ever_enabled", true); +pref("services.sync.prefs.sync.dom.security.https_only_mode_ever_enabled_pbm", true); +pref("services.sync.prefs.sync.dom.security.https_only_mode_pbm", true); +pref("services.sync.prefs.sync.extensions.update.enabled", true); +pref("services.sync.prefs.sync.extensions.activeThemeID", true); +pref("services.sync.prefs.sync.general.autoScroll", true); +pref("services.sync.prefs.sync.general.smoothScroll", true); +pref("services.sync.prefs.sync.intl.accept_languages", true); +pref("services.sync.prefs.sync.intl.regional_prefs.use_os_locales", true); +pref("services.sync.prefs.sync.layout.spellcheckDefault", true); +pref("services.sync.prefs.sync.media.autoplay.default", true); +pref("services.sync.prefs.sync.media.eme.enabled", true); +pref("services.sync.prefs.sync.media.videocontrols.picture-in-picture.video-toggle.enabled", true); +pref("services.sync.prefs.sync.network.cookie.cookieBehavior", true); +pref("services.sync.prefs.sync.network.cookie.lifetimePolicy", true); +pref("services.sync.prefs.sync.network.cookie.thirdparty.sessionOnly", true); +pref("services.sync.prefs.sync.permissions.default.image", true); +pref("services.sync.prefs.sync.pref.downloads.disable_button.edit_actions", true); +pref("services.sync.prefs.sync.pref.privacy.disable_button.cookie_exceptions", true); +pref("services.sync.prefs.sync.privacy.clearOnShutdown.cache", true); +pref("services.sync.prefs.sync.privacy.clearOnShutdown.cookies", true); +pref("services.sync.prefs.sync.privacy.clearOnShutdown.downloads", true); +pref("services.sync.prefs.sync.privacy.clearOnShutdown.formdata", true); +pref("services.sync.prefs.sync.privacy.clearOnShutdown.history", true); +pref("services.sync.prefs.sync.privacy.clearOnShutdown.offlineApps", true); +pref("services.sync.prefs.sync.privacy.clearOnShutdown.sessions", true); +pref("services.sync.prefs.sync.privacy.clearOnShutdown.siteSettings", true); +pref("services.sync.prefs.sync.privacy.donottrackheader.enabled", true); +pref("services.sync.prefs.sync.privacy.fuzzyfox.enabled", false); +pref("services.sync.prefs.sync.privacy.fuzzyfox.clockgrainus", false); +pref("services.sync.prefs.sync.privacy.sanitize.sanitizeOnShutdown", true); +pref("services.sync.prefs.sync.privacy.trackingprotection.enabled", true); +pref("services.sync.prefs.sync.privacy.trackingprotection.cryptomining.enabled", true); +pref("services.sync.prefs.sync.privacy.trackingprotection.fingerprinting.enabled", true); +pref("services.sync.prefs.sync.privacy.trackingprotection.pbmode.enabled", true); +pref("services.sync.prefs.sync.privacy.resistFingerprinting", true); +pref("services.sync.prefs.sync.privacy.reduceTimerPrecision", true); +pref("services.sync.prefs.sync.privacy.resistFingerprinting.reduceTimerPrecision.microseconds", true); +pref("services.sync.prefs.sync.privacy.resistFingerprinting.reduceTimerPrecision.jitter", true); +pref("services.sync.prefs.sync.privacy.userContext.enabled", true); +pref("services.sync.prefs.sync.privacy.userContext.newTabContainerOnLeftClick.enabled", true); +pref("services.sync.prefs.sync.security.default_personal_cert", true); +pref("services.sync.prefs.sync.services.sync.syncedTabs.showRemoteIcons", true); +pref("services.sync.prefs.sync.signon.autofillForms", true); +pref("services.sync.prefs.sync.signon.generation.enabled", true); +pref("services.sync.prefs.sync.signon.management.page.breach-alerts.enabled", true); +pref("services.sync.prefs.sync.signon.rememberSignons", true); +pref("services.sync.prefs.sync.spellchecker.dictionary", true); +pref("services.sync.prefs.sync.ui.osk.enabled", true); + +// A preference which, if false, means sync will only apply incoming preference +// changes if there's already a local services.sync.prefs.sync.* control pref. +// If true, all incoming preferences will be applied and the local "control +// pref" updated accordingly. +pref("services.sync.prefs.dangerously_allow_arbitrary", false); + +// A preference that controls whether we should show the icon for a remote tab. +// This pref has no UI but exists because some people may be concerned that +// fetching these icons to show remote tabs may leak information about that +// user's tabs and bookmarks. Note this pref is also synced. +pref("services.sync.syncedTabs.showRemoteIcons", true); + +// Whether the character encoding menu is under the main Firefox button. This +// preference is a string so that localizers can alter it. +pref("browser.menu.showCharacterEncoding", "chrome://browser/locale/browser.properties"); + +// Whether prompts should be content modal (1) tab modal (2) or window modal(3) by default +// This is a fallback value for when prompt callers do not specify a modalType. +pref("prompts.defaultModalType", 3); + +pref("browser.topsites.useRemoteSetting", false); + +// The base URL for the Quick Suggest anonymizing proxy. To make a request to +// the proxy, include a campaign ID in the path. +pref("browser.partnerlink.attributionURL", "https://topsites.services.mozilla.com/cid/"); +pref("browser.partnerlink.campaign.topsites", "amzn_2020_a1"); + +// Whether to show tab level system prompts opened via nsIPrompt(Service) as +// SubDialogs in the TabDialogBox (true) or as TabModalPrompt in the +// TabModalPromptBox (false). +pref("prompts.tabChromePromptSubDialog", true); + +// Whether to show the dialogs opened at the content level, such as +// alert() or prompt(), using a SubDialogManager in the TabDialogBox. +#ifdef EARLY_BETA_OR_EARLIER + pref("prompts.contentPromptSubDialog", true); +#else + pref("prompts.contentPromptSubDialog", false); +#endif + +// Activates preloading of the new tab url. +pref("browser.newtab.preload", true); + +// Preference to enable the entire new newtab experience at once. +pref("browser.newtabpage.activity-stream.newNewtabExperience.enabled", false); + +// A preference which allows us to enable the fly out customization overlay +// on the newtab page. +pref("browser.newtabpage.activity-stream.customizationMenu.enabled", false); +pref("browser.newtabpage.activity-stream.newNewtabExperience.colors", "#0090ED,#FF4F5F,#2AC3A2,#FF7139,#A172FF,#FFA437,#FF2A8A"); + +// Activity Stream prefs that control to which page to redirect +#ifndef RELEASE_OR_BETA + pref("browser.newtabpage.activity-stream.debug", false); +#endif + +pref("browser.library.activity-stream.enabled", true); + +// The remote FxA root content URL for the Activity Stream firstrun page. +pref("browser.newtabpage.activity-stream.fxaccounts.endpoint", "https://accounts.firefox.com/"); + +// The pref that controls if the search shortcuts experiment is on +pref("browser.newtabpage.activity-stream.improvesearch.topSiteSearchShortcuts", true); + +// ASRouter provider configuration +pref("browser.newtabpage.activity-stream.asrouter.providers.cfr", "{\"id\":\"cfr\",\"enabled\":true,\"type\":\"remote-settings\",\"bucket\":\"cfr\",\"updateCycleInMs\":3600000}"); +pref("browser.newtabpage.activity-stream.asrouter.providers.whats-new-panel", "{\"id\":\"whats-new-panel\",\"enabled\":true,\"type\":\"remote-settings\",\"bucket\":\"whats-new-panel\",\"updateCycleInMs\":3600000}"); +pref("browser.newtabpage.activity-stream.asrouter.providers.message-groups", "{\"id\":\"message-groups\",\"enabled\":true,\"type\":\"remote-settings\",\"bucket\":\"message-groups\",\"updateCycleInMs\":3600000}"); +// This url, if changed, MUST continue to point to an https url. Pulling arbitrary content to inject into +// this page over http opens us up to a man-in-the-middle attack that we'd rather not face. If you are a downstream +// repackager of this code using an alternate snippet url, please keep your users safe +pref("browser.newtabpage.activity-stream.asrouter.providers.snippets", "{\"id\":\"snippets\",\"enabled\":true,\"type\":\"remote\",\"url\":\"https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VERSION%/%DISTRIBUTION%/%DISTRIBUTION_VERSION%/\",\"updateCycleInMs\":14400000}"); +pref("browser.newtabpage.activity-stream.asrouter.providers.messaging-experiments", "{\"id\":\"messaging-experiments\",\"enabled\":true,\"type\":\"remote-experiments\",\"messageGroups\":[\"cfr\",\"whats-new-panel\",\"moments-page\",\"snippets\",\"cfr-fxa\",\"aboutwelcome\",\"infobar\"],\"updateCycleInMs\":3600000}"); + +// ASRouter user prefs +pref("browser.newtabpage.activity-stream.asrouter.userprefs.cfr.addons", true); +pref("browser.newtabpage.activity-stream.asrouter.userprefs.cfr.features", true); + +// The pref that controls if ASRouter uses the remote fluent files. +// It's enabled by default, but could be disabled to force ASRouter to use the local files. +pref("browser.newtabpage.activity-stream.asrouter.useRemoteL10n", true); + +// These prefs control if Discovery Stream is enabled. +pref("browser.newtabpage.activity-stream.discoverystream.enabled", true); +pref("browser.newtabpage.activity-stream.discoverystream.hardcoded-basic-layout", false); +pref("browser.newtabpage.activity-stream.discoverystream.spocs-endpoint", ""); +pref("browser.newtabpage.activity-stream.discoverystream.spocs-endpoint-query", ""); + +// List of regions that do not get stories, regardless of locale-list-config. +pref("browser.newtabpage.activity-stream.discoverystream.region-stories-block", "FR"); +// List of locales that get stories, regardless of region-stories-config. +#ifdef NIGHTLY_BUILD + pref("browser.newtabpage.activity-stream.discoverystream.locale-list-config", "en-US,en-CA,en-GB"); +#else + pref("browser.newtabpage.activity-stream.discoverystream.locale-list-config", ""); +#endif +// List of regions that get stories by default. +pref("browser.newtabpage.activity-stream.discoverystream.region-stories-config", "US,DE,CA,GB,IE,CH,AT,BE,IN"); + +// List of regions that get spocs by default. +pref("browser.newtabpage.activity-stream.discoverystream.region-spocs-config", "US,CA,DE,GB"); +// List of regions that don't get the 7 row layout. +pref("browser.newtabpage.activity-stream.discoverystream.region-basic-config", ""); + +// Allows Pocket story collections to be dismissed. +pref("browser.newtabpage.activity-stream.discoverystream.isCollectionDismissible", true); +pref("browser.newtabpage.activity-stream.discoverystream.personalization.version", 2); +// Configurable keys used by personalization version 2. +pref("browser.newtabpage.activity-stream.discoverystream.personalization.modelKeys", "nb_model_arts_and_entertainment, nb_model_autos_and_vehicles, nb_model_beauty_and_fitness, nb_model_blogging_resources_and_services, nb_model_books_and_literature, nb_model_business_and_industrial, nb_model_computers_and_electronics, nb_model_finance, nb_model_food_and_drink, nb_model_games, nb_model_health, nb_model_hobbies_and_leisure, nb_model_home_and_garden, nb_model_internet_and_telecom, nb_model_jobs_and_education, nb_model_law_and_government, nb_model_online_communities, nb_model_people_and_society, nb_model_pets_and_animals, nb_model_real_estate, nb_model_reference, nb_model_science, nb_model_shopping, nb_model_sports, nb_model_travel"); +// System pref to allow Pocket stories personalization to be turned on/off. +pref("browser.newtabpage.activity-stream.discoverystream.recs.personalized", false); +// System pref to allow Pocket sponsored content personalization to be turned on/off. +pref("browser.newtabpage.activity-stream.discoverystream.spocs.personalized", true); + +// User pref to show stories on newtab (feeds.system.topstories has to be set to true as well) +pref("browser.newtabpage.activity-stream.feeds.section.topstories", true); + +// The pref controls if search hand-off is enabled for Activity Stream. +#ifdef NIGHTLY_BUILD + pref("browser.newtabpage.activity-stream.improvesearch.handoffToAwesomebar", true); +#else + pref("browser.newtabpage.activity-stream.improvesearch.handoffToAwesomebar", false); +#endif + +pref("browser.newtabpage.activity-stream.logowordmark.alwaysVisible", false); + +// Used to display triplet cards on newtab +pref("trailhead.firstrun.newtab.triplets", ""); +// Separate about welcome +pref("browser.aboutwelcome.enabled", true); +// Used to set multistage welcome UX +pref("browser.aboutwelcome.overrideContent", ""); + +// The pref that controls if the What's New panel is enabled. +pref("browser.messaging-system.whatsNewPanel.enabled", true); +// Used for CFR messages with scores. See Bug 1594422. +pref("browser.messaging-system.personalized-cfr.scores", "{}"); +pref("browser.messaging-system.personalized-cfr.score-threshold", 5000); + +// Experiment Manager +// See Console.jsm LOG_LEVELS for all possible values +pref("messaging-system.log", "warn"); +pref("messaging-system.rsexperimentloader.enabled", true); +pref("messaging-system.rsexperimentloader.collection_id", "nimbus-desktop-experiments"); + +// Enable the DOM fullscreen API. +pref("full-screen-api.enabled", true); + +// Startup Crash Tracking +// number of startup crashes that can occur before starting into safe mode automatically +// (this pref has no effect if more than 6 hours have passed since the last crash) +pref("toolkit.startup.max_resumed_crashes", 3); + +// Whether to use RegisterApplicationRestart to restart the browser and resume +// the session on next Windows startup +#if defined(XP_WIN) + pref("toolkit.winRegisterApplicationRestart", true); +#endif + +// Completely disable pdf.js as an option to preview pdfs within firefox. +// Note: if this is not disabled it does not necessarily mean pdf.js is the pdf +// handler just that it is an option. +pref("pdfjs.disabled", false); +// Used by pdf.js to know the first time firefox is run with it installed so it +// can become the default pdf viewer. +pref("pdfjs.firstRun", true); +// The values of preferredAction and alwaysAskBeforeHandling before pdf.js +// became the default. +pref("pdfjs.previousHandler.preferredAction", 0); +pref("pdfjs.previousHandler.alwaysAskBeforeHandling", false); + +// Try to convert PDFs sent as octet-stream +pref("pdfjs.handleOctetStream", true); + +// Is the sidebar positioned ahead of the content browser +pref("sidebar.position_start", true); + +pref("security.identitypopup.recordEventTelemetry", true); +pref("security.protectionspopup.recordEventTelemetry", true); +pref("security.app_menu.recordEventTelemetry", true); + +// Block insecure active content on https pages +pref("security.mixed_content.block_active_content", true); + +// Show in-content login form warning UI for insecure login fields +pref("security.insecure_field_warning.contextual.enabled", true); + +// Show degraded UI for http pages. +pref("security.insecure_connection_icon.enabled", true); +// Show degraded UI for http pages in private mode. +pref("security.insecure_connection_icon.pbmode.enabled", true); + +// For secure connections, show gray instead of green lock icon +pref("security.secure_connection_icon_color_gray", true); + +// Show "Not Secure" text for http pages; disabled for now +pref("security.insecure_connection_text.enabled", false); +pref("security.insecure_connection_text.pbmode.enabled", false); + +// 1 = allow MITM for certificate pinning checks. +pref("security.cert_pinning.enforcement_level", 1); + + +// If this turns true, Moz*Gesture events are not called stopPropagation() +// before content. +pref("dom.debug.propagate_gesture_events_through_content", false); + +// CustomizableUI debug logging. +pref("browser.uiCustomization.debug", false); + +// CustomizableUI state of the browser's user interface +pref("browser.uiCustomization.state", ""); + +// If set to false, FxAccounts and Sync will be unavailable. +// A restart is mandatory after flipping that preference. +pref("identity.fxaccounts.enabled", true); + +// The remote FxA root content URL. Must use HTTPS. +pref("identity.fxaccounts.remote.root", "https://accounts.firefox.com/"); + +// The value of the context query parameter passed in fxa requests. +pref("identity.fxaccounts.contextParam", "fx_desktop_v3"); + +// The remote URL of the FxA Profile Server +pref("identity.fxaccounts.remote.profile.uri", "https://profile.accounts.firefox.com/v1"); + +// The remote URL of the FxA OAuth Server +pref("identity.fxaccounts.remote.oauth.uri", "https://oauth.accounts.firefox.com/v1"); + +// Whether FxA pairing using QR codes is enabled. +pref("identity.fxaccounts.pairing.enabled", true); + +// The remote URI of the FxA pairing server +pref("identity.fxaccounts.remote.pairing.uri", "wss://channelserver.services.mozilla.com"); + +// Token server used by the FxA Sync identity. +pref("identity.sync.tokenserver.uri", "https://token.services.mozilla.com/1.0/sync/1.5"); + +// Fetch Sync tokens using the OAuth token function +pref("identity.sync.useOAuthForSyncToken", true); + +// Using session tokens to fetch OAuth tokens +pref("identity.fxaccounts.useSessionTokensForOAuth", true); + +// Auto-config URL for FxA self-hosters, makes an HTTP request to +// [identity.fxaccounts.autoconfig.uri]/.well-known/fxa-client-configuration +// This is now the prefered way of pointing to a custom FxA server, instead +// of making changes to "identity.fxaccounts.*.uri". +pref("identity.fxaccounts.autoconfig.uri", ""); + +// URL for help link about Send Tab. +pref("identity.sendtabpromo.url", "https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab"); + +// URLs for promo links to mobile browsers. Note that consumers are expected to +// append a value for utm_campaign. +pref("identity.mobilepromo.android", "https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign="); +pref("identity.mobilepromo.ios", "https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign="); + +// Migrate any existing Firefox Account data from the default profile to the +// Developer Edition profile. +#ifdef MOZ_DEV_EDITION + pref("identity.fxaccounts.migrateToDevEdition", true); +#else + pref("identity.fxaccounts.migrateToDevEdition", false); +#endif + +// If activated, send tab will use the new FxA commands backend. +pref("identity.fxaccounts.commands.enabled", true); +// How often should we try to fetch missed FxA commands on sync (in seconds). +// Default is 24 hours. +pref("identity.fxaccounts.commands.missed.fetch_interval", 86400); + +// Whether we should run a test-pattern through EME GMPs before assuming they'll +// decode H.264. +pref("media.gmp.trial-create.enabled", true); + +// Note: when media.gmp-*.visible is true, provided we're running on a +// supported platform/OS version, the corresponding CDM appears in the +// plugins list, Firefox will download the GMP/CDM if enabled, and our +// UI to re-enable EME prompts the user to re-enable EME if it's disabled +// and script requests EME. If *.visible is false, we won't show the UI +// to enable the CDM if its disabled; it's as if the keysystem is completely +// unsupported. + +#ifdef MOZ_WIDEVINE_EME + pref("media.gmp-widevinecdm.visible", true); + pref("media.gmp-widevinecdm.enabled", true); +#endif + +pref("media.gmp-gmpopenh264.visible", true); +pref("media.gmp-gmpopenh264.enabled", true); + +// Set Firefox to block autoplay, asking for permission by default. +pref("media.autoplay.default", 1); // 0=Allowed, 1=Blocked, 5=All Blocked + +#ifdef NIGHTLY_BUILD + // Block WebAudio from playing automatically. + pref("media.autoplay.block-webaudio", true); +#else + pref("media.autoplay.block-webaudio", false); +#endif + +pref("media.videocontrols.picture-in-picture.enabled", true); +pref("media.videocontrols.picture-in-picture.video-toggle.enabled", true); +pref("media.videocontrols.picture-in-picture.keyboard-controls.enabled", true); + +#ifdef NIGHTLY_BUILD + // Show the audio toggle for Picture-in-Picture. + pref("media.videocontrols.picture-in-picture.audio-toggle.enabled", true); + // Enable keyboard controls for Picture-in-Picture. +#else + pref("media.videocontrols.picture-in-picture.audio-toggle.enabled", false); +#endif + +pref("browser.translation.detectLanguage", false); +pref("browser.translation.neverForLanguages", ""); +// Show the translation UI bits, like the info bar, notification icon and preferences. +pref("browser.translation.ui.show", false); +// Allows to define the translation engine. Google is default, Bing or Yandex are other options. +pref("browser.translation.engine", "Google"); + +// Telemetry settings. +// Determines if Telemetry pings can be archived locally. +pref("toolkit.telemetry.archive.enabled", true); +// Enables sending the shutdown ping when Firefox shuts down. +pref("toolkit.telemetry.shutdownPingSender.enabled", true); +// Enables sending the shutdown ping using the pingsender from the first session. +pref("toolkit.telemetry.shutdownPingSender.enabledFirstSession", false); +// Enables sending a duplicate of the first shutdown ping from the first session. +pref("toolkit.telemetry.firstShutdownPing.enabled", true); +// Enables sending the 'new-profile' ping on new profiles. +pref("toolkit.telemetry.newProfilePing.enabled", true); +// Enables sending 'update' pings on Firefox updates. +pref("toolkit.telemetry.updatePing.enabled", true); +// Enables sending 'bhr' pings when the browser hangs. +pref("toolkit.telemetry.bhrPing.enabled", true); +// Whether to enable Ecosystem Telemetry, requires a restart. +pref("toolkit.telemetry.ecosystemtelemetry.enabled", false); + +// Ping Centre Telemetry settings. +pref("browser.ping-centre.telemetry", true); +pref("browser.ping-centre.log", false); + +// Enable GMP support in the addon manager. +pref("media.gmp-provider.enabled", true); + +#ifdef NIGHTLY_BUILD +// Enable Dynamic First-Party Isolation in Nightly. +pref("network.cookie.cookieBehavior", 5 /* BEHAVIOR_REJECT_TRACKER_AND_PARTITION_FOREIGN */); +#else +// Enable blocking access to storage from tracking resources by default. +pref("network.cookie.cookieBehavior", 4 /* BEHAVIOR_REJECT_TRACKER */); +#endif + +// Enable fingerprinting blocking by default for all channels, only on desktop. +pref("privacy.trackingprotection.fingerprinting.enabled", true); + +// Enable cryptomining blocking by default for all channels, only on desktop. +pref("privacy.trackingprotection.cryptomining.enabled", true); + +pref("browser.contentblocking.database.enabled", true); + +pref("dom.storage_access.enabled", true); + +pref("browser.contentblocking.cryptomining.preferences.ui.enabled", true); +pref("browser.contentblocking.fingerprinting.preferences.ui.enabled", true); +#ifdef NIGHTLY_BUILD + // Enable cookieBehavior = BEHAVIOR_REJECT_TRACKER_AND_PARTITION_FOREIGN as an option in the custom category ui + pref("browser.contentblocking.reject-and-isolate-cookies.preferences.ui.enabled", true); +#endif +// State Partitioning MVP UI. +pref("browser.contentblocking.state-partitioning.mvp.ui.enabled", true); + +// Possible values for browser.contentblocking.features.strict pref: +// Tracking Protection: +// "tp": tracking protection enabled +// "-tp": tracking protection disabled +// Tracking Protection in private windows: +// "tpPrivate": tracking protection in private windows enabled +// "-tpPrivate": tracking protection in private windows disabled +// Fingerprinting: +// "fp": fingerprinting blocking enabled +// "-fp": fingerprinting blocking disabled +// Cryptomining: +// "cm": cryptomining blocking enabled +// "-cm": cryptomining blocking disabled +// Social Tracking Protection: +// "stp": social tracking protection enabled +// "-stp": social tracking protection disabled +// Cookie behavior: +// "cookieBehavior0": cookie behaviour BEHAVIOR_ACCEPT +// "cookieBehavior1": cookie behaviour BEHAVIOR_REJECT_FOREIGN +// "cookieBehavior2": cookie behaviour BEHAVIOR_REJECT +// "cookieBehavior3": cookie behaviour BEHAVIOR_LIMIT_FOREIGN +// "cookieBehavior4": cookie behaviour BEHAVIOR_REJECT_TRACKER +// "cookieBehavior5": cookie behaviour BEHAVIOR_REJECT_TRACKER_AND_PARTITION_FOREIGN +// One value from each section must be included in the browser.contentblocking.features.strict pref. +pref("browser.contentblocking.features.strict", "tp,tpPrivate,cookieBehavior5,cm,fp,stp,lvl2"); + +// Hide the "Change Block List" link for trackers/tracking content in the custom +// Content Blocking/ETP panel. By default, it will not be visible. There is also +// an UI migration in place to set this pref to true if a user has a custom block +// lists enabled. +pref("browser.contentblocking.customBlockList.preferences.ui.enabled", false); + +pref("browser.contentblocking.reportBreakage.url", "https://tracking-protection-issues.herokuapp.com/new"); + +// Enable Protections report's Lockwise card by default. +pref("browser.contentblocking.report.lockwise.enabled", true); + +// Enable Protections report's Monitor card by default. +pref("browser.contentblocking.report.monitor.enabled", true); + +// Disable Protections report's Proxy card by default. +pref("browser.contentblocking.report.proxy.enabled", false); + +// Disable the mobile promotion by default. +pref("browser.contentblocking.report.show_mobile_app", true); + +// Enable the vpn card by default. +pref("browser.contentblocking.report.vpn.enabled", true); +// Only show vpn card to certain regions. Comma separated string of two letter ISO 3166-1 country codes. +pref("browser.contentblocking.report.vpn_regions", "us,ca,nz,sg,my,gb"); +// Comma separated string of mozilla vpn supported platforms. +pref("browser.contentblocking.report.vpn_platforms", "win"); +pref("browser.contentblocking.report.hide_vpn_banner", false); +pref("browser.contentblocking.report.vpn_sub_id", "sub_HrfCZF7VPHzZkA"); + +pref("browser.contentblocking.report.monitor.url", "https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections"); +pref("browser.contentblocking.report.monitor.how_it_works.url", "https://monitor.firefox.com/about"); +pref("browser.contentblocking.report.monitor.sign_in_url", "https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protections&email="); +pref("browser.contentblocking.report.monitor.preferences_url", "https://monitor.firefox.com/user/preferences"); +pref("browser.contentblocking.report.monitor.home_page_url", "https://monitor.firefox.com/user/dashboard"); +pref("browser.contentblocking.report.manage_devices.url", "https://accounts.firefox.com/settings/clients"); +pref("browser.contentblocking.report.endpoint_url", "https://monitor.firefox.com/user/breach-stats?includeResolved=true"); +pref("browser.contentblocking.report.proxy_extension.url", "https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-protections&utm_content=about-protections"); +pref("browser.contentblocking.report.mobile-ios.url", "https://apps.apple.com/app/firefox-private-safe-browser/id989804926"); +pref("browser.contentblocking.report.mobile-android.url", "https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_report%26utm_content%3Dmobile_promotion"); +pref("browser.contentblocking.report.vpn.url", "https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-protections-card"); +pref("browser.contentblocking.report.vpn-promo.url", "https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-protections-top-promo"); +pref("browser.contentblocking.report.vpn-android.url", "https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-browser%26utm_medium%3Dfirefox-browser%26utm_campaign%3Dabout-protections-mobile-vpn%26anid%3D--"); +pref("browser.contentblocking.report.vpn-ios.url", "https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738"); + +// Protection Report's SUMO urls +pref("browser.contentblocking.report.lockwise.how_it_works.url", "https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report"); +pref("browser.contentblocking.report.social.url", "https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report"); +pref("browser.contentblocking.report.cookie.url", "https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report"); +pref("browser.contentblocking.report.tracker.url", "https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report"); +pref("browser.contentblocking.report.fingerprinter.url", "https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report"); +pref("browser.contentblocking.report.cryptominer.url", "https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report"); + +pref("browser.contentblocking.cfr-milestone.enabled", true); +pref("browser.contentblocking.cfr-milestone.milestone-achieved", 0); +// Milestones should always be in increasing order +pref("browser.contentblocking.cfr-milestone.milestones", "[1000, 5000, 10000, 25000, 50000, 100000, 250000, 314159, 500000, 750000, 1000000, 1250000, 1500000, 1750000, 2000000, 2250000, 2500000, 8675309]"); + +// Enables the new Protections Panel. +#ifdef NIGHTLY_BUILD + pref("browser.protections_panel.enabled", true); + pref("browser.protections_panel.infoMessage.seen", false); +#endif + +// Always enable newtab segregation using containers +pref("privacy.usercontext.about_newtab_segregation.enabled", true); +// Enable Contextual Identity Containers +#ifdef NIGHTLY_BUILD + pref("privacy.userContext.enabled", true); + pref("privacy.userContext.ui.enabled", true); +#else + pref("privacy.userContext.enabled", false); + pref("privacy.userContext.ui.enabled", false); +#endif +pref("privacy.userContext.extension", ""); +// allows user to open container menu on a left click instead of a new +// tab in the default container +pref("privacy.userContext.newTabContainerOnLeftClick.enabled", false); + +#if defined(NIGHTLY_BUILD) || defined(XP_WIN) || defined(XP_MACOSX) +// Set to true to allow the user to silence all notifications when +// sharing the screen. Only shipping on Windows and macOS out to +// release. Enabled for all desktop platforms on Nightly. +pref("privacy.webrtc.allowSilencingNotifications", true); +// Set to true to use the legacy WebRTC global indicator +pref("privacy.webrtc.legacyGlobalIndicator", false); +pref("privacy.webrtc.hideGlobalIndicator", false); +#else +pref("privacy.webrtc.allowSilencingNotifications", false); +pref("privacy.webrtc.legacyGlobalIndicator", true); +#endif + +// Set to true to add toggles to the WebRTC indicator for globally +// muting the camera and microphone. +pref("privacy.webrtc.globalMuteToggles", false); + +// Set to true to enable a warning displayed when attempting +// to switch tabs in a window that's being shared over WebRTC. +pref("privacy.webrtc.sharedTabWarning", false); + +// Start the browser in e10s mode +pref("browser.tabs.remote.autostart", true); +pref("browser.tabs.remote.desktopbehavior", true); + +// Run media transport in a separate process? +#ifdef EARLY_BETA_OR_EARLIER + pref("media.peerconnection.mtransport_process", true); +#else + pref("media.peerconnection.mtransport_process", false); +#endif + +// For speculatively warming up tabs to improve perceived +// performance while using the async tab switcher. +pref("browser.tabs.remote.warmup.enabled", true); + +// Caches tab layers to improve perceived performance +// of tab switches. +pref("browser.tabs.remote.tabCacheSize", 0); + +pref("browser.tabs.remote.warmup.maxTabs", 3); +pref("browser.tabs.remote.warmup.unloadDelayMs", 2000); + +// For the about:tabcrashed page +pref("browser.tabs.crashReporting.sendReport", true); +pref("browser.tabs.crashReporting.includeURL", false); +pref("browser.tabs.crashReporting.requestEmail", false); +pref("browser.tabs.crashReporting.emailMe", false); +pref("browser.tabs.crashReporting.email", ""); + +// If true, unprivileged extensions may use experimental APIs on +// nightly and developer edition. +pref("extensions.experiments.enabled", false); + +#if defined(XP_WIN) + // Allows us to deprioritize the processes of background tabs at an OS level + pref("dom.ipc.processPriorityManager.enabled", true); +#endif + +// Don't limit how many nodes we care about on desktop: +pref("reader.parse-node-limit", 0); + +// On desktop, we want the URLs to be included here for ease of debugging, +// and because (normally) these errors are not persisted anywhere. +pref("reader.errors.includeURLs", true); + +pref("view_source.tab", true); + +pref("dom.serviceWorkers.enabled", true); + +// Enable Push API. +pref("dom.push.enabled", true); + +// These are the thumbnail width/height set in about:newtab. +// If you change this, ENSURE IT IS THE SAME SIZE SET +// by about:newtab. These values are in CSS pixels. +pref("toolkit.pageThumbs.minWidth", 280); +pref("toolkit.pageThumbs.minHeight", 190); + +// Enable speech synthesis +pref("media.webspeech.synth.enabled", true); + +pref("browser.esedbreader.loglevel", "Error"); + +pref("browser.laterrun.enabled", false); + +pref("dom.ipc.processPrelaunch.enabled", true); + +// See comments in bug 1340115 on how we got to these numbers. +pref("browser.migrate.chrome.history.limit", 2000); +pref("browser.migrate.chrome.history.maxAgeInDays", 180); +pref("browser.migrate.showBookmarksToolbarAfterMigration", true); + +pref("extensions.pocket.api", "api.getpocket.com"); +pref("extensions.pocket.enabled", true); +pref("extensions.pocket.oAuthConsumerKey", "40249-e88c401e1b1f2242d9e441c4"); +pref("extensions.pocket.site", "getpocket.com"); +pref("extensions.pocket.onSaveRecs", true); +pref("extensions.pocket.onSaveRecs.locales", "en-US,en-GB,en-CA"); + +// Control what version of the logged out doorhanger is displayed +// Possibilities are: `control`, `control-one-button`, `variant_a`, `variant_b`, `variant_c` +pref("extensions.pocket.loggedOutVariant", "control"); + +#ifdef NIGHTLY_BUILD +pref("signon.management.page.fileImport.enabled", true); +pref("signon.management.page.os-auth.enabled", true); +#else +pref("signon.management.page.fileImport.enabled", false); +pref("signon.management.page.os-auth.enabled", false); +#endif +pref("signon.management.page.breach-alerts.enabled", true); +pref("signon.management.page.vulnerable-passwords.enabled", true); +pref("signon.management.page.sort", "name"); +// The utm_creative value is appended within the code (specific to the location on +// where it is clicked). Be sure that if these two prefs are updated, that +// the utm_creative param be last. +pref("signon.management.page.breachAlertUrl", + "https://monitor.firefox.com/breach-details/"); +pref("signon.management.page.showPasswordSyncNotification", true); +pref("signon.passwordEditCapture.enabled", true); +pref("signon.showAutoCompleteFooter", true); +pref("signon.showAutoCompleteImport", "import"); +pref("signon.suggestImportCount", 3); + +// Enable the "Simplify Page" feature in Print Preview. This feature +// is disabled by default in toolkit. +pref("print.use_simplify_page", true); + +// Space separated list of URLS that are allowed to send objects (instead of +// only strings) through webchannels. This list is duplicated in mobile/android/app/mobile.js +pref("webchannel.allowObject.urlWhitelist", "https://content.cdn.mozilla.net https://support.mozilla.org https://install.mozilla.org"); + +// Whether or not the browser should scan for unsubmitted +// crash reports, and then show a notification for submitting +// those reports. +#ifdef NIGHTLY_BUILD + pref("browser.crashReports.unsubmittedCheck.enabled", true); +#else + pref("browser.crashReports.unsubmittedCheck.enabled", false); +#endif + +// chancesUntilSuppress is how many times we'll show the unsubmitted +// crash report notification across different days and shutdown +// without a user choice before we suppress the notification for +// some number of days. +pref("browser.crashReports.unsubmittedCheck.chancesUntilSuppress", 4); +pref("browser.crashReports.unsubmittedCheck.autoSubmit2", false); + +// Preferences for the form autofill system extension +// The truthy values of "extensions.formautofill.available" are "on" and "detect", +// any other value means autofill isn't available. +// "detect" means it's enabled if conditions defined in the extension are met. +pref("extensions.formautofill.available", "detect"); +pref("extensions.formautofill.addresses.enabled", true); +pref("extensions.formautofill.addresses.capture.enabled", false); +pref("extensions.formautofill.creditCards.available", true); +pref("extensions.formautofill.creditCards.enabled", true); +// Checkbox in sync options for credit card data sync service +pref("services.sync.engine.creditcards.available", true); +// Temporary preference to control displaying the UI elements for +// credit card autofill used for the duration of the A/B test. +pref("extensions.formautofill.creditCards.hideui", false); +// Pref for shield/heartbeat to recognize users who have used Credit Card +// Autofill. The valid values can be: +// 0: none +// 1: submitted a manually-filled credit card form (but didn't see the doorhanger +// because of a duplicate profile in the storage) +// 2: saw the doorhanger +// 3: submitted an autofill'ed credit card form +pref("extensions.formautofill.creditCards.used", 0); +pref("extensions.formautofill.firstTimeUse", true); +pref("extensions.formautofill.heuristics.enabled", true); +// Whether the user enabled the OS re-auth dialog. +pref("extensions.formautofill.reauth.enabled", false); +pref("extensions.formautofill.section.enabled", true); +pref("extensions.formautofill.loglevel", "Warn"); + +pref("toolkit.osKeyStore.loglevel", "Warn"); + +pref("extensions.formautofill.supportedCountries", "US,CA"); +pref("extensions.formautofill.supportRTL", false); + +// Whether or not to restore a session with lazy-browser tabs. +pref("browser.sessionstore.restore_tabs_lazily", true); + +pref("browser.suppress_first_window_animation", true); + +// Preference that allows individual users to disable Screenshots. +pref("extensions.screenshots.disabled", false); +// Preference that allows individual users to leave Screenshots enabled, but +// disable uploading to the server. +pref("extensions.screenshots.upload-disabled", false); + +// DoH Rollout: whether to enable automatic performance-based TRR-selection. +// This pref is controlled by a Normandy rollout so we don't overload providers. +pref("doh-rollout.trr-selection.enabled", false); + +// DoH Rollout: whether to enable automatic steering to provider endpoints. +// This pref is also controlled by a Normandy rollout. +pref("doh-rollout.provider-steering.enabled", false); + +// DoH Rollout: provider details for automatic steering. +pref("doh-rollout.provider-steering.provider-list", "[{ \"name\": \"comcast\", \"canonicalName\": \"doh-discovery.xfinity.com\", \"uri\": \"https://doh.xfinity.com/dns-query\" }]"); + +// DoH Rollout: whether to clear the mode value at shutdown. +pref("doh-rollout.clearModeOnShutdown", false); + +// URL for Learn More link for browser error logging in preferences +pref("browser.chrome.errorReporter.infoURL", + "https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/nightly-error-collection"); + +// Normandy client preferences +pref("app.normandy.api_url", "https://normandy.cdn.mozilla.net/api/v1"); +pref("app.normandy.dev_mode", false); +pref("app.normandy.enabled", true); +pref("app.normandy.first_run", true); +pref("app.normandy.logging.level", 50); // Warn +pref("app.normandy.run_interval_seconds", 21600); // 6 hours +pref("app.normandy.shieldLearnMoreUrl", "https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield"); +pref("app.normandy.last_seen_buildid", ""); +pref("app.normandy.onsync_skew_sec", 600); +#ifdef MOZ_DATA_REPORTING + pref("app.shield.optoutstudies.enabled", true); +#else + pref("app.shield.optoutstudies.enabled", false); +#endif + +// Multi-lingual preferences +#if defined(RELEASE_OR_BETA) && !defined(MOZ_DEV_EDITION) + pref("intl.multilingual.enabled", true); + pref("intl.multilingual.downloadEnabled", true); +#else + pref("intl.multilingual.enabled", false); + // AMO only serves language packs for release and beta versions. + pref("intl.multilingual.downloadEnabled", false); +#endif + +// Simulate conditions that will happen when the browser +// is running with Fission enabled. This is meant to assist +// development and testing of Fission. +// The current simulated conditions are: +// - Don't propagate events from subframes to JS child actors +pref("fission.frontend.simulate-events", false); +// - Only deliver subframe messages that specifies +// their destination (using the BrowsingContext id). +pref("fission.frontend.simulate-messages", false); + +// Coverage ping is disabled by default. +pref("toolkit.coverage.enabled", false); +pref("toolkit.coverage.endpoint.base", "https://coverage.mozilla.org"); + +// Discovery prefs +pref("browser.discovery.enabled", true); +pref("browser.discovery.containers.enabled", true); +pref("browser.discovery.sites", "addons.mozilla.org"); + +pref("browser.engagement.recent_visited_origins.expiry", 86400); // 24 * 60 * 60 (24 hours in seconds) +pref("browser.engagement.downloads-button.has-used", false); +pref("browser.engagement.fxa-toolbar-menu-button.has-used", false); +pref("browser.engagement.home-button.has-used", false); +pref("browser.engagement.sidebar-button.has-used", false); +pref("browser.engagement.library-button.has-used", false); +pref("browser.engagement.ctrlTab.has-used", false); + +pref("browser.aboutConfig.showWarning", true); + +pref("browser.toolbars.keyboard_navigation", true); + +// The visibility of the bookmarks toolbar. +// "newtab": Show on the New Tab Page +// "always": Always show +// "never": Never show +pref("browser.toolbars.bookmarks.visibility", "newtab"); + +// Visibility of the "Show Other Bookmarks" menuitem in the +// bookmarks toolbar contextmenu. +pref("browser.toolbars.bookmarks.showOtherBookmarks", true); + +// When true, this pref will always show the bookmarks bar on +// the New Tab Page, and other functionality to improve the usage of the +// Bookmarks Toolbar. +pref("browser.toolbars.bookmarks.2h2020", true); + +// Prefs to control the Firefox Account toolbar menu. +// This pref will surface existing Firefox Account information +// as a button next to the hamburger menu. It allows +// quick access to sign-in and manage your Firefox Account. +pref("identity.fxaccounts.toolbar.enabled", true); +pref("identity.fxaccounts.toolbar.accessed", false); + +// Prefs for different services supported by Firefox Account +pref("identity.fxaccounts.service.monitorLoginUrl", "https://monitor.firefox.com/"); + +// Check bundled omni JARs for corruption. +pref("corroborator.enabled", true); + +// Toolbox preferences +pref("devtools.toolbox.footer.height", 250); +pref("devtools.toolbox.sidebar.width", 500); +pref("devtools.toolbox.host", "bottom"); +pref("devtools.toolbox.previousHost", "right"); +pref("devtools.toolbox.selectedTool", "inspector"); +pref("devtools.toolbox.sideEnabled", true); +pref("devtools.toolbox.zoomValue", "1"); +pref("devtools.toolbox.splitconsoleEnabled", false); +pref("devtools.toolbox.splitconsoleHeight", 100); +pref("devtools.toolbox.tabsOrder", ""); + +// The fission pref for enabling the "Multiprocess Browser Toolbox", which will +// make it possible to debug anything in Firefox (See Bug 1570639 for more +// information). +#if defined(NIGHTLY_BUILD) +pref("devtools.browsertoolbox.fission", true); +#else +pref("devtools.browsertoolbox.fission", false); +#endif + +// This pref is also related to fission, but not only. It allows the toolbox +// to stay open even if the debugged tab switches to another process. +// It can happen between two documents, one running in the parent process like +// about:sessionrestore and another one running in the content process like +// any web page. Or between two distinct domain when running with fission turned +// on. See bug 1565263. +pref("devtools.target-switching.enabled", true); + +// Toolbox Button preferences +pref("devtools.command-button-pick.enabled", true); +pref("devtools.command-button-frames.enabled", true); +pref("devtools.command-button-splitconsole.enabled", true); +pref("devtools.command-button-paintflashing.enabled", false); +pref("devtools.command-button-responsive.enabled", true); +pref("devtools.command-button-screenshot.enabled", false); +pref("devtools.command-button-rulers.enabled", false); +pref("devtools.command-button-measure.enabled", false); +pref("devtools.command-button-noautohide.enabled", false); +pref("devtools.command-button-errorcount.enabled", true); +#ifndef MOZILLA_OFFICIAL + pref("devtools.command-button-fission-prefs.enabled", true); +#endif + +// Inspector preferences +// Enable the Inspector +pref("devtools.inspector.enabled", true); +// What was the last active sidebar in the inspector +pref("devtools.inspector.activeSidebar", "layoutview"); +pref("devtools.inspector.remote", false); + +// Enable the 3 pane mode in the inspector +pref("devtools.inspector.three-pane-enabled", true); +// Enable the 3 pane mode in the chrome inspector +pref("devtools.inspector.chrome.three-pane-enabled", false); +// Collapse pseudo-elements by default in the rule-view +pref("devtools.inspector.show_pseudo_elements", false); +// The default size for image preview tooltips in the rule-view/computed-view/markup-view +pref("devtools.inspector.imagePreviewTooltipSize", 300); +// Enable user agent style inspection in rule-view +pref("devtools.inspector.showUserAgentStyles", false); +// Show native anonymous content and user agent shadow roots +pref("devtools.inspector.showAllAnonymousContent", false); +// Enable the new Rules View +pref("devtools.inspector.new-rulesview.enabled", false); +// Enable the inline CSS compatiblity warning in inspector rule view +pref("devtools.inspector.ruleview.inline-compatibility-warning.enabled", false); +// Enable the compatibility tool in the inspector. +#if defined(NIGHTLY_BUILD) || defined(MOZ_DEV_EDITION) +pref("devtools.inspector.compatibility.enabled", true); +#else +pref("devtools.inspector.compatibility.enabled", false); +#endif +// Enable color scheme simulation in the inspector. +pref("devtools.inspector.color-scheme-simulation.enabled", false); +// Enable overflow debugging in the inspector. +pref("devtools.overflow.debugging.enabled", true); + +// Grid highlighter preferences +pref("devtools.gridinspector.gridOutlineMaxColumns", 50); +pref("devtools.gridinspector.gridOutlineMaxRows", 50); +pref("devtools.gridinspector.showGridAreas", false); +pref("devtools.gridinspector.showGridLineNumbers", false); +pref("devtools.gridinspector.showInfiniteLines", false); +// Max number of grid highlighters that can be displayed +pref("devtools.gridinspector.maxHighlighters", 3); + +// Whether or not the box model panel is opened in the layout view +pref("devtools.layout.boxmodel.opened", true); +// Whether or not the flexbox panel is opened in the layout view +pref("devtools.layout.flexbox.opened", true); +// Whether or not the flexbox container panel is opened in the layout view +pref("devtools.layout.flex-container.opened", true); +// Whether or not the flexbox item panel is opened in the layout view +pref("devtools.layout.flex-item.opened", true); +// Whether or not the grid inspector panel is opened in the layout view +pref("devtools.layout.grid.opened", true); + +// Enable hovering Box Model values and jumping to their source CSS rule in the +// rule-view. +#if defined(NIGHTLY_BUILD) + pref("devtools.layout.boxmodel.highlightProperty", true); +#else + pref("devtools.layout.boxmodel.highlightProperty", false); +#endif + +// By how many times eyedropper will magnify pixels +pref("devtools.eyedropper.zoom", 6); + +// Enable to collapse attributes that are too long. +pref("devtools.markup.collapseAttributes", true); +// Length to collapse attributes +pref("devtools.markup.collapseAttributeLength", 120); +// Whether to auto-beautify the HTML on copy. +pref("devtools.markup.beautifyOnCopy", false); +// Whether or not the DOM mutation breakpoints context menu are enabled in the +// markup view. +pref("devtools.markup.mutationBreakpoints.enabled", true); + +// DevTools default color unit +pref("devtools.defaultColorUnit", "authored"); + +// Enable the Memory tools +pref("devtools.memory.enabled", true); + +pref("devtools.memory.custom-census-displays", "{}"); +pref("devtools.memory.custom-label-displays", "{}"); +pref("devtools.memory.custom-tree-map-displays", "{}"); + +pref("devtools.memory.max-individuals", 1000); +pref("devtools.memory.max-retaining-paths", 10); + +// Enable the Performance tools +pref("devtools.performance.enabled", true); + +// The default Performance UI settings +pref("devtools.performance.memory.sample-probability", "0.05"); +// Can't go higher than this without causing internal allocation overflows while +// serializing the allocations data over the RDP. +pref("devtools.performance.memory.max-log-length", 125000); +pref("devtools.performance.timeline.hidden-markers", + "[\"Composite\",\"CompositeForwardTransaction\"]"); +pref("devtools.performance.profiler.buffer-size", 10000000); +pref("devtools.performance.profiler.sample-frequency-hz", 1000); +pref("devtools.performance.ui.invert-call-tree", true); +pref("devtools.performance.ui.invert-flame-graph", false); +pref("devtools.performance.ui.flatten-tree-recursion", true); +pref("devtools.performance.ui.show-platform-data", false); +pref("devtools.performance.ui.show-idle-blocks", true); +pref("devtools.performance.ui.enable-memory", false); +pref("devtools.performance.ui.enable-allocations", false); +pref("devtools.performance.ui.enable-framerate", true); +pref("devtools.performance.ui.show-jit-optimizations", false); +pref("devtools.performance.ui.show-triggers-for-gc-types", + "TOO_MUCH_MALLOC ALLOC_TRIGGER LAST_DITCH EAGER_ALLOC_TRIGGER"); + +// Temporary pref disabling memory flame views +// TODO remove once we have flame charts via bug 1148663 +pref("devtools.performance.ui.enable-memory-flame", false); + +// Enable experimental options in the UI only in Nightly +#if defined(NIGHTLY_BUILD) + pref("devtools.performance.ui.experimental", true); +#else + pref("devtools.performance.ui.experimental", false); +#endif + +// The default cache UI setting +pref("devtools.cache.disabled", false); + +// The default service workers UI setting +pref("devtools.serviceWorkers.testing.enabled", false); + +// Enable the Network Monitor +pref("devtools.netmonitor.enabled", true); + +pref("devtools.netmonitor.features.search", true); +pref("devtools.netmonitor.features.requestBlocking", true); + +// Enable the Application panel +pref("devtools.application.enabled", true); + +// The default Network Monitor UI settings +pref("devtools.netmonitor.panes-network-details-width", 550); +pref("devtools.netmonitor.panes-network-details-height", 450); +pref("devtools.netmonitor.panes-search-width", 550); +pref("devtools.netmonitor.panes-search-height", 450); +pref("devtools.netmonitor.filters", "[\"all\"]"); +pref("devtools.netmonitor.visibleColumns", + "[\"status\",\"method\",\"domain\",\"file\",\"initiator\",\"type\",\"transferred\",\"contentSize\",\"waterfall\"]" +); +pref("devtools.netmonitor.columnsData", + '[{"name":"status","minWidth":30,"width":5}, {"name":"method","minWidth":30,"width":5}, {"name":"domain","minWidth":30,"width":10}, {"name":"file","minWidth":30,"width":25}, {"name":"url","minWidth":30,"width":25},{"name":"initiator","minWidth":30,"width":10},{"name":"type","minWidth":30,"width":5},{"name":"transferred","minWidth":30,"width":10},{"name":"contentSize","minWidth":30,"width":5},{"name":"waterfall","minWidth":150,"width":15}]'); +pref("devtools.netmonitor.msg.payload-preview-height", 128); +pref("devtools.netmonitor.msg.visibleColumns", + '["data", "time"]' +); +pref("devtools.netmonitor.msg.displayed-messages.limit", 500); + +pref("devtools.netmonitor.response.ui.limit", 10240); + +// Save request/response bodies yes/no. +pref("devtools.netmonitor.saveRequestAndResponseBodies", true); + +// The default Network monitor HAR export setting +pref("devtools.netmonitor.har.defaultLogDir", ""); +pref("devtools.netmonitor.har.defaultFileName", "%hostname_Archive [%date]"); +pref("devtools.netmonitor.har.jsonp", false); +pref("devtools.netmonitor.har.jsonpCallback", ""); +pref("devtools.netmonitor.har.includeResponseBodies", true); +pref("devtools.netmonitor.har.compress", false); +pref("devtools.netmonitor.har.forceExport", false); +pref("devtools.netmonitor.har.pageLoadedTimeout", 1500); +pref("devtools.netmonitor.har.enableAutoExportToFile", false); + +pref("devtools.netmonitor.features.webSockets", true); + +// netmonitor audit +pref("devtools.netmonitor.audits.slow", 500); + +// Enable the EventSource Inspector +pref("devtools.netmonitor.features.serverSentEvents", true); + +// Enable the Storage Inspector +pref("devtools.storage.enabled", true); + +// Enable the Style Editor. +pref("devtools.styleeditor.enabled", true); +pref("devtools.styleeditor.autocompletion-enabled", true); +pref("devtools.styleeditor.showMediaSidebar", true); +pref("devtools.styleeditor.mediaSidebarWidth", 238); +pref("devtools.styleeditor.navSidebarWidth", 245); +pref("devtools.styleeditor.transitions", true); + +// Screenshot Option Settings. +pref("devtools.screenshot.clipboard.enabled", false); +pref("devtools.screenshot.audio.enabled", true); + +// Make sure the DOM panel is hidden by default +pref("devtools.dom.enabled", false); + +// Enable the Accessibility panel. +pref("devtools.accessibility.enabled", true); + +// Web console filters +pref("devtools.webconsole.filter.error", true); +pref("devtools.webconsole.filter.warn", true); +pref("devtools.webconsole.filter.info", true); +pref("devtools.webconsole.filter.log", true); +pref("devtools.webconsole.filter.debug", true); +pref("devtools.webconsole.filter.css", false); +pref("devtools.webconsole.filter.net", false); +pref("devtools.webconsole.filter.netxhr", false); + +// Webconsole autocomplete preference +pref("devtools.webconsole.input.autocomplete",true); + +// Show context selector in console input, in the browser toolbox +#if defined(NIGHTLY_BUILD) + pref("devtools.webconsole.input.context", true); +#else + pref("devtools.webconsole.input.context", false); +#endif + +// Show context selector in console input, in the content toolbox +pref("devtools.contenttoolbox.webconsole.input.context", false); + +// Set to true to eagerly show the results of webconsole terminal evaluations +// when they don't have side effects. +pref("devtools.webconsole.input.eagerEvaluation", true); + +// Browser console filters +pref("devtools.browserconsole.filter.error", true); +pref("devtools.browserconsole.filter.warn", true); +pref("devtools.browserconsole.filter.info", true); +pref("devtools.browserconsole.filter.log", true); +pref("devtools.browserconsole.filter.debug", true); +pref("devtools.browserconsole.filter.css", false); +pref("devtools.browserconsole.filter.net", false); +pref("devtools.browserconsole.filter.netxhr", false); + +// Max number of inputs to store in web console history. +pref("devtools.webconsole.inputHistoryCount", 300); + +// Persistent logging: |true| if you want the relevant tool to keep all of the +// logged messages after reloading the page, |false| if you want the output to +// be cleared each time page navigation happens. +pref("devtools.webconsole.persistlog", false); +pref("devtools.netmonitor.persistlog", false); + +// Web Console timestamp: |true| if you want the logs and instructions +// in the Web Console to display a timestamp, or |false| to not display +// any timestamps. +pref("devtools.webconsole.timestampMessages", false); + +// Enable the webconsole sidebar toggle in Nightly builds. +#if defined(NIGHTLY_BUILD) + pref("devtools.webconsole.sidebarToggle", true); +#else + pref("devtools.webconsole.sidebarToggle", false); +#endif + +// Saved editor mode state in the console. +pref("devtools.webconsole.input.editor", false); +pref("devtools.browserconsole.input.editor", false); + +// Editor width for webconsole and browserconsole. +pref("devtools.webconsole.input.editorWidth", 0); +pref("devtools.browserconsole.input.editorWidth", 0); + +// Display an onboarding UI for the Editor mode. +pref("devtools.webconsole.input.editorOnboarding", true); + +// Disable the new performance recording panel by default +pref("devtools.performance.new-panel-enabled", false); + +// Enable message grouping in the console, true by default +pref("devtools.webconsole.groupWarningMessages", true); + +// Saved state of the Display content messages checkbox in the browser console. +pref("devtools.browserconsole.contentMessages", false); + +// Enable client-side mapping service for source maps +pref("devtools.source-map.client-service.enabled", true); + +// The number of lines that are displayed in the web console. +pref("devtools.hud.loglimit", 10000); + +// The developer tools editor configuration: +// - tabsize: how many spaces to use when a Tab character is displayed. +// - expandtab: expand Tab characters to spaces. +// - keymap: which keymap to use (can be 'default', 'emacs' or 'vim') +// - autoclosebrackets: whether to permit automatic bracket/quote closing. +// - detectindentation: whether to detect the indentation from the file +// - enableCodeFolding: Whether to enable code folding or not. +pref("devtools.editor.tabsize", 2); +pref("devtools.editor.expandtab", true); +pref("devtools.editor.keymap", "default"); +pref("devtools.editor.autoclosebrackets", true); +pref("devtools.editor.detectindentation", true); +pref("devtools.editor.enableCodeFolding", true); +pref("devtools.editor.autocomplete", true); + +// The angle of the viewport. +pref("devtools.responsive.viewport.angle", 0); +// The width of the viewport. +pref("devtools.responsive.viewport.width", 320); +// The height of the viewport. +pref("devtools.responsive.viewport.height", 480); +// The pixel ratio of the viewport. +pref("devtools.responsive.viewport.pixelRatio", 0); +// Whether or not the viewports are left aligned. +pref("devtools.responsive.leftAlignViewport.enabled", false); +// Whether to reload when touch simulation is toggled +pref("devtools.responsive.reloadConditions.touchSimulation", false); +// Whether to reload when user agent is changed +pref("devtools.responsive.reloadConditions.userAgent", false); +// Whether to show the notification about reloading to apply emulation +pref("devtools.responsive.reloadNotification.enabled", true); +// Whether or not touch simulation is enabled. +pref("devtools.responsive.touchSimulation.enabled", false); +// Whether or not meta viewport is enabled, if and only if touchSimulation +// is also enabled. +pref("devtools.responsive.metaViewport.enabled", true); +// The user agent of the viewport. +pref("devtools.responsive.userAgent", ""); + +// Show the custom user agent input only in Nightly. +#if defined(NIGHTLY_BUILD) + pref("devtools.responsive.showUserAgentInput", true); +#else + pref("devtools.responsive.showUserAgentInput", false); +#endif + +// Show tab debug targets for This Firefox (on by default for local builds). +#ifdef MOZILLA_OFFICIAL + pref("devtools.aboutdebugging.local-tab-debugging", false); +#else + pref("devtools.aboutdebugging.local-tab-debugging", true); +#endif + +// Show process debug targets. +pref("devtools.aboutdebugging.process-debugging", true); +// Stringified array of network locations that users can connect to. +pref("devtools.aboutdebugging.network-locations", "[]"); +// Debug target pane collapse/expand settings. +pref("devtools.aboutdebugging.collapsibilities.installedExtension", false); +pref("devtools.aboutdebugging.collapsibilities.otherWorker", false); +pref("devtools.aboutdebugging.collapsibilities.serviceWorker", false); +pref("devtools.aboutdebugging.collapsibilities.sharedWorker", false); +pref("devtools.aboutdebugging.collapsibilities.tab", false); +pref("devtools.aboutdebugging.collapsibilities.temporaryExtension", false); + +// about:debugging: only show system and hidden extensions in local builds by +// default. +#ifdef MOZILLA_OFFICIAL + pref("devtools.aboutdebugging.showHiddenAddons", false); +#else + pref("devtools.aboutdebugging.showHiddenAddons", true); +#endif + +// Map top-level await expressions in the console +pref("devtools.debugger.features.map-await-expression", true); + +// This relies on javascript.options.asyncstack as well or it has no effect. +pref("devtools.debugger.features.async-captured-stacks", true); +pref("devtools.debugger.features.async-live-stacks", false); + +// Disable autohide for DevTools popups and tooltips. +// This is currently not exposed by any UI to avoid making +// about:devtools-toolbox tabs unusable by mistake. +pref("devtools.popup.disable_autohide", false); + +// FirstStartup service time-out in ms +pref("first-startup.timeout", 30000); + +// Enable the default browser agent. +// The agent still runs as scheduled if this pref is disabled, +// but it exits immediately before taking any action. +#ifdef XP_WIN + pref("default-browser-agent.enabled", true); +#endif + +// Test Prefs that do nothing for testing +#if defined(EARLY_BETA_OR_EARLIER) + pref("app.normandy.test-prefs.bool", false); + pref("app.normandy.test-prefs.integer", 0); + pref("app.normandy.test-prefs.string", ""); +#endif diff --git a/browser/app/splash.rc b/browser/app/splash.rc new file mode 100644 index 0000000000..a5d418e812 --- /dev/null +++ b/browser/app/splash.rc @@ -0,0 +1,19 @@ +/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#include +#include "nsNativeAppSupportWin.h" + +IDI_APPICON ICON FIREFOX_ICO +IDI_DOCUMENT ICON DOCUMENT_ICO +IDI_APPLICATION ICON FIREFOX_ICO +IDI_NEWWINDOW ICON NEWWINDOW_ICO +IDI_NEWTAB ICON NEWTAB_ICO +IDI_PBMODE ICON PBMODE_ICO + +STRINGTABLE DISCARDABLE +BEGIN + IDS_STARTMENU_APPNAME, "@MOZ_APP_DISPLAYNAME@" +END diff --git a/browser/app/winlauncher/DllBlocklistInit.cpp b/browser/app/winlauncher/DllBlocklistInit.cpp new file mode 100644 index 0000000000..4384bea1bd --- /dev/null +++ b/browser/app/winlauncher/DllBlocklistInit.cpp @@ -0,0 +1,213 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* vim: set ts=8 sts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. */ + +#define MOZ_USE_LAUNCHER_ERROR + +#include "nsWindowsDllInterceptor.h" +#include "mozilla/ArrayUtils.h" +#include "mozilla/Attributes.h" +#include "mozilla/BinarySearch.h" +#include "mozilla/ImportDir.h" +#include "mozilla/NativeNt.h" +#include "mozilla/ScopeExit.h" +#include "mozilla/Types.h" +#include "mozilla/WindowsDllBlocklist.h" +#include "mozilla/WinHeaderOnlyUtils.h" + +#include "DllBlocklistInit.h" +#include "freestanding/DllBlocklist.h" +#include "freestanding/SharedSection.h" + +namespace mozilla { + +#if defined(MOZ_ASAN) || defined(_M_ARM64) + +// This DLL blocking code is incompatible with ASAN because +// it is able to execute before ASAN itself has even initialized. +// Also, AArch64 has not been tested with this. +LauncherVoidResultWithLineInfo InitializeDllBlocklistOOP( + const wchar_t* aFullImagePath, HANDLE aChildProcess, + const IMAGE_THUNK_DATA*) { + return mozilla::Ok(); +} + +LauncherVoidResultWithLineInfo InitializeDllBlocklistOOPFromLauncher( + const wchar_t* aFullImagePath, HANDLE aChildProcess) { + return mozilla::Ok(); +} + +#else + +static LauncherVoidResultWithLineInfo InitializeDllBlocklistOOPInternal( + const wchar_t* aFullImagePath, nt::CrossExecTransferManager& aTransferMgr, + const IMAGE_THUNK_DATA* aCachedNtdllThunk) { + CrossProcessDllInterceptor intcpt(aTransferMgr.RemoteProcess()); + intcpt.Init(L"ntdll.dll"); + + bool ok = freestanding::stub_NtMapViewOfSection.SetDetour( + aTransferMgr, intcpt, "NtMapViewOfSection", + &freestanding::patched_NtMapViewOfSection); + if (!ok) { + return LAUNCHER_ERROR_FROM_DETOUR_ERROR(intcpt.GetLastDetourError()); + } + + ok = freestanding::stub_LdrLoadDll.SetDetour( + aTransferMgr, intcpt, "LdrLoadDll", &freestanding::patched_LdrLoadDll); + if (!ok) { + return LAUNCHER_ERROR_FROM_DETOUR_ERROR(intcpt.GetLastDetourError()); + } + + // Because aChildProcess has just been created in a suspended state, its + // dynamic linker has not yet been initialized, thus its executable has + // not yet been linked with ntdll.dll. If the blocklist hook intercepts a + // library load prior to the link, the hook will be unable to invoke any + // ntdll.dll functions. + // + // We know that the executable for our *current* process's binary is already + // linked into ntdll, so we obtain the IAT from our own executable and graft + // it onto the child process's IAT, thus enabling the child process's hook to + // safely make its ntdll calls. + + const nt::PEHeaders& ourExeImage = aTransferMgr.LocalPEHeaders(); + + // As part of our mitigation of binary tampering, copy our import directory + // from the original in our executable file. + LauncherVoidResult importDirRestored = + RestoreImportDirectory(aFullImagePath, aTransferMgr); + if (importDirRestored.isErr()) { + return importDirRestored; + } + + mozilla::nt::PEHeaders ntdllImage(::GetModuleHandleW(L"ntdll.dll")); + if (!ntdllImage) { + return LAUNCHER_ERROR_FROM_WIN32(ERROR_BAD_EXE_FORMAT); + } + + // If we have a cached IAT i.e. |aCachedNtdllThunk| is non-null, we can + // safely copy it to |aChildProcess| even if the local IAT has been modified. + // If |aCachedNtdllThunk| is null, we've failed to cache the IAT or we're in + // the launcher process where there is no chance to cache the IAT. In those + // cases, we retrieve the IAT with the boundary check to avoid a modified IAT + // from being copied into |aChildProcess|. + Maybe > ntdllThunks; + if (aCachedNtdllThunk) { + ntdllThunks = ourExeImage.GetIATThunksForModule("ntdll.dll"); + } else { + Maybe > ntdllBoundaries = ntdllImage.GetBounds(); + if (!ntdllBoundaries) { + return LAUNCHER_ERROR_FROM_WIN32(ERROR_BAD_EXE_FORMAT); + } + + // We can use GetIATThunksForModule() to check whether IAT is modified + // or not because no functions exported from ntdll.dll is forwarded. + ntdllThunks = + ourExeImage.GetIATThunksForModule("ntdll.dll", ntdllBoundaries.ptr()); + } + if (!ntdllThunks) { + return LAUNCHER_ERROR_FROM_WIN32(ERROR_INVALID_DATA); + } + + { // Scope for prot + PIMAGE_THUNK_DATA firstIatThunkDst = ntdllThunks.value().data(); + const IMAGE_THUNK_DATA* firstIatThunkSrc = + aCachedNtdllThunk ? aCachedNtdllThunk : firstIatThunkDst; + SIZE_T iatLength = ntdllThunks.value().LengthBytes(); + + AutoVirtualProtect prot = + aTransferMgr.Protect(firstIatThunkDst, iatLength, PAGE_READWRITE); + if (!prot) { + return LAUNCHER_ERROR_FROM_MOZ_WINDOWS_ERROR(prot.GetError()); + } + + LauncherVoidResult writeResult = + aTransferMgr.Transfer(firstIatThunkDst, firstIatThunkSrc, iatLength); + if (writeResult.isErr()) { + return writeResult.propagateErr(); + } + } + + // Tell the mozglue blocklist that we have bootstrapped + uint32_t newFlags = eDllBlocklistInitFlagWasBootstrapped; + + if (gBlocklistInitFlags & eDllBlocklistInitFlagWasBootstrapped) { + // If we ourselves were bootstrapped, then we are starting a child process + // and need to set the appropriate flag. + newFlags |= eDllBlocklistInitFlagIsChildProcess; + } + + LauncherVoidResult writeResult = + aTransferMgr.Transfer(&gBlocklistInitFlags, &newFlags, sizeof(newFlags)); + if (writeResult.isErr()) { + return writeResult.propagateErr(); + } + + return Ok(); +} + +LauncherVoidResultWithLineInfo InitializeDllBlocklistOOP( + const wchar_t* aFullImagePath, HANDLE aChildProcess, + const IMAGE_THUNK_DATA* aCachedNtdllThunk) { + nt::CrossExecTransferManager transferMgr(aChildProcess); + if (!transferMgr) { + return LAUNCHER_ERROR_FROM_WIN32(ERROR_BAD_EXE_FORMAT); + } + + // We come here when the browser process launches a sandbox process. + // If the launcher process already failed to bootstrap the browser process, + // we should not attempt to bootstrap a child process because it's likely + // to fail again. Instead, we only restore the import directory entry. + if (!(gBlocklistInitFlags & eDllBlocklistInitFlagWasBootstrapped)) { + return RestoreImportDirectory(aFullImagePath, transferMgr); + } + + // Transfer a readonly handle to the child processes because all information + // are already written to the section by the launcher and main process. + LauncherVoidResult transferResult = + freestanding::gSharedSection.TransferHandle(transferMgr, GENERIC_READ); + if (transferResult.isErr()) { + return transferResult.propagateErr(); + } + + return InitializeDllBlocklistOOPInternal(aFullImagePath, transferMgr, + aCachedNtdllThunk); +} + +LauncherVoidResultWithLineInfo InitializeDllBlocklistOOPFromLauncher( + const wchar_t* aFullImagePath, HANDLE aChildProcess) { + nt::CrossExecTransferManager transferMgr(aChildProcess); + if (!transferMgr) { + return LAUNCHER_ERROR_FROM_WIN32(ERROR_BAD_EXE_FORMAT); + } + + // The launcher process initializes a section object, whose handle is + // transferred to the browser process, and that transferred handle in + // the browser process is transferred to the sandbox processes. + LauncherVoidResultWithLineInfo result = + freestanding::gSharedSection.Init(transferMgr.LocalPEHeaders()); + if (result.isErr()) { + return result.propagateErr(); + } + + // Transfer a writable handle to the main process because it needs to append + // dependent module paths to the section. + LauncherVoidResult transferResult = + freestanding::gSharedSection.TransferHandle(transferMgr, + GENERIC_READ | GENERIC_WRITE); + if (transferResult.isErr()) { + return transferResult.propagateErr(); + } + + auto clearInstance = MakeScopeExit([]() { + // After transfer, the launcher process does not need the object anymore. + freestanding::gSharedSection.Reset(nullptr); + }); + return InitializeDllBlocklistOOPInternal(aFullImagePath, transferMgr, + nullptr); +} + +#endif // defined(MOZ_ASAN) || defined(_M_ARM64) + +} // namespace mozilla diff --git a/browser/app/winlauncher/DllBlocklistInit.h b/browser/app/winlauncher/DllBlocklistInit.h new file mode 100644 index 0000000000..c6b87bce91 --- /dev/null +++ b/browser/app/winlauncher/DllBlocklistInit.h @@ -0,0 +1,25 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* vim: set ts=8 sts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. */ + +#ifndef mozilla_DllBlocklistInit_h +#define mozilla_DllBlocklistInit_h + +#include + +#include "mozilla/WinHeaderOnlyUtils.h" + +namespace mozilla { + +LauncherVoidResultWithLineInfo InitializeDllBlocklistOOP( + const wchar_t* aFullImagePath, HANDLE aChildProcess, + const IMAGE_THUNK_DATA* aCachedNtdllThunk); + +LauncherVoidResultWithLineInfo InitializeDllBlocklistOOPFromLauncher( + const wchar_t* aFullImagePath, HANDLE aChildProcess); + +} // namespace mozilla + +#endif // mozilla_DllBlocklistInit_h diff --git a/browser/app/winlauncher/ErrorHandler.cpp b/browser/app/winlauncher/ErrorHandler.cpp new file mode 100644 index 0000000000..7b90b9c98b --- /dev/null +++ b/browser/app/winlauncher/ErrorHandler.cpp @@ -0,0 +1,781 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* vim: set ts=8 sts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. */ + +#include "ErrorHandler.h" + +#include + +#include "mozilla/ArrayUtils.h" +#include "mozilla/CmdLineAndEnvUtils.h" +#include "mozilla/DebugOnly.h" +#include "mozilla/JSONWriter.h" +#include "mozilla/UniquePtr.h" +#include "mozilla/Unused.h" +#include "mozilla/WinTokenUtils.h" +#include "mozilla/WindowsVersion.h" +#include "mozilla/XREAppData.h" +#include "mozilla/glue/WindowsDllServices.h" +#include "mozilla/mscom/ProcessRuntime.h" +#include "nsWindowsHelpers.h" + +#if defined(MOZ_LAUNCHER_PROCESS) +# include "mozilla/LauncherRegistryInfo.h" +#endif // defined(MOZ_LAUNCHER_PROCESS) + +#include +#include +#include +#include +#include +#include +#include + +#include +#include +#if !defined(__MINGW32__) +# include +# include +# include +#endif // !defined(__MINGW32__) +#include + +#if !defined(RRF_SUBKEY_WOW6464KEY) +# define RRF_SUBKEY_WOW6464KEY 0x00010000 +#endif // !defined(RRF_SUBKEY_WOW6464KEY) + +#define QUOTE_ME2(x) #x +#define QUOTE_ME(x) QUOTE_ME2(x) + +#define TELEMETRY_BASE_URL L"https://incoming.telemetry.mozilla.org/submit" +#define TELEMETRY_NAMESPACE L"/firefox-launcher-process" +#define TELEMETRY_LAUNCHER_PING_DOCTYPE L"/launcher-process-failure" +#define TELEMETRY_LAUNCHER_PING_VERSION L"/1" + +static const wchar_t kUrl[] = TELEMETRY_BASE_URL TELEMETRY_NAMESPACE + TELEMETRY_LAUNCHER_PING_DOCTYPE TELEMETRY_LAUNCHER_PING_VERSION L"/"; +static const uint32_t kGuidCharLenWithNul = 39; +static const uint32_t kGuidCharLenNoBracesNoNul = 36; +static const mozilla::StaticXREAppData* gAppData; +static bool gForceEventLog = false; + +namespace { + +struct EventSourceDeleter { + using pointer = HANDLE; + + void operator()(pointer aEvtSrc) { ::DeregisterEventSource(aEvtSrc); } +}; + +using EventLog = mozilla::UniquePtr; + +struct SerializedEventData { + HRESULT mHr; + uint32_t mLine; + char mFile[1]; +}; + +} // anonymous namespace + +static void PostErrorToLog(const mozilla::LauncherError& aError) { + // This is very bare-bones; just enough to spit out an HRESULT to the + // Application event log. + EventLog log(::RegisterEventSourceW(nullptr, L"Firefox")); + if (!log) { + return; + } + + size_t fileLen = strlen(aError.mFile); + size_t dataLen = sizeof(HRESULT) + sizeof(uint32_t) + fileLen; + auto evtDataBuf = mozilla::MakeUnique(dataLen); + SerializedEventData& evtData = + *reinterpret_cast(evtDataBuf.get()); + evtData.mHr = aError.mError.AsHResult(); + evtData.mLine = aError.mLine; + // Since this is binary data, we're not concerning ourselves with null + // terminators. + memcpy(evtData.mFile, aError.mFile, fileLen); + + ::ReportEventW(log.get(), EVENTLOG_ERROR_TYPE, 0, aError.mError.AsHResult(), + nullptr, 0, dataLen, nullptr, evtDataBuf.get()); +} + +#if defined(MOZ_TELEMETRY_REPORTING) + +namespace { + +// This JSONWriteFunc writes directly to a temp file. By creating this file +// with the FILE_ATTRIBUTE_TEMPORARY attribute, we hint to the OS that this +// file is short-lived. The OS will try to avoid flushing it to disk if at +// all possible. +class TempFileWriter final : public mozilla::JSONWriteFunc { + public: + TempFileWriter() : mFailed(false), mSuccessfulHandoff(false) { + wchar_t name[MAX_PATH + 1] = {}; + if (_wtmpnam_s(name)) { + mFailed = true; + return; + } + + mTempFileName = name; + + mTempFile.own(::CreateFileW(name, GENERIC_WRITE, FILE_SHARE_READ, nullptr, + CREATE_NEW, FILE_ATTRIBUTE_TEMPORARY, nullptr)); + if (mTempFile.get() == INVALID_HANDLE_VALUE) { + mFailed = true; + } + } + + ~TempFileWriter() { + if (mSuccessfulHandoff) { + // It is no longer our responsibility to delete the temp file if we have + // successfully handed it off to pingsender. + return; + } + + mTempFile.reset(); + ::DeleteFileW(mTempFileName.c_str()); + } + + explicit operator bool() const { return !mFailed; } + + void Write(const mozilla::Span& aStr) override { + if (mFailed) { + return; + } + + DWORD bytesWritten = 0; + if (!::WriteFile(mTempFile, aStr.data(), aStr.size(), &bytesWritten, + nullptr) || + bytesWritten != aStr.size()) { + mFailed = true; + } + } + + const std::wstring& GetFileName() const { return mTempFileName; } + + void SetSuccessfulHandoff() { mSuccessfulHandoff = true; } + + private: + bool mFailed; + bool mSuccessfulHandoff; + std::wstring mTempFileName; + nsAutoHandle mTempFile; +}; + +using SigMap = mozilla::Vector; + +} // anonymous namespace + +// This is the guideline for maximum string length for telemetry intake +static const size_t kMaxStrLen = 80; + +static mozilla::UniquePtr WideToUTF8(const wchar_t* aStr, + const size_t aStrLenExclNul) { + // Yes, this might not handle surrogate pairs correctly. Let's just let + // WideCharToMultiByte fail in that unlikely case. + size_t cvtLen = std::min(aStrLenExclNul, kMaxStrLen); + + int numConv = ::WideCharToMultiByte(CP_UTF8, 0, aStr, cvtLen, nullptr, 0, + nullptr, nullptr); + if (!numConv) { + return nullptr; + } + + // Include room for the null terminator by adding one + auto buf = mozilla::MakeUnique(numConv + 1); + + numConv = ::WideCharToMultiByte(CP_UTF8, 0, aStr, cvtLen, buf.get(), numConv, + nullptr, nullptr); + if (!numConv) { + return nullptr; + } + + // Add null termination. numConv does not include the terminator, so we don't + // subtract 1 when indexing into buf. + buf[numConv] = 0; + + return buf; +} + +static mozilla::UniquePtr WideToUTF8(const wchar_t* aStr) { + return WideToUTF8(aStr, wcslen(aStr)); +} + +static mozilla::UniquePtr WideToUTF8(const std::wstring& aStr) { + return WideToUTF8(aStr.c_str(), aStr.length()); +} + +// MinGW does not support the Windows Security Center APIs. +# if !defined(__MINGW32__) + +static mozilla::UniquePtr WideToUTF8(const _bstr_t& aStr) { + return WideToUTF8(static_cast(aStr), aStr.length()); +} + +namespace { + +struct ProviderKey { + WSC_SECURITY_PROVIDER mProviderType; + const char* mKey; +}; + +} // anonymous namespace + +static bool EnumWSCProductList(RefPtr& aProdList, + mozilla::JSONWriter& aJson) { + LONG count; + HRESULT hr = aProdList->get_Count(&count); + if (FAILED(hr)) { + return false; + } + + // Unlikely, but put a bound on the max length of the output array for the + // purposes of telemetry intake. + count = std::min(count, 1000L); + + // Record the name(s) of each active registered product in this category + for (LONG index = 0; index < count; ++index) { + RefPtr product; + hr = aProdList->get_Item(index, getter_AddRefs(product)); + if (FAILED(hr)) { + return false; + } + + WSC_SECURITY_PRODUCT_STATE state; + hr = product->get_ProductState(&state); + if (FAILED(hr)) { + return false; + } + + // We only care about products that are active + if (state == WSC_SECURITY_PRODUCT_STATE_OFF || + state == WSC_SECURITY_PRODUCT_STATE_SNOOZED || + state == WSC_SECURITY_PRODUCT_STATE_EXPIRED) { + continue; + } + + _bstr_t bName; + hr = product->get_ProductName(bName.GetAddress()); + if (FAILED(hr)) { + return false; + } + + auto buf = WideToUTF8(bName); + if (!buf) { + return false; + } + + aJson.StringElement(mozilla::MakeStringSpan(buf.get())); + } + + return true; +} + +static const ProviderKey gProvKeys[] = { + {WSC_SECURITY_PROVIDER_ANTIVIRUS, "av"}, + {WSC_SECURITY_PROVIDER_ANTISPYWARE, "antispyware"}, + {WSC_SECURITY_PROVIDER_FIREWALL, "firewall"}}; + +static bool AddWscInfo(mozilla::JSONWriter& aJson) { + if (!mozilla::IsWin8OrLater()) { + // We haven't written anything yet, so we can return true here and continue + // capturing data. + return true; + } + + // We need COM for this. Using ProcessRuntime so that process-global COM + // configuration is done correctly + mozilla::mscom::ProcessRuntime mscom( + mozilla::mscom::ProcessRuntime::ProcessCategory::Launcher); + if (!mscom) { + // We haven't written anything yet, so we can return true here and continue + // capturing data. + return true; + } + + aJson.StartObjectProperty("security"); + + const CLSID clsid = __uuidof(WSCProductList); + const IID iid = __uuidof(IWSCProductList); + + for (uint32_t index = 0; index < mozilla::ArrayLength(gProvKeys); ++index) { + // NB: A separate instance of IWSCProductList is needed for each distinct + // security provider type; MSDN says that we cannot reuse the same object + // and call Initialize() to pave over the previous data. + RefPtr prodList; + HRESULT hr = ::CoCreateInstance(clsid, nullptr, CLSCTX_INPROC_SERVER, iid, + getter_AddRefs(prodList)); + if (FAILED(hr)) { + return false; + } + + hr = prodList->Initialize(gProvKeys[index].mProviderType); + if (FAILED(hr)) { + return false; + } + + aJson.StartArrayProperty(mozilla::MakeStringSpan(gProvKeys[index].mKey)); + + if (!EnumWSCProductList(prodList, aJson)) { + return false; + } + + aJson.EndArray(); + } + + aJson.EndObject(); + + return true; +} +# endif // !defined(__MINGW32__) + +// Max array length for telemetry intake. +static const size_t kMaxArrayLen = 1000; + +static bool AddModuleInfo(const nsAutoHandle& aSnapshot, + mozilla::JSONWriter& aJson) { + if (aSnapshot.get() == INVALID_HANDLE_VALUE) { + // We haven't written anything yet, so we can return true here and continue + // capturing data. + return true; + } + + SigMap signatures; + size_t moduleCount = 0; + + MODULEENTRY32W module = {sizeof(module)}; + if (!::Module32FirstW(aSnapshot, &module)) { + // We haven't written anything yet, so we can return true here and continue + // capturing data. + return true; + } + + mozilla::glue::BasicDllServices dllServices; + + aJson.StartObjectProperty("modules"); + + // For each module, add its version number (or empty string if not present), + // followed by an optional index into the signatures array + do { + ++moduleCount; + + wchar_t leaf[_MAX_FNAME] = {}; + if (::_wsplitpath_s(module.szExePath, nullptr, 0, nullptr, 0, leaf, + mozilla::ArrayLength(leaf), nullptr, 0)) { + return false; + } + + if (_wcslwr_s(leaf, mozilla::ArrayLength(leaf))) { + return false; + } + + auto leafUtf8 = WideToUTF8(leaf); + if (!leafUtf8) { + return false; + } + + aJson.StartArrayProperty(mozilla::MakeStringSpan(leafUtf8.get())); + + std::string version; + DWORD verInfoSize = ::GetFileVersionInfoSizeW(module.szExePath, nullptr); + if (verInfoSize) { + auto verInfoBuf = mozilla::MakeUnique(verInfoSize); + + if (::GetFileVersionInfoW(module.szExePath, 0, verInfoSize, + verInfoBuf.get())) { + VS_FIXEDFILEINFO* fixedInfo = nullptr; + UINT fixedInfoLen = 0; + + if (::VerQueryValueW(verInfoBuf.get(), L"\\", + reinterpret_cast(&fixedInfo), + &fixedInfoLen)) { + std::ostringstream oss; + oss << HIWORD(fixedInfo->dwFileVersionMS) << '.' + << LOWORD(fixedInfo->dwFileVersionMS) << '.' + << HIWORD(fixedInfo->dwFileVersionLS) << '.' + << LOWORD(fixedInfo->dwFileVersionLS); + version = oss.str(); + } + } + } + + aJson.StringElement(version); + + mozilla::Maybe sigIndex; + auto signedBy = dllServices.GetBinaryOrgName(module.szExePath); + if (signedBy) { + std::wstring strSignedBy(signedBy.get()); + auto entry = std::find(signatures.begin(), signatures.end(), strSignedBy); + if (entry == signatures.end()) { + mozilla::Unused << signatures.append(std::move(strSignedBy)); + entry = &signatures.back(); + } + + sigIndex = mozilla::Some(entry - signatures.begin()); + } + + if (sigIndex) { + aJson.IntElement(sigIndex.value()); + } + + aJson.EndArray(); + } while (moduleCount < kMaxArrayLen && ::Module32NextW(aSnapshot, &module)); + + aJson.EndObject(); + + aJson.StartArrayProperty("signatures"); + + // Serialize each entry in the signatures array + for (auto&& itr : signatures) { + auto sigUtf8 = WideToUTF8(itr); + if (!sigUtf8) { + continue; + } + + aJson.StringElement(mozilla::MakeStringSpan(sigUtf8.get())); + } + + aJson.EndArray(); + + return true; +} + +namespace { + +struct PingThreadContext { + explicit PingThreadContext(const mozilla::LauncherError& aError, + const char* aProcessType) + : mLauncherError(aError), + mModulesSnapshot(::CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, 0)), + mProcessType(aProcessType ? aProcessType : "") {} + mozilla::LauncherError mLauncherError; + nsAutoHandle mModulesSnapshot; + std::string mProcessType; +}; + +} // anonymous namespace + +static bool PrepPing(const PingThreadContext& aContext, const std::wstring& aId, + mozilla::JSONWriter& aJson) { +# if defined(DEBUG) + const mozilla::JSONWriter::CollectionStyle style = + mozilla::JSONWriter::MultiLineStyle; +# else + const mozilla::JSONWriter::CollectionStyle style = + mozilla::JSONWriter::SingleLineStyle; +# endif // defined(DEBUG) + + aJson.Start(style); + + aJson.StringProperty("type", "launcher-process-failure"); + aJson.IntProperty("version", 1); + + auto idUtf8 = WideToUTF8(aId); + if (idUtf8) { + aJson.StringProperty("id", mozilla::MakeStringSpan(idUtf8.get())); + } + + time_t now; + time(&now); + tm gmTm; + if (!gmtime_s(&gmTm, &now)) { + char isoTimeBuf[32] = {}; + if (strftime(isoTimeBuf, mozilla::ArrayLength(isoTimeBuf), "%FT%T.000Z", + &gmTm)) { + aJson.StringProperty("creationDate", isoTimeBuf); + } + } + + aJson.StringProperty("update_channel", QUOTE_ME(MOZ_UPDATE_CHANNEL)); + + if (gAppData) { + aJson.StringProperty("build_id", + mozilla::MakeStringSpan(gAppData->buildID)); + aJson.StringProperty("build_version", + mozilla::MakeStringSpan(gAppData->version)); + } + + OSVERSIONINFOEXW osv = {sizeof(osv)}; + if (::GetVersionExW(reinterpret_cast(&osv))) { + std::ostringstream oss; + oss << osv.dwMajorVersion << "." << osv.dwMinorVersion << "." + << osv.dwBuildNumber; + + if (osv.dwMajorVersion == 10 && osv.dwMinorVersion == 0) { + // Get the "Update Build Revision" (UBR) value + DWORD ubrValue; + DWORD ubrValueLen = sizeof(ubrValue); + LSTATUS ubrOk = + ::RegGetValueW(HKEY_LOCAL_MACHINE, + L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", + L"UBR", RRF_RT_DWORD | RRF_SUBKEY_WOW6464KEY, nullptr, + &ubrValue, &ubrValueLen); + if (ubrOk == ERROR_SUCCESS) { + oss << "." << ubrValue; + } + } + + if (oss) { + aJson.StringProperty("os_version", oss.str()); + } + + bool isServer = osv.wProductType == VER_NT_DOMAIN_CONTROLLER || + osv.wProductType == VER_NT_SERVER; + aJson.BoolProperty("server_os", isServer); + } + + WCHAR localeName[LOCALE_NAME_MAX_LENGTH] = {}; + int localeNameLen = + ::GetUserDefaultLocaleName(localeName, mozilla::ArrayLength(localeName)); + if (localeNameLen) { + auto localeNameUtf8 = WideToUTF8(localeName, localeNameLen - 1); + if (localeNameUtf8) { + aJson.StringProperty("os_locale", + mozilla::MakeStringSpan(localeNameUtf8.get())); + } + } + + SYSTEM_INFO sysInfo; + ::GetNativeSystemInfo(&sysInfo); + aJson.IntProperty("cpu_arch", sysInfo.wProcessorArchitecture); + aJson.IntProperty("num_logical_cpus", sysInfo.dwNumberOfProcessors); + + mozilla::LauncherResult isAdminWithoutUac = + mozilla::IsAdminWithoutUac(); + if (isAdminWithoutUac.isOk()) { + aJson.BoolProperty("is_admin_without_uac", isAdminWithoutUac.unwrap()); + } + + if (!aContext.mProcessType.empty()) { + aJson.StringProperty("process_type", aContext.mProcessType); + } + + MEMORYSTATUSEX memStatus = {sizeof(memStatus)}; + if (::GlobalMemoryStatusEx(&memStatus)) { + aJson.StartObjectProperty("memory"); + aJson.IntProperty("total_phys", memStatus.ullTotalPhys); + aJson.IntProperty("avail_phys", memStatus.ullAvailPhys); + aJson.IntProperty("avail_page_file", memStatus.ullAvailPageFile); + aJson.IntProperty("avail_virt", memStatus.ullAvailVirtual); + aJson.EndObject(); + } + + aJson.StringProperty("xpcom_abi", TARGET_XPCOM_ABI); + + aJson.StartObjectProperty("launcher_error", style); + + std::string srcFileLeaf(aContext.mLauncherError.mFile); + // Obtain the leaf name of the file for privacy reasons + // (In case this is somebody's local build) + auto pos = srcFileLeaf.find_last_of("/\\"); + if (pos != std::string::npos) { + srcFileLeaf = srcFileLeaf.substr(pos + 1); + } + + aJson.StringProperty("source_file", srcFileLeaf); + + aJson.IntProperty("source_line", aContext.mLauncherError.mLine); + aJson.IntProperty("hresult", aContext.mLauncherError.mError.AsHResult()); + +# if defined(NIGHTLY_BUILD) + if (aContext.mLauncherError.mDetourError.isSome()) { + static const char* kHexMap = "0123456789abcdef"; + char hexStr[sizeof(mozilla::DetourError::mOrigBytes) * 2 + 1]; + int cnt = 0; + for (uint8_t byte : aContext.mLauncherError.mDetourError->mOrigBytes) { + hexStr[cnt++] = kHexMap[(byte >> 4) & 0x0f]; + hexStr[cnt++] = kHexMap[byte & 0x0f]; + } + hexStr[cnt] = 0; + aJson.StringProperty("detour_orig_bytes", hexStr); + } +# endif // defined(NIGHTLY_BUILD) + + aJson.EndObject(); + +# if !defined(__MINGW32__) + if (!AddWscInfo(aJson)) { + return false; + } +# endif // !defined(__MINGW32__) + + if (!AddModuleInfo(aContext.mModulesSnapshot, aJson)) { + return false; + } + + aJson.End(); + + return true; +} + +static bool DoSendPing(const PingThreadContext& aContext) { + auto writeFunc = mozilla::MakeUnique(); + if (!(*writeFunc)) { + return false; + } + + mozilla::JSONWriter json(std::move(writeFunc)); + + UUID uuid; + if (::UuidCreate(&uuid) != RPC_S_OK) { + return false; + } + + wchar_t guidBuf[kGuidCharLenWithNul] = {}; + if (::StringFromGUID2(uuid, guidBuf, kGuidCharLenWithNul) != + kGuidCharLenWithNul) { + return false; + } + + // Strip the curly braces off of the guid + std::wstring guidNoBraces(guidBuf + 1, kGuidCharLenNoBracesNoNul); + + // Populate json with the ping information + if (!PrepPing(aContext, guidNoBraces, json)) { + return false; + } + + // Obtain the name of the temp file that we have written + TempFileWriter& tempFile = *static_cast(json.WriteFunc()); + if (!tempFile) { + return false; + } + + const std::wstring& fileName = tempFile.GetFileName(); + + // Using the path to our executable binary, construct the path to + // pingsender.exe + mozilla::UniquePtr exePath(mozilla::GetFullBinaryPath()); + + wchar_t drive[_MAX_DRIVE] = {}; + wchar_t dir[_MAX_DIR] = {}; + if (_wsplitpath_s(exePath.get(), drive, mozilla::ArrayLength(drive), dir, + mozilla::ArrayLength(dir), nullptr, 0, nullptr, 0)) { + return false; + } + + wchar_t pingSenderPath[MAX_PATH + 1] = {}; + if (_wmakepath_s(pingSenderPath, mozilla::ArrayLength(pingSenderPath), drive, + dir, L"pingsender", L"exe")) { + return false; + } + + // Construct the telemetry URL + wchar_t urlBuf[mozilla::ArrayLength(kUrl) + kGuidCharLenNoBracesNoNul] = {}; + if (wcscpy_s(urlBuf, kUrl)) { + return false; + } + + if (wcscat_s(urlBuf, guidNoBraces.c_str())) { + return false; + } + + // Now build the command line arguments to pingsender + wchar_t* pingSenderArgv[] = {pingSenderPath, urlBuf, + const_cast(fileName.c_str())}; + + mozilla::UniquePtr pingSenderCmdLine(mozilla::MakeCommandLine( + mozilla::ArrayLength(pingSenderArgv), pingSenderArgv)); + + // Now start pingsender to handle the rest + PROCESS_INFORMATION pi; + + STARTUPINFOW si = {sizeof(si)}; + si.dwFlags = STARTF_USESHOWWINDOW; + si.wShowWindow = SW_HIDE; + + if (!::CreateProcessW(pingSenderPath, pingSenderCmdLine.get(), nullptr, + nullptr, FALSE, 0, nullptr, nullptr, &si, &pi)) { + return false; + } + + tempFile.SetSuccessfulHandoff(); + + nsAutoHandle proc(pi.hProcess); + nsAutoHandle thread(pi.hThread); + + return true; +} + +static unsigned __stdcall SendPingThread(void* aContext) { + mozilla::UniquePtr context( + reinterpret_cast(aContext)); + + if (!DoSendPing(*context) || gForceEventLog) { + PostErrorToLog(context->mLauncherError); + } + + return 0; +} + +#endif // defined(MOZ_TELEMETRY_REPORTING) + +static bool SendPing(const mozilla::LauncherError& aError, + const char* aProcessType) { +#if defined(MOZ_TELEMETRY_REPORTING) +# if defined(MOZ_LAUNCHER_PROCESS) + mozilla::LauncherRegistryInfo regInfo; + mozilla::LauncherResult telemetryEnabled = regInfo.IsTelemetryEnabled(); + if (telemetryEnabled.isErr() || !telemetryEnabled.unwrap()) { + // Do not send anything if telemetry has been opted out + return false; + } +# endif // defined(MOZ_LAUNCHER_PROCESS) + + // We send this ping when the launcher process fails. After we start the + // SendPingThread, this thread falls back from running as the launcher process + // to running as the browser main thread. Once this happens, it will be unsafe + // to set up PoisonIOInterposer (since we have already spun up a background + // thread). + mozilla::SaveToEnv("MOZ_DISABLE_POISON_IO_INTERPOSER=1"); + + // Capture aError and our module list into context for processing on another + // thread. + auto thdParam = mozilla::MakeUnique(aError, aProcessType); + + // The ping does a lot of file I/O. Since we want this thread to continue + // executing browser startup, we should gather that information on a + // background thread. + uintptr_t thdHandle = + _beginthreadex(nullptr, 0, &SendPingThread, thdParam.get(), + STACK_SIZE_PARAM_IS_A_RESERVATION, nullptr); + if (!thdHandle) { + return false; + } + + // We have handed off thdParam to the background thread + mozilla::Unused << thdParam.release(); + + ::CloseHandle(reinterpret_cast(thdHandle)); + return true; +#else + return false; +#endif +} + +namespace mozilla { + +void HandleLauncherError(const LauncherError& aError, + const char* aProcessType) { +#if defined(MOZ_LAUNCHER_PROCESS) + LauncherRegistryInfo regInfo; + Unused << regInfo.DisableDueToFailure(); +#endif // defined(MOZ_LAUNCHER_PROCESS) + + if (SendPing(aError, aProcessType) && !gForceEventLog) { + return; + } + + PostErrorToLog(aError); +} + +void SetLauncherErrorAppData(const StaticXREAppData& aAppData) { + gAppData = &aAppData; +} + +void SetLauncherErrorForceEventLog() { gForceEventLog = true; } + +} // namespace mozilla diff --git a/browser/app/winlauncher/ErrorHandler.h b/browser/app/winlauncher/ErrorHandler.h new file mode 100644 index 0000000000..71fe72cf07 --- /dev/null +++ b/browser/app/winlauncher/ErrorHandler.h @@ -0,0 +1,54 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* vim: set ts=8 sts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. */ + +#ifndef mozilla_ErrorHandler_h +#define mozilla_ErrorHandler_h + +#include "mozilla/Assertions.h" +#include "mozilla/WinHeaderOnlyUtils.h" + +namespace mozilla { + +/** + * All launcher process error handling should live in the implementation of + * this function. + */ +void HandleLauncherError(const LauncherError& aError, + const char* aProcessType = nullptr); + +// This function is simply a convenience overload that automatically unwraps +// the LauncherError from the provided LauncherResult and then forwards it to +// the main implementation. +template +inline void HandleLauncherError(const LauncherResult& aResult, + const char* aProcessType = nullptr) { + MOZ_ASSERT(aResult.isErr()); + if (aResult.isOk()) { + return; + } + + HandleLauncherError(aResult.inspectErr(), aProcessType); +} + +// This function is simply a convenience overload that unwraps the provided +// GenericErrorResult and forwards it to the main implementation. +inline void HandleLauncherError( + const GenericErrorResult& aResult, + const char* aProcessType = nullptr) { + LauncherVoidResult r(aResult); + HandleLauncherError(r, aProcessType); +} + +// Forward declaration +struct StaticXREAppData; + +void SetLauncherErrorAppData(const StaticXREAppData& aAppData); + +void SetLauncherErrorForceEventLog(); + +} // namespace mozilla + +#endif // mozilla_ErrorHandler_h diff --git a/browser/app/winlauncher/LaunchUnelevated.cpp b/browser/app/winlauncher/LaunchUnelevated.cpp new file mode 100644 index 0000000000..41f0d377f3 --- /dev/null +++ b/browser/app/winlauncher/LaunchUnelevated.cpp @@ -0,0 +1,243 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* vim: set ts=8 sts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. */ + +#define MOZ_USE_LAUNCHER_ERROR + +#include "LaunchUnelevated.h" + +#include "mozilla/Assertions.h" +#include "mozilla/CmdLineAndEnvUtils.h" +#include "mozilla/mscom/ProcessRuntime.h" +#include "mozilla/RefPtr.h" +#include "mozilla/ShellHeaderOnlyUtils.h" +#include "mozilla/WinHeaderOnlyUtils.h" +#include "nsWindowsHelpers.h" + +#include + +static mozilla::LauncherResult IsHighIntegrity( + const nsAutoHandle& aToken) { + DWORD reqdLen; + if (!::GetTokenInformation(aToken.get(), TokenIntegrityLevel, nullptr, 0, + &reqdLen)) { + DWORD err = ::GetLastError(); + if (err != ERROR_INSUFFICIENT_BUFFER) { + return LAUNCHER_ERROR_FROM_WIN32(err); + } + } + + auto buf = mozilla::MakeUnique(reqdLen); + + if (!::GetTokenInformation(aToken.get(), TokenIntegrityLevel, buf.get(), + reqdLen, &reqdLen)) { + return LAUNCHER_ERROR_FROM_LAST(); + } + + auto tokenLabel = reinterpret_cast(buf.get()); + + DWORD subAuthCount = *::GetSidSubAuthorityCount(tokenLabel->Label.Sid); + DWORD integrityLevel = + *::GetSidSubAuthority(tokenLabel->Label.Sid, subAuthCount - 1); + return integrityLevel > SECURITY_MANDATORY_MEDIUM_RID; +} + +static mozilla::LauncherResult GetMediumIntegrityToken( + const nsAutoHandle& aProcessToken) { + HANDLE rawResult; + if (!::DuplicateTokenEx(aProcessToken.get(), 0, nullptr, + SecurityImpersonation, TokenPrimary, &rawResult)) { + return LAUNCHER_ERROR_FROM_LAST(); + } + + nsAutoHandle result(rawResult); + + BYTE mediumIlSid[SECURITY_MAX_SID_SIZE]; + DWORD mediumIlSidSize = sizeof(mediumIlSid); + if (!::CreateWellKnownSid(WinMediumLabelSid, nullptr, mediumIlSid, + &mediumIlSidSize)) { + return LAUNCHER_ERROR_FROM_LAST(); + } + + TOKEN_MANDATORY_LABEL integrityLevel = {}; + integrityLevel.Label.Attributes = SE_GROUP_INTEGRITY; + integrityLevel.Label.Sid = reinterpret_cast(mediumIlSid); + + if (!::SetTokenInformation(rawResult, TokenIntegrityLevel, &integrityLevel, + sizeof(integrityLevel))) { + return LAUNCHER_ERROR_FROM_LAST(); + } + + return result.disown(); +} + +static mozilla::LauncherResult IsAdminByAppCompat( + HKEY aRootKey, const wchar_t* aExecutablePath) { + static const wchar_t kPathToLayers[] = + L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\" + L"AppCompatFlags\\Layers"; + + DWORD dataLength = 0; + LSTATUS status = ::RegGetValueW(aRootKey, kPathToLayers, aExecutablePath, + RRF_RT_REG_SZ | RRF_SUBKEY_WOW6464KEY, + nullptr, nullptr, &dataLength); + if (status == ERROR_FILE_NOT_FOUND) { + return false; + } else if (status != ERROR_SUCCESS) { + return LAUNCHER_ERROR_FROM_WIN32(status); + } + + auto valueData = mozilla::MakeUnique(dataLength); + if (!valueData) { + return LAUNCHER_ERROR_FROM_WIN32(ERROR_OUTOFMEMORY); + } + + status = ::RegGetValueW(aRootKey, kPathToLayers, aExecutablePath, + RRF_RT_REG_SZ | RRF_SUBKEY_WOW6464KEY, nullptr, + valueData.get(), &dataLength); + if (status != ERROR_SUCCESS) { + return LAUNCHER_ERROR_FROM_WIN32(status); + } + + const wchar_t kRunAsAdmin[] = L"RUNASADMIN"; + const wchar_t kDelimiters[] = L" "; + wchar_t* tokenContext = nullptr; + const wchar_t* token = wcstok_s(valueData.get(), kDelimiters, &tokenContext); + while (token) { + if (!_wcsnicmp(token, kRunAsAdmin, mozilla::ArrayLength(kRunAsAdmin))) { + return true; + } + token = wcstok_s(nullptr, kDelimiters, &tokenContext); + } + + return false; +} + +namespace mozilla { + +// If we're running at an elevated integrity level, re-run ourselves at the +// user's normal integrity level. We do this by locating the active explorer +// shell, and then asking it to do a ShellExecute on our behalf. We do it this +// way to ensure that the child process runs as the original user in the active +// session; an elevated process could be running with different credentials than +// those of the session. +// See https://blogs.msdn.microsoft.com/oldnewthing/20131118-00/?p=2643 + +LauncherVoidResult LaunchUnelevated(int aArgc, wchar_t* aArgv[]) { + // We need COM to talk to Explorer. Using ProcessRuntime so that + // process-global COM configuration is done correctly + mozilla::mscom::ProcessRuntime mscom(GeckoProcessType_Default); + if (!mscom) { + return LAUNCHER_ERROR_FROM_HRESULT(mscom.GetHResult()); + } + + // Omit argv[0] because ShellExecute doesn't need it in params + UniquePtr cmdLine(MakeCommandLine(aArgc - 1, aArgv + 1)); + if (!cmdLine) { + return LAUNCHER_ERROR_GENERIC(); + } + + _bstr_t exe(aArgv[0]); + _variant_t args(cmdLine.get()); + _variant_t operation(L"open"); + _variant_t directory; + _variant_t showCmd(SW_SHOWNORMAL); + return ShellExecuteByExplorer(exe, args, operation, directory, showCmd); +} + +LauncherResult GetElevationState( + const wchar_t* aExecutablePath, mozilla::LauncherFlags aFlags, + nsAutoHandle& aOutMediumIlToken) { + aOutMediumIlToken.reset(); + + const DWORD tokenFlags = TOKEN_QUERY | TOKEN_DUPLICATE | + TOKEN_ADJUST_DEFAULT | TOKEN_ASSIGN_PRIMARY; + HANDLE rawToken; + if (!::OpenProcessToken(::GetCurrentProcess(), tokenFlags, &rawToken)) { + return LAUNCHER_ERROR_FROM_LAST(); + } + + nsAutoHandle token(rawToken); + + LauncherResult elevationType = GetElevationType(token); + if (elevationType.isErr()) { + return elevationType.propagateErr(); + } + + Maybe elevationState; + switch (elevationType.unwrap()) { + case TokenElevationTypeLimited: + return ElevationState::eNormalUser; + case TokenElevationTypeFull: + elevationState = Some(ElevationState::eElevated); + break; + case TokenElevationTypeDefault: { + // In this case, UAC is disabled. We do not yet know whether or not we + // are running at high integrity. If we are at high integrity, we can't + // relaunch ourselves in a non-elevated state via Explorer, as we would + // just end up in an infinite loop of launcher processes re-launching + // themselves. + LauncherResult isHighIntegrity = IsHighIntegrity(token); + if (isHighIntegrity.isErr()) { + return isHighIntegrity.propagateErr(); + } + + if (!isHighIntegrity.unwrap()) { + return ElevationState::eNormalUser; + } + + elevationState = Some(ElevationState::eHighIntegrityNoUAC); + break; + } + default: + MOZ_ASSERT_UNREACHABLE("Was a new value added to the enumeration?"); + return LAUNCHER_ERROR_GENERIC(); + } + + MOZ_ASSERT(elevationState.isSome() && + elevationState.value() != ElevationState::eNormalUser, + "Should have returned earlier for the eNormalUser case."); + + LauncherResult isAdminByAppCompat = + IsAdminByAppCompat(HKEY_CURRENT_USER, aExecutablePath); + if (isAdminByAppCompat.isErr()) { + return isAdminByAppCompat.propagateErr(); + } + + if (isAdminByAppCompat.unwrap()) { + elevationState = Some(ElevationState::eHighIntegrityByAppCompat); + } else { + isAdminByAppCompat = + IsAdminByAppCompat(HKEY_LOCAL_MACHINE, aExecutablePath); + if (isAdminByAppCompat.isErr()) { + return isAdminByAppCompat.propagateErr(); + } + + if (isAdminByAppCompat.unwrap()) { + elevationState = Some(ElevationState::eHighIntegrityByAppCompat); + } + } + + // A medium IL token is not needed in the following cases. + // 1) We keep the process elevated (= LauncherFlags::eNoDeelevate) + // 2) The process was elevated by UAC (= ElevationState::eElevated) + // AND the launcher process doesn't wait for the browser process + if ((aFlags & mozilla::LauncherFlags::eNoDeelevate) || + (elevationState.value() == ElevationState::eElevated && + !(aFlags & mozilla::LauncherFlags::eWaitForBrowser))) { + return elevationState.value(); + } + + LauncherResult tokenResult = GetMediumIntegrityToken(token); + if (tokenResult.isOk()) { + aOutMediumIlToken.own(tokenResult.unwrap()); + } else { + return tokenResult.propagateErr(); + } + + return elevationState.value(); +} + +} // namespace mozilla diff --git a/browser/app/winlauncher/LaunchUnelevated.h b/browser/app/winlauncher/LaunchUnelevated.h new file mode 100644 index 0000000000..8c6679edf3 --- /dev/null +++ b/browser/app/winlauncher/LaunchUnelevated.h @@ -0,0 +1,32 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* vim: set ts=8 sts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. */ + +#ifndef mozilla_LaunchUnelevated_h +#define mozilla_LaunchUnelevated_h + +#include "LauncherProcessWin.h" +#include "mozilla/WinHeaderOnlyUtils.h" +#include "mozilla/Maybe.h" +#include "nsWindowsHelpers.h" + +namespace mozilla { + +enum class ElevationState { + eNormalUser = 0, + eElevated = (1 << 0), + eHighIntegrityNoUAC = (1 << 1), + eHighIntegrityByAppCompat = (1 << 2), +}; + +LauncherResult GetElevationState( + const wchar_t* aExecutablePath, LauncherFlags aFlags, + nsAutoHandle& aOutMediumIlToken); + +LauncherVoidResult LaunchUnelevated(int aArgc, wchar_t* aArgv[]); + +} // namespace mozilla + +#endif // mozilla_LaunchUnelevated_h diff --git a/browser/app/winlauncher/LauncherProcessWin.cpp b/browser/app/winlauncher/LauncherProcessWin.cpp new file mode 100644 index 0000000000..faf53eff9a --- /dev/null +++ b/browser/app/winlauncher/LauncherProcessWin.cpp @@ -0,0 +1,412 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* vim: set ts=8 sts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. */ + +#define MOZ_USE_LAUNCHER_ERROR + +#include "LauncherProcessWin.h" + +#include + +#include "mozilla/Attributes.h" +#include "mozilla/CmdLineAndEnvUtils.h" +#include "mozilla/DebugOnly.h" +#include "mozilla/DynamicallyLinkedFunctionPtr.h" +#include "mozilla/glue/Debug.h" +#include "mozilla/Maybe.h" +#include "mozilla/SafeMode.h" +#include "mozilla/UniquePtr.h" +#include "mozilla/WindowsConsole.h" +#include "mozilla/WindowsVersion.h" +#include "mozilla/WinHeaderOnlyUtils.h" +#include "nsWindowsHelpers.h" + +#include +#include + +#include "DllBlocklistInit.h" +#include "ErrorHandler.h" +#include "LaunchUnelevated.h" +#include "ProcThreadAttributes.h" + +#if defined(MOZ_LAUNCHER_PROCESS) +# include "mozilla/LauncherRegistryInfo.h" +# include "SameBinary.h" +#endif // defined(MOZ_LAUNCHER_PROCESS) + +/** + * At this point the child process has been created in a suspended state. Any + * additional startup work (eg, blocklist setup) should go here. + * + * @return Ok if browser startup should proceed + */ +static mozilla::LauncherVoidResult PostCreationSetup( + const wchar_t* aFullImagePath, HANDLE aChildProcess, + HANDLE aChildMainThread, const bool aIsSafeMode) { + return mozilla::InitializeDllBlocklistOOPFromLauncher(aFullImagePath, + aChildProcess); +} + +#if !defined( \ + PROCESS_CREATION_MITIGATION_POLICY_IMAGE_LOAD_PREFER_SYSTEM32_ALWAYS_ON) +# define PROCESS_CREATION_MITIGATION_POLICY_IMAGE_LOAD_PREFER_SYSTEM32_ALWAYS_ON \ + (0x00000001ULL << 60) +#endif // !defined(PROCESS_CREATION_MITIGATION_POLICY_IMAGE_LOAD_PREFER_SYSTEM32_ALWAYS_ON) + +#if !defined(PROCESS_CREATION_MITIGATION_POLICY_CONTROL_FLOW_GUARD_ALWAYS_OFF) +# define PROCESS_CREATION_MITIGATION_POLICY_CONTROL_FLOW_GUARD_ALWAYS_OFF \ + (0x00000002ULL << 40) +#endif // !defined(PROCESS_CREATION_MITIGATION_POLICY_CONTROL_FLOW_GUARD_ALWAYS_OFF) + +#if (_WIN32_WINNT < 0x0602) +BOOL WINAPI +SetProcessMitigationPolicy(PROCESS_MITIGATION_POLICY aMitigationPolicy, + PVOID aBuffer, SIZE_T aBufferLen); +#endif // (_WIN32_WINNT >= 0x0602) + +/** + * Any mitigation policies that should be set on the browser process should go + * here. + */ +static void SetMitigationPolicies(mozilla::ProcThreadAttributes& aAttrs, + const bool aIsSafeMode) { + if (mozilla::IsWin10AnniversaryUpdateOrLater()) { + aAttrs.AddMitigationPolicy( + PROCESS_CREATION_MITIGATION_POLICY_IMAGE_LOAD_PREFER_SYSTEM32_ALWAYS_ON); + } + +#if defined(_M_ARM64) + // Disable CFG on older versions of ARM64 Windows to avoid a crash in COM. + if (!mozilla::IsWin10Sep2018UpdateOrLater()) { + aAttrs.AddMitigationPolicy( + PROCESS_CREATION_MITIGATION_POLICY_CONTROL_FLOW_GUARD_ALWAYS_OFF); + } +#endif // defined(_M_ARM64) +} + +static mozilla::LauncherFlags ProcessCmdLine(int& aArgc, wchar_t* aArgv[]) { + mozilla::LauncherFlags result = mozilla::LauncherFlags::eNone; + + if (mozilla::CheckArg(aArgc, aArgv, L"wait-for-browser", + static_cast(nullptr), + mozilla::CheckArgFlag::RemoveArg) == + mozilla::ARG_FOUND || + mozilla::CheckArg(aArgc, aArgv, L"marionette", + static_cast(nullptr), + mozilla::CheckArgFlag::None) == mozilla::ARG_FOUND || + mozilla::CheckArg(aArgc, aArgv, L"headless", + static_cast(nullptr), + mozilla::CheckArgFlag::None) == mozilla::ARG_FOUND || + mozilla::EnvHasValue("MOZ_AUTOMATION") || + mozilla::EnvHasValue("MOZ_HEADLESS")) { + result |= mozilla::LauncherFlags::eWaitForBrowser; + } + + if (mozilla::CheckArg(aArgc, aArgv, L"no-deelevate") == mozilla::ARG_FOUND) { + result |= mozilla::LauncherFlags::eNoDeelevate; + } + + return result; +} + +static void MaybeBreakForBrowserDebugging() { + if (mozilla::EnvHasValue("MOZ_DEBUG_BROWSER_PROCESS")) { + ::DebugBreak(); + return; + } + + const wchar_t* pauseLenS = _wgetenv(L"MOZ_DEBUG_BROWSER_PAUSE"); + if (!pauseLenS || !(*pauseLenS)) { + return; + } + + DWORD pauseLenMs = wcstoul(pauseLenS, nullptr, 10) * 1000; + printf_stderr("\n\nBROWSERBROWSERBROWSERBROWSER\n debug me @ %lu\n\n", + ::GetCurrentProcessId()); + ::Sleep(pauseLenMs); +} + +static bool DoLauncherProcessChecks(int& argc, wchar_t** argv) { + // NB: We run all tests in this function instead of returning early in order + // to ensure that all side effects take place, such as clearing environment + // variables. + bool result = false; + +#if defined(MOZ_LAUNCHER_PROCESS) + // We still prefer to compare file ids. Comparing NT paths i.e. passing + // CompareNtPathsOnly to IsSameBinaryAsParentProcess is much faster, but + // we're not 100% sure that NT path comparison perfectly prevents the + // launching loop of the launcher process. + mozilla::LauncherResult isSame = mozilla::IsSameBinaryAsParentProcess(); + if (isSame.isOk()) { + result = !isSame.unwrap(); + } else { + HandleLauncherError(isSame.unwrapErr()); + } +#endif // defined(MOZ_LAUNCHER_PROCESS) + + if (mozilla::EnvHasValue("MOZ_LAUNCHER_PROCESS")) { + mozilla::SaveToEnv("MOZ_LAUNCHER_PROCESS="); + result = true; + } + + result |= mozilla::CheckArg( + argc, argv, L"launcher", static_cast(nullptr), + mozilla::CheckArgFlag::RemoveArg) == mozilla::ARG_FOUND; + + return result; +} + +#if defined(MOZ_LAUNCHER_PROCESS) +static mozilla::Maybe RunAsLauncherProcess( + mozilla::LauncherRegistryInfo& aRegInfo, int& argc, wchar_t** argv) { +#else +static mozilla::Maybe RunAsLauncherProcess(int& argc, wchar_t** argv) { +#endif // defined(MOZ_LAUNCHER_PROCESS) + // return fast when we're a child process. + // (The remainder of this function has some side effects that are + // undesirable for content processes) + if (mozilla::CheckArg(argc, argv, L"contentproc", + static_cast(nullptr), + mozilla::CheckArgFlag::None) == mozilla::ARG_FOUND) { + return mozilla::Some(false); + } + + bool runAsLauncher = DoLauncherProcessChecks(argc, argv); + +#if defined(MOZ_LAUNCHER_PROCESS) + bool forceLauncher = + runAsLauncher && + mozilla::CheckArg(argc, argv, L"force-launcher", + static_cast(nullptr), + mozilla::CheckArgFlag::RemoveArg) == mozilla::ARG_FOUND; + + mozilla::LauncherRegistryInfo::ProcessType desiredType = + runAsLauncher ? mozilla::LauncherRegistryInfo::ProcessType::Launcher + : mozilla::LauncherRegistryInfo::ProcessType::Browser; + + mozilla::LauncherRegistryInfo::CheckOption checkOption = + forceLauncher ? mozilla::LauncherRegistryInfo::CheckOption::Force + : mozilla::LauncherRegistryInfo::CheckOption::Default; + + mozilla::LauncherResult + runAsType = aRegInfo.Check(desiredType, checkOption); + + if (runAsType.isErr()) { + mozilla::HandleLauncherError(runAsType); + return mozilla::Nothing(); + } + + runAsLauncher = runAsType.unwrap() == + mozilla::LauncherRegistryInfo::ProcessType::Launcher; +#endif // defined(MOZ_LAUNCHER_PROCESS) + + if (!runAsLauncher) { + // In this case, we will be proceeding to run as the browser. + // We should check MOZ_DEBUG_BROWSER_* env vars. + MaybeBreakForBrowserDebugging(); + } + + return mozilla::Some(runAsLauncher); +} + +namespace mozilla { + +Maybe LauncherMain(int& argc, wchar_t* argv[], + const StaticXREAppData& aAppData) { + // Note: keep in sync with nsBrowserApp. + const wchar_t* acceptableParams[] = {L"url", nullptr}; + EnsureCommandlineSafe(argc, argv, acceptableParams); + + SetLauncherErrorAppData(aAppData); + + if (CheckArg(argc, argv, L"log-launcher-error", + static_cast(nullptr), + mozilla::CheckArgFlag::RemoveArg) == ARG_FOUND) { + SetLauncherErrorForceEventLog(); + } + +#if defined(MOZ_LAUNCHER_PROCESS) + LauncherRegistryInfo regInfo; + Maybe runAsLauncher = RunAsLauncherProcess(regInfo, argc, argv); +#else + Maybe runAsLauncher = RunAsLauncherProcess(argc, argv); +#endif // defined(MOZ_LAUNCHER_PROCESS) + if (!runAsLauncher || !runAsLauncher.value()) { +#if defined(MOZ_LAUNCHER_PROCESS) + // Update the registry as Browser + LauncherVoidResult commitResult = regInfo.Commit(); + if (commitResult.isErr()) { + mozilla::HandleLauncherError(commitResult); + } +#endif // defined(MOZ_LAUNCHER_PROCESS) + return Nothing(); + } + + // Make sure that the launcher process itself has image load policies set + if (IsWin10AnniversaryUpdateOrLater()) { + static const StaticDynamicallyLinkedFunctionPtr + pSetProcessMitigationPolicy(L"kernel32.dll", + "SetProcessMitigationPolicy"); + if (pSetProcessMitigationPolicy) { + PROCESS_MITIGATION_IMAGE_LOAD_POLICY imgLoadPol = {}; + imgLoadPol.PreferSystem32Images = 1; + + DebugOnly setOk = pSetProcessMitigationPolicy( + ProcessImageLoadPolicy, &imgLoadPol, sizeof(imgLoadPol)); + MOZ_ASSERT(setOk); + } + } + + mozilla::UseParentConsole(); + + if (!SetArgv0ToFullBinaryPath(argv)) { + HandleLauncherError(LAUNCHER_ERROR_GENERIC()); + return Nothing(); + } + + LauncherFlags flags = ProcessCmdLine(argc, argv); + + nsAutoHandle mediumIlToken; + LauncherResult elevationState = + GetElevationState(argv[0], flags, mediumIlToken); + if (elevationState.isErr()) { + HandleLauncherError(elevationState); + return Nothing(); + } + + // If we're elevated, we should relaunch ourselves as a normal user. + // Note that we only call LaunchUnelevated when we don't need to wait for the + // browser process. + if (elevationState.unwrap() == ElevationState::eElevated && + !(flags & + (LauncherFlags::eWaitForBrowser | LauncherFlags::eNoDeelevate)) && + !mediumIlToken.get()) { + LauncherVoidResult launchedUnelevated = LaunchUnelevated(argc, argv); + bool failed = launchedUnelevated.isErr(); + if (failed) { + HandleLauncherError(launchedUnelevated); + return Nothing(); + } + + return Some(0); + } + +#if defined(MOZ_LAUNCHER_PROCESS) + // Update the registry as Launcher + LauncherVoidResult commitResult = regInfo.Commit(); + if (commitResult.isErr()) { + mozilla::HandleLauncherError(commitResult); + return Nothing(); + } +#endif // defined(MOZ_LAUNCHER_PROCESS) + + // Now proceed with setting up the parameters for process creation + UniquePtr cmdLine(MakeCommandLine(argc, argv)); + if (!cmdLine) { + HandleLauncherError(LAUNCHER_ERROR_GENERIC()); + return Nothing(); + } + + const Maybe isSafeMode = + IsSafeModeRequested(argc, argv, SafeModeFlag::NoKeyPressCheck); + if (!isSafeMode) { + HandleLauncherError(LAUNCHER_ERROR_FROM_WIN32(ERROR_INVALID_PARAMETER)); + return Nothing(); + } + + ProcThreadAttributes attrs; + SetMitigationPolicies(attrs, isSafeMode.value()); + + HANDLE stdHandles[] = {::GetStdHandle(STD_INPUT_HANDLE), + ::GetStdHandle(STD_OUTPUT_HANDLE), + ::GetStdHandle(STD_ERROR_HANDLE)}; + + attrs.AddInheritableHandles(stdHandles); + + DWORD creationFlags = CREATE_SUSPENDED | CREATE_UNICODE_ENVIRONMENT; + + STARTUPINFOEXW siex; + LauncherResult attrsOk = attrs.AssignTo(siex); + if (attrsOk.isErr()) { + HandleLauncherError(attrsOk); + return Nothing(); + } + + BOOL inheritHandles = FALSE; + + if (attrsOk.unwrap()) { + creationFlags |= EXTENDED_STARTUPINFO_PRESENT; + + if (attrs.HasInheritableHandles()) { + siex.StartupInfo.dwFlags |= STARTF_USESTDHANDLES; + siex.StartupInfo.hStdInput = stdHandles[0]; + siex.StartupInfo.hStdOutput = stdHandles[1]; + siex.StartupInfo.hStdError = stdHandles[2]; + + // Since attrsOk == true, we have successfully set the handle inheritance + // whitelist policy, so only the handles added to attrs will be inherited. + inheritHandles = TRUE; + } + } + + PROCESS_INFORMATION pi = {}; + BOOL createOk; + + if (mediumIlToken.get()) { + createOk = + ::CreateProcessAsUserW(mediumIlToken.get(), argv[0], cmdLine.get(), + nullptr, nullptr, inheritHandles, creationFlags, + nullptr, nullptr, &siex.StartupInfo, &pi); + } else { + createOk = ::CreateProcessW(argv[0], cmdLine.get(), nullptr, nullptr, + inheritHandles, creationFlags, nullptr, nullptr, + &siex.StartupInfo, &pi); + } + + if (!createOk) { + HandleLauncherError(LAUNCHER_ERROR_FROM_LAST()); + return Nothing(); + } + + nsAutoHandle process(pi.hProcess); + nsAutoHandle mainThread(pi.hThread); + + LauncherVoidResult setupResult = PostCreationSetup( + argv[0], process.get(), mainThread.get(), isSafeMode.value()); + if (setupResult.isErr()) { + HandleLauncherError(setupResult); + ::TerminateProcess(process.get(), 1); + return Nothing(); + } + + if (::ResumeThread(mainThread.get()) == static_cast(-1)) { + HandleLauncherError(LAUNCHER_ERROR_FROM_LAST()); + ::TerminateProcess(process.get(), 1); + return Nothing(); + } + + if (flags & LauncherFlags::eWaitForBrowser) { + DWORD exitCode; + if (::WaitForSingleObject(process.get(), INFINITE) == WAIT_OBJECT_0 && + ::GetExitCodeProcess(process.get(), &exitCode)) { + // Propagate the browser process's exit code as our exit code. + return Some(static_cast(exitCode)); + } + } else { + const DWORD timeout = + ::IsDebuggerPresent() ? INFINITE : kWaitForInputIdleTimeoutMS; + + // Keep the current process around until the callback process has created + // its message queue, to avoid the launched process's windows being forced + // into the background. + mozilla::WaitForInputIdle(process.get(), timeout); + } + + return Some(0); +} + +} // namespace mozilla diff --git a/browser/app/winlauncher/LauncherProcessWin.h b/browser/app/winlauncher/LauncherProcessWin.h new file mode 100644 index 0000000000..4fc819f658 --- /dev/null +++ b/browser/app/winlauncher/LauncherProcessWin.h @@ -0,0 +1,39 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* vim: set ts=8 sts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. */ + +#ifndef mozilla_LauncherProcessWin_h +#define mozilla_LauncherProcessWin_h + +#include "mozilla/Maybe.h" +#include "mozilla/TypedEnumBits.h" + +#include + +namespace mozilla { + +// Forward declaration +struct StaticXREAppData; + +/** + * Determine whether or not the current process should be run as the launcher + * process, and run if so. If we are not supposed to run as the launcher + * process, or in the event of a launcher process failure, return Nothing, thus + * indicating that we should continue on the original startup code path. + */ +Maybe LauncherMain(int& argc, wchar_t* argv[], + const StaticXREAppData& aAppData); + +enum class LauncherFlags : uint32_t { + eNone = 0, + eWaitForBrowser = (1 << 0), // Launcher should block until browser finishes + eNoDeelevate = (1 << 1), // If elevated, do not attempt to de-elevate +}; + +MOZ_MAKE_ENUM_CLASS_BITWISE_OPERATORS(LauncherFlags) + +} // namespace mozilla + +#endif // mozilla_LauncherProcessWin_h diff --git a/browser/app/winlauncher/NtLoaderAPI.cpp b/browser/app/winlauncher/NtLoaderAPI.cpp new file mode 100644 index 0000000000..805fdc881e --- /dev/null +++ b/browser/app/winlauncher/NtLoaderAPI.cpp @@ -0,0 +1,30 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* vim: set ts=8 sts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. */ + +#include "mozilla/LoaderAPIInterfaces.h" + +#include "freestanding/CheckForCaller.h" +#include "freestanding/LoaderPrivateAPI.h" + +namespace mozilla { + +extern "C" MOZ_EXPORT nt::LoaderAPI* GetNtLoaderAPI( + nt::LoaderObserver* aNewObserver) { + const bool isCallerMozglue = + CheckForAddress(RETURN_ADDRESS(), L"mozglue.dll"); + MOZ_ASSERT(isCallerMozglue); + if (!isCallerMozglue) { + return nullptr; + } + + freestanding::EnsureInitialized(); + freestanding::LoaderPrivateAPI& api = freestanding::gLoaderPrivateAPI; + api.SetObserver(aNewObserver); + + return &api; +} + +} // namespace mozilla diff --git a/browser/app/winlauncher/ProcThreadAttributes.h b/browser/app/winlauncher/ProcThreadAttributes.h new file mode 100644 index 0000000000..74d5fee06c --- /dev/null +++ b/browser/app/winlauncher/ProcThreadAttributes.h @@ -0,0 +1,159 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* vim: set ts=8 sts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. */ + +#ifndef mozilla_ProcThreadAttributes_h +#define mozilla_ProcThreadAttributes_h + +#include + +#include + +#include "mozilla/Attributes.h" +#include "mozilla/Maybe.h" +#include "mozilla/UniquePtr.h" +#include "mozilla/Vector.h" + +namespace mozilla { + +class MOZ_RAII ProcThreadAttributes final { + struct ProcThreadAttributeListDeleter { + void operator()(LPPROC_THREAD_ATTRIBUTE_LIST aList) { + ::DeleteProcThreadAttributeList(aList); + delete[] reinterpret_cast(aList); + } + }; + + using ProcThreadAttributeListPtr = + UniquePtr<_PROC_THREAD_ATTRIBUTE_LIST, ProcThreadAttributeListDeleter>; + + public: + ProcThreadAttributes() : mMitigationPolicies(0) {} + + ~ProcThreadAttributes() = default; + + ProcThreadAttributes(const ProcThreadAttributes&) = delete; + ProcThreadAttributes(ProcThreadAttributes&&) = delete; + ProcThreadAttributes& operator=(const ProcThreadAttributes&) = delete; + ProcThreadAttributes& operator=(ProcThreadAttributes&&) = delete; + + void AddMitigationPolicy(DWORD64 aPolicy) { mMitigationPolicies |= aPolicy; } + + bool AddInheritableHandle(HANDLE aHandle) { + DWORD type = ::GetFileType(aHandle); + if (type != FILE_TYPE_DISK && type != FILE_TYPE_PIPE) { + return false; + } + + if (!::SetHandleInformation(aHandle, HANDLE_FLAG_INHERIT, + HANDLE_FLAG_INHERIT)) { + return false; + } + + return mInheritableHandles.append(aHandle); + } + + template + bool AddInheritableHandles(HANDLE (&aHandles)[N]) { + bool ok = true; + for (auto handle : aHandles) { + ok &= AddInheritableHandle(handle); + } + + return ok; + } + + bool HasMitigationPolicies() const { return !!mMitigationPolicies; } + + bool HasInheritableHandles() const { return !mInheritableHandles.empty(); } + + /** + * @return false if the STARTUPINFOEXW::lpAttributeList was set to null + * as expected based on the state of |this|; + * true if the STARTUPINFOEXW::lpAttributeList was set to + * non-null; + */ + LauncherResult AssignTo(STARTUPINFOEXW& aSiex) { + ZeroMemory(&aSiex, sizeof(STARTUPINFOEXW)); + + // We'll set the size to sizeof(STARTUPINFOW) until we determine whether the + // extended fields will be used. + aSiex.StartupInfo.cb = sizeof(STARTUPINFOW); + + DWORD numAttributes = 0; + if (HasMitigationPolicies()) { + ++numAttributes; + } + + if (HasInheritableHandles()) { + ++numAttributes; + } + + if (!numAttributes) { + return false; + } + + SIZE_T listSize = 0; + if (!::InitializeProcThreadAttributeList(nullptr, numAttributes, 0, + &listSize)) { + DWORD err = ::GetLastError(); + if (err != ERROR_INSUFFICIENT_BUFFER) { + return LAUNCHER_ERROR_FROM_WIN32(err); + } + } + + auto buf = MakeUnique(listSize); + + LPPROC_THREAD_ATTRIBUTE_LIST tmpList = + reinterpret_cast(buf.get()); + + if (!::InitializeProcThreadAttributeList(tmpList, numAttributes, 0, + &listSize)) { + return LAUNCHER_ERROR_FROM_LAST(); + } + + // Transfer buf to a ProcThreadAttributeListPtr - now that the list is + // initialized, we are no longer dealing with a plain old char array. We + // must now deinitialize the attribute list before deallocating the + // underlying buffer. + ProcThreadAttributeListPtr attrList( + reinterpret_cast(buf.release())); + + if (mMitigationPolicies) { + if (!::UpdateProcThreadAttribute( + attrList.get(), 0, PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY, + &mMitigationPolicies, sizeof(mMitigationPolicies), nullptr, + nullptr)) { + return LAUNCHER_ERROR_FROM_LAST(); + } + } + + if (!mInheritableHandles.empty()) { + if (!::UpdateProcThreadAttribute( + attrList.get(), 0, PROC_THREAD_ATTRIBUTE_HANDLE_LIST, + mInheritableHandles.begin(), + mInheritableHandles.length() * sizeof(HANDLE), nullptr, + nullptr)) { + return LAUNCHER_ERROR_FROM_LAST(); + } + } + + mAttrList = std::move(attrList); + aSiex.lpAttributeList = mAttrList.get(); + aSiex.StartupInfo.cb = sizeof(STARTUPINFOEXW); + return true; + } + + private: + static const uint32_t kNumInline = 3; // Inline storage for the std handles + + DWORD64 mMitigationPolicies; + Vector mInheritableHandles; + ProcThreadAttributeListPtr mAttrList; +}; + +} // namespace mozilla + +#endif // mozilla_ProcThreadAttributes_h diff --git a/browser/app/winlauncher/SameBinary.h b/browser/app/winlauncher/SameBinary.h new file mode 100644 index 0000000000..f382e69572 --- /dev/null +++ b/browser/app/winlauncher/SameBinary.h @@ -0,0 +1,142 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* vim: set ts=8 sts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. */ + +#ifndef mozilla_SameBinary_h +#define mozilla_SameBinary_h + +#include "mozilla/WinHeaderOnlyUtils.h" +#include "mozilla/NativeNt.h" +#include "nsWindowsHelpers.h" + +namespace mozilla { + +class ProcessImagePath final { + PathType mType; + LauncherVoidResult mLastError; + + // Using a larger buffer because an NT path may exceed MAX_PATH. + WCHAR mPathBuffer[(MAX_PATH * 2) + 1]; + + public: + // Initialize with an NT path string of a given process handle + explicit ProcessImagePath(const nsAutoHandle& aProcess) + : mType(PathType::eNtPath), mLastError(Ok()) { + DWORD len = mozilla::ArrayLength(mPathBuffer); + if (!::QueryFullProcessImageNameW(aProcess.get(), PROCESS_NAME_NATIVE, + mPathBuffer, &len)) { + mLastError = LAUNCHER_ERROR_FROM_LAST(); + return; + } + } + + // Initizlize with a DOS path string of a given imagebase address + explicit ProcessImagePath(HMODULE aImageBase) + : mType(PathType::eDosPath), mLastError(Ok()) { + DWORD len = ::GetModuleFileNameW(aImageBase, mPathBuffer, + mozilla::ArrayLength(mPathBuffer)); + if (!len || len == mozilla::ArrayLength(mPathBuffer)) { + mLastError = LAUNCHER_ERROR_FROM_LAST(); + return; + } + } + + bool IsError() const { return mLastError.isErr(); } + + const WindowsErrorType& GetError() const { return mLastError.inspectErr(); } + + FileUniqueId GetId() const { return FileUniqueId(mPathBuffer, mType); } + + bool CompareNtPaths(const ProcessImagePath& aOther) const { + if (mLastError.isErr() || aOther.mLastError.isErr() || + mType != PathType::eNtPath || aOther.mType != PathType::eNtPath) { + return false; + } + + UNICODE_STRING path1, path2; + ::RtlInitUnicodeString(&path1, mPathBuffer); + ::RtlInitUnicodeString(&path2, aOther.mPathBuffer); + return !!::RtlEqualUnicodeString(&path1, &path2, TRUE); + } +}; + +enum class ImageFileCompareOption { + Default, + CompareNtPathsOnly, +}; + +static inline mozilla::LauncherResult IsSameBinaryAsParentProcess( + ImageFileCompareOption aOption = ImageFileCompareOption::Default) { + mozilla::LauncherResult parentPid = mozilla::nt::GetParentProcessId(); + if (parentPid.isErr()) { + return parentPid.propagateErr(); + } + + nsAutoHandle parentProcess(::OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, + FALSE, parentPid.unwrap())); + if (!parentProcess.get()) { + DWORD err = ::GetLastError(); + if (err == ERROR_INVALID_PARAMETER) { + // The process identified by parentPid has already exited. This is a + // common case when the parent process is not Firefox, thus we should + // return false instead of erroring out. + return false; + } + + return LAUNCHER_ERROR_FROM_WIN32(err); + } + + ProcessImagePath parentExe(parentProcess); + if (parentExe.IsError()) { + return ::mozilla::Err(parentExe.GetError()); + } + + if (aOption == ImageFileCompareOption::Default) { + bool skipFileIdComparison = false; + + FileUniqueId id1 = parentExe.GetId(); + if (id1.IsError()) { + // We saw a number of Win7 users failed to call NtOpenFile with + // STATUS_OBJECT_PATH_NOT_FOUND for an unknown reason. In this + // particular case, we fall back to the logic to compare NT path + // strings instead of a file id which will not fail because we don't + // need to open a file handle. +#if !defined(STATUS_OBJECT_PATH_NOT_FOUND) + constexpr NTSTATUS STATUS_OBJECT_PATH_NOT_FOUND = 0xc000003a; +#endif + const LauncherError& err = id1.GetError(); + if (err.mError != + WindowsError::FromNtStatus(STATUS_OBJECT_PATH_NOT_FOUND)) { + return ::mozilla::Err(err); + } + + skipFileIdComparison = true; + } + + if (!skipFileIdComparison) { + ProcessImagePath ourExe(nullptr); + if (ourExe.IsError()) { + return ::mozilla::Err(ourExe.GetError()); + } + + FileUniqueId id2 = ourExe.GetId(); + if (id2.IsError()) { + return ::mozilla::Err(id2.GetError()); + } + return id1 == id2; + } + } + + nsAutoHandle ourProcess(::GetCurrentProcess()); + ProcessImagePath ourExeNt(ourProcess); + if (ourExeNt.IsError()) { + return ::mozilla::Err(ourExeNt.GetError()); + } + return parentExe.CompareNtPaths(ourExeNt); +} + +} // namespace mozilla + +#endif // mozilla_SameBinary_h diff --git a/browser/app/winlauncher/freestanding/CheckForCaller.h b/browser/app/winlauncher/freestanding/CheckForCaller.h new file mode 100644 index 0000000000..799d16cd1f --- /dev/null +++ b/browser/app/winlauncher/freestanding/CheckForCaller.h @@ -0,0 +1,36 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* vim: set ts=8 sts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. */ + +#ifndef mozilla_freestanding_CheckForCaller_h +#define mozilla_freestanding_CheckForCaller_h + +namespace mozilla { + +#if defined(_MSC_VER) +# include +# pragma intrinsic(_ReturnAddress) +# define RETURN_ADDRESS() _ReturnAddress() +#elif defined(__GNUC__) || defined(__clang__) +# define RETURN_ADDRESS() \ + __builtin_extract_return_addr(__builtin_return_address(0)) +#endif + +template +bool CheckForAddress(void* aReturnAddress, const wchar_t (&aName)[N]) { + HMODULE callingModule; + if (!::GetModuleHandleExW(GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS | + GET_MODULE_HANDLE_EX_FLAG_UNCHANGED_REFCOUNT, + reinterpret_cast(aReturnAddress), + &callingModule)) { + return false; + } + + return callingModule && callingModule == ::GetModuleHandleW(aName); +} + +} // namespace mozilla + +#endif // mozilla_freestanding_CheckForCaller_h diff --git a/browser/app/winlauncher/freestanding/DllBlocklist.cpp b/browser/app/winlauncher/freestanding/DllBlocklist.cpp new file mode 100644 index 0000000000..2806cec87e --- /dev/null +++ b/browser/app/winlauncher/freestanding/DllBlocklist.cpp @@ -0,0 +1,483 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* vim: set ts=8 sts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. */ + +#include "mozilla/ArrayUtils.h" +#include "mozilla/Attributes.h" +#include "mozilla/BinarySearch.h" +#include "mozilla/NativeNt.h" +#include "mozilla/Types.h" +#include "mozilla/WindowsDllBlocklist.h" + +#include "DllBlocklist.h" +#include "LoaderPrivateAPI.h" +#include "ModuleLoadFrame.h" +#include "SharedSection.h" + +// clang-format off +#define MOZ_LITERAL_UNICODE_STRING(s) \ + { \ + /* Length of the string in bytes, less the null terminator */ \ + sizeof(s) - sizeof(wchar_t), \ + /* Length of the string in bytes, including the null terminator */ \ + sizeof(s), \ + /* Pointer to the buffer */ \ + const_cast(s) \ + } +// clang-format on + +#define DLL_BLOCKLIST_ENTRY(name, ...) \ + {MOZ_LITERAL_UNICODE_STRING(L##name), __VA_ARGS__}, +#define DLL_BLOCKLIST_STRING_TYPE UNICODE_STRING + +#if defined(MOZ_LAUNCHER_PROCESS) || defined(NIGHTLY_BUILD) +# include "mozilla/WindowsDllBlocklistLauncherDefs.h" +#else +# include "mozilla/WindowsDllBlocklistCommon.h" +DLL_BLOCKLIST_DEFINITIONS_BEGIN +DLL_BLOCKLIST_DEFINITIONS_END +#endif + +class MOZ_STATIC_CLASS MOZ_TRIVIAL_CTOR_DTOR NativeNtBlockSet final { + struct NativeNtBlockSetEntry { + NativeNtBlockSetEntry() = default; + ~NativeNtBlockSetEntry() = default; + NativeNtBlockSetEntry(const UNICODE_STRING& aName, uint64_t aVersion, + NativeNtBlockSetEntry* aNext) + : mName(aName), mVersion(aVersion), mNext(aNext) {} + UNICODE_STRING mName; + uint64_t mVersion; + NativeNtBlockSetEntry* mNext; + }; + + public: + // Constructor and destructor MUST be trivial + constexpr NativeNtBlockSet() : mFirstEntry(nullptr) {} + ~NativeNtBlockSet() = default; + + void Add(const UNICODE_STRING& aName, uint64_t aVersion); + void Write(HANDLE aFile); + + private: + static NativeNtBlockSetEntry* NewEntry(const UNICODE_STRING& aName, + uint64_t aVersion, + NativeNtBlockSetEntry* aNextEntry); + + private: + NativeNtBlockSetEntry* mFirstEntry; + mozilla::nt::SRWLock mLock; +}; + +NativeNtBlockSet::NativeNtBlockSetEntry* NativeNtBlockSet::NewEntry( + const UNICODE_STRING& aName, uint64_t aVersion, + NativeNtBlockSet::NativeNtBlockSetEntry* aNextEntry) { + return mozilla::freestanding::RtlNew(aName, aVersion, + aNextEntry); +} + +void NativeNtBlockSet::Add(const UNICODE_STRING& aName, uint64_t aVersion) { + mozilla::nt::AutoExclusiveLock lock(mLock); + + for (NativeNtBlockSetEntry* entry = mFirstEntry; entry; + entry = entry->mNext) { + if (::RtlEqualUnicodeString(&entry->mName, &aName, TRUE) && + aVersion == entry->mVersion) { + return; + } + } + + // Not present, add it + NativeNtBlockSetEntry* newEntry = NewEntry(aName, aVersion, mFirstEntry); + if (newEntry) { + mFirstEntry = newEntry; + } +} + +void NativeNtBlockSet::Write(HANDLE aFile) { + // NB: If this function is called, it is long after kernel32 is initialized, + // so it is safe to use Win32 calls here. + DWORD nBytes; + char buf[MAX_PATH]; + + // It would be nicer to use RAII here. However, its destructor + // might not run if an exception occurs, in which case we would never release + // the lock (MSVC warns about this possibility). So we acquire and release + // manually. + ::AcquireSRWLockExclusive(&mLock); + + MOZ_SEH_TRY { + for (auto entry = mFirstEntry; entry; entry = entry->mNext) { + int convOk = ::WideCharToMultiByte(CP_UTF8, 0, entry->mName.Buffer, + entry->mName.Length / sizeof(wchar_t), + buf, sizeof(buf), nullptr, nullptr); + if (!convOk) { + continue; + } + + // write name[,v.v.v.v]; + if (!WriteFile(aFile, buf, convOk, &nBytes, nullptr)) { + continue; + } + + if (entry->mVersion != DllBlockInfo::ALL_VERSIONS) { + WriteFile(aFile, ",", 1, &nBytes, nullptr); + uint16_t parts[4]; + parts[0] = entry->mVersion >> 48; + parts[1] = (entry->mVersion >> 32) & 0xFFFF; + parts[2] = (entry->mVersion >> 16) & 0xFFFF; + parts[3] = entry->mVersion & 0xFFFF; + for (size_t p = 0; p < mozilla::ArrayLength(parts); ++p) { + ltoa(parts[p], buf, 10); + WriteFile(aFile, buf, strlen(buf), &nBytes, nullptr); + if (p != mozilla::ArrayLength(parts) - 1) { + WriteFile(aFile, ".", 1, &nBytes, nullptr); + } + } + } + WriteFile(aFile, ";", 1, &nBytes, nullptr); + } + } + MOZ_SEH_EXCEPT(EXCEPTION_EXECUTE_HANDLER) {} + + ::ReleaseSRWLockExclusive(&mLock); +} + +static NativeNtBlockSet gBlockSet; + +extern "C" void MOZ_EXPORT NativeNtBlockSet_Write(HANDLE aHandle) { + gBlockSet.Write(aHandle); +} + +enum class BlockAction { + Allow, + SubstituteLSP, + Error, + Deny, + NoOpEntryPoint, +}; + +static BlockAction CheckBlockInfo(const DllBlockInfo* aInfo, + const mozilla::nt::PEHeaders& aHeaders, + uint64_t& aVersion) { + aVersion = DllBlockInfo::ALL_VERSIONS; + + if (aInfo->mFlags & (DllBlockInfo::BLOCK_WIN8_AND_OLDER | + DllBlockInfo::BLOCK_WIN7_AND_OLDER)) { + RTL_OSVERSIONINFOW osv = {sizeof(osv)}; + NTSTATUS ntStatus = ::RtlGetVersion(&osv); + if (!NT_SUCCESS(ntStatus)) { + return BlockAction::Error; + } + + if ((aInfo->mFlags & DllBlockInfo::BLOCK_WIN8_AND_OLDER) && + (osv.dwMajorVersion > 6 || + (osv.dwMajorVersion == 6 && osv.dwMinorVersion > 2))) { + return BlockAction::Allow; + } + + if ((aInfo->mFlags & DllBlockInfo::BLOCK_WIN7_AND_OLDER) && + (osv.dwMajorVersion > 6 || + (osv.dwMajorVersion == 6 && osv.dwMinorVersion > 1))) { + return BlockAction::Allow; + } + } + + if ((aInfo->mFlags & DllBlockInfo::CHILD_PROCESSES_ONLY) && + !(gBlocklistInitFlags & eDllBlocklistInitFlagIsChildProcess)) { + return BlockAction::Allow; + } + + if ((aInfo->mFlags & DllBlockInfo::BROWSER_PROCESS_ONLY) && + (gBlocklistInitFlags & eDllBlocklistInitFlagIsChildProcess)) { + return BlockAction::Allow; + } + + if (aInfo->mMaxVersion == DllBlockInfo::ALL_VERSIONS) { + return BlockAction::Deny; + } + + if (!aHeaders) { + return BlockAction::Error; + } + + if (aInfo->mFlags & DllBlockInfo::USE_TIMESTAMP) { + DWORD timestamp; + if (!aHeaders.GetTimeStamp(timestamp)) { + return BlockAction::Error; + } + + if (timestamp > aInfo->mMaxVersion) { + return BlockAction::Allow; + } + + return BlockAction::Deny; + } + + // Else we try to get the file version information. Note that we don't have + // access to GetFileVersionInfo* APIs. + if (!aHeaders.GetVersionInfo(aVersion)) { + return BlockAction::Error; + } + + if (aInfo->IsVersionBlocked(aVersion)) { + return BlockAction::Deny; + } + + return BlockAction::Allow; +} + +struct DllBlockInfoComparator { + explicit DllBlockInfoComparator(const UNICODE_STRING& aTarget) + : mTarget(&aTarget) {} + + int operator()(const DllBlockInfo& aVal) const { + return static_cast( + ::RtlCompareUnicodeString(mTarget, &aVal.mName, TRUE)); + } + + PCUNICODE_STRING mTarget; +}; + +static BOOL WINAPI NoOp_DllMain(HINSTANCE, DWORD, LPVOID) { return TRUE; } + +// This helper function checks whether a given module is included +// in the executable's Import Table. Because an injected module's +// DllMain may revert the Import Table to the original state, we parse +// the Import Table every time a module is loaded without creating a cache. +static bool IsDependentModule( + const UNICODE_STRING& aModuleLeafName, + mozilla::freestanding::Kernel32ExportsSolver& aK32Exports) { + // We enable automatic DLL blocking only in Nightly for now because it caused + // a compat issue (bug 1682304). +#if defined(NIGHTLY_BUILD) + aK32Exports.Resolve(mozilla::freestanding::gK32ExportsResolveOnce); + if (!aK32Exports.IsResolved()) { + return false; + } + + mozilla::nt::PEHeaders exeHeaders(aK32Exports.mGetModuleHandleW(nullptr)); + if (!exeHeaders || !exeHeaders.IsImportDirectoryTampered()) { + // If no tampering is detected, no need to enumerate the Import Table. + return false; + } + + bool isDependent = false; + exeHeaders.EnumImportChunks( + [&isDependent, &aModuleLeafName, &exeHeaders](const char* aDepModule) { + // If |aDepModule| is within the PE image, it's not an injected module + // but a legitimate dependent module. + if (isDependent || exeHeaders.IsWithinImage(aDepModule)) { + return; + } + + UNICODE_STRING depModuleLeafName; + mozilla::nt::AllocatedUnicodeString depModuleName(aDepModule); + mozilla::nt::GetLeafName(&depModuleLeafName, depModuleName); + isDependent = (::RtlCompareUnicodeString( + &aModuleLeafName, &depModuleLeafName, TRUE) == 0); + }); + return isDependent; +#else + return false; +#endif +} + +// Allowing a module to be loaded but detour the entrypoint to NoOp_DllMain +// so that the module has no chance to interact with our code. We need this +// technique to safely block a module injected by IAT tampering because +// blocking such a module makes a process fail to launch. +static bool RedirectToNoOpEntryPoint( + const mozilla::nt::PEHeaders& aModule, + mozilla::freestanding::Kernel32ExportsSolver& aK32Exports) { + aK32Exports.Resolve(mozilla::freestanding::gK32ExportsResolveOnce); + if (!aK32Exports.IsResolved()) { + return false; + } + + mozilla::interceptor::WindowsDllEntryPointInterceptor interceptor( + aK32Exports); + if (!interceptor.Set(aModule, NoOp_DllMain)) { + return false; + } + + return true; +} + +static BlockAction DetermineBlockAction( + const UNICODE_STRING& aLeafName, void* aBaseAddress, + mozilla::freestanding::Kernel32ExportsSolver* aK32Exports) { + if (mozilla::nt::Contains12DigitHexString(aLeafName) || + mozilla::nt::IsFileNameAtLeast16HexDigits(aLeafName)) { + return BlockAction::Deny; + } + + DECLARE_POINTER_TO_FIRST_DLL_BLOCKLIST_ENTRY(info); + DECLARE_DLL_BLOCKLIST_NUM_ENTRIES(infoNumEntries); + + DllBlockInfoComparator comp(aLeafName); + + size_t match; + if (!BinarySearchIf(info, 0, infoNumEntries, comp, &match)) { + return BlockAction::Allow; + } + + const DllBlockInfo& entry = info[match]; + + mozilla::nt::PEHeaders headers(aBaseAddress); + uint64_t version; + BlockAction checkResult = CheckBlockInfo(&entry, headers, version); + if (checkResult == BlockAction::Allow) { + return checkResult; + } + + gBlockSet.Add(entry.mName, version); + + if ((entry.mFlags & DllBlockInfo::REDIRECT_TO_NOOP_ENTRYPOINT) && + aK32Exports && RedirectToNoOpEntryPoint(headers, *aK32Exports)) { + return BlockAction::NoOpEntryPoint; + } + + return checkResult; +} + +namespace mozilla { +namespace freestanding { + +CrossProcessDllInterceptor::FuncHookType stub_LdrLoadDll; +RTL_RUN_ONCE gK32ExportsResolveOnce = RTL_RUN_ONCE_INIT; + +NTSTATUS NTAPI patched_LdrLoadDll(PWCHAR aDllPath, PULONG aFlags, + PUNICODE_STRING aDllName, + PHANDLE aOutHandle) { + ModuleLoadFrame frame(aDllName); + + NTSTATUS ntStatus = stub_LdrLoadDll(aDllPath, aFlags, aDllName, aOutHandle); + + return frame.SetLoadStatus(ntStatus, aOutHandle); +} + +CrossProcessDllInterceptor::FuncHookType + stub_NtMapViewOfSection; + +NTSTATUS NTAPI patched_NtMapViewOfSection( + HANDLE aSection, HANDLE aProcess, PVOID* aBaseAddress, ULONG_PTR aZeroBits, + SIZE_T aCommitSize, PLARGE_INTEGER aSectionOffset, PSIZE_T aViewSize, + SECTION_INHERIT aInheritDisposition, ULONG aAllocationType, + ULONG aProtectionFlags) { + // We always map first, then we check for additional info after. + NTSTATUS stubStatus = stub_NtMapViewOfSection( + aSection, aProcess, aBaseAddress, aZeroBits, aCommitSize, aSectionOffset, + aViewSize, aInheritDisposition, aAllocationType, aProtectionFlags); + if (!NT_SUCCESS(stubStatus)) { + return stubStatus; + } + + if (aProcess != nt::kCurrentProcess) { + // We're only interested in mapping for the current process. + return stubStatus; + } + + // Do a query to see if the memory is MEM_IMAGE. If not, continue + MEMORY_BASIC_INFORMATION mbi; + NTSTATUS ntStatus = + ::NtQueryVirtualMemory(aProcess, *aBaseAddress, MemoryBasicInformation, + &mbi, sizeof(mbi), nullptr); + if (!NT_SUCCESS(ntStatus)) { + ::NtUnmapViewOfSection(aProcess, *aBaseAddress); + return STATUS_ACCESS_DENIED; + } + + // We don't care about mappings that aren't MEM_IMAGE + if (!(mbi.Type & MEM_IMAGE)) { + return stubStatus; + } + + // Get the section name + nt::MemorySectionNameBuf sectionFileName( + gLoaderPrivateAPI.GetSectionNameBuffer(*aBaseAddress)); + if (sectionFileName.IsEmpty()) { + ::NtUnmapViewOfSection(aProcess, *aBaseAddress); + return STATUS_ACCESS_DENIED; + } + + // Find the leaf name + UNICODE_STRING leafOnStack; + nt::GetLeafName(&leafOnStack, sectionFileName); + + bool isDependent = false; + auto resultView = freestanding::gSharedSection.GetView(); + // Small optimization: Since loading a dependent module does not involve + // LdrLoadDll, we know isDependent is false if we hold a top frame. + if (resultView.isOk() && !ModuleLoadFrame::ExistsTopFrame()) { + isDependent = + IsDependentModule(leafOnStack, resultView.inspect()->mK32Exports); + } + + BlockAction blockAction; + if (isDependent) { + // Add an NT dv\path to the shared section so that a sandbox process can + // use it to bypass CIG. In a sandbox process, this addition fails + // because we cannot map the section to a writable region, but it's + // ignorable because the paths have been added by the browser process. + Unused << freestanding::gSharedSection.AddDepenentModule(sectionFileName); + + // For a dependent module, try redirection instead of blocking it. + // If we fail, we reluctantly allow the module for free. + mozilla::nt::PEHeaders headers(*aBaseAddress); + blockAction = + RedirectToNoOpEntryPoint(headers, resultView.inspect()->mK32Exports) + ? BlockAction::NoOpEntryPoint + : BlockAction::Allow; + } else { + // Check blocklist + blockAction = DetermineBlockAction( + leafOnStack, *aBaseAddress, + resultView.isOk() ? &resultView.inspect()->mK32Exports : nullptr); + } + + ModuleLoadInfo::Status loadStatus = ModuleLoadInfo::Status::Blocked; + + switch (blockAction) { + case BlockAction::Allow: + loadStatus = ModuleLoadInfo::Status::Loaded; + break; + + case BlockAction::NoOpEntryPoint: + loadStatus = ModuleLoadInfo::Status::Redirected; + break; + + case BlockAction::SubstituteLSP: + // The process heap needs to be available here because + // NotifyLSPSubstitutionRequired below copies a given string into + // the heap. We use a soft assert here, assuming LSP load always + // occurs after the heap is initialized. + MOZ_ASSERT(nt::RtlGetProcessHeap()); + + // Notify patched_LdrLoadDll that it will be necessary to perform + // a substitution before returning. + ModuleLoadFrame::NotifyLSPSubstitutionRequired(&leafOnStack); + break; + + default: + break; + } + + if (nt::RtlGetProcessHeap()) { + ModuleLoadFrame::NotifySectionMap( + nt::AllocatedUnicodeString(sectionFileName), *aBaseAddress, stubStatus, + loadStatus); + } + + if (loadStatus == ModuleLoadInfo::Status::Loaded || + loadStatus == ModuleLoadInfo::Status::Redirected) { + return stubStatus; + } + + ::NtUnmapViewOfSection(aProcess, *aBaseAddress); + return STATUS_ACCESS_DENIED; +} + +} // namespace freestanding +} // namespace mozilla diff --git a/browser/app/winlauncher/freestanding/DllBlocklist.h b/browser/app/winlauncher/freestanding/DllBlocklist.h new file mode 100644 index 0000000000..153a1dfb28 --- /dev/null +++ b/browser/app/winlauncher/freestanding/DllBlocklist.h @@ -0,0 +1,38 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* vim: set ts=8 sts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. */ + +#ifndef mozilla_freestanding_DllBlocklist_h +#define mozilla_freestanding_DllBlocklist_h + +#include "mozilla/NativeNt.h" +#include "nsWindowsDllInterceptor.h" +#include "mozilla/WinHeaderOnlyUtils.h" + +namespace mozilla { +namespace freestanding { + +NTSTATUS NTAPI patched_LdrLoadDll(PWCHAR aDllPath, PULONG aFlags, + PUNICODE_STRING aDllName, PHANDLE aOutHandle); + +NTSTATUS NTAPI patched_NtMapViewOfSection( + HANDLE aSection, HANDLE aProcess, PVOID* aBaseAddress, ULONG_PTR aZeroBits, + SIZE_T aCommitSize, PLARGE_INTEGER aSectionOffset, PSIZE_T aViewSize, + SECTION_INHERIT aInheritDisposition, ULONG aAllocationType, + ULONG aProtectionFlags); + +using LdrLoadDllPtr = decltype(&::LdrLoadDll); + +extern CrossProcessDllInterceptor::FuncHookType stub_LdrLoadDll; + +using NtMapViewOfSectionPtr = decltype(&::NtMapViewOfSection); + +extern CrossProcessDllInterceptor::FuncHookType + stub_NtMapViewOfSection; + +} // namespace freestanding +} // namespace mozilla + +#endif // mozilla_freestanding_DllBlocklist_h diff --git a/browser/app/winlauncher/freestanding/Freestanding.h b/browser/app/winlauncher/freestanding/Freestanding.h new file mode 100644 index 0000000000..03999f231e --- /dev/null +++ b/browser/app/winlauncher/freestanding/Freestanding.h @@ -0,0 +1,67 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* vim: set ts=8 sts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. */ + +#ifndef mozilla_freestanding_Freestanding_h +#define mozilla_freestanding_Freestanding_h + +/** + * This header is automatically included in all source code residing in the + * /browser/app/winlauncher/freestanding directory. + */ + +#if defined(__STDC_HOSTED__) && __STDC_HOSTED__ == 1 +# error "This header should only be included by freestanding code" +#endif // defined(__STDC_HOSTED__) && __STDC_HOSTED__ == 1 + +#define MOZ_USE_LAUNCHER_ERROR +#include "mozilla/NativeNt.h" + +namespace mozilla { +namespace freestanding { + +/** + * Since this library is the only part of firefox.exe that needs special + * treatment with respect to the heap, we implement |RtlNew| and |RtlDelete| + * to be used instead of |new| and |delete| for any heap allocations inside + * the freestanding library. + */ +template +inline static T* RtlNew(Args&&... aArgs) { + HANDLE processHeap = nt::RtlGetProcessHeap(); + if (!processHeap) { + // Handle the case where the process heap is not initialized because + // passing nullptr to RtlAllocateHeap crashes the process. + return nullptr; + } + + void* ptr = ::RtlAllocateHeap(processHeap, 0, sizeof(T)); + if (!ptr) { + return nullptr; + } + + return new (ptr) T(std::forward(aArgs)...); +} + +template +inline static void RtlDelete(T* aPtr) { + if (!aPtr) { + return; + } + + aPtr->~T(); + ::RtlFreeHeap(nt::RtlGetProcessHeap(), 0, aPtr); +} + +} // namespace freestanding +} // namespace mozilla + +// Initialization code for all statically-allocated data in freestanding is +// placed into a separate section. This allows us to initialize any +// freestanding statics without needing to initialize everything else in this +// binary. +#pragma init_seg(".freestd$g") + +#endif // mozilla_freestanding_Freestanding_h diff --git a/browser/app/winlauncher/freestanding/LoaderPrivateAPI.cpp b/browser/app/winlauncher/freestanding/LoaderPrivateAPI.cpp new file mode 100644 index 0000000000..527b6556a6 --- /dev/null +++ b/browser/app/winlauncher/freestanding/LoaderPrivateAPI.cpp @@ -0,0 +1,287 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* vim: set ts=8 sts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. */ + +#include "LoaderPrivateAPI.h" + +#include "mozilla/Assertions.h" +#include "mozilla/Types.h" +#include "mozilla/Unused.h" +#include "../DllBlocklistInit.h" +#include "../ErrorHandler.h" + +using GlobalInitializerFn = void(__cdecl*)(void); + +// Allocation of static initialization section for the freestanding library +#pragma section(".freestd$a", read) +__declspec(allocate(".freestd$a")) static const GlobalInitializerFn + FreeStdStart = reinterpret_cast(0); + +#pragma section(".freestd$z", read) +__declspec(allocate(".freestd$z")) static const GlobalInitializerFn FreeStdEnd = + reinterpret_cast(0); + +namespace mozilla { +namespace freestanding { + +static RTL_RUN_ONCE gRunOnce = RTL_RUN_ONCE_INIT; + +// The contract for this callback is identical to the InitOnceCallback from +// Win32 land; we're just using ntdll-layer types instead. +static ULONG NTAPI DoOneTimeInit(PRTL_RUN_ONCE aRunOnce, PVOID aParameter, + PVOID* aContext) { + // Invoke every static initializer in the .freestd section + const GlobalInitializerFn* cur = &FreeStdStart + 1; + while (cur < &FreeStdEnd) { + if (*cur) { + (*cur)(); + } + + ++cur; + } + + return TRUE; +} + +/** + * This observer is only used until the mozglue observer connects itself. + * All we do here is accumulate the module loads into a vector. + * As soon as mozglue connects, we call |Forward| on mozglue's LoaderObserver + * to pass our vector on for further processing. This object then becomes + * defunct. + */ +class MOZ_ONLY_USED_TO_AVOID_STATIC_CONSTRUCTORS DefaultLoaderObserver final + : public nt::LoaderObserver { + public: + constexpr DefaultLoaderObserver() : mModuleLoads(nullptr) {} + + void OnBeginDllLoad(void** aContext, + PCUNICODE_STRING aRequestedDllName) final {} + bool SubstituteForLSP(PCUNICODE_STRING aLSPLeafName, + PHANDLE aOutHandle) final { + return false; + } + void OnEndDllLoad(void* aContext, NTSTATUS aNtStatus, + ModuleLoadInfo&& aModuleLoadInfo) final; + void Forward(nt::LoaderObserver* aNext) final; + void OnForward(ModuleLoadInfoVec&& aInfo) final { + MOZ_ASSERT_UNREACHABLE("Not valid in freestanding::DefaultLoaderObserver"); + } + + private: + mozilla::nt::SRWLock mLock; + ModuleLoadInfoVec* mModuleLoads; +}; + +class MOZ_ONLY_USED_TO_AVOID_STATIC_CONSTRUCTORS LoaderPrivateAPIImp final + : public LoaderPrivateAPI { + public: + // LoaderAPI + ModuleLoadInfo ConstructAndNotifyBeginDllLoad( + void** aContext, PCUNICODE_STRING aRequestedDllName) final; + bool SubstituteForLSP(PCUNICODE_STRING aLSPLeafName, + PHANDLE aOutHandle) final; + void NotifyEndDllLoad(void* aContext, NTSTATUS aLoadNtStatus, + ModuleLoadInfo&& aModuleLoadInfo) final; + nt::AllocatedUnicodeString GetSectionName(void* aSectionAddr) final; + nt::LoaderAPI::InitDllBlocklistOOPFnPtr GetDllBlocklistInitFn() final; + nt::LoaderAPI::HandleLauncherErrorFnPtr GetHandleLauncherErrorFn() final; + + // LoaderPrivateAPI + void NotifyBeginDllLoad(void** aContext, + PCUNICODE_STRING aRequestedDllName) final; + void NotifyBeginDllLoad(ModuleLoadInfo& aModuleLoadInfo, void** aContext, + PCUNICODE_STRING aRequestedDllName) final; + void SetObserver(nt::LoaderObserver* aNewObserver) final; + bool IsDefaultObserver() const final; + nt::MemorySectionNameBuf GetSectionNameBuffer(void* aSectionAddr) final; +}; + +static void Init() { + DebugOnly ntStatus = + ::RtlRunOnceExecuteOnce(&gRunOnce, &DoOneTimeInit, nullptr, nullptr); + MOZ_ASSERT(NT_SUCCESS(ntStatus)); +} + +} // namespace freestanding +} // namespace mozilla + +static mozilla::freestanding::DefaultLoaderObserver gDefaultObserver; +static mozilla::freestanding::LoaderPrivateAPIImp gPrivateAPI; + +static mozilla::nt::SRWLock gLoaderObserverLock; +static mozilla::nt::LoaderObserver* gLoaderObserver = &gDefaultObserver; + +namespace mozilla { +namespace freestanding { + +LoaderPrivateAPI& gLoaderPrivateAPI = gPrivateAPI; + +void DefaultLoaderObserver::OnEndDllLoad(void* aContext, NTSTATUS aNtStatus, + ModuleLoadInfo&& aModuleLoadInfo) { + // If the DLL load failed, or if the DLL was loaded by a previous request + // and thus was not mapped by this request, we do not save the ModuleLoadInfo. + if (!NT_SUCCESS(aNtStatus) || !aModuleLoadInfo.WasMapped()) { + return; + } + + nt::AutoExclusiveLock lock(mLock); + if (!mModuleLoads) { + mModuleLoads = RtlNew(); + if (!mModuleLoads) { + return; + } + } + + Unused << mModuleLoads->emplaceBack( + std::forward(aModuleLoadInfo)); +} + +/** + * Pass mModuleLoads's data off to |aNext| for further processing. + */ +void DefaultLoaderObserver::Forward(nt::LoaderObserver* aNext) { + MOZ_ASSERT(aNext); + if (!aNext) { + return; + } + + ModuleLoadInfoVec* moduleLoads = nullptr; + + { // Scope for lock + nt::AutoExclusiveLock lock(mLock); + moduleLoads = mModuleLoads; + mModuleLoads = nullptr; + } + + if (!moduleLoads) { + return; + } + + aNext->OnForward(std::move(*moduleLoads)); + RtlDelete(moduleLoads); +} + +ModuleLoadInfo LoaderPrivateAPIImp::ConstructAndNotifyBeginDllLoad( + void** aContext, PCUNICODE_STRING aRequestedDllName) { + ModuleLoadInfo loadInfo(aRequestedDllName); + + NotifyBeginDllLoad(loadInfo, aContext, aRequestedDllName); + + return loadInfo; +} + +bool LoaderPrivateAPIImp::SubstituteForLSP(PCUNICODE_STRING aLSPLeafName, + PHANDLE aOutHandle) { + nt::AutoSharedLock lock(gLoaderObserverLock); + return gLoaderObserver->SubstituteForLSP(aLSPLeafName, aOutHandle); +} + +void LoaderPrivateAPIImp::NotifyEndDllLoad(void* aContext, + NTSTATUS aLoadNtStatus, + ModuleLoadInfo&& aModuleLoadInfo) { + aModuleLoadInfo.SetEndLoadTimeStamp(); + + if (NT_SUCCESS(aLoadNtStatus)) { + aModuleLoadInfo.CaptureBacktrace(); + } + + nt::AutoSharedLock lock(gLoaderObserverLock); + + // We need to notify the observer that the DLL load has ended even when + // |aLoadNtStatus| indicates a failure. This is to ensure that any resources + // acquired by the observer during OnBeginDllLoad are cleaned up. + gLoaderObserver->OnEndDllLoad(aContext, aLoadNtStatus, + std::move(aModuleLoadInfo)); +} + +nt::AllocatedUnicodeString LoaderPrivateAPIImp::GetSectionName( + void* aSectionAddr) { + const HANDLE kCurrentProcess = reinterpret_cast(-1); + + nt::MemorySectionNameBuf buf; + NTSTATUS ntStatus = + ::NtQueryVirtualMemory(kCurrentProcess, aSectionAddr, MemorySectionName, + &buf, sizeof(buf), nullptr); + if (!NT_SUCCESS(ntStatus)) { + return nt::AllocatedUnicodeString(); + } + + return nt::AllocatedUnicodeString(&buf.mSectionFileName); +} + +nt::LoaderAPI::InitDllBlocklistOOPFnPtr +LoaderPrivateAPIImp::GetDllBlocklistInitFn() { + return &InitializeDllBlocklistOOP; +} + +nt::LoaderAPI::HandleLauncherErrorFnPtr +LoaderPrivateAPIImp::GetHandleLauncherErrorFn() { + return &HandleLauncherError; +} + +nt::MemorySectionNameBuf LoaderPrivateAPIImp::GetSectionNameBuffer( + void* aSectionAddr) { + const HANDLE kCurrentProcess = reinterpret_cast(-1); + + nt::MemorySectionNameBuf buf; + NTSTATUS ntStatus = + ::NtQueryVirtualMemory(kCurrentProcess, aSectionAddr, MemorySectionName, + &buf, sizeof(buf), nullptr); + if (!NT_SUCCESS(ntStatus)) { + return nt::MemorySectionNameBuf(); + } + + return buf; +} + +void LoaderPrivateAPIImp::NotifyBeginDllLoad( + void** aContext, PCUNICODE_STRING aRequestedDllName) { + nt::AutoSharedLock lock(gLoaderObserverLock); + gLoaderObserver->OnBeginDllLoad(aContext, aRequestedDllName); +} + +void LoaderPrivateAPIImp::NotifyBeginDllLoad( + ModuleLoadInfo& aModuleLoadInfo, void** aContext, + PCUNICODE_STRING aRequestedDllName) { + NotifyBeginDllLoad(aContext, aRequestedDllName); + aModuleLoadInfo.SetBeginLoadTimeStamp(); +} + +void LoaderPrivateAPIImp::SetObserver(nt::LoaderObserver* aNewObserver) { + nt::LoaderObserver* prevLoaderObserver = nullptr; + + nt::AutoExclusiveLock lock(gLoaderObserverLock); + + MOZ_ASSERT(aNewObserver); + if (!aNewObserver) { + // This is unlikely, but we always want a valid observer, so use the + // gDefaultObserver if necessary. + gLoaderObserver = &gDefaultObserver; + return; + } + + prevLoaderObserver = gLoaderObserver; + gLoaderObserver = aNewObserver; + + MOZ_ASSERT(prevLoaderObserver); + if (!prevLoaderObserver) { + return; + } + + // Now that we have a new observer, the previous observer must forward its + // data on to the new observer for processing. + prevLoaderObserver->Forward(aNewObserver); +} + +bool LoaderPrivateAPIImp::IsDefaultObserver() const { + nt::AutoSharedLock lock(gLoaderObserverLock); + return gLoaderObserver == &gDefaultObserver; +} + +void EnsureInitialized() { Init(); } + +} // namespace freestanding +} // namespace mozilla diff --git a/browser/app/winlauncher/freestanding/LoaderPrivateAPI.h b/browser/app/winlauncher/freestanding/LoaderPrivateAPI.h new file mode 100644 index 0000000000..f21472d689 --- /dev/null +++ b/browser/app/winlauncher/freestanding/LoaderPrivateAPI.h @@ -0,0 +1,62 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* vim: set ts=8 sts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. */ + +#ifndef mozilla_freestanding_LoaderPrivateAPI_h +#define mozilla_freestanding_LoaderPrivateAPI_h + +#include "mozilla/LoaderAPIInterfaces.h" + +namespace mozilla { +namespace freestanding { + +/** + * This part of the API is available only to the launcher process. + */ +class NS_NO_VTABLE LoaderPrivateAPI : public nt::LoaderAPI { + public: + /** + * Notify the nt::LoaderObserver that a module load is beginning + */ + virtual void NotifyBeginDllLoad(void** aContext, + PCUNICODE_STRING aRequestedDllName) = 0; + /** + * Notify the nt::LoaderObserver that a module load is beginning and set the + * begin load timestamp on |aModuleLoadInfo|. + */ + virtual void NotifyBeginDllLoad(ModuleLoadInfo& aModuleLoadInfo, + void** aContext, + PCUNICODE_STRING aRequestedDllName) = 0; + + /** + * Set a new nt::LoaderObserver to be used by the launcher process. NB: This + * should only happen while the current process is still single-threaded! + */ + virtual void SetObserver(nt::LoaderObserver* aNewObserver) = 0; + + /** + * Returns true if the current nt::LoaderObserver is the launcher process's + * built-in observer. + */ + virtual bool IsDefaultObserver() const = 0; + + /** + * Returns the name of a given mapped section address as a local instance of + * nt::MemorySectionNameBuf. This does not involve heap allocation. + */ + virtual nt::MemorySectionNameBuf GetSectionNameBuffer(void* aSectionAddr) = 0; +}; + +/** + * Ensures that any statics in the freestanding library are initialized. + */ +void EnsureInitialized(); + +extern LoaderPrivateAPI& gLoaderPrivateAPI; + +} // namespace freestanding +} // namespace mozilla + +#endif // mozilla_freestanding_LoaderPrivateAPI_h diff --git a/browser/app/winlauncher/freestanding/ModuleLoadFrame.cpp b/browser/app/winlauncher/freestanding/ModuleLoadFrame.cpp new file mode 100644 index 0000000000..c734e70ed5 --- /dev/null +++ b/browser/app/winlauncher/freestanding/ModuleLoadFrame.cpp @@ -0,0 +1,139 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* vim: set ts=8 sts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. */ + +#include "ModuleLoadFrame.h" + +#include "LoaderPrivateAPI.h" + +namespace mozilla { +namespace freestanding { + +ModuleLoadFrame::ModuleLoadFrame(PCUNICODE_STRING aRequestedDllName) + : mPrev(sTopFrame.get()), + mContext(nullptr), + mLSPSubstitutionRequired(false), + mLoadNtStatus(STATUS_UNSUCCESSFUL), + mLoadInfo(aRequestedDllName) { + EnsureInitialized(); + sTopFrame.set(this); + + gLoaderPrivateAPI.NotifyBeginDllLoad(mLoadInfo, &mContext, aRequestedDllName); +} + +ModuleLoadFrame::ModuleLoadFrame(nt::AllocatedUnicodeString&& aSectionName, + const void* aMapBaseAddr, NTSTATUS aNtStatus, + ModuleLoadInfo::Status aLoadStatus) + : mPrev(sTopFrame.get()), + mContext(nullptr), + mLSPSubstitutionRequired(false), + mLoadNtStatus(aNtStatus), + mLoadInfo(std::move(aSectionName), aMapBaseAddr, aLoadStatus) { + sTopFrame.set(this); + + gLoaderPrivateAPI.NotifyBeginDllLoad(&mContext, mLoadInfo.mSectionName); +} + +ModuleLoadFrame::~ModuleLoadFrame() { + gLoaderPrivateAPI.NotifyEndDllLoad(mContext, mLoadNtStatus, + std::move(mLoadInfo)); + sTopFrame.set(mPrev); +} + +/* static */ +void ModuleLoadFrame::NotifyLSPSubstitutionRequired( + PCUNICODE_STRING aLeafName) { + ModuleLoadFrame* topFrame = sTopFrame.get(); + if (!topFrame) { + return; + } + + topFrame->SetLSPSubstitutionRequired(aLeafName); +} + +void ModuleLoadFrame::SetLSPSubstitutionRequired(PCUNICODE_STRING aLeafName) { + MOZ_ASSERT(!mLoadInfo.mBaseAddr); + if (mLoadInfo.mBaseAddr) { + // If mBaseAddr is not null then |this| has already seen a module load. This + // should not be the case for a LSP substitution, so we bail. + return; + } + + // Save aLeafName, as it will be used by SetLoadStatus when invoking + // SubstituteForLSP + mLoadInfo.mRequestedDllName = aLeafName; + mLSPSubstitutionRequired = true; +} + +/* static */ +void ModuleLoadFrame::NotifySectionMap( + nt::AllocatedUnicodeString&& aSectionName, const void* aMapBaseAddr, + NTSTATUS aMapNtStatus, ModuleLoadInfo::Status aLoadStatus) { + ModuleLoadFrame* topFrame = sTopFrame.get(); + if (!topFrame) { + // The only time that this data is useful is during initial mapping of + // the executable's dependent DLLs. If mozglue is present then + // IsDefaultObserver will return false, indicating that we are beyond + // initial process startup. + if (gLoaderPrivateAPI.IsDefaultObserver()) { + OnBareSectionMap(std::move(aSectionName), aMapBaseAddr, aMapNtStatus, + aLoadStatus); + } + return; + } + + topFrame->OnSectionMap(std::move(aSectionName), aMapBaseAddr, aMapNtStatus, + aLoadStatus); +} + +/* static */ +bool ModuleLoadFrame::ExistsTopFrame() { return !!sTopFrame.get(); } + +void ModuleLoadFrame::OnSectionMap(nt::AllocatedUnicodeString&& aSectionName, + const void* aMapBaseAddr, + NTSTATUS aMapNtStatus, + ModuleLoadInfo::Status aLoadStatus) { + if (mLoadInfo.mBaseAddr) { + // If mBaseAddr is not null then |this| has already seen a module load. This + // means that we are witnessing a bare section map. + OnBareSectionMap(std::move(aSectionName), aMapBaseAddr, aMapNtStatus, + aLoadStatus); + return; + } + + mLoadInfo.mSectionName = std::move(aSectionName); + mLoadInfo.mBaseAddr = aMapBaseAddr; + mLoadInfo.mStatus = aLoadStatus; +} + +/* static */ +void ModuleLoadFrame::OnBareSectionMap( + nt::AllocatedUnicodeString&& aSectionName, const void* aMapBaseAddr, + NTSTATUS aMapNtStatus, ModuleLoadInfo::Status aLoadStatus) { + // We call the special constructor variant that is used for bare mappings. + ModuleLoadFrame frame(std::move(aSectionName), aMapBaseAddr, aMapNtStatus, + aLoadStatus); +} + +NTSTATUS ModuleLoadFrame::SetLoadStatus(NTSTATUS aNtStatus, + PHANDLE aOutHandle) { + mLoadNtStatus = aNtStatus; + + if (!mLSPSubstitutionRequired) { + return aNtStatus; + } + + if (!gLoaderPrivateAPI.SubstituteForLSP(mLoadInfo.mRequestedDllName, + aOutHandle)) { + return aNtStatus; + } + + return STATUS_SUCCESS; +} + +SafeThreadLocal ModuleLoadFrame::sTopFrame; + +} // namespace freestanding +} // namespace mozilla diff --git a/browser/app/winlauncher/freestanding/ModuleLoadFrame.h b/browser/app/winlauncher/freestanding/ModuleLoadFrame.h new file mode 100644 index 0000000000..a0dfc01b57 --- /dev/null +++ b/browser/app/winlauncher/freestanding/ModuleLoadFrame.h @@ -0,0 +1,95 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* vim: set ts=8 sts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. */ + +#ifndef mozilla_freestanding_ModuleLoadFrame_h +#define mozilla_freestanding_ModuleLoadFrame_h + +#include "mozilla/LoaderAPIInterfaces.h" +#include "mozilla/NativeNt.h" +#include "mozilla/ThreadLocal.h" + +#include "SafeThreadLocal.h" + +namespace mozilla { +namespace freestanding { + +/** + * This class holds information about a DLL load at a particular frame in the + * current thread's stack. Each instance adds itself to a thread-local linked + * list of ModuleLoadFrames, enabling us to query information about the + * previous module load on the stack. + */ +class MOZ_RAII ModuleLoadFrame final { + public: + /** + * This constructor is for use by the LdrLoadDll hook. + */ + explicit ModuleLoadFrame(PCUNICODE_STRING aRequestedDllName); + ~ModuleLoadFrame(); + + static void NotifyLSPSubstitutionRequired(PCUNICODE_STRING aLeafName); + + /** + * This static method is called by the NtMapViewOfSection hook. + */ + static void NotifySectionMap(nt::AllocatedUnicodeString&& aSectionName, + const void* aMapBaseAddr, NTSTATUS aMapNtStatus, + ModuleLoadInfo::Status aLoadStatus); + static bool ExistsTopFrame(); + + /** + * Called by the LdrLoadDll hook to indicate the status of the load and for + * us to provide a substitute output handle if necessary. + */ + NTSTATUS SetLoadStatus(NTSTATUS aNtStatus, PHANDLE aOutHandle); + + ModuleLoadFrame(const ModuleLoadFrame&) = delete; + ModuleLoadFrame(ModuleLoadFrame&&) = delete; + ModuleLoadFrame& operator=(const ModuleLoadFrame&) = delete; + ModuleLoadFrame& operator=(ModuleLoadFrame&&) = delete; + + private: + /** + * Called by OnBareSectionMap to construct a frame for a bare load. + */ + ModuleLoadFrame(nt::AllocatedUnicodeString&& aSectionName, + const void* aMapBaseAddr, NTSTATUS aNtStatus, + ModuleLoadInfo::Status aLoadStatus); + + void SetLSPSubstitutionRequired(PCUNICODE_STRING aLeafName); + void OnSectionMap(nt::AllocatedUnicodeString&& aSectionName, + const void* aMapBaseAddr, NTSTATUS aMapNtStatus, + ModuleLoadInfo::Status aLoadStatus); + + /** + * A "bare" section mapping is one that was mapped without the code passing + * through a call to ntdll!LdrLoadDll. This method is invoked when we detect + * that condition. + */ + static void OnBareSectionMap(nt::AllocatedUnicodeString&& aSectionName, + const void* aMapBaseAddr, NTSTATUS aMapNtStatus, + ModuleLoadInfo::Status aLoadStatus); + + private: + // Link to the previous frame + ModuleLoadFrame* mPrev; + // Pointer to context managed by the nt::LoaderObserver implementation + void* mContext; + // Set to |true| when we need to block a WinSock LSP + bool mLSPSubstitutionRequired; + // NTSTATUS code from the |LdrLoadDll| call + NTSTATUS mLoadNtStatus; + // Telemetry information that will be forwarded to the nt::LoaderObserver + ModuleLoadInfo mLoadInfo; + + // Head of the linked list + static SafeThreadLocal sTopFrame; +}; + +} // namespace freestanding +} // namespace mozilla + +#endif // mozilla_freestanding_ModuleLoadFrame_h diff --git a/browser/app/winlauncher/freestanding/SafeThreadLocal.h b/browser/app/winlauncher/freestanding/SafeThreadLocal.h new file mode 100644 index 0000000000..e4b869f649 --- /dev/null +++ b/browser/app/winlauncher/freestanding/SafeThreadLocal.h @@ -0,0 +1,96 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* vim: set ts=8 sts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. */ + +#ifndef mozilla_freestanding_SafeThreadLocal_h +#define mozilla_freestanding_SafeThreadLocal_h + +#include + +#include "mozilla/NativeNt.h" +#include "mozilla/ThreadLocal.h" + +namespace mozilla { +namespace freestanding { + +// We cannot fall back to the Tls* APIs because kernel32 might not have been +// loaded yet. +#if defined(__MINGW32__) && !defined(HAVE_THREAD_TLS_KEYWORD) +# error "This code requires the compiler to have native TLS support" +#endif // defined(__MINGW32__) && !defined(HAVE_THREAD_TLS_KEYWORD) + +/** + * This class holds data as a thread-local variable, or as a global variable + * if the thread local storage is not initialized yet. It should be safe + * because in that early stage we assume there is no more than a single thread. + */ +template +class SafeThreadLocal final { + static MOZ_THREAD_LOCAL(T) sThreadLocal; + static T sGlobal; + static bool sIsTlsUsed; + + // In normal cases, TLS is always available and the class uses sThreadLocal + // without changing sMainThreadId. So sMainThreadId is likely to be 0. + // + // If TLS is not available, we use sGlobal instead and update sMainThreadId + // so that that thread keeps using sGlobal even after TLS is initialized + // later. + static DWORD sMainThreadId; + + // Need non-inline accessors to prevent the compiler from generating code + // accessing sThreadLocal before checking a condition. + MOZ_NEVER_INLINE static void SetGlobalValue(T aValue) { sGlobal = aValue; } + MOZ_NEVER_INLINE static T GetGlobalValue() { return sGlobal; } + + public: + static void set(T aValue) { + static_assert(std::is_pointer_v, + "SafeThreadLocal must be used with a pointer"); + + if (sMainThreadId == mozilla::nt::RtlGetCurrentThreadId()) { + SetGlobalValue(aValue); + } else if (sIsTlsUsed) { + MOZ_ASSERT(mozilla::nt::RtlGetThreadLocalStoragePointer(), + "Once TLS is used, TLS should be available till the end."); + sThreadLocal.set(aValue); + } else if (mozilla::nt::RtlGetThreadLocalStoragePointer()) { + sIsTlsUsed = true; + sThreadLocal.set(aValue); + } else { + MOZ_ASSERT(sMainThreadId == 0, + "A second thread cannot be created before TLS is available."); + sMainThreadId = mozilla::nt::RtlGetCurrentThreadId(); + SetGlobalValue(aValue); + } + } + + static T get() { + if (sMainThreadId == mozilla::nt::RtlGetCurrentThreadId()) { + return GetGlobalValue(); + } else if (sIsTlsUsed) { + return sThreadLocal.get(); + } + return GetGlobalValue(); + } +}; + +template +MOZ_THREAD_LOCAL(T) +SafeThreadLocal::sThreadLocal; + +template +T SafeThreadLocal::sGlobal = nullptr; + +template +bool SafeThreadLocal::sIsTlsUsed = false; + +template +DWORD SafeThreadLocal::sMainThreadId = 0; + +} // namespace freestanding +} // namespace mozilla + +#endif // mozilla_freestanding_SafeThreadLocal_h diff --git a/browser/app/winlauncher/freestanding/SharedSection.cpp b/browser/app/winlauncher/freestanding/SharedSection.cpp new file mode 100644 index 0000000000..66891ac80f --- /dev/null +++ b/browser/app/winlauncher/freestanding/SharedSection.cpp @@ -0,0 +1,267 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* vim: set ts=8 sts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. */ + +#include "SharedSection.h" + +#include "CheckForCaller.h" + +namespace { + +bool AddString(void* aBuffer, size_t aBufferSize, const UNICODE_STRING& aStr) { + size_t offset = 0; + while (offset < aBufferSize) { + UNICODE_STRING uniStr; + ::RtlInitUnicodeString(&uniStr, + reinterpret_cast( + reinterpret_cast(aBuffer) + offset)); + + if (uniStr.Length == 0) { + // Reached to the array's last item. + break; + } + + if (::RtlCompareUnicodeString(&uniStr, &aStr, TRUE) == 0) { + // Already included in the array. + return true; + } + + // Go to the next string. + offset += uniStr.MaximumLength; + } + + // Ensure enough space including the last empty string at the end. + if (offset + aStr.MaximumLength + sizeof(wchar_t) > aBufferSize) { + return false; + } + + auto newStr = reinterpret_cast(aBuffer) + offset; + memcpy(newStr, aStr.Buffer, aStr.Length); + memset(newStr + aStr.Length, 0, sizeof(wchar_t)); + return true; +} + +} // anonymous namespace + +namespace mozilla { +namespace freestanding { + +SharedSection gSharedSection; + +bool Kernel32ExportsSolver::IsInitialized() const { + return mState == State::Initialized || IsResolved(); +} + +bool Kernel32ExportsSolver::IsResolved() const { + return mState == State::Resolved; +} + +// Why don't we use ::GetProcAddress? +// If the export table of kernel32.dll is tampered in the current process, +// we cannot transfer an RVA because the function pointed by the RVA may not +// exist in a target process. +// We can use ::GetProcAddress with additional check to detect tampering, but +// FindExportAddressTableEntry fits perfectly here because it returns nullptr +// if the target entry is outside the image, which means it's tampered or +// forwarded to another DLL. +#define INIT_FUNCTION(exports, name) \ + do { \ + auto rvaToFunction = exports.FindExportAddressTableEntry(#name); \ + if (!rvaToFunction) { \ + return; \ + } \ + m##name = reinterpret_cast(*rvaToFunction); \ + } while (0) + +#define RESOLVE_FUNCTION(base, name) \ + m##name = reinterpret_cast( \ + base + reinterpret_cast(m##name)) + +void Kernel32ExportsSolver::Init() { + if (mState == State::Initialized || mState == State::Resolved) { + return; + } + + interceptor::MMPolicyInProcess policy; + auto k32Exports = nt::PEExportSection::Get( + ::GetModuleHandleW(L"kernel32.dll"), policy); + if (!k32Exports) { + return; + } + + // Please make sure these functions are not forwarded to another DLL. + INIT_FUNCTION(k32Exports, FlushInstructionCache); + INIT_FUNCTION(k32Exports, GetModuleHandleW); + INIT_FUNCTION(k32Exports, GetSystemInfo); + INIT_FUNCTION(k32Exports, VirtualProtect); + + mState = State::Initialized; +} + +void Kernel32ExportsSolver::ResolveInternal() { + if (mState == State::Resolved) { + return; + } + + MOZ_RELEASE_ASSERT(mState == State::Initialized); + + UNICODE_STRING k32Name; + ::RtlInitUnicodeString(&k32Name, L"kernel32.dll"); + + // We cannot use GetModuleHandleW because this code can be called + // before IAT is resolved. + auto k32Module = nt::GetModuleHandleFromLeafName(k32Name); + MOZ_RELEASE_ASSERT(k32Module.isOk()); + + uintptr_t k32Base = + nt::PEHeaders::HModuleToBaseAddr(k32Module.unwrap()); + + RESOLVE_FUNCTION(k32Base, FlushInstructionCache); + RESOLVE_FUNCTION(k32Base, GetModuleHandleW); + RESOLVE_FUNCTION(k32Base, GetSystemInfo); + RESOLVE_FUNCTION(k32Base, VirtualProtect); + + mState = State::Resolved; +} + +/* static */ +ULONG NTAPI Kernel32ExportsSolver::ResolveOnce(PRTL_RUN_ONCE aRunOnce, + PVOID aParameter, PVOID*) { + reinterpret_cast(aParameter)->ResolveInternal(); + return TRUE; +} + +void Kernel32ExportsSolver::Resolve(RTL_RUN_ONCE& aRunOnce) { + ::RtlRunOnceExecuteOnce(&aRunOnce, &ResolveOnce, this, nullptr); +} + +HANDLE SharedSection::sSectionHandle = nullptr; +void* SharedSection::sWriteCopyView = nullptr; + +void SharedSection::Reset(HANDLE aNewSecionObject) { + if (sWriteCopyView) { + nt::AutoMappedView view(sWriteCopyView); + sWriteCopyView = nullptr; + } + + if (sSectionHandle != aNewSecionObject) { + if (sSectionHandle) { + ::CloseHandle(sSectionHandle); + } + sSectionHandle = aNewSecionObject; + } +} + +void SharedSection::ConvertToReadOnly() { + if (!sSectionHandle) { + return; + } + + HANDLE readonlyHandle; + if (!::DuplicateHandle(nt::kCurrentProcess, sSectionHandle, + nt::kCurrentProcess, &readonlyHandle, GENERIC_READ, + FALSE, 0)) { + return; + } + + Reset(readonlyHandle); +} + +LauncherVoidResult SharedSection::Init(const nt::PEHeaders& aPEHeaders) { + static_assert( + kSharedViewSize >= sizeof(Layout), + "kSharedViewSize is too small to represent SharedSection::Layout."); + + HANDLE section = + ::CreateFileMappingW(INVALID_HANDLE_VALUE, nullptr, PAGE_READWRITE, 0, + kSharedViewSize, nullptr); + if (!section) { + return LAUNCHER_ERROR_FROM_LAST(); + } + Reset(section); + + // The initial contents of the pages in a file mapping object backed by + // the operating system paging file are 0 (zero). No need to zero it out + // ourselves. + // https://docs.microsoft.com/en-us/windows/win32/api/memoryapi/nf-memoryapi-createfilemappingw + nt::AutoMappedView writableView(sSectionHandle, PAGE_READWRITE); + if (!writableView) { + return LAUNCHER_ERROR_FROM_LAST(); + } + + SharedSection::Layout* view = writableView.as(); + view->mK32Exports.Init(); + + return Ok(); +} + +LauncherVoidResult SharedSection::AddDepenentModule(PCUNICODE_STRING aNtPath) { + nt::AutoMappedView writableView(sSectionHandle, PAGE_READWRITE); + if (!writableView) { + return LAUNCHER_ERROR_FROM_WIN32(::RtlGetLastWin32Error()); + } + + SharedSection::Layout* view = writableView.as(); + if (!AddString(view->mModulePathArray, + kSharedViewSize - sizeof(Kernel32ExportsSolver), *aNtPath)) { + return LAUNCHER_ERROR_FROM_WIN32(ERROR_INSUFFICIENT_BUFFER); + } + + return Ok(); +} + +LauncherResult SharedSection::GetView() { + if (!sWriteCopyView) { + nt::AutoMappedView view(sSectionHandle, PAGE_WRITECOPY); + if (!view) { + return LAUNCHER_ERROR_FROM_WIN32(::RtlGetLastWin32Error()); + } + sWriteCopyView = view.release(); + } + return reinterpret_cast(sWriteCopyView); +} + +LauncherVoidResult SharedSection::TransferHandle( + nt::CrossExecTransferManager& aTransferMgr, DWORD aDesiredAccess, + HANDLE* aDestinationAddress) { + HANDLE remoteHandle; + if (!::DuplicateHandle(nt::kCurrentProcess, sSectionHandle, + aTransferMgr.RemoteProcess(), &remoteHandle, + aDesiredAccess, FALSE, 0)) { + return LAUNCHER_ERROR_FROM_LAST(); + } + + return aTransferMgr.Transfer(aDestinationAddress, &remoteHandle, + sizeof(remoteHandle)); +} + +// This exported function is invoked by SandboxBroker of xul.dll +// in order to add dependent modules to the CIG exception list. +extern "C" MOZ_EXPORT const wchar_t* GetDependentModulePaths() { + // We enable pre-spawn CIG only in Nightly for now because it caused + // a compat issue (bug 1682304). +#if defined(NIGHTLY_BUILD) + const bool isCallerXul = CheckForAddress(RETURN_ADDRESS(), L"xul.dll"); + MOZ_ASSERT(isCallerXul); + if (!isCallerXul) { + return nullptr; + } + + // Remap a write-copy section to take the latest update in mModulePathArray. + gSharedSection.Reset(); + + LauncherResult resultView = gSharedSection.GetView(); + if (resultView.isErr()) { + return nullptr; + } + + return resultView.inspect()->mModulePathArray; +#else + return nullptr; +#endif +} + +} // namespace freestanding +} // namespace mozilla diff --git a/browser/app/winlauncher/freestanding/SharedSection.h b/browser/app/winlauncher/freestanding/SharedSection.h new file mode 100644 index 0000000000..0724cfc05d --- /dev/null +++ b/browser/app/winlauncher/freestanding/SharedSection.h @@ -0,0 +1,118 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* vim: set ts=8 sts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. */ + +#ifndef mozilla_freestanding_SharedSection_h +#define mozilla_freestanding_SharedSection_h + +#include "mozilla/NativeNt.h" +#include "mozilla/interceptor/MMPolicies.h" + +namespace mozilla { +namespace freestanding { + +// This class calculates RVAs of kernel32's functions and transfers them +// to a target process, where the transferred RVAs are resolved into +// function addresses so that the target process can use them after +// kernel32.dll is loaded and before IAT is resolved. +class MOZ_TRIVIAL_CTOR_DTOR Kernel32ExportsSolver final + : public interceptor::MMPolicyInProcessEarlyStage::Kernel32Exports { + enum class State { + Uninitialized, + Initialized, + Resolved, + } mState; + + static ULONG NTAPI ResolveOnce(PRTL_RUN_ONCE aRunOnce, PVOID aParameter, + PVOID*); + void ResolveInternal(); + + public: + Kernel32ExportsSolver() = default; + + Kernel32ExportsSolver(const Kernel32ExportsSolver&) = delete; + Kernel32ExportsSolver(Kernel32ExportsSolver&&) = delete; + Kernel32ExportsSolver& operator=(const Kernel32ExportsSolver&) = delete; + Kernel32ExportsSolver& operator=(Kernel32ExportsSolver&&) = delete; + + bool IsInitialized() const; + bool IsResolved() const; + + void Init(); + void Resolve(RTL_RUN_ONCE& aRunOnce); +}; + +// This class manages a section which is created in the launcher process and +// mapped in the browser process and the sandboxed processes. The section's +// layout is represented as SharedSection::Layout. +// +// (1) Kernel32's functions required for MMPolicyInProcessEarlyStage +// Formatted as Kernel32ExportsSolver. +// +// (2) Array of NT paths of the executable's dependent modules +// Formatted as a null-delimited wide-character string set ending with +// an empty string. +// +// +--------------------------------------------------------------+ +// | (1) | FlushInstructionCache | +// | | GetModuleHandleW | +// | | GetSystemInfo | +// | | VirtualProtect | +// | | State [Uninitialized|Initialized|Resolved] | +// +--------------------------------------------------------------+ +// | (2) | L"NT path 1" | +// | | L"NT path 2" | +// | | ... | +// | | L"" | +// +--------------------------------------------------------------+ +class MOZ_TRIVIAL_CTOR_DTOR SharedSection final { + // As we define a global variable of this class and use it in our blocklist + // which is excuted in a process's early stage. If we have a complex dtor, + // the static initializer tries to register that dtor with onexit() of + // ucrtbase.dll which is not loaded yet, resulting in crash. Thus, we have + // a raw handle and a pointer as a static variable and manually release them + // by calling Reset() where possible. + static HANDLE sSectionHandle; + static void* sWriteCopyView; + + static constexpr size_t kSharedViewSize = 0x1000; + + public: + struct Layout final { + Kernel32ExportsSolver mK32Exports; + wchar_t mModulePathArray[1]; + + Layout() = delete; // disallow instantiation + }; + + // Replace |sSectionHandle| with a given handle. + static void Reset(HANDLE aNewSecionObject = sSectionHandle); + + // Replace |sSectionHandle| with a new readonly handle. + static void ConvertToReadOnly(); + + // Create a new writable section and initialize the Kernel32ExportsSolver + // part. + static LauncherVoidResult Init(const nt::PEHeaders& aPEHeaders); + + // Append a new string to the |sSectionHandle| + static LauncherVoidResult AddDepenentModule(PCUNICODE_STRING aNtPath); + + // Map |sSectionHandle| to a copy-on-write page and return its address. + static LauncherResult GetView(); + + // Transfer |sSectionHandle| to a process associated with |aTransferMgr|. + static LauncherVoidResult TransferHandle( + nt::CrossExecTransferManager& aTransferMgr, DWORD aDesiredAccess, + HANDLE* aDestinationAddress = &sSectionHandle); +}; + +extern SharedSection gSharedSection; +extern RTL_RUN_ONCE gK32ExportsResolveOnce; + +} // namespace freestanding +} // namespace mozilla + +#endif // mozilla_freestanding_SharedSection_h diff --git a/browser/app/winlauncher/freestanding/gen_ntdll_freestanding_lib.py b/browser/app/winlauncher/freestanding/gen_ntdll_freestanding_lib.py new file mode 100644 index 0000000000..a69261cc3a --- /dev/null +++ b/browser/app/winlauncher/freestanding/gen_ntdll_freestanding_lib.py @@ -0,0 +1,30 @@ +# -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*- +# vim: set filetype=python: +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, You can obtain one at http://mozilla.org/MPL/2.0/. + +from __future__ import absolute_import + +import os +import subprocess +import tempfile + + +def main(output_fd, def_file, llvm_dlltool, *llvm_dlltool_args): + # llvm-dlltool can't output to stdout, so we create a temp file, use that + # to write out the lib, and then copy it over to output_fd + (tmp_fd, tmp_output) = tempfile.mkstemp() + os.close(tmp_fd) + + try: + cmd = [llvm_dlltool] + cmd.extend(llvm_dlltool_args) + cmd += ["-d", def_file, "-l", tmp_output] + + subprocess.check_call(cmd) + + with open(tmp_output, "rb") as tmplib: + output_fd.write(tmplib.read()) + finally: + os.remove(tmp_output) diff --git a/browser/app/winlauncher/freestanding/moz.build b/browser/app/winlauncher/freestanding/moz.build new file mode 100644 index 0000000000..7a43d9a104 --- /dev/null +++ b/browser/app/winlauncher/freestanding/moz.build @@ -0,0 +1,56 @@ +# -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*- +# vim: set filetype=python: +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, You can obtain one at http://mozilla.org/MPL/2.0/. + +Library("winlauncher-freestanding") + +FORCE_STATIC_LIB = True + +# Our patched NtMapViewOfSection can be called before the process's import +# table is populated. Don't let the compiler insert any instrumentation +# that might call an import. +NO_PGO = True + +UNIFIED_SOURCES += [ + "DllBlocklist.cpp", + "LoaderPrivateAPI.cpp", + "ModuleLoadFrame.cpp", + "SharedSection.cpp", +] + +# This library must be compiled in a freestanding environment, as its code must +# not assume that it has access to any runtime libraries. +if CONFIG["CC_TYPE"] == "clang-cl": + CXXFLAGS += ["-Xclang"] + +CXXFLAGS += [ + "-ffreestanding", +] + +# Forcibly include Freestanding.h into all source files in this library. +if CONFIG["CC_TYPE"] == "clang-cl": + CXXFLAGS += ["-FI"] +else: + CXXFLAGS += ["-include"] + +CXXFLAGS += [SRCDIR + "/Freestanding.h"] + +OS_LIBS += [ + "ntdll", + "ntdll_freestanding", +] + +if CONFIG["COMPILE_ENVIRONMENT"] and CONFIG["LLVM_DLLTOOL"]: + GeneratedFile( + "%sntdll_freestanding.%s" % (CONFIG["LIB_PREFIX"], CONFIG["LIB_SUFFIX"]), + script="gen_ntdll_freestanding_lib.py", + inputs=["ntdll_freestanding.def"], + flags=[CONFIG["LLVM_DLLTOOL"]] + CONFIG["LLVM_DLLTOOL_FLAGS"], + ) + +DisableStlWrapping() + +with Files("**"): + BUG_COMPONENT = ("Firefox", "Launcher Process") diff --git a/browser/app/winlauncher/freestanding/ntdll_freestanding.def b/browser/app/winlauncher/freestanding/ntdll_freestanding.def new file mode 100644 index 0000000000..6e5e2685fe --- /dev/null +++ b/browser/app/winlauncher/freestanding/ntdll_freestanding.def @@ -0,0 +1,25 @@ +; This Source Code Form is subject to the terms of the Mozilla Public +; License, v. 2.0. If a copy of the MPL was not distributed with this +; file, You can obtain one at http://mozilla.org/MPL/2.0/. + +LIBRARY ntdll + +; When we compile with -freestanding, the compiler still requires implementation +; of the four functions listed below. +; +; We could implement our own naive versions of these functions, but that +; solution is less than ideal since the implementations must be extern and are +; thus picked up by the entire firefox.exe binary. This denies the rest of +; firefox.exe the benefit of optimized implementations. On Windows the +; sandbox is linked into firefox.exe, so we cannot just shrug and +; assume that a naive implementation will not have any effect on anything. +; +; There are, however, optimized implementations of these functions that are +; exported by ntdll.dll. OTOH, they are not included in the ntdll.lib +; import library. This .def file is used to build an import library that "fills +; in the blanks" and allows us to link into the ntdll implementations. +EXPORTS + memcmp + memcpy + memmove + memset diff --git a/browser/app/winlauncher/moz.build b/browser/app/winlauncher/moz.build new file mode 100644 index 0000000000..585e883547 --- /dev/null +++ b/browser/app/winlauncher/moz.build @@ -0,0 +1,51 @@ +# -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*- +# vim: set filetype=python: +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, You can obtain one at http://mozilla.org/MPL/2.0/. + +Library("winlauncher") + +FORCE_STATIC_LIB = True + +UNIFIED_SOURCES += [ + "/ipc/mscom/ProcessRuntime.cpp", + "/widget/windows/WindowsConsole.cpp", + "DllBlocklistInit.cpp", + "ErrorHandler.cpp", + "LauncherProcessWin.cpp", + "LaunchUnelevated.cpp", + "NtLoaderAPI.cpp", +] + +OS_LIBS += [ + "oleaut32", + "ole32", + "rpcrt4", + "version", +] + +DIRS += [ + "freestanding", +] + +USE_LIBS += [ + "winlauncher-freestanding", +] + +TEST_DIRS += [ + "test", +] + +if CONFIG["MOZ_LAUNCHER_PROCESS"]: + UNIFIED_SOURCES += [ + "/toolkit/xre/LauncherRegistryInfo.cpp", + "/toolkit/xre/WinTokenUtils.cpp", + ] + for var in ("MOZ_APP_BASENAME", "MOZ_APP_VENDOR"): + DEFINES[var] = '"%s"' % CONFIG[var] + +DisableStlWrapping() + +with Files("**"): + BUG_COMPONENT = ("Firefox", "Launcher Process") diff --git a/browser/app/winlauncher/test/TestCrossProcessWin.cpp b/browser/app/winlauncher/test/TestCrossProcessWin.cpp new file mode 100644 index 0000000000..0c5c57aaaa --- /dev/null +++ b/browser/app/winlauncher/test/TestCrossProcessWin.cpp @@ -0,0 +1,365 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* vim: set ts=8 sts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. */ + +#define MOZ_USE_LAUNCHER_ERROR + +#include "freestanding/SharedSection.cpp" +#include "mozilla/CmdLineAndEnvUtils.h" +#include "mozilla/NativeNt.h" + +const wchar_t kChildArg[] = L"--child"; +const char kTestStrings[][6] = { + "a b c", "A B C", "a b c", "A B C", "X Y Z", +}; +const wchar_t kTestStringsMerged[] = + L"a b c" + L"\0" + L"X Y Z" + L"\0"; + +using namespace mozilla; +using namespace mozilla::freestanding; + +template +void PrintLauncherError(const LauncherResult& aResult, + const char (&aMsg)[N]) { + const LauncherError& err = aResult.inspectErr(); + printf("TEST-FAILED | TestCrossProcessWin | %s - %lx at %s:%d\n", aMsg, + err.mError.AsHResult(), err.mFile, err.mLine); +} + +#define VERIFY_FUNCTION_RESOLVED(mod, exports, name) \ + do { \ + if (reinterpret_cast(exports.m##name) != \ + ::GetProcAddress(mod, #name)) { \ + printf( \ + "TEST-FAILED | TestCrossProcessWin | " \ + "Kernel32ExportsSolver::" #name " did not match.\n"); \ + return false; \ + } \ + } while (0) + +static bool VerifySharedSection(SharedSection& aSharedSection) { + LauncherResult resultView = aSharedSection.GetView(); + if (resultView.isErr()) { + PrintLauncherError(resultView, "Failed to map a shared section"); + return false; + } + + SharedSection::Layout* view = resultView.unwrap(); + + // Use a local variable of RTL_RUN_ONCE to resolve Kernel32Exports every time + RTL_RUN_ONCE sRunEveryTime = RTL_RUN_ONCE_INIT; + view->mK32Exports.Resolve(sRunEveryTime); + + HMODULE k32mod = ::GetModuleHandleW(L"kernel32.dll"); + VERIFY_FUNCTION_RESOLVED(k32mod, view->mK32Exports, FlushInstructionCache); + VERIFY_FUNCTION_RESOLVED(k32mod, view->mK32Exports, GetModuleHandleW); + VERIFY_FUNCTION_RESOLVED(k32mod, view->mK32Exports, GetSystemInfo); + VERIFY_FUNCTION_RESOLVED(k32mod, view->mK32Exports, VirtualProtect); + + bool matched = memcmp(view->mModulePathArray, kTestStringsMerged, + sizeof(kTestStringsMerged)) == 0; + if (!matched) { + // Print actual strings on error + for (const wchar_t* p = view->mModulePathArray; *p;) { + printf("%p: %ls\n", p, p); + while (*p) { + ++p; + } + ++p; + } + return false; + } + + return true; +} + +static bool TestAddString() { + wchar_t testBuffer[3] = {0}; + UNICODE_STRING ustr; + + // This makes |testBuffer| full. + ::RtlInitUnicodeString(&ustr, L"a"); + if (!AddString(testBuffer, sizeof(testBuffer), ustr)) { + printf( + "TEST-FAILED | TestCrossProcessWin | " + "AddString failed.\n"); + return false; + } + + // Adding a string to a full buffer should fail. + ::RtlInitUnicodeString(&ustr, L"b"); + if (AddString(testBuffer, sizeof(testBuffer), ustr)) { + printf( + "TEST-FAILED | TestCrossProcessWin | " + "AddString caused OOB memory access.\n"); + return false; + } + + bool matched = memcmp(testBuffer, L"a\0", sizeof(testBuffer)) == 0; + if (!matched) { + printf( + "TEST-FAILED | TestCrossProcessWin | " + "AddString wrote wrong values.\n"); + return false; + } + + return true; +} + +class ChildProcess final { + nsAutoHandle mChildProcess; + nsAutoHandle mChildMainThread; + DWORD mProcessId; + + public: + // The following variables are updated from the parent process via + // WriteProcessMemory while the process is suspended as a part of + // TestWithChildProcess(). + // + // Having both a non-const and a const is important because a constant + // is separately placed in the .rdata section which is read-only, so + // the region's attribute needs to be changed before modifying data via + // WriteProcessMemory. + // The keyword "volatile" is needed for a constant, otherwise the compiler + // evaluates a constant as a literal without fetching data from memory. + static HMODULE sExecutableImageBase; + static volatile const DWORD sReadOnlyProcessId; + + static int Main() { + if (sExecutableImageBase != ::GetModuleHandle(nullptr)) { + printf( + "TEST-FAILED | TestCrossProcessWin | " + "sExecutableImageBase is expected to be %p, but actually was %p.\n", + ::GetModuleHandle(nullptr), sExecutableImageBase); + return 1; + } + + if (sReadOnlyProcessId != ::GetCurrentProcessId()) { + printf( + "TEST-FAILED | TestCrossProcessWin | " + "sReadOnlyProcessId is expected to be %lx, but actually was %lx.\n", + ::GetCurrentProcessId(), sReadOnlyProcessId); + return 1; + } + + auto getDependentModulePaths = + reinterpret_cast(::GetProcAddress( + ::GetModuleHandleW(nullptr), "GetDependentModulePaths")); + if (!getDependentModulePaths) { + printf( + "TEST-FAILED | TestCrossProcessWin | " + "Failed to get a pointer to GetDependentModulePaths - %08lx.\n", + ::GetLastError()); + return 1; + } + +#if !defined(DEBUG) + // GetDependentModulePaths does not allow a caller other than xul.dll. + // Skip on Debug build because it hits MOZ_ASSERT. + if (getDependentModulePaths()) { + printf( + "TEST-FAILED | TestCrossProcessWin | " + "GetDependentModulePaths should return zero if the caller is " + "not xul.dll.\n"); + return 1; + } +#endif // !defined(DEBUG) + + if (!VerifySharedSection(gSharedSection)) { + return 1; + } + + // Test a scenario to transfer a transferred section as a readonly handle + static HANDLE copiedHandle = nullptr; + nt::CrossExecTransferManager tansferToSelf(::GetCurrentProcess()); + LauncherVoidResult result = gSharedSection.TransferHandle( + tansferToSelf, GENERIC_READ, &copiedHandle); + if (result.isErr()) { + PrintLauncherError(result, "SharedSection::TransferHandle(self) failed"); + return 1; + } + + gSharedSection.Reset(copiedHandle); + + UNICODE_STRING ustr; + ::RtlInitUnicodeString(&ustr, L"test"); + result = gSharedSection.AddDepenentModule(&ustr); + if (result.inspectErr() != + WindowsError::FromWin32Error(ERROR_ACCESS_DENIED)) { + PrintLauncherError(result, "The readonly section was writable"); + return 1; + } + + if (!VerifySharedSection(gSharedSection)) { + return 1; + } + + return 0; + } + + ChildProcess(const wchar_t* aExecutable, const wchar_t* aOption) + : mProcessId(0) { + const wchar_t* childArgv[] = {aExecutable, aOption}; + auto cmdLine( + mozilla::MakeCommandLine(mozilla::ArrayLength(childArgv), childArgv)); + + STARTUPINFOW si = {sizeof(si)}; + PROCESS_INFORMATION pi; + BOOL ok = + ::CreateProcessW(aExecutable, cmdLine.get(), nullptr, nullptr, FALSE, + CREATE_SUSPENDED, nullptr, nullptr, &si, &pi); + if (!ok) { + printf( + "TEST-FAILED | TestCrossProcessWin | " + "CreateProcessW falied - %08lx.\n", + GetLastError()); + return; + } + + mProcessId = pi.dwProcessId; + + mChildProcess.own(pi.hProcess); + mChildMainThread.own(pi.hThread); + } + + ~ChildProcess() { ::TerminateProcess(mChildProcess, 0); } + + operator HANDLE() const { return mChildProcess; } + DWORD GetProcessId() const { return mProcessId; } + + bool ResumeAndWaitUntilExit() { + if (::ResumeThread(mChildMainThread) == 0xffffffff) { + printf( + "TEST-FAILED | TestCrossProcessWin | " + "ResumeThread failed - %08lx\n", + GetLastError()); + return false; + } + + if (::WaitForSingleObject(mChildProcess, 60000) != WAIT_OBJECT_0) { + printf( + "TEST-FAILED | TestCrossProcessWin | " + "Unexpected result from WaitForSingleObject\n"); + return false; + } + + DWORD exitCode; + if (!::GetExitCodeProcess(mChildProcess, &exitCode)) { + printf( + "TEST-FAILED | TestCrossProcessWin | " + "GetExitCodeProcess failed - %08lx\n", + GetLastError()); + return false; + } + + return exitCode == 0; + } +}; + +HMODULE ChildProcess::sExecutableImageBase = 0; +volatile const DWORD ChildProcess::sReadOnlyProcessId = 0; + +int wmain(int argc, wchar_t* argv[]) { + printf("Process: %-8lx Base: %p\n", ::GetCurrentProcessId(), + ::GetModuleHandle(nullptr)); + + if (argc == 2 && wcscmp(argv[1], kChildArg) == 0) { + return ChildProcess::Main(); + } + + ChildProcess childProcess(argv[0], kChildArg); + if (!childProcess) { + return 1; + } + + if (!TestAddString()) { + return 1; + } + + LauncherResult remoteImageBase = + nt::GetProcessExeModule(childProcess); + if (remoteImageBase.isErr()) { + PrintLauncherError(remoteImageBase, "nt::GetProcessExeModule failed"); + return 1; + } + + nt::CrossExecTransferManager transferMgr(childProcess); + if (!transferMgr) { + printf( + "TEST-FAILED | TestCrossProcessWin | " + "CrossExecTransferManager instantiation failed.\n"); + return 1; + } + + LauncherVoidResult result = + transferMgr.Transfer(&ChildProcess::sExecutableImageBase, + &remoteImageBase.inspect(), sizeof(HMODULE)); + if (result.isErr()) { + PrintLauncherError(result, "ChildProcess::WriteData(Imagebase) failed"); + return 1; + } + + DWORD childPid = childProcess.GetProcessId(); + + DWORD* readOnlyData = const_cast(&ChildProcess::sReadOnlyProcessId); + result = transferMgr.Transfer(readOnlyData, &childPid, sizeof(DWORD)); + if (result.isOk()) { + printf( + "TEST-UNEXPECTED | TestCrossProcessWin | " + "A constant was located in a writable section."); + return 1; + } + + AutoVirtualProtect prot = + transferMgr.Protect(readOnlyData, sizeof(uint32_t), PAGE_READWRITE); + if (!prot) { + printf( + "TEST-FAILED | TestCrossProcessWin | " + "VirtualProtect failed - %08lx\n", + prot.GetError().AsHResult()); + return 1; + } + + result = transferMgr.Transfer(readOnlyData, &childPid, sizeof(DWORD)); + if (result.isErr()) { + PrintLauncherError(result, "ChildProcess::WriteData(PID) failed"); + return 1; + } + + { + // Define a scope for |sharedSection| to resume the child process after + // the section is deleted in the parent process. + result = gSharedSection.Init(transferMgr.LocalPEHeaders()); + if (result.isErr()) { + PrintLauncherError(result, "SharedSection::Init failed"); + return 1; + } + + for (const auto& testString : kTestStrings) { + nt::AllocatedUnicodeString ustr(testString); + result = gSharedSection.AddDepenentModule(ustr); + if (result.isErr()) { + PrintLauncherError(result, "SharedSection::AddDepenentModule failed"); + return 1; + } + } + + result = gSharedSection.TransferHandle(transferMgr, + GENERIC_READ | GENERIC_WRITE); + if (result.isErr()) { + PrintLauncherError(result, "SharedSection::TransferHandle failed"); + return 1; + } + } + + if (!childProcess.ResumeAndWaitUntilExit()) { + return 1; + } + + return 0; +} diff --git a/browser/app/winlauncher/test/TestSafeThreadLocal.cpp b/browser/app/winlauncher/test/TestSafeThreadLocal.cpp new file mode 100644 index 0000000000..5aa122e16e --- /dev/null +++ b/browser/app/winlauncher/test/TestSafeThreadLocal.cpp @@ -0,0 +1,74 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* vim: set ts=8 sts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. */ + +#define MOZ_USE_LAUNCHER_ERROR + +#include "freestanding/SafeThreadLocal.h" + +#include "mozilla/NativeNt.h" +#include "nsWindowsHelpers.h" + +#include +#include + +// Need a non-inline function to bypass compiler optimization that the thread +// local storage pointer is cached in a register before accessing a thread-local +// variable. +MOZ_NEVER_INLINE PVOID SwapThreadLocalStoragePointer(PVOID aNewValue) { + auto oldValue = mozilla::nt::RtlGetThreadLocalStoragePointer(); + mozilla::nt::RtlSetThreadLocalStoragePointerForTestingOnly(aNewValue); + return oldValue; +} + +static mozilla::freestanding::SafeThreadLocal gTheStorage; + +static unsigned int __stdcall TestNonMainThread(void* aArg) { + for (int i = 0; i < 100; ++i) { + gTheStorage.set(&i); + if (gTheStorage.get() != &i) { + printf( + "TEST-FAILED | TestSafeThreadLocal | " + "A value is not correctly stored in the thread-local storage.\n"); + return 1; + } + } + return 0; +} + +extern "C" int wmain(int argc, wchar_t* argv[]) { + int dummy = 0x1234; + + auto origHead = SwapThreadLocalStoragePointer(nullptr); + // Setting gTheStorage when TLS is null. + gTheStorage.set(&dummy); + SwapThreadLocalStoragePointer(origHead); + + nsAutoHandle handles[8]; + for (auto& handle : handles) { + handle.own(reinterpret_cast( + ::_beginthreadex(nullptr, 0, TestNonMainThread, nullptr, 0, nullptr))); + } + + for (int i = 0; i < 100; ++i) { + if (gTheStorage.get() != &dummy) { + printf( + "TEST-FAILED | TestSafeThreadLocal | " + "A value is not correctly stored in the global scope.\n"); + return 1; + } + } + + for (auto& handle : handles) { + ::WaitForSingleObject(handle, INFINITE); + + DWORD exitCode; + if (!::GetExitCodeThread(handle, &exitCode) || exitCode) { + return 1; + } + } + + return 0; +} diff --git a/browser/app/winlauncher/test/TestSameBinary.cpp b/browser/app/winlauncher/test/TestSameBinary.cpp new file mode 100644 index 0000000000..2cb45f546f --- /dev/null +++ b/browser/app/winlauncher/test/TestSameBinary.cpp @@ -0,0 +1,255 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* vim: set ts=8 sts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. */ + +#define MOZ_USE_LAUNCHER_ERROR + +#include +#include + +#include + +#include "SameBinary.h" +#include "mozilla/ArrayUtils.h" +#include "mozilla/Assertions.h" +#include "mozilla/CmdLineAndEnvUtils.h" +#include "mozilla/NativeNt.h" +#include "mozilla/Unused.h" +#include "mozilla/Vector.h" +#include "mozilla/WinHeaderOnlyUtils.h" +#include "nsWindowsHelpers.h" + +#define EXPECT_SAMEBINARY_IS(expected, option, message) \ + do { \ + mozilla::LauncherResult isSame = \ + mozilla::IsSameBinaryAsParentProcess(option); \ + if (isSame.isErr()) { \ + PrintLauncherError(isSame, \ + "IsSameBinaryAsParentProcess returned error " \ + "when we were expecting success."); \ + return 1; \ + } \ + if (isSame.unwrap() != expected) { \ + PrintErrorMsg(message); \ + return 1; \ + } \ + } while (0) + +/** + * This test involves three processes: + * 1. The "Monitor" process, which is executed by |MonitorMain|. This process + * is responsible for integrating with the test harness, so it spawns the + * "Parent" process (2), and then waits for the other two processes to + * finish. + * 2. The "Parent" process, which is executed by |ParentMain|. This process + * creates the "Child" process (3) and then waits indefinitely. + * 3. The "Child" process, which is executed by |ChildMain| and carries out + * the actual test. It terminates the Parent process during its execution, + * using the Child PID as the Parent process's exit code. This serves as a + * hacky yet effective way to signal to the Monitor process which PID it + * should wait on to ensure that the Child process has exited. + */ + +static const char kMsgStart[] = "TEST-FAILED | SameBinary | "; + +inline void PrintErrorMsg(const char* aMsg) { + printf("%s%s\n", kMsgStart, aMsg); +} + +inline void PrintWinError(const char* aMsg) { + mozilla::WindowsError err(mozilla::WindowsError::FromLastError()); + printf("%s%s: %S\n", kMsgStart, aMsg, err.AsString().get()); +} + +template +inline void PrintLauncherError(const mozilla::LauncherResult& aResult, + const char* aMsg = nullptr) { + const char* const kSep = aMsg ? ": " : ""; + const char* msg = aMsg ? aMsg : ""; + const mozilla::LauncherError& err = aResult.inspectErr(); + printf("%s%s%s%S (%s:%d)\n", kMsgStart, msg, kSep, + err.mError.AsString().get(), err.mFile, err.mLine); +} + +static int ChildMain(DWORD aExpectedParentPid) { + mozilla::LauncherResult parentPid = mozilla::nt::GetParentProcessId(); + if (parentPid.isErr()) { + PrintLauncherError(parentPid); + return 1; + } + + if (parentPid.inspect() != aExpectedParentPid) { + PrintErrorMsg("Unexpected mismatch of parent PIDs"); + return 1; + } + + const DWORD kAccess = PROCESS_QUERY_LIMITED_INFORMATION | PROCESS_TERMINATE; + nsAutoHandle parentProcess( + ::OpenProcess(kAccess, FALSE, parentPid.inspect())); + if (!parentProcess) { + PrintWinError("Unexpectedly failed to call OpenProcess on parent"); + return 1; + } + + EXPECT_SAMEBINARY_IS( + true, mozilla::ImageFileCompareOption::Default, + "IsSameBinaryAsParentProcess returned incorrect result for identical " + "binaries"); + EXPECT_SAMEBINARY_IS( + true, mozilla::ImageFileCompareOption::CompareNtPathsOnly, + "IsSameBinaryAsParentProcess(CompareNtPathsOnly) returned incorrect " + "result for identical binaries"); + + // Total hack, but who cares? We'll set the parent's exit code as our PID + // so that the monitor process knows who to wait for! + if (!::TerminateProcess(parentProcess.get(), ::GetCurrentProcessId())) { + PrintWinError("Unexpected failure in TerminateProcess"); + return 1; + } + + // Close our handle to the parent process so that no references are held. + ::CloseHandle(parentProcess.disown()); + + // Querying a pid on a terminated process may still succeed some time after + // that process has been terminated. For the purposes of this test, we'll poll + // the OS until we cannot succesfully open the parentPid anymore. + const uint32_t kMaxAttempts = 100; + uint32_t curAttempt = 0; + while (HANDLE p = ::OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, FALSE, + parentPid.inspect())) { + ::CloseHandle(p); + ::Sleep(100); + ++curAttempt; + if (curAttempt >= kMaxAttempts) { + PrintErrorMsg( + "Exhausted retry attempts waiting for parent pid to become invalid"); + return 1; + } + } + + EXPECT_SAMEBINARY_IS( + false, mozilla::ImageFileCompareOption::Default, + "IsSameBinaryAsParentProcess returned incorrect result for dead parent " + "process"); + EXPECT_SAMEBINARY_IS( + false, mozilla::ImageFileCompareOption::CompareNtPathsOnly, + "IsSameBinaryAsParentProcess(CompareNtPathsOnly) returned incorrect " + "result for dead parent process"); + + return 0; +} + +static nsReturnRef CreateSelfProcess(int argc, wchar_t* argv[]) { + nsAutoHandle empty; + + DWORD myPid = ::GetCurrentProcessId(); + + wchar_t strPid[11] = {}; +#if defined(__MINGW32__) + _ultow(myPid, strPid, 16); +#else + if (_ultow_s(myPid, strPid, 16)) { + PrintErrorMsg("_ultow_s failed"); + return empty.out(); + } +#endif // defined(__MINGW32__) + + wchar_t* extraArgs[] = {strPid}; + + auto cmdLine = mozilla::MakeCommandLine( + argc, argv, mozilla::ArrayLength(extraArgs), extraArgs); + if (!cmdLine) { + PrintErrorMsg("MakeCommandLine failed"); + return empty.out(); + } + + STARTUPINFOW si = {sizeof(si)}; + PROCESS_INFORMATION pi; + BOOL ok = + ::CreateProcessW(argv[0], cmdLine.get(), nullptr, nullptr, FALSE, + CREATE_UNICODE_ENVIRONMENT, nullptr, nullptr, &si, &pi); + if (!ok) { + PrintWinError("CreateProcess failed"); + return empty.out(); + } + + nsAutoHandle proc(pi.hProcess); + nsAutoHandle thd(pi.hThread); + + return proc.out(); +} + +static int ParentMain(int argc, wchar_t* argv[]) { + nsAutoHandle childProc(CreateSelfProcess(argc, argv)); + if (!childProc) { + return 1; + } + + if (::WaitForSingleObject(childProc.get(), INFINITE) != WAIT_OBJECT_0) { + PrintWinError( + "Unexpected result from WaitForSingleObject on child process"); + return 1; + } + + MOZ_ASSERT_UNREACHABLE("This process should be terminated by now"); + return 0; +} + +static int MonitorMain(int argc, wchar_t* argv[]) { + // In this process, "parent" means the process that will be running + // ParentMain, which is our child process (confusing, I know...) + nsAutoHandle parentProc(CreateSelfProcess(argc, argv)); + if (!parentProc) { + return 1; + } + + if (::WaitForSingleObject(parentProc.get(), 60000) != WAIT_OBJECT_0) { + PrintWinError("Unexpected result from WaitForSingleObject on parent"); + return 1; + } + + DWORD childPid; + if (!::GetExitCodeProcess(parentProc.get(), &childPid)) { + PrintWinError("GetExitCodeProcess failed"); + return 1; + } + + nsAutoHandle childProc(::OpenProcess(SYNCHRONIZE, FALSE, childPid)); + if (!childProc) { + // Nothing to wait on anymore, which is OK. + return 0; + } + + // We want no more references to parentProc + ::CloseHandle(parentProc.disown()); + + if (::WaitForSingleObject(childProc.get(), 60000) != WAIT_OBJECT_0) { + PrintWinError("Unexpected result from WaitForSingleObject on child"); + return 1; + } + + return 0; +} + +extern "C" int wmain(int argc, wchar_t* argv[]) { + if (argc == 3) { + return ChildMain(wcstoul(argv[2], nullptr, 16)); + } + + if (!mozilla::SetArgv0ToFullBinaryPath(argv)) { + return 1; + } + + if (argc == 1) { + return MonitorMain(argc, argv); + } + + if (argc == 2) { + return ParentMain(argc, argv); + } + + PrintErrorMsg("Unexpected argc"); + return 1; +} diff --git a/browser/app/winlauncher/test/moz.build b/browser/app/winlauncher/test/moz.build new file mode 100644 index 0000000000..a8503ddf55 --- /dev/null +++ b/browser/app/winlauncher/test/moz.build @@ -0,0 +1,30 @@ +# -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*- +# vim: set filetype=python: +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, You can obtain one at http://mozilla.org/MPL/2.0/. + +DisableStlWrapping() + +GeckoCppUnitTests( + [ + "TestCrossProcessWin", + "TestSafeThreadLocal", + "TestSameBinary", + ], + linkage=None, +) + +LOCAL_INCLUDES += [ + "/browser/app/winlauncher", +] + +OS_LIBS += [ + "ntdll", +] + +if CONFIG["CC_TYPE"] in ("gcc", "clang"): + # This allows us to use wmain as the entry point on mingw + LDFLAGS += [ + "-municode", + ] -- cgit v1.2.3