diff options
| author | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-07 09:22:09 +0000 |
|---|---|---|
| committer | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-07 09:22:09 +0000 |
| commit | 43a97878ce14b72f0981164f87f2e35e14151312 (patch) | |
| tree | 620249daf56c0258faa40cbdcf9cfba06de2a846 /browser/app | |
| parent | Initial commit. (diff) | |
| download | firefox-43a97878ce14b72f0981164f87f2e35e14151312.tar.xz firefox-43a97878ce14b72f0981164f87f2e35e14151312.zip | |
Adding upstream version 110.0.1.upstream/110.0.1upstream
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to '')
55 files changed, 9758 insertions, 0 deletions
diff --git a/browser/app.mozbuild b/browser/app.mozbuild new file mode 100644 index 0000000000..91178ef16c --- /dev/null +++ b/browser/app.mozbuild @@ -0,0 +1,12 @@ +# vim: set filetype=python: +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, You can obtain one at http://mozilla.org/MPL/2.0/. + +include('/toolkit/toolkit.mozbuild') + +DIRS += ['/%s' % CONFIG['MOZ_BRANDING_DIRECTORY']] + +# Never add dirs after browser because they apparently won't get +# packaged properly on Mac. +DIRS += ['/browser'] diff --git a/browser/app/BrowserDefines.h b/browser/app/BrowserDefines.h new file mode 100644 index 0000000000..6bffd584ff --- /dev/null +++ b/browser/app/BrowserDefines.h @@ -0,0 +1,32 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* vim: set ts=8 sts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. */ + +#ifndef mozilla_BrowserDefines_h +#define mozilla_BrowserDefines_h + +#include <cstddef> +#include "mozilla/CmdLineAndEnvUtils.h" + +namespace mozilla { +namespace browser { +constexpr static const char* kRequiredArguments[] = {"url", "private-window"}; +#ifdef XP_WIN +# define ATTEMPTING_DEELEVATION_FLAG "attempting-deelevation" +constexpr static const char* kOptionalArguments[] = { + ATTEMPTING_DEELEVATION_FLAG}; +#else +constexpr static auto kOptionalArguments = nullptr; +#endif +} // namespace browser + +template <typename CharT> +inline void EnsureBrowserCommandlineSafe(int aArgc, CharT** aArgv) { + mozilla::EnsureCommandlineSafe(aArgc, aArgv, browser::kRequiredArguments, + browser::kOptionalArguments); +} +} // namespace mozilla + +#endif diff --git a/browser/app/Makefile.in b/browser/app/Makefile.in new file mode 100644 index 0000000000..54d6b43fe1 --- /dev/null +++ b/browser/app/Makefile.in @@ -0,0 +1,106 @@ +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, You can obtain one at http://mozilla.org/MPL/2.0/. + +dist_dest = $(DIST)/$(MOZ_MACBUNDLE_NAME) + +# hardcode en-US for the moment +AB_CD = en-US + +# Build a binary bootstrapping with XRE_main + +ifndef MOZ_WINCONSOLE +ifneq (,$(MOZ_DEBUG)$(MOZ_ASAN)) +MOZ_WINCONSOLE = 1 +else +MOZ_WINCONSOLE = 0 +endif +endif + +include $(topsrcdir)/config/config.mk + +# If we are trying to show an error dialog about the lack of SSE2 support, +# make sure that code itself doesn't use SSE2. +ifdef MOZ_LINUX_32_SSE2_STARTUP_ERROR +CXX := $(filter-out -march=% -msse -msse2 -mfpmath=sse,$(CXX)) +CXX += -march=pentiumpro +endif + +ifeq ($(OS_ARCH),WINNT) +# Rebuild firefox.exe if the manifest changes - it's included by splash.rc. +# (this dependency should really be just for firefox.exe, not other targets) +# Note the manifest file exists in the tree, so we use the explicit filename +# here. +EXTRA_DEPS += $(srcdir)/firefox.exe.manifest +endif + +PROGRAMS_DEST = $(DIST)/bin +objdir = $(topobjdir)/browser/app + +include $(topsrcdir)/config/rules.mk + +ifneq (,$(filter-out WINNT,$(OS_ARCH))) + +ifdef COMPILE_ENVIRONMENT +ifndef MOZ_NO_PIE_COMPAT +libs:: + cp -p $(DIST)/bin/$(MOZ_APP_NAME)$(BIN_SUFFIX) $(DIST)/bin/$(MOZ_APP_NAME)-bin$(BIN_SUFFIX) +endif +endif + +endif + +# channel-prefs.js is handled separate from other prefs due to bug 756325 +# DO NOT change the content of channel-prefs.js without taking the appropriate +# steps. See bug 1431342. +libs:: $(srcdir)/profile/channel-prefs.js + $(NSINSTALL) -D $(DIST)/bin/defaults/pref + $(call py_action,preprocessor,-Fsubstitution $(PREF_PPFLAGS) $(ACDEFINES) $^ -o $(DIST)/bin/defaults/pref/channel-prefs.js) + +ifeq (cocoa,$(MOZ_WIDGET_TOOLKIT)) + +MAC_APP_NAME = $(MOZ_APP_DISPLAYNAME) + +ifdef MOZ_DEBUG +MAC_APP_NAME := $(MAC_APP_NAME)Debug +endif + +AB_CD = $(MOZ_UI_LOCALE) + +ifeq (zh-TW,$(AB_CD)) +LPROJ_ROOT := $(subst -,_,$(AB_CD)) +else +LPROJ_ROOT := $(firstword $(subst -, ,$(AB_CD))) +endif +LPROJ := Contents/Resources/$(LPROJ_ROOT).lproj + +repackage:: + $(RM) -r $(dist_dest) + +MAC_BUNDLE_VERSION = $(shell $(PYTHON3) $(srcdir)/macversion.py --version=$(MOZ_APP_VERSION) --buildid=$(DEPTH)/buildid.h) + +.PHONY: repackage +tools repackage:: $(DIST)/bin/$(MOZ_APP_NAME) $(objdir)/macbuild/Contents/MacOS-files.txt + rm -rf $(dist_dest) + $(MKDIR) -p '$(dist_dest)/Contents/MacOS' + $(MKDIR) -p '$(dist_dest)/$(LPROJ)' + rsync -a --exclude '*.in' $(srcdir)/macbuild/Contents '$(dist_dest)' --exclude English.lproj + rsync -a --exclude '*.in' $(srcdir)/macbuild/Contents/Resources/English.lproj/ '$(dist_dest)/$(LPROJ)' + $(call py_action,preprocessor,-Fsubstitution -DAPP_VERSION='$(MOZ_APP_VERSION)' -DMOZ_APP_NAME='$(MOZ_APP_NAME)' -DMAC_APP_NAME='$(MAC_APP_NAME)' -DMOZ_MACBUNDLE_ID='$(MOZ_MACBUNDLE_ID)' -DMAC_BUNDLE_VERSION='$(MAC_BUNDLE_VERSION)' -DMOZ_DEVELOPER_REPO_PATH='$(topsrcdir)' -DMOZ_DEVELOPER_OBJ_PATH='$(topobjdir)' $(srcdir)/macbuild/Contents/Info.plist.in -o '$(dist_dest)/Contents/Info.plist') + $(call py_action,preprocessor,-Fsubstitution --output-encoding utf-16 -DMAC_APP_NAME='$(MAC_APP_NAME)' $(srcdir)/macbuild/Contents/Resources/English.lproj/InfoPlist.strings.in -o '$(dist_dest)/$(LPROJ)/InfoPlist.strings') + rsync -a --exclude-from='$(objdir)/macbuild/Contents/MacOS-files.txt' $(DIST)/bin/ '$(dist_dest)/Contents/Resources' + rsync -a --include-from='$(objdir)/macbuild/Contents/MacOS-files.txt' --exclude '*' $(DIST)/bin/ '$(dist_dest)/Contents/MacOS' + # MacOS-files-copy.in is a list of files that should be copies rather + # than symlinks and placed in .app/Contents/MacOS. + rsync -aL --include-from='$(srcdir)/macbuild/Contents/MacOS-files-copy.in' --exclude '*' $(DIST)/bin/ '$(dist_dest)/Contents/MacOS' + $(RM) '$(dist_dest)/Contents/MacOS/$(MOZ_APP_NAME)' + rsync -aL $(DIST)/bin/$(MOZ_APP_NAME) '$(dist_dest)/Contents/MacOS' + cp -RL $(topsrcdir)/$(MOZ_BRANDING_DIRECTORY)/firefox.icns '$(dist_dest)/Contents/Resources/firefox.icns' + cp -RL $(topsrcdir)/$(MOZ_BRANDING_DIRECTORY)/document.icns '$(dist_dest)/Contents/Resources/document.icns' + $(MKDIR) -p '$(dist_dest)/Contents/Library/LaunchServices' +ifdef MOZ_UPDATER + mv -f '$(dist_dest)/Contents/MacOS/updater.app/Contents/MacOS/org.mozilla.updater' '$(dist_dest)/Contents/Library/LaunchServices' + ln -s ../../../../Library/LaunchServices/org.mozilla.updater '$(dist_dest)/Contents/MacOS/updater.app/Contents/MacOS/org.mozilla.updater' +endif + printf APPLMOZB > '$(dist_dest)/Contents/PkgInfo' +endif diff --git a/browser/app/firefox.exe.manifest b/browser/app/firefox.exe.manifest new file mode 100644 index 0000000000..995b2fc869 --- /dev/null +++ b/browser/app/firefox.exe.manifest @@ -0,0 +1,47 @@ +<?xml version="1.0" encoding="UTF-8" standalone="yes"?> +<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> +<assemblyIdentity + version="1.0.0.0" + processorArchitecture="*" + name="Firefox" + type="win32" +/> +<description>Firefox</description> +<dependency> + <dependentAssembly> + <assemblyIdentity + type="win32" + name="Microsoft.Windows.Common-Controls" + version="6.0.0.0" + processorArchitecture="*" + publicKeyToken="6595b64144ccf1df" + language="*" + /> + </dependentAssembly> +</dependency> +<dependency> + <dependentAssembly> + <assemblyIdentity + type="win32" + name="mozglue" + version="1.0.0.0" + language="*" + /> + </dependentAssembly> +</dependency> +<ms_asmv3:trustInfo xmlns:ms_asmv3="urn:schemas-microsoft-com:asm.v3"> + <ms_asmv3:security> + <ms_asmv3:requestedPrivileges> + <ms_asmv3:requestedExecutionLevel level="asInvoker" uiAccess="false" /> + </ms_asmv3:requestedPrivileges> + </ms_asmv3:security> +</ms_asmv3:trustInfo> + <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"> + <application> + <supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/> + <supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/> + <supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/> + <supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/> + </application> + </compatibility> +</assembly> diff --git a/browser/app/macbuild/Contents/Info.plist.in b/browser/app/macbuild/Contents/Info.plist.in new file mode 100644 index 0000000000..99849c6f06 --- /dev/null +++ b/browser/app/macbuild/Contents/Info.plist.in @@ -0,0 +1,279 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> +<plist version="1.0"> +<dict> + <key>CFBundleDevelopmentRegion</key> + <string>English</string> + <key>CFBundleDocumentTypes</key> + <array> + <dict> + <key>CFBundleTypeExtensions</key> + <array> + <string>html</string> + <string>htm</string> + <string>shtml</string> + <string>xht</string> + <string>xhtml</string> + </array> + <key>CFBundleTypeIconFile</key> + <string>document.icns</string> + <key>CFBundleTypeName</key> + <string>HTML Document</string> + <key>CFBundleTypeOSTypes</key> + <array> + <string>HTML</string> + </array> + <key>CFBundleTypeRole</key> + <string>Viewer</string> + </dict> + <dict> + <key>CFBundleTypeExtensions</key> + <array> + <string>json</string> + </array> + <key>CFBundleTypeIconFile</key> + <string>document.icns</string> + <key>CFBundleTypeMIMETypes</key> + <array> + <string>application/json</string> + </array> + <key>CFBundleTypeName</key> + <string>JSON File</string> + <key>CFBundleTypeOSTypes</key> + <array> + <string>TEXT</string> + </array> + <key>CFBundleTypeRole</key> + <string>Viewer</string> + </dict> + <dict> + <key>CFBundleTypeExtensions</key> + <array> + <string>pdf</string> + </array> + <key>CFBundleTypeIconFile</key> + <string>document.icns</string> + <key>CFBundleTypeMIMETypes</key> + <array> + <string>application/pdf</string> + </array> + <key>CFBundleTypeName</key> + <string>PDF document</string> + <key>CFBundleTypeOSTypes</key> + <array> + <string>TEXT</string> + </array> + <key>CFBundleTypeRole</key> + <string>Viewer</string> + <key>LSHandlerRank</key> + <string>Alternate</string> + </dict> + <dict> + <key>CFBundleTypeExtensions</key> + <array> + <string>svg</string> + </array> + <key>CFBundleTypeIconFile</key> + <string>document.icns</string> + <key>CFBundleTypeMIMETypes</key> + <array> + <string>image/svg+xml</string> + </array> + <key>CFBundleTypeName</key> + <string>SVG document</string> + <key>CFBundleTypeOSTypes</key> + <array> + <string>TEXT</string> + </array> + <key>CFBundleTypeRole</key> + <string>Viewer</string> + <key>NSDocumentClass</key> + <string>BrowserDocument</string> + </dict> + <dict> + <key>CFBundleTypeExtensions</key> + <array> + <string>text</string> + <string>txt</string> + <string>js</string> + <string>log</string> + <string>css</string> + <string>xul</string> + <string>rdf</string> + </array> + <key>CFBundleTypeIconFile</key> + <string>document.icns</string> + <key>CFBundleTypeName</key> + <string>Text Document</string> + <key>CFBundleTypeOSTypes</key> + <array> + <string>TEXT</string> + <string>utxt</string> + </array> + <key>CFBundleTypeRole</key> + <string>Viewer</string> + </dict> + <dict> + <key>CFBundleTypeExtensions</key> + <array> + <string>jpeg</string> + <string>jpg</string> + <string>png</string> + <string>gif</string> + </array> + <key>CFBundleTypeIconFile</key> + <string>fileBookmark.icns</string> + <key>CFBundleTypeName</key> + <string>document.icns</string> + <key>CFBundleTypeOSTypes</key> + <array> + <string>GIFf</string> + <string>JPEG</string> + <string>PNGf</string> + </array> + <key>CFBundleTypeRole</key> + <string>Viewer</string> + </dict> + <dict> + <key>CFBundleTypeExtensions</key> + <array> + <string>oga</string> + <string>ogg</string> + </array> + <key>CFBundleTypeIconFile</key> + <string>document.icns</string> + <key>CFBundleTypeMIMETypes</key> + <array> + <string>audio/ogg</string> + </array> + <key>CFBundleTypeName</key> + <string>HTML5 Audio (Ogg)</string> + <key>CFBundleTypeRole</key> + <string>Viewer</string> + </dict> + <dict> + <key>CFBundleTypeExtensions</key> + <array> + <string>ogv</string> + </array> + <key>CFBundleTypeIconFile</key> + <string>document.icns</string> + <key>CFBundleTypeMIMETypes</key> + <array> + <string>video/ogg</string> + </array> + <key>CFBundleTypeName</key> + <string>HTML5 Video (Ogg)</string> + <key>CFBundleTypeRole</key> + <string>Viewer</string> + </dict> + <dict> + <key>CFBundleTypeExtensions</key> + <array> + <string>webm</string> + </array> + <key>CFBundleTypeIconFile</key> + <string>document.icns</string> + <key>CFBundleTypeMIMETypes</key> + <array> + <string>video/webm</string> + </array> + <key>CFBundleTypeName</key> + <string>HTML5 Video (WebM)</string> + <key>CFBundleTypeRole</key> + <string>Viewer</string> + </dict> + </array> + <key>CFBundleExecutable</key> + <string>@MOZ_APP_NAME@</string> + <key>CFBundleGetInfoString</key> + <string>@MAC_APP_NAME@ @APP_VERSION@</string> + <key>CFBundleIconFile</key> + <string>firefox.icns</string> + <key>CFBundleIdentifier</key> + <string>@MOZ_MACBUNDLE_ID@</string> + <key>CFBundleInfoDictionaryVersion</key> + <string>6.0</string> + <key>CFBundleName</key> + <string>@MAC_APP_NAME@</string> + <key>CFBundlePackageType</key> + <string>APPL</string> + <key>CFBundleShortVersionString</key> + <string>@APP_VERSION@</string> + <key>CFBundleSignature</key> + <string>MOZB</string> + <key>CFBundleURLTypes</key> + <array> + <dict> + <key>CFBundleURLIconFile</key> + <string>document.icns</string> + <key>CFBundleURLName</key> + <string>http URL</string> + <key>CFBundleURLSchemes</key> + <array> + <string>http</string> + </array> + </dict> + <dict> + <key>CFBundleURLIconFile</key> + <string>document.icns</string> + <key>CFBundleURLName</key> + <string>https URL</string> + <key>CFBundleURLSchemes</key> + <array> + <string>https</string> + </array> + </dict> + <dict> + <key>CFBundleURLName</key> + <string>file URL</string> + <key>CFBundleURLSchemes</key> + <array> + <string>file</string> + </array> + </dict> + </array> + <key>CFBundleVersion</key> + <string>@MAC_BUNDLE_VERSION@</string> + <key>NSUserActivityTypes</key> + <array> + <string>NSUserActivityTypeBrowsingWeb</string> + </array> + <key>NSAppleScriptEnabled</key> + <true/> + <key>LSApplicationCategoryType</key> + <string>public.app-category.productivity</string> + <key>LSEnvironment</key> + <dict> + <key>MallocNanoZone</key> + <string>0</string> + <key>SYSTEM_VERSION_COMPAT</key> + <string>0</string> + </dict> + <key>LSFileQuarantineEnabled</key> + <true/> + <key>LSMinimumSystemVersion</key> + <string>10.12.0</string> + <key>NSSupportsAutomaticGraphicsSwitching</key> + <true/> + <key>NSRequiresAquaSystemAppearance</key> + <false/> + <key>NSPrincipalClass</key> + <string>GeckoNSApplication</string> + <key>SMPrivilegedExecutables</key> + <dict> + <key>org.mozilla.updater</key> + <string>identifier "org.mozilla.updater" and ((anchor apple generic and certificate leaf[field.1.2.840.113635.100.6.1.9]) or (anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] and certificate leaf[field.1.2.840.113635.100.6.1.13] and certificate leaf[subject.OU] = "43AQ936H96"))</string> + </dict> + <key>MozillaDeveloperRepoPath</key> + <string>@MOZ_DEVELOPER_REPO_PATH@</string> + <key>MozillaDeveloperObjPath</key> + <string>@MOZ_DEVELOPER_OBJ_PATH@</string> + + <key>NSCameraUsageDescription</key> + <string>Only sites you allow within @MAC_APP_NAME@ will be able to use the camera.</string> + + <key>NSMicrophoneUsageDescription</key> + <string>Only sites you allow within @MAC_APP_NAME@ will be able to use the microphone.</string> +</dict> +</plist> diff --git a/browser/app/macbuild/Contents/MacOS-files-copy.in b/browser/app/macbuild/Contents/MacOS-files-copy.in new file mode 100644 index 0000000000..e9d0f0efb9 --- /dev/null +++ b/browser/app/macbuild/Contents/MacOS-files-copy.in @@ -0,0 +1,11 @@ +# Specifies files that should be copied (via deep copy, resolving symlinks) +# from dist/bin to the .app/Contents/MacOS directory. Linking is preferred to +# reduce disk I/O during builds, so just include dylibs which need to be in the +# same directory as returned by dladddr(3). +# +# Some of these dylibs load other dylibs which are assumed to be siblings in +# the same directory obtained from dladdr(3). With macOS 10.15, dladdr returns +# absolute resolved paths which breaks this assumption if symlinks are used +# because the symlink targets are in different directories. Hence the need for +# them to be copied to the same directory. +/*.dylib diff --git a/browser/app/macbuild/Contents/MacOS-files.in b/browser/app/macbuild/Contents/MacOS-files.in new file mode 100644 index 0000000000..6f0b448147 --- /dev/null +++ b/browser/app/macbuild/Contents/MacOS-files.in @@ -0,0 +1,24 @@ +#if 0 +; Specifies files that should be copied (preserving symlinks) from dist/bin +; to the .app/Contents/MacOS directory. +#endif +#filter substitution +/*.app/*** +/certutil +/@MOZ_APP_NAME@-bin +#if defined(MOZ_GECKODRIVER) +/geckodriver +#endif +/gtest/*** +/http3server +#if defined(MOZ_ASAN) || defined(MOZ_TSAN) +/llvm-symbolizer +#endif +#if defined(MOZ_CRASHREPORTER) +/minidump-analyzer +#endif +/pingsender +/pk12util +/ssltunnel +/xpcshell +/XUL diff --git a/browser/app/macbuild/Contents/Resources/English.lproj/InfoPlist.strings.in b/browser/app/macbuild/Contents/Resources/English.lproj/InfoPlist.strings.in new file mode 100644 index 0000000000..c84535de6a --- /dev/null +++ b/browser/app/macbuild/Contents/Resources/English.lproj/InfoPlist.strings.in @@ -0,0 +1,5 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +CFBundleName = "@MAC_APP_NAME@"; diff --git a/browser/app/macbuild/Contents/moz.build b/browser/app/macbuild/Contents/moz.build new file mode 100644 index 0000000000..b8b28926de --- /dev/null +++ b/browser/app/macbuild/Contents/moz.build @@ -0,0 +1,25 @@ +# -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*- +# vim: set filetype=python: +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, You can obtain one at http://mozilla.org/MPL/2.0/. + +defs = [] + +for s in ( + "MOZ_GECKODRIVER", + "MOZ_ASAN", + "MOZ_TSAN", + "MOZ_CRASHREPORTER", + "MOZ_APP_NAME", +): + if CONFIG[s]: + defs.append("-D%s=%s" % (s, "1" if CONFIG[s] is True else CONFIG[s])) + +GeneratedFile( + "MacOS-files.txt", + script="/python/mozbuild/mozbuild/action/preprocessor.py", + entry_point="generate", + inputs=["MacOS-files.in"], + flags=defs, +) diff --git a/browser/app/macversion.py b/browser/app/macversion.py new file mode 100644 index 0000000000..878fb09640 --- /dev/null +++ b/browser/app/macversion.py @@ -0,0 +1,46 @@ +#!/usr/bin/python +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, You can obtain one at http://mozilla.org/MPL/2.0/. + +import io +import re +import sys +from optparse import OptionParser + +o = OptionParser() +o.add_option("--buildid", dest="buildid") +o.add_option("--version", dest="version") + +(options, args) = o.parse_args() + +if not options.buildid: + print("--buildid is required", file=sys.stderr) + sys.exit(1) + +if not options.version: + print("--version is required", file=sys.stderr) + sys.exit(1) + +# We want to build a version number that matches the format allowed for +# CFBundleVersion (nnnnn[.nn[.nn]]). We'll incorporate both the version +# number as well as the date, so that it changes at least daily (for nightly +# builds), but also so that newly-built older versions (e.g. beta build) aren't +# considered "newer" than previously-built newer versions (e.g. a trunk nightly) + +define, MOZ_BUILDID, buildid = ( + io.open(options.buildid, "r", encoding="utf-8").read().split() +) + +# extract only the major version (i.e. "14" from "14.0b1") +majorVersion = re.match(r"^(\d+)[^\d].*", options.version).group(1) +# last two digits of the year +twodigityear = buildid[2:4] +month = buildid[4:6] +if month[0] == "0": + month = month[1] +day = buildid[6:8] +if day[0] == "0": + day = day[1] + +print("%s.%s.%s" % (majorVersion + twodigityear, month, day)) diff --git a/browser/app/module.ver b/browser/app/module.ver new file mode 100644 index 0000000000..5ef8d2a02a --- /dev/null +++ b/browser/app/module.ver @@ -0,0 +1,8 @@ +WIN32_MODULE_COMPANYNAME=Mozilla Corporation +WIN32_MODULE_COPYRIGHT=©Firefox and Mozilla Developers; available under the MPL 2 license. +WIN32_MODULE_PRODUCTVERSION=@MOZ_APP_WINVERSION@ +WIN32_MODULE_PRODUCTVERSION_STRING=@MOZ_APP_VERSION@ +WIN32_MODULE_TRADEMARKS=Firefox is a Trademark of The Mozilla Foundation. +WIN32_MODULE_DESCRIPTION=@MOZ_APP_DISPLAYNAME@ +WIN32_MODULE_PRODUCTNAME=@MOZ_APP_DISPLAYNAME@ +WIN32_MODULE_NAME=@MOZ_APP_DISPLAYNAME@ diff --git a/browser/app/moz.build b/browser/app/moz.build new file mode 100644 index 0000000000..be6748dfcb --- /dev/null +++ b/browser/app/moz.build @@ -0,0 +1,172 @@ +# -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*- +# vim: set filetype=python: +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, You can obtain one at http://mozilla.org/MPL/2.0/. + +with Files("**"): + BUG_COMPONENT = ("Firefox", "General") + +with Files("firefox.exe.manifest"): + BUG_COMPONENT = ("Core", "Widget: Win32") +with Files("module.ver"): + BUG_COMPONENT = ("Core", "Widget: Win32") +with Files("splash.rc"): + BUG_COMPONENT = ("Core", "Widget: Win32") + +with Files("macversion.py"): + BUG_COMPONENT = ("Core", "Widget: Cocoa") +with Files("macbuild/**"): + BUG_COMPONENT = ("Core", "Widget: Cocoa") + +with Files("moz.build"): + BUG_COMPONENT = ("Firefox Build System", "General") +with Files("Makefile.in"): + BUG_COMPONENT = ("Firefox Build System", "General") + +with Files("profile/channel-prefs.js"): + BUG_COMPONENT = ("Firefox", "Installer") +with Files("profile/firefox.js"): + BUG_COMPONENT = ("Firefox", "General") + +if CONFIG["MOZ_MACBUNDLE_NAME"]: + DIRS += ["macbuild/Contents"] + +if CONFIG["MOZ_NO_PIE_COMPAT"]: + GeckoProgram(CONFIG["MOZ_APP_NAME"] + "-bin") + + DIRS += ["no-pie"] +else: + GeckoProgram(CONFIG["MOZ_APP_NAME"]) + +SOURCES += [ + "nsBrowserApp.cpp", +] + +# Neither channel-prefs.js nor firefox.exe want to end up in dist/bin/browser. +DIST_SUBDIR = "" + +LOCAL_INCLUDES += [ + "!/build", + "/toolkit/xre", + "/xpcom/base", + "/xpcom/build", +] + +# The pthred_create() interposer needs to be linked as early as possible so +# that it will appear before libpthread when resolving symbols. +if CONFIG["OS_ARCH"] == "Linux" and CONFIG["MOZ_CRASHREPORTER"]: + USE_LIBS += ["pthread_create_interposer"] + +if CONFIG["LIBFUZZER"]: + USE_LIBS += ["fuzzer"] + LOCAL_INCLUDES += [ + "/tools/fuzzing/libfuzzer", + ] + +if CONFIG["MOZ_GECKODRIVER"]: + DEFINES["MOZ_GECKODRIVER"] = True + +if CONFIG["CC_TYPE"] == "clang-cl": + # Always enter a Windows program through wmain, whether or not we're + # a console application. + WIN32_EXE_LDFLAGS += ["-ENTRY:wmainCRTStartup"] + +if CONFIG["OS_ARCH"] == "WINNT": + RCINCLUDE = "splash.rc" + DIRS += [ + "pbproxy", + "winlauncher", + ] + USE_LIBS += [ + "winlauncher", + ] + LOCAL_INCLUDES += [ + "/browser/app/winlauncher", + ] + OS_LIBS += [ + "advapi32", + "shell32", + "uuid", + ] + DELAYLOAD_DLLS += [ + "advapi32.dll", + "oleaut32.dll", + "ole32.dll", + "rpcrt4.dll", + "shell32.dll", + "version.dll", + ] + + if CONFIG["CC_TYPE"] == "clang-cl": + libpath_flag = "-LIBPATH:" + else: + libpath_flag = "-L" + + WIN32_EXE_LDFLAGS += [ + libpath_flag + OBJDIR + "/winlauncher/freestanding", + ] + + # Don't build firefox.exe with CETCOMPAT, because we need to be able to + # only enable it for processes that are not using JIT in xul.dll. + LINK_FLAGS["CETCOMPAT"] = [] + +if CONFIG["OS_ARCH"] == "Darwin": + OS_LIBS += [ + "-framework CoreFoundation", + ] + +if CONFIG["MOZ_SANDBOX"] and CONFIG["OS_ARCH"] == "WINNT": + # For sandbox includes and the include dependencies those have + LOCAL_INCLUDES += [ + "/security/sandbox/chromium", + "/security/sandbox/chromium-shim", + ] + + USE_LIBS += [ + "sandbox_s", + ] + + OS_LIBS += [ + "winmm", + ] + DELAYLOAD_DLLS += [ + "winmm.dll", + "user32.dll", + "usp10.dll", + ] + +# Control the default heap size. +# This is the heap returned by GetProcessHeap(). +# As we use the CRT heap, the default size is too large and wastes VM. +# +# The default heap size is 1MB on Win32. +# The heap will grow if need be. +# +# Set it to 256k. See bug 127069. +if CONFIG["OS_ARCH"] == "WINNT" and CONFIG["CC_TYPE"] not in ("clang", "gcc"): + LDFLAGS += ["/HEAP:0x40000"] + +DisableStlWrapping() + +if CONFIG["HAVE_CLOCK_MONOTONIC"]: + OS_LIBS += CONFIG["REALTIME_LIBS"] + +if CONFIG["MOZ_LINUX_32_SSE2_STARTUP_ERROR"]: + DEFINES["MOZ_LINUX_32_SSE2_STARTUP_ERROR"] = True + COMPILE_FLAGS["OS_CXXFLAGS"] = [ + f + for f in COMPILE_FLAGS.get("OS_CXXFLAGS", []) + if not f.startswith("-march=") and f not in ("-msse", "-msse2", "-mfpmath=sse") + ] + [ + "-mno-sse", + "-mno-sse2", + "-mfpmath=387", + ] + +for icon in ("firefox", "document", "newwindow", "newtab", "pbmode", "document_pdf"): + DEFINES[icon.upper() + "_ICO"] = '"%s/%s/%s.ico"' % ( + TOPSRCDIR, + CONFIG["MOZ_BRANDING_DIRECTORY"], + icon, + ) diff --git a/browser/app/no-pie/NoPie.c b/browser/app/no-pie/NoPie.c new file mode 100644 index 0000000000..39b206e0af --- /dev/null +++ b/browser/app/no-pie/NoPie.c @@ -0,0 +1,26 @@ +/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#include <errno.h> +#include <limits.h> +#include <stdio.h> +#include <string.h> +#include <unistd.h> + +int main(int argc, char* argv[]) { + // Ideally, we'd use mozilla::BinaryPath, but that pulls in stdc++compat, + // and further causes trouble linking with LTO. + char path[PATH_MAX + 4]; + ssize_t len = readlink("/proc/self/exe", path, PATH_MAX - 1); + if (len < 0) { + fprintf(stderr, "Couldn't find the application directory.\n"); + return 255; + } + strcpy(path + len, "-bin"); + execv(path, argv); + // execv never returns. If it did, there was an error. + fprintf(stderr, "Exec failed with error: %s\n", strerror(errno)); + return 255; +} diff --git a/browser/app/no-pie/moz.build b/browser/app/no-pie/moz.build new file mode 100644 index 0000000000..74aa89409d --- /dev/null +++ b/browser/app/no-pie/moz.build @@ -0,0 +1,24 @@ +# -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*- +# vim: set filetype=python: +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, You can obtain one at http://mozilla.org/MPL/2.0/. + +Program(CONFIG["MOZ_APP_NAME"]) + +SOURCES += [ + "NoPie.c", +] + +# For some reason, LTO messes things up. We don't care anyways. +CFLAGS += [ + "-fno-lto", +] + +# Use OS_LIBS instead of LDFLAGS to "force" the flag to come after -pie +# from MOZ_PROGRAM_LDFLAGS. +if CONFIG["CC_TYPE"] == "clang": + # clang < 5.0 doesn't support -no-pie. + OS_LIBS += ["-nopie"] +else: + OS_LIBS += ["-no-pie"] diff --git a/browser/app/nsBrowserApp.cpp b/browser/app/nsBrowserApp.cpp new file mode 100644 index 0000000000..445782bd69 --- /dev/null +++ b/browser/app/nsBrowserApp.cpp @@ -0,0 +1,453 @@ +/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#include "nsXULAppAPI.h" +#include "mozilla/XREAppData.h" +#include "XREShellData.h" +#include "application.ini.h" +#include "mozilla/Bootstrap.h" +#include "mozilla/ProcessType.h" +#include "mozilla/RuntimeExceptionModule.h" +#include "mozilla/ScopeExit.h" +#include "BrowserDefines.h" +#if defined(XP_WIN) +# include <windows.h> +# include <stdlib.h> +#elif defined(XP_UNIX) +# include <sys/resource.h> +# include <unistd.h> +#endif + +#include <stdio.h> +#include <stdarg.h> +#include <time.h> + +#include "nsCOMPtr.h" + +#ifdef XP_WIN +# include "mozilla/PreXULSkeletonUI.h" +# include "freestanding/SharedSection.h" +# include "LauncherProcessWin.h" +# include "mozilla/GeckoArgs.h" +# include "mozilla/mscom/ProcessRuntime.h" +# include "mozilla/WindowsDllBlocklist.h" +# include "mozilla/WindowsDpiInitialization.h" +# include "mozilla/WindowsProcessMitigations.h" + +# define XRE_WANT_ENVIRON +# define strcasecmp _stricmp +# ifdef MOZ_SANDBOX +# include "mozilla/sandboxing/SandboxInitialization.h" +# endif +#endif +#include "BinaryPath.h" + +#include "nsXPCOMPrivate.h" // for MAXPATHLEN and XPCOM_DLL + +#include "mozilla/Sprintf.h" +#include "mozilla/StartupTimeline.h" +#include "BaseProfiler.h" + +#ifdef LIBFUZZER +# include "FuzzerDefs.h" +#endif + +#ifdef MOZ_LINUX_32_SSE2_STARTUP_ERROR +# include <cpuid.h> +# include "mozilla/Unused.h" + +static bool IsSSE2Available() { + // The rest of the app has been compiled to assume that SSE2 is present + // unconditionally, so we can't use the normal copy of SSE.cpp here. + // Since SSE.cpp caches the results and we need them only transiently, + // instead of #including SSE.cpp here, let's just inline the specific check + // that's needed. + unsigned int level = 1u; + unsigned int eax, ebx, ecx, edx; + unsigned int bits = (1u << 26); + unsigned int max = __get_cpuid_max(0, nullptr); + if (level > max) { + return false; + } + __cpuid_count(level, 0, eax, ebx, ecx, edx); + return (edx & bits) == bits; +} + +static const char sSSE2Message[] = + "This browser version requires a processor with the SSE2 instruction " + "set extension.\nYou may be able to obtain a version that does not " + "require SSE2 from your Linux distribution.\n"; + +__attribute__((constructor)) static void SSE2Check() { + if (IsSSE2Available()) { + return; + } + // Using write() in order to avoid jemalloc-based buffering. Ignoring return + // values, since there isn't much we could do on failure and there is no + // point in trying to recover from errors. + MOZ_UNUSED( + write(STDERR_FILENO, sSSE2Message, MOZ_ARRAY_LENGTH(sSSE2Message) - 1)); + // _exit() instead of exit() to avoid running the usual "at exit" code. + _exit(255); +} +#endif + +#if !defined(MOZ_WIDGET_COCOA) && !defined(MOZ_WIDGET_ANDROID) +# define MOZ_BROWSER_CAN_BE_CONTENTPROC +# include "../../ipc/contentproc/plugin-container.cpp" +#endif + +using namespace mozilla; + +#ifdef XP_MACOSX +# define kOSXResourcesFolder "Resources" +#endif +#define kDesktopFolder "browser" + +static MOZ_FORMAT_PRINTF(1, 2) void Output(const char* fmt, ...) { + va_list ap; + va_start(ap, fmt); + +#ifndef XP_WIN + vfprintf(stderr, fmt, ap); +#else + char msg[2048]; + vsnprintf_s(msg, _countof(msg), _TRUNCATE, fmt, ap); + + wchar_t wide_msg[2048]; + MultiByteToWideChar(CP_UTF8, 0, msg, -1, wide_msg, _countof(wide_msg)); +# if MOZ_WINCONSOLE + fwprintf_s(stderr, wide_msg); +# else + // Linking user32 at load-time interferes with the DLL blocklist (bug 932100). + // This is a rare codepath, so we can load user32 at run-time instead. + HMODULE user32 = LoadLibraryW(L"user32.dll"); + if (user32) { + decltype(MessageBoxW)* messageBoxW = + (decltype(MessageBoxW)*)GetProcAddress(user32, "MessageBoxW"); + if (messageBoxW) { + messageBoxW(nullptr, wide_msg, L"Firefox", + MB_OK | MB_ICONERROR | MB_SETFOREGROUND); + } + FreeLibrary(user32); + } +# endif +#endif + + va_end(ap); +} + +/** + * Return true if |arg| matches the given argument name. + */ +static bool IsArg(const char* arg, const char* s) { + if (*arg == '-') { + if (*++arg == '-') ++arg; + return !strcasecmp(arg, s); + } + +#if defined(XP_WIN) + if (*arg == '/') return !strcasecmp(++arg, s); +#endif + + return false; +} + +Bootstrap::UniquePtr gBootstrap; + +static int do_main(int argc, char* argv[], char* envp[]) { + // Allow firefox.exe to launch XULRunner apps via -app <application.ini> + // Note that -app must be the *first* argument. + const char* appDataFile = getenv("XUL_APP_FILE"); + if ((!appDataFile || !*appDataFile) && (argc > 1 && IsArg(argv[1], "app"))) { + if (argc == 2) { + Output("Incorrect number of arguments passed to -app"); + return 255; + } + appDataFile = argv[2]; + + char appEnv[MAXPATHLEN]; + SprintfLiteral(appEnv, "XUL_APP_FILE=%s", argv[2]); + if (putenv(strdup(appEnv))) { + Output("Couldn't set %s.\n", appEnv); + return 255; + } + argv[2] = argv[0]; + argv += 2; + argc -= 2; + } else if (argc > 1 && IsArg(argv[1], "xpcshell")) { + for (int i = 1; i < argc; i++) { + argv[i] = argv[i + 1]; + } + + XREShellData shellData; +#if defined(XP_WIN) && defined(MOZ_SANDBOX) + shellData.sandboxBrokerServices = + sandboxing::GetInitializedBrokerServices(); +#endif + +#ifdef LIBFUZZER + shellData.fuzzerDriver = fuzzer::FuzzerDriver; +#endif + + return gBootstrap->XRE_XPCShellMain(--argc, argv, envp, &shellData); + } + + BootstrapConfig config; + + if (appDataFile && *appDataFile) { + config.appData = nullptr; + config.appDataPath = appDataFile; + } else { + // no -app flag so we use the compiled-in app data + config.appData = &sAppData; + config.appDataPath = kDesktopFolder; + } + +#if defined(XP_WIN) && defined(MOZ_SANDBOX) + sandbox::BrokerServices* brokerServices = + sandboxing::GetInitializedBrokerServices(); + if (!brokerServices) { + Output("Couldn't initialize the broker services.\n"); + return 255; + } + config.sandboxBrokerServices = brokerServices; +#endif + +#ifdef LIBFUZZER + if (getenv("FUZZER")) + gBootstrap->XRE_LibFuzzerSetDriver(fuzzer::FuzzerDriver); +#endif + + EnsureBrowserCommandlineSafe(argc, argv); + + return gBootstrap->XRE_main(argc, argv, config); +} + +static nsresult InitXPCOMGlue(LibLoadingStrategy aLibLoadingStrategy) { + if (gBootstrap) { + return NS_OK; + } + + UniqueFreePtr<char> exePath = BinaryPath::Get(); + if (!exePath) { + Output("Couldn't find the application directory.\n"); + return NS_ERROR_FAILURE; + } + + auto bootstrapResult = + mozilla::GetBootstrap(exePath.get(), aLibLoadingStrategy); + if (bootstrapResult.isErr()) { + Output("Couldn't load XPCOM.\n"); + return NS_ERROR_FAILURE; + } + + gBootstrap = bootstrapResult.unwrap(); + + // This will set this thread as the main thread. + gBootstrap->NS_LogInit(); + + return NS_OK; +} + +#ifdef HAS_DLL_BLOCKLIST +// NB: This must be extern, as this value is checked elsewhere +uint32_t gBlocklistInitFlags = eDllBlocklistInitFlagDefault; +#endif + +int main(int argc, char* argv[], char* envp[]) { +#if defined(MOZ_ENABLE_FORKSERVER) + if (strcmp(argv[argc - 1], "forkserver") == 0) { + nsresult rv = InitXPCOMGlue(LibLoadingStrategy::NoReadAhead); + if (NS_FAILED(rv)) { + return 255; + } + + // Run a fork server in this process, single thread. When it + // returns, it means the fork server have been stopped or a new + // content process is created. + // + // For the later case, XRE_ForkServer() will return false, running + // in a content process just forked from the fork server process. + // argc & argv will be updated with the values passing from the + // chrome process. With the new values, this function + // continues the reset of the code acting as a content process. + if (gBootstrap->XRE_ForkServer(&argc, &argv)) { + // Return from the fork server in the fork server process. + // Stop the fork server. + gBootstrap->NS_LogTerm(); + return 0; + } + // In a content process forked from the fork server. + // Start acting as a content process. + } +#endif + + mozilla::TimeStamp start = mozilla::TimeStamp::Now(); + + AUTO_BASE_PROFILER_INIT; + AUTO_BASE_PROFILER_LABEL("nsBrowserApp main", OTHER); + + // Make sure we unregister the runtime exception module before returning. + // We do this here to cover both registers for child and main processes. + auto unregisterRuntimeExceptionModule = + MakeScopeExit([] { CrashReporter::UnregisterRuntimeExceptionModule(); }); + +#ifdef MOZ_BROWSER_CAN_BE_CONTENTPROC + // We are launching as a content process, delegate to the appropriate + // main + if (argc > 1 && IsArg(argv[1], "contentproc")) { + // Set the process type. We don't remove the arg here as that will be done + // later in common code. + SetGeckoProcessType(argv[argc - 1]); + + // Register an external module to report on otherwise uncatchable + // exceptions. Note that in child processes this must be called after Gecko + // process type has been set. + CrashReporter::RegisterRuntimeExceptionModule(); + +# ifdef HAS_DLL_BLOCKLIST + uint32_t initFlags = + gBlocklistInitFlags | eDllBlocklistInitFlagIsChildProcess; + // This is too early in launch to call XRE_IsUtilityProcess(), so roll + // our own. + if (GetGeckoProcessType() == GeckoProcessType_Utility) { + initFlags |= eDllBlocklistInitFlagIsUtilityProcess; + } else if (GetGeckoProcessType() == GeckoProcessType_Socket) { + initFlags |= eDllBlocklistInitFlagIsSocketProcess; + } + DllBlocklist_Initialize(initFlags); +# endif // HAS_DLL_BLOCKLIST +# if defined(XP_WIN) && defined(MOZ_SANDBOX) + // We need to set whether our process is supposed to have win32k locked down + // from the command line setting before GetInitializedTargetServices and + // WindowsDpiInitialization. + Maybe<bool> win32kLockedDown = + mozilla::geckoargs::sWin32kLockedDown.Get(argc, argv); + if (win32kLockedDown.isSome() && *win32kLockedDown) { + mozilla::SetWin32kLockedDownInPolicy(); + } + + // We need to initialize the sandbox TargetServices before InitXPCOMGlue + // because we might need the sandbox broker to give access to some files. + if (IsSandboxedProcess() && !sandboxing::GetInitializedTargetServices()) { + Output("Failed to initialize the sandbox target services."); + return 255; + } +# endif +# if defined(XP_WIN) + // Ideally, we would be able to set our DPI awareness in + // firefox.exe.manifest Unfortunately, that would cause Win32k calls when + // user32.dll gets loaded, which would be incompatible with Win32k Lockdown + // + // MSDN says that it's allowed-but-not-recommended to initialize DPI + // programatically, as long as it's done before any HWNDs are created. + // Thus, we do it almost as soon as we possibly can + { + auto result = mozilla::WindowsDpiInitialization(); + (void)result; // Ignore errors since some tools block DPI calls + } +# endif + + nsresult rv = InitXPCOMGlue(LibLoadingStrategy::NoReadAhead); + if (NS_FAILED(rv)) { + return 255; + } + + int result = content_process_main(gBootstrap.get(), argc, argv); + +# if defined(DEBUG) && defined(HAS_DLL_BLOCKLIST) + DllBlocklist_Shutdown(); +# endif + + // InitXPCOMGlue calls NS_LogInit, so we need to balance it here. + gBootstrap->NS_LogTerm(); + + return result; + } +#endif + + // Register an external module to report on otherwise uncatchable exceptions. + CrashReporter::RegisterRuntimeExceptionModule(); + +#ifdef HAS_DLL_BLOCKLIST + DllBlocklist_Initialize(gBlocklistInitFlags); +#endif + +// We will likely only ever support this as a command line argument on Windows +// and OSX, so we're ifdefing here just to not create any expectations. +#if defined(XP_WIN) || defined(XP_MACOSX) + if (argc > 1 && IsArg(argv[1], "silentmode")) { + ::putenv(const_cast<char*>("MOZ_APP_SILENT_START=1")); +# if defined(XP_WIN) + // On windows We also want to set a separate variable, which we want to + // persist across restarts, which will let us keep the process alive + // even if the last window is closed. + ::putenv(const_cast<char*>("MOZ_APP_ALLOW_WINDOWLESS=1")); +# endif +# if defined(XP_MACOSX) + ::putenv(const_cast<char*>("MOZ_APP_NO_DOCK=1")); +# endif + } +#endif + +#if defined(XP_WIN) + + // Ideally, we would be able to set our DPI awareness in firefox.exe.manifest + // Unfortunately, that would cause Win32k calls when user32.dll gets loaded, + // which would be incompatible with Win32k Lockdown + // + // MSDN says that it's allowed-but-not-recommended to initialize DPI + // programatically, as long as it's done before any HWNDs are created. + // Thus, we do it almost as soon as we possibly can + { + auto result = mozilla::WindowsDpiInitialization(); + (void)result; // Ignore errors since some tools block DPI calls + } + + // Once the browser process hits the main function, we no longer need + // a writable section handle because all dependent modules have been + // loaded. + mozilla::freestanding::gSharedSection.ConvertToReadOnly(); + + mozilla::CreateAndStorePreXULSkeletonUI(GetModuleHandle(nullptr), argc, argv); +#endif + + nsresult rv = InitXPCOMGlue(LibLoadingStrategy::ReadAhead); + if (NS_FAILED(rv)) { + return 255; + } + + gBootstrap->XRE_StartupTimelineRecord(mozilla::StartupTimeline::START, start); + +#ifdef MOZ_BROWSER_CAN_BE_CONTENTPROC + gBootstrap->XRE_EnableSameExecutableForContentProc(); +#endif + + int result = do_main(argc, argv, envp); + +#if defined(XP_WIN) + CleanupProcessRuntime(); +#endif + + gBootstrap->NS_LogTerm(); + +#if defined(DEBUG) && defined(HAS_DLL_BLOCKLIST) + DllBlocklist_Shutdown(); +#endif + +#ifdef XP_MACOSX + // Allow writes again. While we would like to catch writes from static + // destructors to allow early exits to use _exit, we know that there is + // at least one such write that we don't control (see bug 826029). For + // now we enable writes again and early exits will have to use exit instead + // of _exit. + gBootstrap->XRE_StopLateWriteChecks(); +#endif + + gBootstrap.reset(); + + return result; +} diff --git a/browser/app/pbproxy/Makefile.in b/browser/app/pbproxy/Makefile.in new file mode 100644 index 0000000000..f58f09bec1 --- /dev/null +++ b/browser/app/pbproxy/Makefile.in @@ -0,0 +1,2 @@ +# To make sure this process doesn't show a taskbar icon +MOZ_WINCONSOLE = 0 diff --git a/browser/app/pbproxy/docs/index.rst b/browser/app/pbproxy/docs/index.rst new file mode 100644 index 0000000000..b7d0b60467 --- /dev/null +++ b/browser/app/pbproxy/docs/index.rst @@ -0,0 +1,15 @@ +====================== +Private Browsing Proxy +====================== + +On Windows, Firefox ships with a small binary that always launches +``firefox.exe`` in Private Browsing mode (``private_browsing.exe``). Its sole +purpose for existing is to allow Private Browsing shortcuts to have their own +Visual Elements. This is most notably seen when pinning a Private Browsing +shortcut to the Start Menu -- Visual Elements are used for the icon there +rather than the shortcut's icon. + +In addition to always passing ``-private-window``, ``private_browsing.exe`` +will forward any other command line arguments given to it to ``firefox.exe``. +It will also forward shortcut information from the Windows ``STARTUPINFOW`` +structure to ensure that Firefox knows how it was started. diff --git a/browser/app/pbproxy/module.ver b/browser/app/pbproxy/module.ver new file mode 100644 index 0000000000..5ef8d2a02a --- /dev/null +++ b/browser/app/pbproxy/module.ver @@ -0,0 +1,8 @@ +WIN32_MODULE_COMPANYNAME=Mozilla Corporation +WIN32_MODULE_COPYRIGHT=©Firefox and Mozilla Developers; available under the MPL 2 license. +WIN32_MODULE_PRODUCTVERSION=@MOZ_APP_WINVERSION@ +WIN32_MODULE_PRODUCTVERSION_STRING=@MOZ_APP_VERSION@ +WIN32_MODULE_TRADEMARKS=Firefox is a Trademark of The Mozilla Foundation. +WIN32_MODULE_DESCRIPTION=@MOZ_APP_DISPLAYNAME@ +WIN32_MODULE_PRODUCTNAME=@MOZ_APP_DISPLAYNAME@ +WIN32_MODULE_NAME=@MOZ_APP_DISPLAYNAME@ diff --git a/browser/app/pbproxy/moz.build b/browser/app/pbproxy/moz.build new file mode 100644 index 0000000000..bf9e0125e0 --- /dev/null +++ b/browser/app/pbproxy/moz.build @@ -0,0 +1,29 @@ +SPHINX_TREES["private-browsing-proxy"] = "docs" + +SOURCES += ["pbproxy.cpp"] + +# For nsNativeAppSupportWin.h icon definitions +LOCAL_INCLUDES += ["/toolkit/xre"] + +if CONFIG["OS_TARGET"] == "WINNT" and CONFIG["CC_TYPE"] in ("gcc", "clang"): + # This allows us to use wmain as the entry point on mingw + LDFLAGS += [ + "-municode", + ] + +RCINCLUDE = "pbproxy.rc" +DEFINES["UNICODE"] = 1 +DEFINES["MOZ_APP_NAME"] = 'L"{}"'.format(CONFIG["MOZ_APP_NAME"]) +Program("private_browsing") + +OS_LIBS += ["shlwapi", "user32"] + +DEFINES["PBMODE_ICO"] = '"{}/{}/pbmode.ico"'.format( + TOPSRCDIR, + CONFIG["MOZ_BRANDING_DIRECTORY"], +) + +DisableStlWrapping() + +with Files("**"): + BUG_COMPONENT = ("Firefox", "Shell Integration") diff --git a/browser/app/pbproxy/pbproxy.cpp b/browser/app/pbproxy/pbproxy.cpp new file mode 100644 index 0000000000..841cd654a1 --- /dev/null +++ b/browser/app/pbproxy/pbproxy.cpp @@ -0,0 +1,94 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#include <windows.h> +#include <processthreadsapi.h> +#include <winbase.h> +#include <winuser.h> +#include <shlwapi.h> +#include <string> + +// Max command line length, per CreateProcessW docs +#define MAX_CMD_LENGTH 32767 +#define EXTRA_ERR_MSG_LENGTH 39 +#define ERR_GET_OUR_PATH L"844fa30e-0860-11ed-898b-373276936058" +#define ERR_GET_APP_DIR L"811237de-0904-11ed-8745-c7c269742323" +#define ERR_GET_APP_EXE L"8964fd30-0860-11ed-8374-576505ba4488" +#define ERR_LAUNCHING_APP L"89d2ca2c-0860-11ed-883c-bf345b8391bc" + +void raiseError(DWORD err, std::wstring uuid) { + LPWSTR winerr; + if (err && ::FormatMessageW(FORMAT_MESSAGE_ALLOCATE_BUFFER | + FORMAT_MESSAGE_FROM_SYSTEM | + FORMAT_MESSAGE_IGNORE_INSERTS, + nullptr, err, 0, (LPWSTR)&winerr, 0, nullptr)) { + std::wstring errmsg(winerr); + errmsg += L"\n\n" + uuid; + ::MessageBoxW(nullptr, errmsg.c_str(), MOZ_APP_NAME " private_browsing.exe", + MB_OK | MB_ICONERROR | MB_SETFOREGROUND); + } else { + ::MessageBoxW(nullptr, uuid.c_str(), MOZ_APP_NAME " private_browsing.exe", + MB_OK | MB_ICONERROR | MB_SETFOREGROUND); + } +} + +/* + * A very simple wrapper that always launches Firefox in Private Browsing + * mode. Any arguments given to this program will be forwarded to Firefox, + * as well the information provided by GetStartupInfoW() (the latter is mainly + * done to ensure that Firefox's `launch_method` Telemetry works, which + * depends on shortcut information). + * + * Any errors that happen during this process will pop up a MessageBox + * with a Windows error (if present) and a unique UUID for debugability -- + * but these are very unlikely to be seen in practice. + */ +int WINAPI wWinMain(HINSTANCE, HINSTANCE, LPWSTR aCmdLine, int) { + wchar_t app[MAX_PATH]; + DWORD ret = GetModuleFileNameW(nullptr, app, MAX_PATH); + if (!ret || + (ret == MAX_PATH && ::GetLastError() == ERROR_INSUFFICIENT_BUFFER)) { + ret = ::GetLastError(); + raiseError(ret, ERR_GET_OUR_PATH); + return ret; + } + if (!PathRemoveFileSpecW(app)) { + raiseError(0, ERR_GET_APP_DIR); + return 1; + } + if (!PathAppendW(app, MOZ_APP_NAME L".exe")) { + raiseError(0, ERR_GET_APP_EXE); + return 1; + } + + std::wstring cmdLine(L"\""); + cmdLine += app; + cmdLine += L"\" -private-window"; + if (wcslen(aCmdLine) > 0) { + cmdLine += L" "; + cmdLine += aCmdLine; + } + DWORD creationFlags = CREATE_UNICODE_ENVIRONMENT; + // Mainly used to pass along shortcut information to ensure + // launch_method Telemetry will be accurate. + STARTUPINFOW startupInfo = {0}; + startupInfo.cb = sizeof(STARTUPINFOW); + GetStartupInfoW(&startupInfo); + PROCESS_INFORMATION pi; + + bool rv = + ::CreateProcessW(app, cmdLine.data(), nullptr, nullptr, FALSE, + creationFlags, nullptr, nullptr, &startupInfo, &pi); + + if (!rv) { + ret = ::GetLastError(); + raiseError(ret, ERR_LAUNCHING_APP); + return ret; + } + + ::CloseHandle(pi.hProcess); + ::CloseHandle(pi.hThread); + + return 0; +} diff --git a/browser/app/pbproxy/pbproxy.rc b/browser/app/pbproxy/pbproxy.rc new file mode 100644 index 0000000000..bb7489d03c --- /dev/null +++ b/browser/app/pbproxy/pbproxy.rc @@ -0,0 +1,9 @@ +/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#include <windows.h> +#include "nsNativeAppSupportWin.h" + +IDI_APPICON ICON PBMODE_ICO diff --git a/browser/app/permissions b/browser/app/permissions new file mode 100644 index 0000000000..5bc1d66fcd --- /dev/null +++ b/browser/app/permissions @@ -0,0 +1,30 @@ +# This file has default permissions for the permission manager. +# The file-format is strict: +# * matchtype \t type \t permission \t host +# * "origin" should be used for matchtype, "host" is supported for legacy reasons +# * type is a string that identifies the type of permission (e.g. "cookie") +# * permission is an integer between 1 and 15 +# Permissions defined here will also be set for private browsing. +# See PermissionManager.cpp for more... + +# UITour +# Bug 1557153: www.mozilla.org gets a special workaround in UITourChild.jsm +origin uitour 1 https://www.mozilla.org +origin uitour 1 https://monitor.firefox.com +origin uitour 1 https://screenshots.firefox.com +origin uitour 1 https://support.mozilla.org +origin uitour 1 https://truecolors.firefox.com +origin uitour 1 about:home +origin uitour 1 about:newtab + +# XPInstall +origin install 1 https://addons.mozilla.org + +# Remote troubleshooting +origin remote-troubleshooting 1 https://support.mozilla.org + +# addon install +origin install 1 https://fpn.firefox.com + +# autoplay video/audio +origin autoplay-media 1 about:welcome diff --git a/browser/app/profile/channel-prefs.js b/browser/app/profile/channel-prefs.js new file mode 100644 index 0000000000..eed6e634c2 --- /dev/null +++ b/browser/app/profile/channel-prefs.js @@ -0,0 +1,9 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ +// +// This pref is in its own file for complex reasons. See the comment in +// browser/app/Makefile.in, bug 756325, and bug 1431342 for details. Do not add +// other prefs to this file. + +pref("app.update.channel", "@MOZ_UPDATE_CHANNEL@"); diff --git a/browser/app/profile/firefox.js b/browser/app/profile/firefox.js new file mode 100644 index 0000000000..ef8a4aae40 --- /dev/null +++ b/browser/app/profile/firefox.js @@ -0,0 +1,2773 @@ +#filter dumbComments emptyLines substitution + +// -*- indent-tabs-mode: nil; js-indent-level: 2 -*- +// This Source Code Form is subject to the terms of the Mozilla Public +// License, v. 2.0. If a copy of the MPL was not distributed with this +// file, You can obtain one at http://mozilla.org/MPL/2.0/. + +// Non-static prefs that are specific to desktop Firefox belong in this file +// (unless there is a compelling and documented reason for them to belong in +// another file). +// +// Please indent all prefs defined within #ifdef/#ifndef conditions. This +// improves readability, particular for conditional blocks that exceed a single +// screen. + +#ifdef XP_UNIX + #ifndef XP_MACOSX + #define UNIX_BUT_NOT_MAC + #endif +#endif + +pref("browser.hiddenWindowChromeURL", "chrome://browser/content/hiddenWindowMac.xhtml"); + +// Enables some extra Extension System Logging (can reduce performance) +pref("extensions.logging.enabled", false); + +// Disables strict compatibility, making addons compatible-by-default. +pref("extensions.strictCompatibility", false); + +// Temporary preference to forcibly make themes more safe with Australis even if +// extensions.checkCompatibility=false has been set. +pref("extensions.checkCompatibility.temporaryThemeOverride_minAppVersion", "29.0a1"); + +pref("extensions.webextOptionalPermissionPrompts", true); +// If enabled, install origin permission verification happens after addons are downloaded. +pref("extensions.postDownloadThirdPartyPrompt", true); + +// Preferences for AMO integration +pref("extensions.getAddons.cache.enabled", true); +pref("extensions.getAddons.get.url", "https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%"); +pref("extensions.getAddons.search.browseURL", "https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%"); +pref("extensions.getAddons.link.url", "https://addons.mozilla.org/%LOCALE%/firefox/"); +pref("extensions.getAddons.langpacks.url", "https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversion=%VERSION%"); +pref("extensions.getAddons.discovery.api_url", "https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%"); + +// The URL for the privacy policy related to recommended extensions. +pref("extensions.recommendations.privacyPolicyUrl", "https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=privacy-policy-link#addons"); +// The URL for Firefox Color, recommended on the theme page in about:addons. +pref("extensions.recommendations.themeRecommendationUrl", "https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-footer-link"); + +pref("extensions.update.autoUpdateDefault", true); + +// Check AUS for system add-on updates. +pref("extensions.systemAddon.update.url", "https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VERSION%/%DISTRIBUTION%/%DISTRIBUTION_VERSION%/update.xml"); +pref("extensions.systemAddon.update.enabled", true); + +// Disable add-ons that are not installed by the user in all scopes by default. +// See the SCOPE constants in AddonManager.jsm for values to use here. +pref("extensions.autoDisableScopes", 15); +// Scopes to scan for changes at startup. +pref("extensions.startupScanScopes", 0); + +pref("extensions.geckoProfiler.acceptedExtensionIds", "geckoprofiler@mozilla.com,quantum-foxfooding@mozilla.com,raptor@mozilla.org"); + + +pref("extensions.webextensions.remote", true); + +// Require signed add-ons by default +pref("extensions.langpacks.signatures.required", true); +pref("xpinstall.signatures.required", true); +pref("xpinstall.signatures.devInfoURL", "https://wiki.mozilla.org/Addons/Extension_Signing"); + +// Enable extensionStorage storage actor by default +pref("devtools.storage.extensionStorage.enabled", true); + +// Enable the unified extensions UI by default. +pref("extensions.unifiedExtensions.enabled", true); + +// Dictionary download preference +pref("browser.dictionaries.download.url", "https://addons.mozilla.org/%LOCALE%/firefox/language-tools/"); + +// At startup, should we check to see if the installation +// date is older than some threshold +pref("app.update.checkInstallTime", true); + +// The number of days a binary is permitted to be old without checking is defined in +// firefox-branding.js (app.update.checkInstallTime.days) + +// The minimum delay in seconds for the timer to fire between the notification +// of each consumer of the timer manager. +// minimum=30 seconds, default=120 seconds, and maximum=300 seconds +pref("app.update.timerMinimumDelay", 120); + +// The minimum delay in milliseconds for the first firing after startup of the timer +// to notify consumers of the timer manager. +// minimum=10 seconds, default=30 seconds, and maximum=120 seconds +pref("app.update.timerFirstInterval", 30000); + +// App-specific update preferences + +// The interval to check for updates (app.update.interval) is defined in +// firefox-branding.js + +// Enables some extra Application Update Logging (can reduce performance) +pref("app.update.log", false); +// Causes Application Update Logging to be sent to a file in the profile +// directory. This preference is automatically disabled on application start to +// prevent it from being left on accidentally. Turning this pref on enables +// logging, even if app.update.log is false. +pref("app.update.log.file", false); + +// The number of general background check failures to allow before notifying the +// user of the failure. User initiated update checks always notify the user of +// the failure. +pref("app.update.backgroundMaxErrors", 10); + +// Ids of the links to the "What's new" update documentation +pref("app.update.link.updateAvailableWhatsNew", "update-available-whats-new"); +pref("app.update.link.updateManualWhatsNew", "update-manual-whats-new"); + +// How many times we should let downloads fail before prompting the user to +// download a fresh installer. +pref("app.update.download.promptMaxAttempts", 2); + +// How many times we should let an elevation prompt fail before prompting the user to +// download a fresh installer. +pref("app.update.elevation.promptMaxAttempts", 2); + +#ifdef NIGHTLY_BUILD + // Whether to delay popup notifications when an update is available and + // suppress them when an update is installed and waiting for user to restart. + // If set to true, these notifications will immediately be shown as banners in + // the app menu and as badges on the app menu button. Update available + // notifications will not create popup prompts until a week has passed without + // the user installing the update. Update restart notifications will not + // create popup prompts at all. This doesn't affect update notifications + // triggered by errors/failures or manual install prompts. + pref("app.update.suppressPrompts", false); +#endif + +// If set to true, a message will be displayed in the hamburger menu while +// an update is being downloaded. +pref("app.update.notifyDuringDownload", false); + +// If set to true, the Update Service will automatically download updates if the +// user can apply updates. This pref is no longer used on Windows, except as the +// default value to migrate to the new location that this data is now stored +// (which is in a file in the update directory). Because of this, this pref +// should no longer be used directly. Instead, getAppUpdateAutoEnabled and +// getAppUpdateAutoEnabled from UpdateUtils.sys.mjs should be used. +#ifndef XP_WIN + pref("app.update.auto", true); +#endif + +// If set to true, the Update Service will apply updates in the background +// when it finishes downloading them. +pref("app.update.staging.enabled", true); + +// Update service URL: +// app.update.url was removed in Bug 1568994 +// app.update.url.manual is in branding section +// app.update.url.details is in branding section + +// app.update.badgeWaitTime is in branding section +// app.update.interval is in branding section +// app.update.promptWaitTime is in branding section + +// Whether or not to attempt using the service for updates. +#ifdef MOZ_MAINTENANCE_SERVICE + pref("app.update.service.enabled", true); +#endif + +#ifdef MOZ_BITS_DOWNLOAD + // If set to true, the Update Service will attempt to use Windows BITS to + // download updates and will fallback to downloading internally if that fails. + pref("app.update.BITS.enabled", true); +#endif + +pref("app.update.langpack.enabled", true); + +#if defined(MOZ_UPDATE_AGENT) + pref("app.update.background.loglevel", "error"); + pref("app.update.background.timeoutSec", 600); + // By default, check for updates when the browser is not running every 7 hours. + pref("app.update.background.interval", 25200); + // By default, snapshot Firefox Messaging System targeting for use by the + // background update task every 30 minutes. + pref("app.update.background.messaging.targeting.snapshot.intervalSec", 1800); +#endif + +#ifdef XP_MACOSX + // If set to true, Firefox will automatically restart if it is left running + // with no browser windows open. + pref("app.update.noWindowAutoRestart.enabled", true); + // How long to wait after all browser windows are closed before restarting, + // in milliseconds. 5 min = 300000 ms + pref("app.update.noWindowAutoRestart.delayMs", 300000); +#endif + +#if defined(MOZ_BACKGROUNDTASKS) + // The amount of time, in seconds, before background tasks time out and exit. + // Tasks can override this default (10 minutes). + pref("toolkit.backgroundtasks.defaultTimeoutSec", 600); +#endif + +// Symmetric (can be overridden by individual extensions) update preferences. +// e.g. +// extensions.{GUID}.update.enabled +// extensions.{GUID}.update.url +// .. etc .. +// +pref("extensions.update.enabled", true); +pref("extensions.update.url", "https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID%&version=%ITEM_VERSION%&maxAppVersion=%ITEM_MAXAPPVERSION%&status=%ITEM_STATUS%&appID=%APP_ID%&appVersion=%APP_VERSION%&appOS=%APP_OS%&appABI=%APP_ABI%&locale=%APP_LOCALE%¤tAppVersion=%CURRENT_APP_VERSION%&updateType=%UPDATE_TYPE%&compatMode=%COMPATIBILITY_MODE%"); +pref("extensions.update.background.url", "https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID%&version=%ITEM_VERSION%&maxAppVersion=%ITEM_MAXAPPVERSION%&status=%ITEM_STATUS%&appID=%APP_ID%&appVersion=%APP_VERSION%&appOS=%APP_OS%&appABI=%APP_ABI%&locale=%APP_LOCALE%¤tAppVersion=%CURRENT_APP_VERSION%&updateType=%UPDATE_TYPE%&compatMode=%COMPATIBILITY_MODE%"); +pref("extensions.update.interval", 86400); // Check for updates to Extensions and + // Themes every day + +pref("lightweightThemes.getMoreURL", "https://addons.mozilla.org/%LOCALE%/firefox/themes"); + +#if defined(MOZ_WIDEVINE_EME) + pref("browser.eme.ui.enabled", true); +#else + pref("browser.eme.ui.enabled", false); +#endif + +// UI tour experience. +pref("browser.uitour.enabled", true); +pref("browser.uitour.loglevel", "Error"); +pref("browser.uitour.requireSecure", true); +pref("browser.uitour.themeOrigin", "https://addons.mozilla.org/%LOCALE%/firefox/themes/"); +pref("browser.uitour.url", "https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/"); +// How long to show a Hearbeat survey (two hours, in seconds) +pref("browser.uitour.surveyDuration", 7200); + +pref("keyword.enabled", true); + +// Fixup whitelists, the urlbar won't try to search for these words, but will +// instead consider them valid TLDs. Don't check these directly, use +// Services.uriFixup.isDomainKnown() instead. +pref("browser.fixup.domainwhitelist.localhost", true); +// https://tools.ietf.org/html/rfc2606 +pref("browser.fixup.domainsuffixwhitelist.test", true); +pref("browser.fixup.domainsuffixwhitelist.example", true); +pref("browser.fixup.domainsuffixwhitelist.invalid", true); +pref("browser.fixup.domainsuffixwhitelist.localhost", true); +// https://tools.ietf.org/html/draft-wkumari-dnsop-internal-00 +pref("browser.fixup.domainsuffixwhitelist.internal", true); +// https://tools.ietf.org/html/rfc6762 +pref("browser.fixup.domainsuffixwhitelist.local", true); + +// Whether to always go through the DNS server before sending a single word +// search string, that may contain a valid host, to a search engine. +pref("browser.fixup.dns_first_for_single_words", false); + +#ifdef UNIX_BUT_NOT_MAC + pref("general.autoScroll", false); +#else + pref("general.autoScroll", true); +#endif + +// UI density of the browser chrome. This mostly affects toolbarbutton +// and urlbar spacing. The possible values are 0=normal, 1=compact, 2=touch. +pref("browser.uidensity", 0); +// Whether Firefox will automatically override the uidensity to "touch" +// while the user is in a touch environment (such as Windows tablet mode). +pref("browser.touchmode.auto", true); +// Whether Firefox will show the Compact Mode UIDensity option. +pref("browser.compactmode.show", false); + +// At startup, check if we're the default browser and prompt user if not. +pref("browser.shell.checkDefaultBrowser", true); +pref("browser.shell.shortcutFavicons",true); +pref("browser.shell.mostRecentDateSetAsDefault", ""); +pref("browser.shell.skipDefaultBrowserCheckOnFirstRun", true); +pref("browser.shell.didSkipDefaultBrowserCheckOnFirstRun", false); +pref("browser.shell.defaultBrowserCheckCount", 0); +#if defined(XP_WIN) +// Attempt to set the default browser on Windows 10 using the UserChoice registry keys, +// before falling back to launching the modern Settings dialog. +pref("browser.shell.setDefaultBrowserUserChoice", true); +// When setting the default browser on Windows 10 using the UserChoice +// registry keys, also try to set Firefox as the default PDF handler. +pref("browser.shell.setDefaultPDFHandler", true); +// When setting Firefox as the default PDF handler (subject to conditions +// above), only set Firefox as the default PDF handler when the existing handler +// is a known browser, and not when existing handler is another PDF handler such +// as Acrobat Reader or Nitro PDF. +pref("browser.shell.setDefaultPDFHandler.onlyReplaceBrowsers", true); +#endif + + +// 0 = blank, 1 = home (browser.startup.homepage), 2 = last visited page, 3 = resume previous browser session +// The behavior of option 3 is detailed at: http://wiki.mozilla.org/Session_Restore +pref("browser.startup.page", 1); +pref("browser.startup.homepage", "about:home"); +#ifdef NIGHTLY_BUILD +pref("browser.startup.homepage.abouthome_cache.enabled", true); +#else +pref("browser.startup.homepage.abouthome_cache.enabled", false); +#endif +pref("browser.startup.homepage.abouthome_cache.loglevel", "Warn"); + +// Whether we should skip the homepage when opening the first-run page +pref("browser.startup.firstrunSkipsHomepage", true); + +// Whether we should show the session-restore infobar on startup +pref("browser.startup.couldRestoreSession.count", 0); + +// Show an about:blank window as early as possible for quick startup feedback. +// Held to nightly on Linux due to bug 1450626. +// Disabled on Mac because the bouncing dock icon already provides feedback. +#if defined(XP_WIN) || defined(MOZ_WIDGET_GTK) && defined(NIGHTLY_BUILD) + pref("browser.startup.blankWindow", true); +#else + pref("browser.startup.blankWindow", false); +#endif + +// Show a skeleton UI window prior to loading libxul. Only visible for windows +// users as it is not implemented anywhere else. +#if defined(XP_WIN) +pref("browser.startup.preXulSkeletonUI", true); +#endif + +// Show an upgrade dialog on major upgrades. +pref("browser.startup.upgradeDialog.enabled", true); + +// Don't create the hidden window during startup on +// platforms that don't always need it (Win/Linux). +pref("toolkit.lazyHiddenWindow", true); + +pref("browser.chrome.site_icons", true); +// browser.warnOnQuit == false will override all other possible prompts when quitting or restarting +pref("browser.warnOnQuit", true); + +// Whether to warn when quitting when using the shortcut key. +#if defined(XP_WIN) + pref("browser.warnOnQuitShortcut", false); +#else + pref("browser.warnOnQuitShortcut", true); +#endif + +// TODO bug 1702563: Renable fullscreen autohide by default on macOS. +#ifdef XP_MACOSX + pref("browser.fullscreen.autohide", false); +#else + pref("browser.fullscreen.autohide", true); +#endif + +pref("browser.overlink-delay", 80); + +pref("browser.theme.colorway-closet", true); + +// Whether expired built-in colorways themes that are active or retained +// should be allowed to check for updates and be updated to an AMO hosted +// theme with the same id (as part of preparing to remove from mozilla-central +// all the expired built-in colorways themes, after existing users have been +// migrated to colorways themes hosted on AMO). +pref("browser.theme.colorway-migration", false); + +// Whether using `ctrl` when hitting return/enter in the URL bar +// (or clicking 'go') should prefix 'www.' and suffix +// browser.fixup.alternate.suffix to the URL bar value prior to +// navigating. +pref("browser.urlbar.ctrlCanonizesURLs", true); + +// Whether we announce to screen readers when tab-to-search results are +// inserted. +pref("browser.urlbar.accessibility.tabToSearch.announceResults", true); + +// Control autoFill behavior +pref("browser.urlbar.autoFill", true); + +// Whether enabling adaptive history autofill. +pref("browser.urlbar.autoFill.adaptiveHistory.enabled", false); + +// Minimum char length of the user's search string to enable adaptive history +// autofill. +pref("browser.urlbar.autoFill.adaptiveHistory.minCharsThreshold", 0); + +// Whether to warm up network connections for autofill or search results. +pref("browser.urlbar.speculativeConnect.enabled", true); + +// Whether bookmarklets should be filtered out of Address Bar matches. +// This is enabled for security reasons, when true it is still possible to +// search for bookmarklets typing "javascript: " followed by the actual query. +pref("browser.urlbar.filter.javascript", true); + +// Enable a certain level of urlbar logging to the Browser Console. See Log.jsm. +pref("browser.urlbar.loglevel", "Error"); + +// the maximum number of results to show in autocomplete when doing richResults +pref("browser.urlbar.maxRichResults", 10); + +// The maximum number of historical search results to show. +pref("browser.urlbar.maxHistoricalSearchSuggestions", 2); + +// The default behavior for the urlbar can be configured to use any combination +// of the match filters with each additional filter adding more results (union). +pref("browser.urlbar.suggest.bookmark", true); +pref("browser.urlbar.suggest.history", true); +pref("browser.urlbar.suggest.openpage", true); +pref("browser.urlbar.suggest.remotetab", true); +pref("browser.urlbar.suggest.searches", true); +pref("browser.urlbar.suggest.topsites", true); +pref("browser.urlbar.suggest.engines", true); +pref("browser.urlbar.suggest.calculator", false); + +#if defined(EARLY_BETA_OR_EARLIER) + // Enable QuickActions and its urlbar search mode button. + pref("browser.urlbar.quickactions.enabled", true); + pref("browser.urlbar.suggest.quickactions", true); + pref("browser.urlbar.shortcuts.quickactions", true); + pref("browser.urlbar.quickactions.showPrefs", true); + pref("browser.urlbar.quickactions.showInZeroPrefix", false); +#endif + +// Feature gate pref for weather suggestions in the urlbar. +pref("browser.urlbar.weather.featureGate", false); + +// If `browser.urlbar.weather.featureGate` is true, this controls whether +// weather suggestions are turned on. +pref("browser.urlbar.suggest.weather", true); + +// When `browser.urlbar.bestMatch.enabled` is true, this controls whether best +// match results are shown in the urlbar. This pref is exposed to the user in +// the UI, and it's sticky so that its user-branch value persists regardless of +// whatever Firefox Suggest experiments or rollouts the user is enrolled in over +// time. +pref("browser.urlbar.suggest.bestmatch", true, sticky); + +// Whether non-sponsored quick suggest results are shown in the urlbar. This +// pref is exposed to the user in the UI, and it's sticky so that its +// user-branch value persists regardless of whatever Firefox Suggest scenarios, +// with their various default-branch values, the user is enrolled in over time. +pref("browser.urlbar.suggest.quicksuggest.nonsponsored", false, sticky); + +// Whether sponsored quick suggest results are shown in the urlbar. This pref is +// exposed to the user in the UI, and it's sticky so that its user-branch value +// persists regardless of whatever Firefox Suggest scenarios, with their various +// default-branch values, the user is enrolled in over time. +pref("browser.urlbar.suggest.quicksuggest.sponsored", false, sticky); + +// Whether data collection is enabled for quick suggest results in the urlbar. +// This pref is exposed to the user in the UI, and it's sticky so that its +// user-branch value persists regardless of whatever Firefox Suggest scenarios, +// with their various default-branch values, the user is enrolled in over time. +pref("browser.urlbar.quicksuggest.dataCollection.enabled", false, sticky); + +// Whether the quick suggest feature in the urlbar is enabled. +pref("browser.urlbar.quicksuggest.enabled", false); + +// Whether to show the QuickSuggest onboarding dialog. +pref("browser.urlbar.quicksuggest.shouldShowOnboardingDialog", true); + +// Show QuickSuggest onboarding dialog on the nth browser restarts. +pref("browser.urlbar.quicksuggest.showOnboardingDialogAfterNRestarts", 0); + +// The indexes of the sponsored and non-sponsored quick suggest results within +// the general results group. +pref("browser.urlbar.quicksuggest.sponsoredIndex", -1); +pref("browser.urlbar.quicksuggest.nonSponsoredIndex", -1); + +// Whether Remote Settings is enabled as a quick suggest source. +pref("browser.urlbar.quicksuggest.remoteSettings.enabled", true); + +// Whether quick suggest results can be shown in position specified in the +// suggestions. +pref("browser.urlbar.quicksuggest.allowPositionInSuggestions", true); + +// Whether non-sponsored quick suggest results are subject to impression +// frequency caps. +pref("browser.urlbar.quicksuggest.impressionCaps.nonSponsoredEnabled", false); + +// Whether sponsored quick suggest results are subject to impression frequency +// caps. +pref("browser.urlbar.quicksuggest.impressionCaps.sponsoredEnabled", false); + +// Whether the usual non-best-match quick suggest results can be blocked. This +// pref is a fallback for the Nimbus variable `quickSuggestBlockingEnabled`. +pref("browser.urlbar.quicksuggest.blockingEnabled", false); + +// Whether unit conversion is enabled. +#ifdef NIGHTLY_BUILD +pref("browser.urlbar.unitConversion.enabled", true); +#else +pref("browser.urlbar.unitConversion.enabled", false); +#endif + +// Whether to show search suggestions before general results like history and +// bookmarks. +pref("browser.urlbar.showSearchSuggestionsFirst", true); + +// As a user privacy measure, don't fetch search suggestions if a pasted string +// is longer than this. +pref("browser.urlbar.maxCharsForSearchSuggestions", 100); + +pref("browser.urlbar.trimURLs", true); + +// If changed to true, copying the entire URL from the location bar will put the +// human readable (percent-decoded) URL on the clipboard. +pref("browser.urlbar.decodeURLsOnCopy", false); + +// Whether or not to move tabs into the active window when using the "Switch to +// Tab" feature of the awesomebar. +pref("browser.urlbar.switchTabs.adoptIntoActiveWindow", false); + +// Whether addresses and search results typed into the address bar +// should be opened in new tabs by default. +pref("browser.urlbar.openintab", false); + +// Enable three-dot options button and menu for eligible results. +pref("browser.urlbar.resultMenu", false); + +// If true, we show tail suggestions when available. +pref("browser.urlbar.richSuggestions.tail", true); + +// If true, top sites may include sponsored ones. +pref("browser.urlbar.sponsoredTopSites", false); + +// Global toggle for whether the show search terms feature +// can be used at all, and enabled/disabled by the user. +#if defined(EARLY_BETA_OR_EARLIER) +pref("browser.urlbar.showSearchTerms.featureGate", true); +#else +pref("browser.urlbar.showSearchTerms.featureGate", false); +#endif + +// If true, show the search term in the Urlbar while on +// a default search engine results page. +pref("browser.urlbar.showSearchTerms.enabled", true); + +// Controls the empty search behavior in Search Mode: +// 0 - Show nothing +// 1 - Show search history +// 2 - Show search and browsing history +pref("browser.urlbar.update2.emptySearchBehavior", 0); + +// Whether the urlbar displays one-offs to filter searches to history, +// bookmarks, or tabs. +pref("browser.urlbar.shortcuts.bookmarks", true); +pref("browser.urlbar.shortcuts.tabs", true); +pref("browser.urlbar.shortcuts.history", true); + +pref("browser.urlbar.eventTelemetry.enabled", false); + +// Whether search engagement telemetry should be recorded. +pref("browser.urlbar.searchEngagementTelemetry.enabled", false); + +// When we send events to Urlbar extensions, we wait this amount of time in +// milliseconds for them to respond before timing out. +pref("browser.urlbar.extension.timeout", 400); + +// Controls when to DNS resolve single word search strings, after they were +// searched for. If the string is resolved as a valid host, show a +// "Did you mean to go to 'host'" prompt. +// 0 - never resolve; 1 - use heuristics (default); 2 - always resolve +pref("browser.urlbar.dnsResolveSingleWordsAfterSearch", 0); + +// Whether the results panel should be kept open during IME composition. +// The default value is false because some IME open a picker panel, and we end +// up with two panels on top of each other. Since for now we can't detect that +// we leave this choice to the user, hopefully in the future this can be flipped +// for everyone. +pref("browser.urlbar.keepPanelOpenDuringImeComposition", false); + +// Whether Firefox Suggest group labels are shown in the urlbar view. +pref("browser.urlbar.groupLabels.enabled", true); + +// Whether Merino is enabled as a quick suggest source in the urlbar. +pref("browser.urlbar.merino.enabled", true); + +// The Merino endpoint URL, not including parameters. +pref("browser.urlbar.merino.endpointURL", "https://merino.services.mozilla.com/api/v1/suggest"); + +// Timeout for Merino fetches (ms). +pref("browser.urlbar.merino.timeoutMs", 200); + +// Comma-separated list of providers to request from Merino +pref("browser.urlbar.merino.providers", ""); + +// Comma-separated list of client variants to send to Merino +pref("browser.urlbar.merino.clientVariants", ""); + +// Whether the best match feature in the urlbar is enabled. +pref("browser.urlbar.bestMatch.enabled", false); + +// Whether best match results can be blocked. This pref is a fallback for the +// Nimbus variable `bestMatchBlockingEnabled`. +pref("browser.urlbar.bestMatch.blockingEnabled", false); + +// Enable site specific search result. +pref("browser.urlbar.contextualSearch.enabled", false); + +pref("browser.altClickSave", false); + +// Enable logging downloads operations to the Console. +pref("browser.download.loglevel", "Error"); + +// Number of milliseconds to wait for the http headers (and thus +// the Content-Disposition filename) before giving up and falling back to +// picking a filename without that info in hand so that the user sees some +// feedback from their action. +pref("browser.download.saveLinkAsFilenameTimeout", 4000); + +pref("browser.download.useDownloadDir", true); +pref("browser.download.folderList", 1); +pref("browser.download.manager.addToRecentDocs", true); +pref("browser.download.manager.resumeOnWakeDelay", 10000); + +// This allows disabling the animated notifications shown by +// the Downloads Indicator when a download starts or completes. +pref("browser.download.animateNotifications", true); + +// This records whether or not the panel has been shown at least once. +pref("browser.download.panel.shown", false); + +// This records whether or not to show the 'Open in system viewer' context menu item when appropriate +pref("browser.download.openInSystemViewerContextMenuItem", true); + +// This records whether or not to show the 'Always open...' context menu item when appropriate +pref("browser.download.alwaysOpenInSystemViewerContextMenuItem", true); + +// Open downloaded file types internally for the given types. +// This is a comma-separated list, the empty string ("") means no types are +// viewable internally. +pref("browser.download.viewableInternally.enabledTypes", "xml,svg,webp,avif,jxl"); + + +// This controls whether the button is automatically shown/hidden depending +// on whether there are downloads to show. +pref("browser.download.autohideButton", true); + +// Controls whether to open the downloads panel every time a download begins. +// The first download ever run in a new profile will still open the panel. +pref("browser.download.alwaysOpenPanel", true); + +// Determines the behavior of the "Delete" item in the downloads context menu. +// Valid values are 0, 1, and 2. +// 0 - Don't remove the download from session list or history. +// 1 - Remove the download from session list, but not history. +// 2 - Remove the download from both session list and history. +pref("browser.download.clearHistoryOnDelete", 0); + +#ifndef XP_MACOSX + pref("browser.helperApps.deleteTempFileOnExit", true); +#endif + +// This controls the visibility of the radio button in the +// Unknown Content Type (Helper App) dialog that will open +// the content in the browser for PDF and for other +// Viewable Internally types +// (see browser.download.viewableInternally.enabledTypes) +pref("browser.helperApps.showOpenOptionForPdfJS", true); +pref("browser.helperApps.showOpenOptionForViewableInternally", true); + +// search engine removal URL +pref("browser.search.searchEngineRemoval", "https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-engine-removal"); + +// search engines URL +pref("browser.search.searchEnginesURL", "https://addons.mozilla.org/%LOCALE%/firefox/search-engines/"); + +// search bar results always open in a new tab +pref("browser.search.openintab", false); + +// context menu searches open in the foreground +pref("browser.search.context.loadInBackground", false); + +// comma separated list of of engines to hide in the search panel. +pref("browser.search.hiddenOneOffs", ""); + +// Mirrors whether the search-container widget is in the navigation toolbar. +pref("browser.search.widget.inNavBar", false); + +// Enables display of the options for the user using a separate default search +// engine in private browsing mode. +pref("browser.search.separatePrivateDefault.ui.enabled", false); +// The maximum amount of times the private default banner is shown. +pref("browser.search.separatePrivateDefault.ui.banner.max", 0); + +// Enables the display of the Mozilla VPN banner in private browsing windows +pref("browser.privatebrowsing.vpnpromourl", "https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaign=private-browsing-vpn-link"); + +// Enables the new private browsing indicator. +pref("browser.privatebrowsing.enable-new-indicator", true); + +// Enables the new about:privatebrowsing logo. +pref("browser.privatebrowsing.enable-new-logo", true); + +// Whether the user has opted-in to recommended settings for data features. +pref("browser.dataFeatureRecommendations.enabled", false); + +// Temporary pref to control whether or not Private Browsing windows show up +// as separate icons in the Windows taskbar. +pref("browser.privateWindowSeparation.enabled", true); + +// Use dark theme variant for PBM windows. This is only supported if the theme +// sets darkTheme data. +pref("browser.theme.dark-private-windows", true); + +// Controls visibility of the privacy segmentation preferences section. +pref("browser.privacySegmentation.preferences.show", false); + +pref("browser.sessionhistory.max_entries", 50); + +// Built-in default permissions. +pref("permissions.manager.defaultsUrl", "resource://app/defaults/permissions"); + +// Set default fallback values for site permissions we want +// the user to be able to globally change. +pref("permissions.default.camera", 0); +pref("permissions.default.microphone", 0); +pref("permissions.default.geo", 0); +pref("permissions.default.xr", 0); +pref("permissions.default.desktop-notification", 0); +pref("permissions.default.shortcuts", 0); + +pref("permissions.desktop-notification.postPrompt.enabled", true); +pref("permissions.desktop-notification.notNow.enabled", false); + +pref("permissions.fullscreen.allowed", false); + +// handle links targeting new windows +// 1=current window/tab, 2=new window, 3=new tab in most recent window +pref("browser.link.open_newwindow", 3); + +// handle external links (i.e. links opened from a different application) +// default: use browser.link.open_newwindow +// 1-3: see browser.link.open_newwindow for interpretation +pref("browser.link.open_newwindow.override.external", -1); + +// 0: no restrictions - divert everything +// 1: don't divert window.open at all +// 2: don't divert window.open with features +pref("browser.link.open_newwindow.restriction", 2); + +// If true, this pref causes windows opened by window.open to be forced into new +// tabs (rather than potentially opening separate windows, depending on +// window.open arguments) when the browser is in fullscreen mode. +// We set this differently on Mac because the fullscreen implementation there is +// different. +#ifdef XP_MACOSX + pref("browser.link.open_newwindow.disabled_in_fullscreen", true); +#else + pref("browser.link.open_newwindow.disabled_in_fullscreen", false); +#endif + +// Tabbed browser +pref("browser.tabs.closeTabByDblclick", false); +pref("browser.tabs.closeWindowWithLastTab", true); +pref("browser.tabs.allowTabDetach", true); +// Open related links to a tab, e.g., link in current tab, at next to the +// current tab if |insertRelatedAfterCurrent| is true. Otherwise, always +// append new tab to the end. +pref("browser.tabs.insertRelatedAfterCurrent", true); +// Open all links, e.g., bookmarks, history items at next to current tab +// if |insertAfterCurrent| is true. Otherwise, append new tab to the end +// for non-related links. Note that if this is set to true, it will trump +// the value of browser.tabs.insertRelatedAfterCurrent. +pref("browser.tabs.insertAfterCurrent", false); +pref("browser.tabs.warnOnClose", false); +pref("browser.tabs.warnOnCloseOtherTabs", true); +pref("browser.tabs.warnOnOpen", true); +pref("browser.tabs.maxOpenBeforeWarn", 15); +pref("browser.tabs.loadInBackground", true); +pref("browser.tabs.opentabfor.middleclick", true); +pref("browser.tabs.loadDivertedInBackground", false); +pref("browser.tabs.loadBookmarksInBackground", false); +pref("browser.tabs.loadBookmarksInTabs", false); +pref("browser.tabs.tabClipWidth", 140); +pref("browser.tabs.tabMinWidth", 76); +// Users running in any of the following language codes will have the +// secondary text on tabs hidden due to size constraints and readability +// of the text at small font sizes. +pref("browser.tabs.secondaryTextUnsupportedLocales", "ar,bn,bo,ckb,fa,gu,he,hi,ja,km,kn,ko,lo,mr,my,ne,pa,si,ta,te,th,ur,zh"); + +//Control the visibility of Tab Manager Menu. +pref("browser.tabs.tabmanager.enabled", true); + +// When tabs opened by links in other tabs via a combination of +// browser.link.open_newwindow being set to 3 and target="_blank" etc are +// closed: +// true return to the tab that opened this tab (its owner) +// false return to the adjacent tab (old default) +pref("browser.tabs.selectOwnerOnClose", true); + +// This should match Chromium's audio indicator delay. +pref("browser.tabs.delayHidingAudioPlayingIconMS", 3000); + +// Pref to control whether we use a separate privileged content process +// for about: pages. This pref name did not age well: we will have multiple +// types of privileged content processes, each with different privileges. +// types of privleged content processes, each with different privleges. +pref("browser.tabs.remote.separatePrivilegedContentProcess", true); + +#if defined(NIGHTLY_BUILD) && !defined(MOZ_ASAN) + // This pref will cause assertions when a remoteType triggers a process switch + // to a new remoteType it should not be able to trigger. + pref("browser.tabs.remote.enforceRemoteTypeRestrictions", true); +#endif + +// Pref to control whether we use a separate privileged content process +// for certain mozilla webpages (which are listed in the pref +// browser.tabs.remote.separatedMozillaDomains). +pref("browser.tabs.remote.separatePrivilegedMozillaWebContentProcess", true); + +#ifdef NIGHTLY_BUILD +pref("browser.tabs.tooltipsShowPidAndActiveness", true); +#else +pref("browser.tabs.tooltipsShowPidAndActiveness", false); +#endif + +pref("browser.tabs.firefox-view", true); +pref("browser.tabs.firefox-view.logLevel", "Warn"); +pref("browser.tabs.firefox-view.notify-for-tabs", false); + +// allow_eval_* is enabled on Firefox Desktop only at this +// point in time +pref("security.allow_eval_with_system_principal", false); +pref("security.allow_eval_in_parent_process", false); + +pref("security.allow_parent_unrestricted_js_loads", false); + +// Unload tabs when available memory is running low +#if defined(XP_MACOSX) || defined(XP_WIN) + pref("browser.tabs.unloadOnLowMemory", true); +#else + pref("browser.tabs.unloadOnLowMemory", false); +#endif + +// Tab Unloader does not unload tabs whose last inactive period is longer than +// this value (in milliseconds). +pref("browser.tabs.min_inactive_duration_before_unload", 600000); + +#if defined(XP_MACOSX) + // During low memory periods, poll with this frequency (milliseconds) + // until memory is no longer low. Changes to the pref take effect immediately. + // Browser restart not required. Chosen to be consistent with the windows + // implementation, but otherwise the 10s value is arbitrary. + pref("browser.lowMemoryPollingIntervalMS", 10000); + + // Pref to control the reponse taken on macOS when the OS is under memory + // pressure. Changes to the pref take effect immediately. Browser restart not + // required. The pref value is a bitmask: + // 0x0: No response (other than recording for telemetry, crash reporting) + // 0x1: Use the tab unloading feature to reduce memory use. Requires that + // the above "browser.tabs.unloadOnLowMemory" pref be set to true for tab + // unloading to occur. + // 0x2: Issue the internal "memory-pressure" notification to reduce memory use + // 0x3: Both 0x1 and 0x2. + #if defined(NIGHTLY_BUILD) + pref("browser.lowMemoryResponseMask", 3); + #else + pref("browser.lowMemoryResponseMask", 0); + #endif + + // Controls which macOS memory-pressure level triggers the browser low memory + // response. Changes to the pref take effect immediately. Browser restart not + // required. By default, use the "critical" level as that occurs after "warn" + // and we only want to trigger the low memory reponse when necessary. + // The macOS system memory-pressure level is either none, "warn", or + // "critical". The OS notifies the browser when the level changes. A false + // value for the pref indicates the low memory response should occur when + // reaching the "critical" level. A true value indicates the response should + // occur when reaching the "warn" level. + pref("browser.lowMemoryResponseOnWarn", false); +#endif + +pref("browser.ctrlTab.sortByRecentlyUsed", false); + +// By default, do not export HTML at shutdown. +// If true, at shutdown the bookmarks in your menu and toolbar will +// be exported as HTML to the bookmarks.html file. +pref("browser.bookmarks.autoExportHTML", false); + +// The maximum number of daily bookmark backups to +// keep in {PROFILEDIR}/bookmarkbackups. Special values: +// -1: unlimited +// 0: no backups created (and deletes all existing backups) +pref("browser.bookmarks.max_backups", 15); + +// Whether menu should close after Ctrl-click, middle-click, etc. +pref("browser.bookmarks.openInTabClosesMenu", true); + +// Where new bookmarks go by default. +// Use PlacesUIUtils.defaultParentGuid to read this; do NOT read the pref +// directly. +// The value is one of: +// - a bookmarks guid +// - "toolbar", "menu" or "unfiled" for those folders. +// If we use the pref but the value isn't any of these, we'll fall back to +// the bookmarks toolbar as a default. +pref("browser.bookmarks.defaultLocation", "toolbar"); + +// Scripts & Windows prefs +pref("dom.disable_open_during_load", true); + +// allow JS to move and resize existing windows +pref("dom.disable_window_move_resize", false); +// prevent JS from monkeying with window focus, etc +pref("dom.disable_window_flip", true); + +// popups.policy 1=allow,2=reject +pref("privacy.popups.policy", 1); +pref("privacy.popups.usecustom", true); +pref("privacy.popups.showBrowserMessage", true); + +pref("privacy.item.cookies", false); + +pref("privacy.clearOnShutdown.history", true); +pref("privacy.clearOnShutdown.formdata", true); +pref("privacy.clearOnShutdown.downloads", true); +pref("privacy.clearOnShutdown.cookies", true); +pref("privacy.clearOnShutdown.cache", true); +pref("privacy.clearOnShutdown.sessions", true); +pref("privacy.clearOnShutdown.offlineApps", false); +pref("privacy.clearOnShutdown.siteSettings", false); +pref("privacy.clearOnShutdown.openWindows", false); + +pref("privacy.cpd.history", true); +pref("privacy.cpd.formdata", true); +pref("privacy.cpd.passwords", false); +pref("privacy.cpd.downloads", true); +pref("privacy.cpd.cookies", true); +pref("privacy.cpd.cache", true); +pref("privacy.cpd.sessions", true); +pref("privacy.cpd.offlineApps", false); +pref("privacy.cpd.siteSettings", false); +pref("privacy.cpd.openWindows", false); + +pref("privacy.history.custom", false); + +// What default should we use for the time span in the sanitizer: +// 0 - Clear everything +// 1 - Last Hour +// 2 - Last 2 Hours +// 3 - Last 4 Hours +// 4 - Today +// 5 - Last 5 minutes +// 6 - Last 24 hours +pref("privacy.sanitize.timeSpan", 1); + +pref("privacy.sanitize.migrateFx3Prefs", false); + +pref("privacy.panicButton.enabled", true); + +// Time until temporary permissions expire, in ms +pref("privacy.temporary_permission_expire_time_ms", 3600000); + +pref("network.proxy.share_proxy_settings", false); // use the same proxy settings for all protocols + +// simple gestures support +pref("browser.gesture.swipe.left", "Browser:BackOrBackDuplicate"); +pref("browser.gesture.swipe.right", "Browser:ForwardOrForwardDuplicate"); +pref("browser.gesture.swipe.up", "cmd_scrollTop"); +pref("browser.gesture.swipe.down", "cmd_scrollBottom"); +pref("browser.gesture.pinch.latched", false); +pref("browser.gesture.pinch.threshold", 25); +#if defined(XP_WIN) || defined(MOZ_WIDGET_GTK) + // Enabled for touch input display zoom. + pref("browser.gesture.pinch.out", "cmd_fullZoomEnlarge"); + pref("browser.gesture.pinch.in", "cmd_fullZoomReduce"); + pref("browser.gesture.pinch.out.shift", "cmd_fullZoomReset"); + pref("browser.gesture.pinch.in.shift", "cmd_fullZoomReset"); +#else + // Disabled by default due to issues with track pad input. + pref("browser.gesture.pinch.out", ""); + pref("browser.gesture.pinch.in", ""); + pref("browser.gesture.pinch.out.shift", ""); + pref("browser.gesture.pinch.in.shift", ""); +#endif +pref("browser.gesture.twist.latched", false); +pref("browser.gesture.twist.threshold", 0); +pref("browser.gesture.twist.right", "cmd_gestureRotateRight"); +pref("browser.gesture.twist.left", "cmd_gestureRotateLeft"); +pref("browser.gesture.twist.end", "cmd_gestureRotateEnd"); +#if defined(XP_WIN) || defined(MOZ_WIDGET_GTK) + pref("browser.gesture.tap", "cmd_fullZoomReset"); +#else + pref("browser.gesture.tap", ""); +#endif + +pref("browser.history_swipe_animation.disabled", false); + +// 0: Nothing happens +// 1: Scrolling contents +// 2: Go back or go forward, in your history +// 3: Zoom in or out (reflowing zoom). +// 4: Treat vertical wheel as horizontal scroll +// 5: Zoom in or out (pinch zoom). +#ifdef XP_MACOSX + // On macOS, if the wheel has one axis only, shift+wheel comes through as a + // horizontal scroll event. Thus, we can't assign anything other than normal + // scrolling to shift+wheel. + pref("mousewheel.with_shift.action", 1); + pref("mousewheel.with_alt.action", 2); + pref("mousewheel.with_control.action", 1); +#else + // On the other platforms (non-macOS), user may use legacy mouse which + // supports only vertical wheel but want to scroll horizontally. For such + // users, we should provide horizontal scroll with shift+wheel (same as + // Chrome). However, shift+wheel was used for navigating history. For users + // who want to keep using this feature, let's enable it with alt+wheel. This + // is better for consistency with macOS users. + pref("mousewheel.with_shift.action", 4); + pref("mousewheel.with_alt.action", 2); +#endif + +pref("mousewheel.with_win.action", 1); + +pref("browser.xul.error_pages.expert_bad_cert", false); +pref("browser.xul.error_pages.show_safe_browsing_details_on_load", false); + +// Enable captive portal detection. +pref("network.captive-portal-service.enabled", true); + +// If true, network link events will change the value of navigator.onLine +pref("network.manage-offline-status", true); + +// We want to make sure mail URLs are handled externally... +pref("network.protocol-handler.external.mailto", true); // for mail +pref("network.protocol-handler.external.news", true); // for news +pref("network.protocol-handler.external.snews", true); // for secure news +pref("network.protocol-handler.external.nntp", true); // also news +#ifdef XP_WIN + pref("network.protocol-handler.external.ms-windows-store", true); +#endif + +// ...without warning dialogs +pref("network.protocol-handler.warn-external.mailto", false); +pref("network.protocol-handler.warn-external.news", false); +pref("network.protocol-handler.warn-external.snews", false); +pref("network.protocol-handler.warn-external.nntp", false); +#ifdef XP_WIN + pref("network.protocol-handler.warn-external.ms-windows-store", false); +#endif + +// By default, all protocol handlers are exposed. This means that +// the browser will respond to openURL commands for all URL types. +// It will also try to open link clicks inside the browser before +// failing over to the system handlers. +pref("network.protocol-handler.expose-all", true); +pref("network.protocol-handler.expose.mailto", false); +pref("network.protocol-handler.expose.news", false); +pref("network.protocol-handler.expose.snews", false); +pref("network.protocol-handler.expose.nntp", false); + +pref("accessibility.typeaheadfind", false); +pref("accessibility.typeaheadfind.timeout", 5000); +pref("accessibility.typeaheadfind.linksonly", false); +pref("accessibility.typeaheadfind.flashBar", 1); + +pref("plugins.testmode", false); + +// Should plugins that are hidden show the infobar UI? +pref("plugins.show_infobar", false); + +#if defined(_ARM64_) && defined(XP_WIN) + pref("plugin.default.state", 0); +#else + pref("plugin.default.state", 1); +#endif + +// Prefer HTML5 video over Flash content, and don't +// load plugin instances with no src declared. +// These prefs are documented in details on all.js. +// With the "follow-ctp" setting, this will only +// apply to users that have plugin.state.flash = 1. +pref("plugins.favorfallback.mode", "follow-ctp"); +pref("plugins.favorfallback.rules", "nosrc,video"); + +// Toggling Search bar on and off in about:preferences +pref("browser.preferences.search", true); +#if defined(NIGHTLY_BUILD) +pref("browser.preferences.experimental", true); +#else +pref("browser.preferences.experimental", false); +#endif +pref("browser.preferences.moreFromMozilla", true); +pref("browser.preferences.experimental.hidden", false); +pref("browser.preferences.defaultPerformanceSettings.enabled", true); + +pref("browser.proton.toolbar.version", 0); + +// Backspace and Shift+Backspace behavior +// 0 goes Back/Forward +// 1 act like PgUp/PgDown +// 2 and other values, nothing +pref("browser.backspace_action", 2); + +pref("intl.regional_prefs.use_os_locales", false); + +// this will automatically enable inline spellchecking (if it is available) for +// editable elements in HTML +// 0 = spellcheck nothing +// 1 = check multi-line controls [default] +// 2 = check multi/single line controls +pref("layout.spellcheckDefault", 1); + +pref("browser.send_pings", false); + +pref("browser.geolocation.warning.infoURL", "https://www.mozilla.org/%LOCALE%/firefox/geolocation/"); +pref("browser.xr.warning.infoURL", "https://www.mozilla.org/%LOCALE%/firefox/xr/"); + +pref("browser.sessionstore.resume_from_crash", true); +pref("browser.sessionstore.resume_session_once", false); +pref("browser.sessionstore.resuming_after_os_restart", false); + +// Minimal interval between two save operations in milliseconds (while the user is idle). +pref("browser.sessionstore.interval.idle", 3600000); // 1h + +// Time (ms) before we assume that the user is idle and that we don't need to +// collect/save the session quite as often. +pref("browser.sessionstore.idleDelay", 180000); // 3 minutes + +// on which sites to save text data, POSTDATA and cookies +// 0 = everywhere, 1 = unencrypted sites, 2 = nowhere +pref("browser.sessionstore.privacy_level", 0); +// how many tabs can be reopened (per window) +pref("browser.sessionstore.max_tabs_undo", 25); +// how many windows can be reopened (per session) - on non-OS X platforms this +// pref may be ignored when dealing with pop-up windows to ensure proper startup +pref("browser.sessionstore.max_windows_undo", 3); +// number of crashes that can occur before the about:sessionrestore page is displayed +// (this pref has no effect if more than 6 hours have passed since the last crash) +pref("browser.sessionstore.max_resumed_crashes", 1); +// number of back button session history entries to restore (-1 = all of them) +pref("browser.sessionstore.max_serialize_back", 10); +// number of forward button session history entries to restore (-1 = all of them) +pref("browser.sessionstore.max_serialize_forward", -1); +// restore_on_demand overrides MAX_CONCURRENT_TAB_RESTORES (sessionstore constant) +// and restore_hidden_tabs. When true, tabs will not be restored until they are +// focused (also applies to tabs that aren't visible). When false, the values +// for MAX_CONCURRENT_TAB_RESTORES and restore_hidden_tabs are respected. +// Selected tabs are always restored regardless of this pref. +pref("browser.sessionstore.restore_on_demand", true); +// Whether to automatically restore hidden tabs (i.e., tabs in other tab groups) or not +pref("browser.sessionstore.restore_hidden_tabs", false); +// If restore_on_demand is set, pinned tabs are restored on startup by default. +// When set to true, this pref overrides that behavior, and pinned tabs will only +// be restored when they are focused. +pref("browser.sessionstore.restore_pinned_tabs_on_demand", false); +// The version at which we performed the latest upgrade backup +pref("browser.sessionstore.upgradeBackup.latestBuildID", ""); +// How many upgrade backups should be kept +pref("browser.sessionstore.upgradeBackup.maxUpgradeBackups", 3); +// End-users should not run sessionstore in debug mode +pref("browser.sessionstore.debug", false); +// Forget closed windows/tabs after two weeks +pref("browser.sessionstore.cleanup.forget_closed_after", 1209600000); +// Platform collects session storage data for session store +pref("browser.sessionstore.collect_session_storage", true); + +// Don't quit the browser when Ctrl + Q is pressed. +pref("browser.quitShortcut.disabled", false); + +// allow META refresh by default +pref("accessibility.blockautorefresh", false); + +// Whether history is enabled or not. +pref("places.history.enabled", true); + +// Whether or not diacritics must match in history text searches. +pref("places.search.matchDiacritics", false); + +// the (maximum) number of the recent visits to sample +// when calculating frecency +pref("places.frecency.numVisits", 10); + +// buckets (in days) for frecency calculation +pref("places.frecency.firstBucketCutoff", 4); +pref("places.frecency.secondBucketCutoff", 14); +pref("places.frecency.thirdBucketCutoff", 31); +pref("places.frecency.fourthBucketCutoff", 90); + +// weights for buckets for frecency calculations +pref("places.frecency.firstBucketWeight", 100); +pref("places.frecency.secondBucketWeight", 70); +pref("places.frecency.thirdBucketWeight", 50); +pref("places.frecency.fourthBucketWeight", 30); +pref("places.frecency.defaultBucketWeight", 10); + +// bonus (in percent) for visit transition types for frecency calculations +pref("places.frecency.embedVisitBonus", 0); +pref("places.frecency.framedLinkVisitBonus", 0); +pref("places.frecency.linkVisitBonus", 100); +pref("places.frecency.typedVisitBonus", 2000); +// The bookmarks bonus is always added on top of any other bonus, including +// the redirect source and the typed ones. +pref("places.frecency.bookmarkVisitBonus", 75); +// The redirect source bonus overwrites any transition bonus. +// 0 would hide these pages, instead we want them low ranked. Thus we use +// linkVisitBonus - bookmarkVisitBonus, so that a bookmarked source is in par +// with a common link. +pref("places.frecency.redirectSourceVisitBonus", 25); +pref("places.frecency.downloadVisitBonus", 0); +// The perm/temp redirects here relate to redirect targets, not sources. +pref("places.frecency.permRedirectVisitBonus", 50); +pref("places.frecency.tempRedirectVisitBonus", 40); +pref("places.frecency.reloadVisitBonus", 0); +pref("places.frecency.defaultVisitBonus", 0); + +// bonus (in percent) for place types for frecency calculations +pref("places.frecency.unvisitedBookmarkBonus", 140); +pref("places.frecency.unvisitedTypedBonus", 200); + +// Clear data by base domain (including partitioned storage) when the user +// selects "Forget About This Site". +pref("places.forgetThisSite.clearByBaseDomain", true); + +// Whether to warm up network connections for places: menus and places: toolbar. +pref("browser.places.speculativeConnect.enabled", true); + +// Controls behavior of the "Add Exception" dialog launched from SSL error pages +// 0 - don't pre-populate anything +// 1 - pre-populate site URL, but don't fetch certificate +// 2 - pre-populate site URL and pre-fetch certificate +pref("browser.ssl_override_behavior", 2); + +// if true, use full page zoom instead of text zoom +pref("browser.zoom.full", true); + +// Whether or not to save and restore zoom levels on a per-site basis. +pref("browser.zoom.siteSpecific", true); + +// Whether or not to update background tabs to the current zoom level. +pref("browser.zoom.updateBackgroundTabs", true); + +// The breakpad report server to link to in about:crashes +pref("breakpad.reportURL", "https://crash-stats.mozilla.org/report/index/"); + +// URL for "Learn More" for DataCollection +pref("toolkit.datacollection.infoURL", + "https://www.mozilla.org/legal/privacy/firefox.html"); + +// URL for "Learn More" for Crash Reporter +pref("toolkit.crashreporter.infoURL", + "https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter"); + +// base URL for web-based support pages +pref("app.support.baseURL", "https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/"); + +// base url for web-based feedback pages +pref("app.feedback.baseURL", "https://ideas.mozilla.org/"); + +// Name of alternate about: page for certificate errors (when undefined, defaults to about:neterror) +pref("security.alternate_certificate_error_page", "certerror"); + +pref("security.certerrors.recordEventTelemetry", true); +pref("security.certerrors.permanentOverride", true); +pref("security.certerrors.mitm.priming.enabled", true); +pref("security.certerrors.mitm.priming.endpoint", "https://mitmdetection.services.mozilla.com/"); +pref("security.certerrors.mitm.auto_enable_enterprise_roots", true); + +// Whether the bookmark panel should be shown when bookmarking a page. +pref("browser.bookmarks.editDialog.showForNewBookmarks", true); + +// Don't try to alter this pref, it'll be reset the next time you use the +// bookmarking dialog +pref("browser.bookmarks.editDialog.firstEditField", "namePicker"); + +// The number of recently selected folders in the edit bookmarks dialog. +pref("browser.bookmarks.editDialog.maxRecentFolders", 7); + +// By default the Edit Bookmark dialog is instant-apply. This feature pref will allow to +// just save on Accept, once the project is complete. +pref("browser.bookmarks.editDialog.delayedApply.enabled", false); + +#if defined(XP_WIN) && defined(MOZ_SANDBOX) + // This controls the strength of the Windows content process sandbox for + // testing purposes. This will require a restart. + // On windows these levels are: + // See - security/sandbox/win/src/sandboxbroker/sandboxBroker.cpp + // SetSecurityLevelForContentProcess() for what the different settings mean. + pref("security.sandbox.content.level", 6); +#endif + +#if defined(XP_MACOSX) && defined(MOZ_SANDBOX) + // This pref is discussed in bug 1083344, the naming is inspired from its + // Windows counterpart, but on Mac it's an integer which means: + // 0 -> "no sandbox" (nightly only) + // 1 -> "preliminary content sandboxing enabled: write access to + // home directory is prevented" + // 2 -> "preliminary content sandboxing enabled with profile protection: + // write access to home directory is prevented, read and write access + // to ~/Library and profile directories are prevented (excluding + // $PROFILE/{extensions,chrome})" + // 3 -> "no global read/write access, read access permitted to + // $PROFILE/{extensions,chrome}" + // This setting is read when the content process is started. On Mac the + // content process is killed when all windows are closed, so a change will + // take effect when the 1st window is opened. + pref("security.sandbox.content.level", 3); + + // Disconnect content processes from the window server. Depends on + // out-of-process WebGL and non-native theming. i.e., both in-process WebGL + // and native theming depend on content processes having a connection to the + // window server. Window server disconnection is automatically disabled (and + // this pref overridden) if OOP WebGL is disabled. OOP WebGL is disabled + // for some tests. + pref("security.sandbox.content.mac.disconnect-windowserver", true); +#endif + +#if defined(XP_LINUX) && defined(MOZ_SANDBOX) + // This pref is introduced as part of bug 742434, the naming is inspired from + // its Windows/Mac counterpart, but on Linux it's an integer which means: + // 0 -> "no sandbox" + // 1 -> "content sandbox using seccomp-bpf when available" + ipc restrictions + // 2 -> "seccomp-bpf + write file broker" + // 3 -> "seccomp-bpf + read/write file brokering" + // 4 -> all of the above + network/socket restrictions + chroot + // + // The purpose of this setting is to allow Linux users or distros to disable + // the sandbox while we fix their problems, or to allow running Firefox with + // exotic configurations we can't reasonably support out of the box. + // + pref("security.sandbox.content.level", 4); + // Introduced as part of bug 1608558. Linux is currently the only platform + // that uses a sandbox level for the socket process. There are currently + // only 2 levels: + // 0 -> "no sandbox" + // 1 -> "sandboxed, allows socket operations and reading necessary certs" + pref("security.sandbox.socket.process.level", 1); + pref("security.sandbox.content.write_path_whitelist", ""); + pref("security.sandbox.content.read_path_whitelist", ""); + pref("security.sandbox.content.syscall_whitelist", ""); +#endif + +#if defined(XP_OPENBSD) && defined(MOZ_SANDBOX) + pref("security.sandbox.content.level", 1); +#endif + +#if defined(MOZ_SANDBOX) + // ID (a UUID when set by gecko) that is used to form the name of a + // sandbox-writable temporary directory to be used by content processes + // when a temporary writable file is required in a level 1 sandbox. + pref("security.sandbox.content.tempDirSuffix", ""); + pref("security.sandbox.plugin.tempDirSuffix", ""); + + // This pref determines if messages relevant to sandbox violations are + // logged. + #if defined(XP_WIN) || defined(XP_MACOSX) + pref("security.sandbox.logging.enabled", false); + #endif +#endif + +// This pref governs whether we attempt to work around problems caused by +// plugins using OS calls to manipulate the cursor while running out-of- +// process. These workarounds all involve intercepting (hooking) certain +// OS calls in the plugin process, then arranging to make certain OS calls +// in the browser process. Eventually plugins will be required to use the +// NPAPI to manipulate the cursor, and these workarounds will be removed. +// See bug 621117. +#ifdef XP_MACOSX + pref("dom.ipc.plugins.nativeCursorSupport", true); +#endif + +#ifdef XP_WIN + pref("browser.taskbar.previews.enable", false); + pref("browser.taskbar.previews.max", 20); + pref("browser.taskbar.previews.cachetime", 5); + pref("browser.taskbar.lists.enabled", true); + pref("browser.taskbar.lists.frequent.enabled", true); + pref("browser.taskbar.lists.recent.enabled", false); + pref("browser.taskbar.lists.maxListItemCount", 7); + pref("browser.taskbar.lists.tasks.enabled", true); + pref("browser.taskbar.lists.refreshInSeconds", 120); +#endif + +// Preferences to be synced by default. +// Preferences with the prefix `services.sync.prefs.sync-seen.` should have +// a value of `false`, and means the value of the pref will be synced as soon +// as a value for the pref is "seen", even if it is the default, and should be +// used for prefs we sync but which have different values on different channels, +// platforms or distributions. +pref("services.sync.prefs.sync.accessibility.blockautorefresh", true); +pref("services.sync.prefs.sync.accessibility.browsewithcaret", true); +pref("services.sync.prefs.sync.accessibility.typeaheadfind", true); +pref("services.sync.prefs.sync.accessibility.typeaheadfind.linksonly", true); +pref("services.sync.prefs.sync.addons.ignoreUserEnabledChanges", true); +pref("services.sync.prefs.sync.app.shield.optoutstudies.enabled", true); +// The addons prefs related to repository verification are intentionally +// not synced for security reasons. If a system is compromised, a user +// could weaken the pref locally, install an add-on from an untrusted +// source, and this would propagate automatically to other, +// uncompromised Sync-connected devices. +pref("services.sync.prefs.sync.browser.contentblocking.category", true); +pref("services.sync.prefs.sync.browser.contentblocking.features.strict", true); +pref("services.sync.prefs.sync.browser.crashReports.unsubmittedCheck.autoSubmit2", true); +pref("services.sync.prefs.sync.browser.ctrlTab.sortByRecentlyUsed", true); +pref("services.sync.prefs.sync.browser.discovery.enabled", true); +pref("services.sync.prefs.sync.browser.download.useDownloadDir", true); +pref("services.sync.prefs.sync.browser.firefox-view.feature-tour", true); +pref("services.sync.prefs.sync.browser.formfill.enable", true); +pref("services.sync.prefs.sync.browser.link.open_newwindow", true); +pref("services.sync.prefs.sync.browser.menu.showViewImageInfo", true); +pref("services.sync.prefs.sync.browser.newtabpage.activity-stream.asrouter.userprefs.cfr.addons", true); +pref("services.sync.prefs.sync.browser.newtabpage.activity-stream.asrouter.userprefs.cfr.features", true); +pref("services.sync.prefs.sync.browser.newtabpage.activity-stream.showSearch", true); +pref("services.sync.prefs.sync.browser.newtabpage.activity-stream.showSponsored", true); +pref("services.sync.prefs.sync.browser.newtabpage.activity-stream.showSponsoredTopSites", true); +pref("services.sync.prefs.sync.browser.newtabpage.activity-stream.feeds.topsites", true); +pref("services.sync.prefs.sync.browser.newtabpage.activity-stream.topSitesRows", true); +pref("services.sync.prefs.sync.browser.newtabpage.activity-stream.feeds.snippets", true); +pref("services.sync.prefs.sync.browser.newtabpage.activity-stream.feeds.section.topstories", true); +pref("services.sync.prefs.sync.browser.newtabpage.activity-stream.section.topstories.rows", true); +pref("services.sync.prefs.sync.browser.newtabpage.activity-stream.feeds.section.highlights", true); +// Some linux distributions disable all highlights by default. +pref("services.sync.prefs.sync-seen.browser.newtabpage.activity-stream.section.highlights", false); +pref("services.sync.prefs.sync.browser.newtabpage.activity-stream.section.highlights.includeVisited", true); +pref("services.sync.prefs.sync.browser.newtabpage.activity-stream.section.highlights.includeBookmarks", true); +pref("services.sync.prefs.sync.browser.newtabpage.activity-stream.section.highlights.includeDownloads", true); +pref("services.sync.prefs.sync.browser.newtabpage.activity-stream.section.highlights.includePocket", true); +// Some linux distributions disable just pocket by default. +pref("services.sync.prefs.sync-seen.browser.newtabpage.activity-stream.section.highlights.includePocket", false); +pref("services.sync.prefs.sync.browser.newtabpage.activity-stream.section.highlights.rows", true); +pref("services.sync.prefs.sync.browser.newtabpage.enabled", true); +pref("services.sync.prefs.sync.browser.newtabpage.pinned", true); +pref("services.sync.prefs.sync.browser.offline-apps.notify", true); +pref("services.sync.prefs.sync.browser.pdfjs.feature-tour", true); +pref("services.sync.prefs.sync.browser.safebrowsing.downloads.enabled", true); +pref("services.sync.prefs.sync.browser.safebrowsing.downloads.remote.block_potentially_unwanted", true); +pref("services.sync.prefs.sync.browser.safebrowsing.malware.enabled", true); +pref("services.sync.prefs.sync.browser.safebrowsing.phishing.enabled", true); +pref("services.sync.prefs.sync.browser.search.update", true); +pref("services.sync.prefs.sync.browser.search.widget.inNavBar", true); +pref("services.sync.prefs.sync.browser.startup.homepage", true); +pref("services.sync.prefs.sync.browser.startup.page", true); +pref("services.sync.prefs.sync.browser.tabs.loadInBackground", true); +pref("services.sync.prefs.sync.browser.tabs.warnOnClose", true); +pref("services.sync.prefs.sync.browser.tabs.warnOnOpen", true); +pref("services.sync.prefs.sync.browser.taskbar.previews.enable", true); +pref("services.sync.prefs.sync.browser.urlbar.maxRichResults", true); +pref("services.sync.prefs.sync.browser.urlbar.showSearchSuggestionsFirst", true); +pref("services.sync.prefs.sync.browser.urlbar.suggest.bookmark", true); +pref("services.sync.prefs.sync.browser.urlbar.suggest.history", true); +pref("services.sync.prefs.sync.browser.urlbar.suggest.openpage", true); +pref("services.sync.prefs.sync.browser.urlbar.suggest.searches", true); +pref("services.sync.prefs.sync.browser.urlbar.suggest.topsites", true); +pref("services.sync.prefs.sync.browser.urlbar.suggest.engines", true); +pref("services.sync.prefs.sync.dom.disable_open_during_load", true); +pref("services.sync.prefs.sync.dom.disable_window_flip", true); +pref("services.sync.prefs.sync.dom.disable_window_move_resize", true); +pref("services.sync.prefs.sync.dom.event.contextmenu.enabled", true); +pref("services.sync.prefs.sync.dom.security.https_only_mode", true); +pref("services.sync.prefs.sync.dom.security.https_only_mode_ever_enabled", true); +pref("services.sync.prefs.sync.dom.security.https_only_mode_ever_enabled_pbm", true); +pref("services.sync.prefs.sync.dom.security.https_only_mode_pbm", true); +pref("services.sync.prefs.sync.extensions.update.enabled", true); +pref("services.sync.prefs.sync.extensions.activeThemeID", true); +pref("services.sync.prefs.sync.general.autoScroll", true); +// general.autoScroll has a different default on Linux vs elsewhere. +pref("services.sync.prefs.sync-seen.general.autoScroll", false); +pref("services.sync.prefs.sync.general.smoothScroll", true); +pref("services.sync.prefs.sync.intl.accept_languages", true); +pref("services.sync.prefs.sync.intl.regional_prefs.use_os_locales", true); +pref("services.sync.prefs.sync.layout.spellcheckDefault", true); +pref("services.sync.prefs.sync.media.autoplay.default", true); +pref("services.sync.prefs.sync.media.eme.enabled", true); +// Some linux distributions disable eme by default. +pref("services.sync.prefs.sync-seen.media.eme.enabled", false); +pref("services.sync.prefs.sync.media.videocontrols.picture-in-picture.video-toggle.enabled", true); +pref("services.sync.prefs.sync.network.cookie.cookieBehavior", true); +pref("services.sync.prefs.sync.network.cookie.thirdparty.sessionOnly", true); +pref("services.sync.prefs.sync.permissions.default.image", true); +pref("services.sync.prefs.sync.pref.downloads.disable_button.edit_actions", true); +pref("services.sync.prefs.sync.pref.privacy.disable_button.cookie_exceptions", true); +pref("services.sync.prefs.sync.privacy.clearOnShutdown.cache", true); +pref("services.sync.prefs.sync.privacy.clearOnShutdown.cookies", true); +pref("services.sync.prefs.sync.privacy.clearOnShutdown.downloads", true); +pref("services.sync.prefs.sync.privacy.clearOnShutdown.formdata", true); +pref("services.sync.prefs.sync.privacy.clearOnShutdown.history", true); +pref("services.sync.prefs.sync.privacy.clearOnShutdown.offlineApps", true); +pref("services.sync.prefs.sync.privacy.clearOnShutdown.sessions", true); +pref("services.sync.prefs.sync.privacy.clearOnShutdown.siteSettings", true); +pref("services.sync.prefs.sync.privacy.donottrackheader.enabled", true); +pref("services.sync.prefs.sync.privacy.sanitize.sanitizeOnShutdown", true); +pref("services.sync.prefs.sync.privacy.trackingprotection.enabled", true); +pref("services.sync.prefs.sync.privacy.trackingprotection.cryptomining.enabled", true); +pref("services.sync.prefs.sync.privacy.trackingprotection.fingerprinting.enabled", true); +pref("services.sync.prefs.sync.privacy.trackingprotection.pbmode.enabled", true); +// We do not sync `privacy.resistFingerprinting` by default as it's an undocumented, +// not-recommended footgun - see bug 1763278 for more. +pref("services.sync.prefs.sync.privacy.reduceTimerPrecision", true); +pref("services.sync.prefs.sync.privacy.resistFingerprinting.reduceTimerPrecision.microseconds", true); +pref("services.sync.prefs.sync.privacy.resistFingerprinting.reduceTimerPrecision.jitter", true); +pref("services.sync.prefs.sync.privacy.userContext.enabled", true); +pref("services.sync.prefs.sync.privacy.userContext.newTabContainerOnLeftClick.enabled", true); +pref("services.sync.prefs.sync.security.default_personal_cert", true); +pref("services.sync.prefs.sync.services.sync.syncedTabs.showRemoteIcons", true); +pref("services.sync.prefs.sync.signon.autofillForms", true); +pref("services.sync.prefs.sync.signon.generation.enabled", true); +pref("services.sync.prefs.sync.signon.management.page.breach-alerts.enabled", true); +pref("services.sync.prefs.sync.signon.rememberSignons", true); +pref("services.sync.prefs.sync.spellchecker.dictionary", true); +pref("services.sync.prefs.sync.ui.osk.enabled", true); + +// A preference which, if false, means sync will only apply incoming preference +// changes if there's already a local services.sync.prefs.sync.* control pref. +// If true, all incoming preferences will be applied and the local "control +// pref" updated accordingly. +pref("services.sync.prefs.dangerously_allow_arbitrary", false); + +// A preference that controls whether we should show the icon for a remote tab. +// This pref has no UI but exists because some people may be concerned that +// fetching these icons to show remote tabs may leak information about that +// user's tabs and bookmarks. Note this pref is also synced. +pref("services.sync.syncedTabs.showRemoteIcons", true); + +// A preference (in milliseconds) controlling if we sync after a tab change and +// how long to delay before we schedule the sync +// Anything <= 0 means disabled +pref("services.sync.syncedTabs.syncDelayAfterTabChange", 5000); + +// Whether the character encoding menu is under the main Firefox button. This +// preference is a string so that localizers can alter it. +pref("browser.menu.showCharacterEncoding", "chrome://browser/locale/browser.properties"); + +// Whether prompts should be content modal (1) tab modal (2) or window modal(3) by default +// This is a fallback value for when prompt callers do not specify a modalType. +pref("prompts.defaultModalType", 3); + +pref("browser.topsites.useRemoteSetting", true); +// Fetch sponsored Top Sites from Mozilla Tiles Service (Contile) +pref("browser.topsites.contile.enabled", true); +pref("browser.topsites.contile.endpoint", "https://contile.services.mozilla.com/v1/tiles"); + +// The base URL for the Quick Suggest anonymizing proxy. To make a request to +// the proxy, include a campaign ID in the path. +pref("browser.partnerlink.attributionURL", "https://topsites.services.mozilla.com/cid/"); +pref("browser.partnerlink.campaign.topsites", "amzn_2020_a1"); + +// Whether to show tab level system prompts opened via nsIPrompt(Service) as +// SubDialogs in the TabDialogBox (true) or as TabModalPrompt in the +// TabModalPromptBox (false). +pref("prompts.tabChromePromptSubDialog", true); + +// Whether to show the dialogs opened at the content level, such as +// alert() or prompt(), using a SubDialogManager in the TabDialogBox. +pref("prompts.contentPromptSubDialog", true); + +// Whether to show window-modal dialogs opened for browser windows +// in a SubDialog inside their parent, instead of an OS level window. +pref("prompts.windowPromptSubDialog", true); + +// Activates preloading of the new tab url. +pref("browser.newtab.preload", true); + +pref("browser.newtabpage.activity-stream.newNewtabExperience.colors", "#0090ED,#FF4F5F,#2AC3A2,#FF7139,#A172FF,#FFA437,#FF2A8A"); + +// Activity Stream prefs that control to which page to redirect +#ifndef RELEASE_OR_BETA + pref("browser.newtabpage.activity-stream.debug", false); +#endif + +// The remote FxA root content URL for the Activity Stream firstrun page. +pref("browser.newtabpage.activity-stream.fxaccounts.endpoint", "https://accounts.firefox.com/"); + +// The pref that controls if the search shortcuts experiment is on +pref("browser.newtabpage.activity-stream.improvesearch.topSiteSearchShortcuts", true); + +// ASRouter provider configuration +pref("browser.newtabpage.activity-stream.asrouter.providers.cfr", "{\"id\":\"cfr\",\"enabled\":true,\"type\":\"remote-settings\",\"collection\":\"cfr\",\"updateCycleInMs\":3600000}"); +pref("browser.newtabpage.activity-stream.asrouter.providers.whats-new-panel", "{\"id\":\"whats-new-panel\",\"enabled\":true,\"type\":\"remote-settings\",\"collection\":\"whats-new-panel\",\"updateCycleInMs\":3600000}"); +pref("browser.newtabpage.activity-stream.asrouter.providers.message-groups", "{\"id\":\"message-groups\",\"enabled\":true,\"type\":\"remote-settings\",\"collection\":\"message-groups\",\"updateCycleInMs\":3600000}"); +// This url, if changed, MUST continue to point to an https url. Pulling arbitrary content to inject into +// this page over http opens us up to a man-in-the-middle attack that we'd rather not face. If you are a downstream +// repackager of this code using an alternate snippet url, please keep your users safe +pref("browser.newtabpage.activity-stream.asrouter.providers.snippets", "{\"id\":\"snippets\",\"enabled\":false,\"type\":\"remote\",\"url\":\"https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VERSION%/%DISTRIBUTION%/%DISTRIBUTION_VERSION%/\",\"updateCycleInMs\":14400000}"); +pref("browser.newtabpage.activity-stream.asrouter.providers.messaging-experiments", "{\"id\":\"messaging-experiments\",\"enabled\":true,\"type\":\"remote-experiments\",\"updateCycleInMs\":3600000}"); + +// ASRouter user prefs +pref("browser.newtabpage.activity-stream.asrouter.userprefs.cfr.addons", true); +pref("browser.newtabpage.activity-stream.asrouter.userprefs.cfr.features", true); + +// The pref that controls if ASRouter uses the remote fluent files. +// It's enabled by default, but could be disabled to force ASRouter to use the local files. +pref("browser.newtabpage.activity-stream.asrouter.useRemoteL10n", true); + +// These prefs control if Discovery Stream is enabled. +pref("browser.newtabpage.activity-stream.discoverystream.enabled", true); +pref("browser.newtabpage.activity-stream.discoverystream.hardcoded-basic-layout", false); +pref("browser.newtabpage.activity-stream.discoverystream.hybridLayout.enabled", false); +pref("browser.newtabpage.activity-stream.discoverystream.hideCardBackground.enabled", false); +pref("browser.newtabpage.activity-stream.discoverystream.fourCardLayout.enabled", false); +pref("browser.newtabpage.activity-stream.discoverystream.newFooterSection.enabled", false); +pref("browser.newtabpage.activity-stream.discoverystream.saveToPocketCard.enabled", false); +pref("browser.newtabpage.activity-stream.discoverystream.saveToPocketCardRegions", ""); +pref("browser.newtabpage.activity-stream.discoverystream.hideDescriptions.enabled", false); +pref("browser.newtabpage.activity-stream.discoverystream.hideDescriptionsRegions", ""); +pref("browser.newtabpage.activity-stream.discoverystream.compactGrid.enabled", false); +pref("browser.newtabpage.activity-stream.discoverystream.compactImages.enabled", false); +pref("browser.newtabpage.activity-stream.discoverystream.imageGradient.enabled", false); +pref("browser.newtabpage.activity-stream.discoverystream.titleLines", 3); +pref("browser.newtabpage.activity-stream.discoverystream.descLines", 3); +pref("browser.newtabpage.activity-stream.discoverystream.readTime.enabled", true); +pref("browser.newtabpage.activity-stream.discoverystream.newSponsoredLabel.enabled", false); +pref("browser.newtabpage.activity-stream.discoverystream.essentialReadsHeader.enabled", false); +pref("browser.newtabpage.activity-stream.discoverystream.recentSaves.enabled", false); +pref("browser.newtabpage.activity-stream.discoverystream.editorsPicksHeader.enabled", false); +pref("browser.newtabpage.activity-stream.discoverystream.spoc-positions", "1,5,7,11,18,20"); +pref("browser.newtabpage.activity-stream.discoverystream.widget-positions", ""); + +pref("browser.newtabpage.activity-stream.discoverystream.spocs-endpoint", ""); +pref("browser.newtabpage.activity-stream.discoverystream.spocs-endpoint-query", ""); +pref("browser.newtabpage.activity-stream.discoverystream.sponsored-collections.enabled", false); + +// Changes the spoc content. +pref("browser.newtabpage.activity-stream.discoverystream.spocAdTypes", ""); +pref("browser.newtabpage.activity-stream.discoverystream.spocZoneIds", ""); +pref("browser.newtabpage.activity-stream.discoverystream.spocTopsitesAdTypes", ""); +pref("browser.newtabpage.activity-stream.discoverystream.spocTopsitesZoneIds", ""); +pref("browser.newtabpage.activity-stream.discoverystream.spocSiteId", ""); + +pref("browser.newtabpage.activity-stream.discoverystream.sendToPocket.enabled", false); + +// List of regions that do not get stories, regardless of locale-list-config. +pref("browser.newtabpage.activity-stream.discoverystream.region-stories-block", "FR"); +// List of locales that get stories, regardless of region-stories-config. +#ifdef NIGHTLY_BUILD + pref("browser.newtabpage.activity-stream.discoverystream.locale-list-config", "en-US,en-CA,en-GB"); +#else + pref("browser.newtabpage.activity-stream.discoverystream.locale-list-config", ""); +#endif +// List of regions that get stories by default. +pref("browser.newtabpage.activity-stream.discoverystream.region-stories-config", "US,DE,CA,GB,IE,CH,AT,BE,IN"); + +// List of regions that get spocs by default. +pref("browser.newtabpage.activity-stream.discoverystream.region-spocs-config", "US,CA,DE,GB"); +// List of regions that don't get the 7 row layout. +pref("browser.newtabpage.activity-stream.discoverystream.region-basic-config", ""); + +// Allows Pocket story collections to be dismissed. +pref("browser.newtabpage.activity-stream.discoverystream.isCollectionDismissible", true); +pref("browser.newtabpage.activity-stream.discoverystream.personalization.enabled", true); +// Configurable keys used by personalization. +pref("browser.newtabpage.activity-stream.discoverystream.personalization.modelKeys", "nb_model_arts_and_entertainment, nb_model_autos_and_vehicles, nb_model_beauty_and_fitness, nb_model_blogging_resources_and_services, nb_model_books_and_literature, nb_model_business_and_industrial, nb_model_computers_and_electronics, nb_model_finance, nb_model_food_and_drink, nb_model_games, nb_model_health, nb_model_hobbies_and_leisure, nb_model_home_and_garden, nb_model_internet_and_telecom, nb_model_jobs_and_education, nb_model_law_and_government, nb_model_online_communities, nb_model_people_and_society, nb_model_pets_and_animals, nb_model_real_estate, nb_model_reference, nb_model_science, nb_model_shopping, nb_model_sports, nb_model_travel"); +// System pref to allow Pocket stories personalization to be turned on/off. +pref("browser.newtabpage.activity-stream.discoverystream.recs.personalized", false); +// System pref to allow Pocket sponsored content personalization to be turned on/off. +pref("browser.newtabpage.activity-stream.discoverystream.spocs.personalized", true); + +// User pref to show stories on newtab (feeds.system.topstories has to be set to true as well) +pref("browser.newtabpage.activity-stream.feeds.section.topstories", true); + +// The pref controls if search hand-off is enabled for Activity Stream. +pref("browser.newtabpage.activity-stream.improvesearch.handoffToAwesomebar", true); + +pref("browser.newtabpage.activity-stream.logowordmark.alwaysVisible", true); + +// URLs from the user's history that contain this search param will be hidden +// from the top sites. The value is a string with one of the following forms: +// - "" (empty) - Disable this feature +// - "key" - Search param named "key" with any or no value +// - "key=" - Search param named "key" with no value +// - "key=value" - Search param named "key" with value "value" +pref("browser.newtabpage.activity-stream.hideTopSitesWithSearchParam", "mfadid=adm"); + +// Used to display triplet cards on newtab +pref("trailhead.firstrun.newtab.triplets", ""); +// Separate about welcome +pref("browser.aboutwelcome.enabled", true); +// Used to set multistage welcome UX +pref("browser.aboutwelcome.screens", ""); +pref("browser.aboutwelcome.skipFocus", true); +// Used to enable template for MR 2022 Onboarding +pref("browser.aboutwelcome.templateMR", true); +// Used to enable window modal onboarding +pref("browser.aboutwelcome.showModal", false); + +// The pref that controls if the What's New panel is enabled. +pref("browser.messaging-system.whatsNewPanel.enabled", true); + +// Experiment Manager +// See Console.sys.mjs LOG_LEVELS for all possible values +pref("messaging-system.log", "warn"); +pref("messaging-system.rsexperimentloader.enabled", true); +pref("messaging-system.rsexperimentloader.collection_id", "nimbus-desktop-experiments"); +pref("nimbus.debug", false); +pref("nimbus.validation.enabled", true); + +// Nimbus QA prefs. Used to monitor pref-setting test experiments. +pref("nimbus.qa.pref-1", "default"); +pref("nimbus.qa.pref-2", "default"); + +// Enable the DOM fullscreen API. +pref("full-screen-api.enabled", true); + +// Startup Crash Tracking +// number of startup crashes that can occur before starting into safe mode automatically +// (this pref has no effect if more than 6 hours have passed since the last crash) +pref("toolkit.startup.max_resumed_crashes", 3); + +// Whether to use RegisterApplicationRestart to restart the browser and resume +// the session on next Windows startup +#if defined(XP_WIN) + pref("toolkit.winRegisterApplicationRestart", true); +#endif + +// Used by pdf.js to know the first time firefox is run with it installed so it +// can become the default pdf viewer. +pref("pdfjs.firstRun", true); +// The values of preferredAction and alwaysAskBeforeHandling before pdf.js +// became the default. +pref("pdfjs.previousHandler.preferredAction", 0); +pref("pdfjs.previousHandler.alwaysAskBeforeHandling", false); + +// Try to convert PDFs sent as octet-stream +pref("pdfjs.handleOctetStream", true); + +// Is the sidebar positioned ahead of the content browser +pref("sidebar.position_start", true); + +pref("security.identitypopup.recordEventTelemetry", true); +pref("security.protectionspopup.recordEventTelemetry", true); +pref("security.app_menu.recordEventTelemetry", true); + +// Block insecure active content on https pages +pref("security.mixed_content.block_active_content", true); + +// Show degraded UI for http pages. +pref("security.insecure_connection_icon.enabled", true); +// Show degraded UI for http pages in private mode. +pref("security.insecure_connection_icon.pbmode.enabled", true); + +// Show "Not Secure" text for http pages; disabled for now +pref("security.insecure_connection_text.enabled", false); +pref("security.insecure_connection_text.pbmode.enabled", false); + +// 1 = allow MITM for certificate pinning checks. +pref("security.cert_pinning.enforcement_level", 1); + + +// If this turns true, Moz*Gesture events are not called stopPropagation() +// before content. +pref("dom.debug.propagate_gesture_events_through_content", false); + +// CustomizableUI debug logging. +pref("browser.uiCustomization.debug", false); + +// CustomizableUI state of the browser's user interface +pref("browser.uiCustomization.state", ""); + +// If set to false, FxAccounts and Sync will be unavailable. +// A restart is mandatory after flipping that preference. +pref("identity.fxaccounts.enabled", true); + +// The remote FxA root content URL. Must use HTTPS. +pref("identity.fxaccounts.remote.root", "https://accounts.firefox.com/"); + +// The value of the context query parameter passed in fxa requests. +pref("identity.fxaccounts.contextParam", "fx_desktop_v3"); + +// The remote URL of the FxA Profile Server +pref("identity.fxaccounts.remote.profile.uri", "https://profile.accounts.firefox.com/v1"); + +// The remote URL of the FxA OAuth Server +pref("identity.fxaccounts.remote.oauth.uri", "https://oauth.accounts.firefox.com/v1"); + +// Whether FxA pairing using QR codes is enabled. +pref("identity.fxaccounts.pairing.enabled", true); + +// The remote URI of the FxA pairing server +pref("identity.fxaccounts.remote.pairing.uri", "wss://channelserver.services.mozilla.com"); + +// Token server used by the FxA Sync identity. +pref("identity.sync.tokenserver.uri", "https://token.services.mozilla.com/1.0/sync/1.5"); + +// Auto-config URL for FxA self-hosters, makes an HTTP request to +// [identity.fxaccounts.autoconfig.uri]/.well-known/fxa-client-configuration +// This is now the prefered way of pointing to a custom FxA server, instead +// of making changes to "identity.fxaccounts.*.uri". +pref("identity.fxaccounts.autoconfig.uri", ""); + +// URL for help link about Send Tab. +pref("identity.sendtabpromo.url", "https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab"); + +// URLs for promo links to mobile browsers. Note that consumers are expected to +// append a value for utm_campaign. +pref("identity.mobilepromo.android", "https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign="); +pref("identity.mobilepromo.ios", "https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign="); + +// Migrate any existing Firefox Account data from the default profile to the +// Developer Edition profile. +#ifdef MOZ_DEV_EDITION + pref("identity.fxaccounts.migrateToDevEdition", true); +#else + pref("identity.fxaccounts.migrateToDevEdition", false); +#endif + +// If activated, send tab will use the new FxA commands backend. +pref("identity.fxaccounts.commands.enabled", true); +// How often should we try to fetch missed FxA commands on sync (in seconds). +// Default is 24 hours. +pref("identity.fxaccounts.commands.missed.fetch_interval", 86400); + +// Whether we should run a test-pattern through EME GMPs before assuming they'll +// decode H.264. +pref("media.gmp.trial-create.enabled", true); + +// Note: when media.gmp-*.visible is true, provided we're running on a +// supported platform/OS version, the corresponding CDM appears in the +// plugins list, Firefox will download the GMP/CDM if enabled, and our +// UI to re-enable EME prompts the user to re-enable EME if it's disabled +// and script requests EME. If *.visible is false, we won't show the UI +// to enable the CDM if its disabled; it's as if the keysystem is completely +// unsupported. + +#ifdef MOZ_WIDEVINE_EME + pref("media.gmp-widevinecdm.visible", true); + pref("media.gmp-widevinecdm.enabled", true); +#endif + +pref("media.gmp-gmpopenh264.visible", true); +pref("media.gmp-gmpopenh264.enabled", true); + +// Block WebAudio from playing automatically. +pref("media.autoplay.block-webaudio", true); + +pref("media.videocontrols.picture-in-picture.enabled", true); +pref("media.videocontrols.picture-in-picture.audio-toggle.enabled", true); +pref("media.videocontrols.picture-in-picture.video-toggle.enabled", true); +pref("media.videocontrols.picture-in-picture.video-toggle.visibility-threshold", "1.0"); +pref("media.videocontrols.picture-in-picture.keyboard-controls.enabled", true); + +pref("browser.translation.detectLanguage", false); +pref("browser.translation.neverForLanguages", ""); +// Show the translation UI bits, like the info bar, notification icon and preferences. +pref("browser.translation.ui.show", false); +// Allows to define the translation engine. Google is default, Bing or Yandex are other options. +pref("browser.translation.engine", "Google"); + +// Telemetry settings. +// Determines if Telemetry pings can be archived locally. +pref("toolkit.telemetry.archive.enabled", true); +// Enables sending the shutdown ping when Firefox shuts down. +pref("toolkit.telemetry.shutdownPingSender.enabled", true); +// Enables using the `pingsender` background task. +pref("toolkit.telemetry.shutdownPingSender.backgroundtask.enabled", false); +// Enables sending the shutdown ping using the pingsender from the first session. +pref("toolkit.telemetry.shutdownPingSender.enabledFirstSession", false); +// Enables sending a duplicate of the first shutdown ping from the first session. +pref("toolkit.telemetry.firstShutdownPing.enabled", true); +// Enables sending the 'new-profile' ping on new profiles. +pref("toolkit.telemetry.newProfilePing.enabled", true); +// Enables sending 'update' pings on Firefox updates. +pref("toolkit.telemetry.updatePing.enabled", true); +// Enables sending 'bhr' pings when the browser hangs. +pref("toolkit.telemetry.bhrPing.enabled", true); + +// Ping Centre Telemetry settings. +pref("browser.ping-centre.telemetry", true); +pref("browser.ping-centre.log", false); + +// Enable GMP support in the addon manager. +pref("media.gmp-provider.enabled", true); + +// Enable Dynamic First-Party Isolation by default. +pref("network.cookie.cookieBehavior", 5 /* BEHAVIOR_REJECT_TRACKER_AND_PARTITION_FOREIGN */); + +// Target URL for the learn more link of the TCP in standard mode section. +pref("privacy.restrict3rdpartystorage.preferences.learnMoreURLSuffix", "total-cookie-protection"); + +// Enable Dynamic First-Party Isolation in the private browsing mode. +pref("network.cookie.cookieBehavior.pbmode", 5 /* BEHAVIOR_REJECT_TRACKER_AND_PARTITION_FOREIGN */); + +// Enable fingerprinting blocking by default for all channels, only on desktop. +pref("privacy.trackingprotection.fingerprinting.enabled", true); + +// Enable cryptomining blocking by default for all channels, only on desktop. +pref("privacy.trackingprotection.cryptomining.enabled", true); + +pref("browser.contentblocking.database.enabled", true); + +pref("dom.storage_access.enabled", true); + +// Enable URL query stripping in Nightly. +#ifdef NIGHTLY_BUILD +pref("privacy.query_stripping.enabled", true); +#endif + +pref("browser.contentblocking.cryptomining.preferences.ui.enabled", true); +pref("browser.contentblocking.fingerprinting.preferences.ui.enabled", true); +// Enable cookieBehavior = BEHAVIOR_REJECT_TRACKER_AND_PARTITION_FOREIGN as an option in the custom category ui +pref("browser.contentblocking.reject-and-isolate-cookies.preferences.ui.enabled", true); + +// Possible values for browser.contentblocking.features.strict pref: +// Tracking Protection: +// "tp": tracking protection enabled +// "-tp": tracking protection disabled +// Tracking Protection in private windows: +// "tpPrivate": tracking protection in private windows enabled +// "-tpPrivate": tracking protection in private windows disabled +// Fingerprinting: +// "fp": fingerprinting blocking enabled +// "-fp": fingerprinting blocking disabled +// Cryptomining: +// "cm": cryptomining blocking enabled +// "-cm": cryptomining blocking disabled +// Social Tracking Protection: +// "stp": social tracking protection enabled +// "-stp": social tracking protection disabled +// Level 2 Tracking list in normal windows: +// "lvl2": Level 2 tracking list enabled +// "-lvl2": Level 2 tracking list disabled +// Level 2 Tracking list in private windows: +// "lvl2PBM": Level 2 tracking list enabled +// "-lvl2PBM": Level 2 tracking list disabled +// Restrict relaxing default referrer policy: +// "rp": Restrict relaxing default referrer policy enabled +// "-rp": Restrict relaxing default referrer policy disabled +// Restrict relaxing default referrer policy for top navigation: +// "rpTop": Restrict relaxing default referrer policy enabled +// "-rpTop": Restrict relaxing default referrer policy disabled +// OCSP cache partitioning: +// "ocsp": OCSP cache partitioning enabled +// "-ocsp": OCSP cache partitioning disabled +// Query parameter stripping: +// "qps": Query parameter stripping enabled +// "-qps": Query parameter stripping disabled +// Query parameter stripping for private windows: +// "qpsPBM": Query parameter stripping enabled in private windows +// "-qpsPBM": Query parameter stripping disabled in private windows +// Cookie behavior: +// "cookieBehavior0": cookie behaviour BEHAVIOR_ACCEPT +// "cookieBehavior1": cookie behaviour BEHAVIOR_REJECT_FOREIGN +// "cookieBehavior2": cookie behaviour BEHAVIOR_REJECT +// "cookieBehavior3": cookie behaviour BEHAVIOR_LIMIT_FOREIGN +// "cookieBehavior4": cookie behaviour BEHAVIOR_REJECT_TRACKER +// "cookieBehavior5": cookie behaviour BEHAVIOR_REJECT_TRACKER_AND_PARTITION_FOREIGN +// Cookie behavior for private windows: +// "cookieBehaviorPBM0": cookie behaviour BEHAVIOR_ACCEPT +// "cookieBehaviorPBM1": cookie behaviour BEHAVIOR_REJECT_FOREIGN +// "cookieBehaviorPBM2": cookie behaviour BEHAVIOR_REJECT +// "cookieBehaviorPBM3": cookie behaviour BEHAVIOR_LIMIT_FOREIGN +// "cookieBehaviorPBM4": cookie behaviour BEHAVIOR_REJECT_TRACKER +// "cookieBehaviorPBM5": cookie behaviour BEHAVIOR_REJECT_TRACKER_AND_PARTITION_FOREIGN +// One value from each section must be included in the browser.contentblocking.features.strict pref. +pref("browser.contentblocking.features.strict", "tp,tpPrivate,cookieBehavior5,cookieBehaviorPBM5,cm,fp,stp,lvl2,lvl2PBM,rp,rpTop,ocsp,qps,qpsPBM"); + +// Hide the "Change Block List" link for trackers/tracking content in the custom +// Content Blocking/ETP panel. By default, it will not be visible. There is also +// an UI migration in place to set this pref to true if a user has a custom block +// lists enabled. +pref("browser.contentblocking.customBlockList.preferences.ui.enabled", false); + +pref("browser.contentblocking.reportBreakage.url", "https://tracking-protection-issues.herokuapp.com/new"); + +// Enable Protections report's Lockwise card by default. +pref("browser.contentblocking.report.lockwise.enabled", true); + +// Enable Protections report's Monitor card by default. +pref("browser.contentblocking.report.monitor.enabled", true); + +// Disable Protections report's Proxy card by default. +pref("browser.contentblocking.report.proxy.enabled", false); + +// Disable the mobile promotion by default. +pref("browser.contentblocking.report.show_mobile_app", true); + +// Locales in which Send to Device emails are supported +// The most recent list of supported locales can be found at https://github.com/mozilla/bedrock/blob/6a08c876f65924651554decc57b849c00874b4e7/bedrock/settings/base.py#L963 +pref("browser.send_to_device_locales", "de,en-GB,en-US,es-AR,es-CL,es-ES,es-MX,fr,id,pl,pt-BR,ru,zh-TW"); + +// Avoid advertising in certain regions. Comma separated string of two letter ISO 3166-1 country codes. +// We're currently blocking all of Ukraine (ua), but would prefer to block just Crimea (ua-43). Currently, the Mozilla Location Service APIs used by Region.sys.mjs only exposes the country, not the subdivision. +pref("browser.vpn_promo.disallowed_regions", "ae,by,cn,cu,iq,ir,kp,om,ru,sd,sy,tm,tr,ua"); + +// Default to enabling VPN promo messages to be shown when specified and allowed +pref("browser.vpn_promo.enabled", true); +// Only show vpn card to certain regions. Comma separated string of two letter ISO 3166-1 country codes. +// The most recent list of supported countries can be found at https://support.mozilla.org/en-US/kb/mozilla-vpn-countries-available-subscribe +// The full list of supported country codes can also be found at https://github.com/mozilla/bedrock/search?q=VPN_COUNTRY_CODES +pref("browser.contentblocking.report.vpn_regions", "as,at,be,ca,ch,de,es,fi,fr,gb,gg,ie,im,io,it,je,mp,my,nl,nz,pr,se,sg,uk,um,us,vg,vi" +); + +// Avoid advertising Focus in certain regions. Comma separated string of two letter +// ISO 3166-1 country codes. +pref("browser.promo.focus.disallowed_regions", "cn"); + +// Default to enabling focus promos to be shown where allowed. +pref("browser.promo.focus.enabled", true); + +// Default to enabling pin promos to be shown where allowed. +pref("browser.promo.pin.enabled", true); + +// Comma separated string of mozilla vpn supported platforms. +pref("browser.contentblocking.report.vpn_platforms", "win,mac,linux"); +pref("browser.contentblocking.report.hide_vpn_banner", false); +pref("browser.contentblocking.report.vpn_sub_id", "sub_HrfCZF7VPHzZkA"); + +pref("browser.contentblocking.report.monitor.url", "https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections"); +pref("browser.contentblocking.report.monitor.how_it_works.url", "https://monitor.firefox.com/about"); +pref("browser.contentblocking.report.monitor.sign_in_url", "https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protections&email="); +pref("browser.contentblocking.report.monitor.preferences_url", "https://monitor.firefox.com/user/preferences"); +pref("browser.contentblocking.report.monitor.home_page_url", "https://monitor.firefox.com/user/dashboard"); +pref("browser.contentblocking.report.manage_devices.url", "https://accounts.firefox.com/settings/clients"); +pref("browser.contentblocking.report.endpoint_url", "https://monitor.firefox.com/user/breach-stats?includeResolved=true"); +pref("browser.contentblocking.report.proxy_extension.url", "https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-protections&utm_content=about-protections"); +pref("browser.contentblocking.report.mobile-ios.url", "https://apps.apple.com/app/firefox-private-safe-browser/id989804926"); +pref("browser.contentblocking.report.mobile-android.url", "https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_report%26utm_content%3Dmobile_promotion"); +pref("browser.contentblocking.report.vpn.url", "https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-protections-card"); +pref("browser.contentblocking.report.vpn-promo.url", "https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-protections-top-promo"); +pref("browser.contentblocking.report.vpn-android.url", "https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-browser%26utm_medium%3Dfirefox-browser%26utm_campaign%3Dabout-protections-mobile-vpn%26anid%3D--"); +pref("browser.contentblocking.report.vpn-ios.url", "https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738"); + +// Protection Report's SUMO urls +pref("browser.contentblocking.report.lockwise.how_it_works.url", "https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report"); +pref("browser.contentblocking.report.social.url", "https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report"); +pref("browser.contentblocking.report.cookie.url", "https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report"); +pref("browser.contentblocking.report.tracker.url", "https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report"); +pref("browser.contentblocking.report.fingerprinter.url", "https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report"); +pref("browser.contentblocking.report.cryptominer.url", "https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report"); + +pref("browser.contentblocking.cfr-milestone.enabled", true); +pref("browser.contentblocking.cfr-milestone.milestone-achieved", 0); +// Milestones should always be in increasing order +pref("browser.contentblocking.cfr-milestone.milestones", "[1000, 5000, 10000, 25000, 50000, 100000, 250000, 314159, 500000, 750000, 1000000, 1250000, 1500000, 1750000, 2000000, 2250000, 2500000, 8675309]"); + +// Enables the new Protections Panel. +#ifdef NIGHTLY_BUILD + pref("browser.protections_panel.enabled", true); + pref("browser.protections_panel.infoMessage.seen", false); +#endif + +// Always enable newtab segregation using containers +pref("privacy.usercontext.about_newtab_segregation.enabled", true); +// Enable Contextual Identity Containers +#ifdef NIGHTLY_BUILD + pref("privacy.userContext.enabled", true); + pref("privacy.userContext.ui.enabled", true); +#else + pref("privacy.userContext.enabled", false); + pref("privacy.userContext.ui.enabled", false); +#endif +pref("privacy.userContext.extension", ""); +// allows user to open container menu on a left click instead of a new +// tab in the default container +pref("privacy.userContext.newTabContainerOnLeftClick.enabled", false); + +#if defined(NIGHTLY_BUILD) || defined(XP_WIN) || defined(XP_MACOSX) +// Set to true to allow the user to silence all notifications when +// sharing the screen. Only shipping on Windows and macOS out to +// release. Enabled for all desktop platforms on Nightly. +pref("privacy.webrtc.allowSilencingNotifications", true); +// Set to true to use the legacy WebRTC global indicator +pref("privacy.webrtc.legacyGlobalIndicator", false); +pref("privacy.webrtc.hideGlobalIndicator", false); +#else +pref("privacy.webrtc.allowSilencingNotifications", false); +pref("privacy.webrtc.legacyGlobalIndicator", true); +#endif + +// Set to true to add toggles to the WebRTC indicator for globally +// muting the camera and microphone. +pref("privacy.webrtc.globalMuteToggles", false); + +// Set to true to enable a warning displayed when attempting +// to switch tabs in a window that's being shared over WebRTC. +pref("privacy.webrtc.sharedTabWarning", false); + +// Defines a grace period after camera or microphone use ends, where permission +// is granted (even past navigation) to this tab + origin + device. This avoids +// re-prompting without the user having to persist permission to the site, in a +// common case of a web conference asking them for the camera in a lobby page, +// before navigating to the actual meeting room page. Doesn't survive tab close. +pref("privacy.webrtc.deviceGracePeriodTimeoutMs", 3600000); + +// Start the browser in e10s mode +pref("browser.tabs.remote.autostart", true); +pref("browser.tabs.remote.desktopbehavior", true); + +// Run media transport in a separate process? +pref("media.peerconnection.mtransport_process", true); + +// For speculatively warming up tabs to improve perceived +// performance while using the async tab switcher. +pref("browser.tabs.remote.warmup.enabled", true); + +// Caches tab layers to improve perceived performance +// of tab switches. +pref("browser.tabs.remote.tabCacheSize", 0); + +pref("browser.tabs.remote.warmup.maxTabs", 3); +pref("browser.tabs.remote.warmup.unloadDelayMs", 2000); + +// For the about:tabcrashed page +pref("browser.tabs.crashReporting.sendReport", true); +pref("browser.tabs.crashReporting.includeURL", false); + +// If true, unprivileged extensions may use experimental APIs on +// nightly and developer edition. +pref("extensions.experiments.enabled", false); + +#if defined(XP_LINUX) || defined(XP_WIN) + // Allows us to adjust the priority of child processes at the OS level + pref("dom.ipc.processPriorityManager.enabled", true); +#endif + +#if defined(XP_WIN) + pref("dom.ipc.processPriorityManager.backgroundUsesEcoQoS", true); +#endif + +// Don't limit how many nodes we care about on desktop: +pref("reader.parse-node-limit", 0); + +// On desktop, we want the URLs to be included here for ease of debugging, +// and because (normally) these errors are not persisted anywhere. +pref("reader.errors.includeURLs", true); + +// What version of Pocket CTA to show in Reader Mode (Empty string is no CTA) +pref("reader.pocket.ctaVersion", ""); + +pref("view_source.tab", true); + +pref("dom.serviceWorkers.enabled", true); + +// Enable Push API. +pref("dom.push.enabled", true); + +// These are the thumbnail width/height set in about:newtab. +// If you change this, ENSURE IT IS THE SAME SIZE SET +// by about:newtab. These values are in CSS pixels. +pref("toolkit.pageThumbs.minWidth", 280); +pref("toolkit.pageThumbs.minHeight", 190); + +// Enable speech synthesis +pref("media.webspeech.synth.enabled", true); + +pref("browser.esedbreader.loglevel", "Error"); + +pref("browser.laterrun.enabled", false); + +#ifdef FUZZING_SNAPSHOT +pref("dom.ipc.processPrelaunch.enabled", false); +#else +pref("dom.ipc.processPrelaunch.enabled", true); +#endif + +pref("browser.migrate.brave.enabled", true); +pref("browser.migrate.canary.enabled", true); + +pref("browser.migrate.chrome.enabled", true); +// See comments in bug 1340115 on how we got to these numbers. +pref("browser.migrate.chrome.history.limit", 2000); +pref("browser.migrate.chrome.history.maxAgeInDays", 180); + +pref("browser.migrate.chrome-beta.enabled", true); +pref("browser.migrate.chrome-dev.enabled", true); +pref("browser.migrate.chromium.enabled", true); +pref("browser.migrate.chromium-360se.enabled", true); +pref("browser.migrate.chromium-edge.enabled", true); +pref("browser.migrate.chromium-edge-beta.enabled", true); +pref("browser.migrate.edge.enabled", true); +pref("browser.migrate.firefox.enabled", true); +pref("browser.migrate.ie.enabled", true); +pref("browser.migrate.opera.enabled", true); +pref("browser.migrate.opera-gx.enabled", true); +pref("browser.migrate.safari.enabled", true); +pref("browser.migrate.vivaldi.enabled", true); + +pref("browser.migrate.content-modal.enabled", false); + +pref("extensions.pocket.api", "api.getpocket.com"); +pref("extensions.pocket.enabled", true); +pref("extensions.pocket.oAuthConsumerKey", "40249-e88c401e1b1f2242d9e441c4"); +pref("extensions.pocket.site", "getpocket.com"); +pref("extensions.pocket.onSaveRecs", true); +pref("extensions.pocket.onSaveRecs.locales", "en-US,en-GB,en-CA"); + +// Enable Pocket button home panel for non link pages. +pref("extensions.pocket.showHome", true); + +// Control what version of the logged out doorhanger is displayed +// Possibilities are: `control`, `control-one-button`, `variant_a`, `variant_b`, `variant_c` +pref("extensions.pocket.loggedOutVariant", "control"); + +// Just for the new Pocket panels, enables the email signup button. +pref("extensions.pocket.refresh.emailButton.enabled", false); +// Hides the recently saved section in the home panel. +pref("extensions.pocket.refresh.hideRecentSaves.enabled", false); + +pref("signon.management.page.fileImport.enabled", false); + +#ifdef NIGHTLY_BUILD +pref("signon.management.page.os-auth.enabled", true); + +// "not available" - feature is not available (will be removed after QA). +// "available" - user can see feature offer. +// "offered" - we have offered feature to user and they have not yet made a decision. +// "enabled" - user opted in to the feature. +// "disabled" - user opted out of the feature. +// will be enabled after QA round +pref("signon.firefoxRelay.feature", "not available"); +#else +pref("signon.management.page.os-auth.enabled", false); +pref("signon.firefoxRelay.feature", "not available"); +#endif +pref("signon.management.page.breach-alerts.enabled", true); +pref("signon.management.page.vulnerable-passwords.enabled", true); +pref("signon.management.page.sort", "name"); +// The utm_creative value is appended within the code (specific to the location on +// where it is clicked). Be sure that if these two prefs are updated, that +// the utm_creative param be last. +pref("signon.management.page.breachAlertUrl", + "https://monitor.firefox.com/breach-details/"); +pref("signon.passwordEditCapture.enabled", true); +pref("signon.relatedRealms.enabled", false); +pref("signon.showAutoCompleteFooter", true); +pref("signon.showAutoCompleteImport", "import"); +pref("signon.suggestImportCount", 3); + +// Enable the "Simplify Page" feature in Print Preview. This feature +// is disabled by default in toolkit. +pref("print.use_simplify_page", true); + +// Space separated list of URLS that are allowed to send objects (instead of +// only strings) through webchannels. Bug 1275612 tracks removing this pref and capability. +pref("webchannel.allowObject.urlWhitelist", "https://content.cdn.mozilla.net https://install.mozilla.org"); + +// Whether or not the browser should scan for unsubmitted +// crash reports, and then show a notification for submitting +// those reports. +#ifdef NIGHTLY_BUILD + pref("browser.crashReports.unsubmittedCheck.enabled", true); +#else + pref("browser.crashReports.unsubmittedCheck.enabled", false); +#endif + +// chancesUntilSuppress is how many times we'll show the unsubmitted +// crash report notification across different days and shutdown +// without a user choice before we suppress the notification for +// some number of days. +pref("browser.crashReports.unsubmittedCheck.chancesUntilSuppress", 4); +pref("browser.crashReports.unsubmittedCheck.autoSubmit2", false); + +// Preferences for the form autofill toolkit component. +// Checkbox in sync options for credit card data sync service +pref("services.sync.engine.creditcards.available", true); +// Whether the user enabled the OS re-auth dialog. +pref("extensions.formautofill.reauth.enabled", false); + +// Whether or not to restore a session with lazy-browser tabs. +pref("browser.sessionstore.restore_tabs_lazily", true); + +pref("browser.suppress_first_window_animation", true); + +// Preference that allows individual users to disable Screenshots. +pref("extensions.screenshots.disabled", false); + +// Preference that determines whether Screenshots is opened as a dedicated browser component +pref("screenshots.browser.component.enabled", false); + +// DoH Rollout: whether to clear the mode value at shutdown. +pref("doh-rollout.clearModeOnShutdown", false); + +// URL for Learn More link for browser error logging in preferences +pref("browser.chrome.errorReporter.infoURL", + "https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/nightly-error-collection"); + +// Normandy client preferences +pref("app.normandy.api_url", "https://normandy.cdn.mozilla.net/api/v1"); +pref("app.normandy.dev_mode", false); +pref("app.normandy.enabled", true); +pref("app.normandy.first_run", true); +pref("app.normandy.logging.level", 50); // Warn +pref("app.normandy.run_interval_seconds", 21600); // 6 hours +pref("app.normandy.shieldLearnMoreUrl", "https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield"); +pref("app.normandy.last_seen_buildid", ""); +pref("app.normandy.onsync_skew_sec", 600); +#ifdef MOZ_DATA_REPORTING + pref("app.shield.optoutstudies.enabled", true); +#else + pref("app.shield.optoutstudies.enabled", false); +#endif + +// Multi-lingual preferences: +// *.enabled - Are langpacks available for the build of Firefox? +// *.downloadEnabled - Langpacks are allowed to be downloaded from AMO. AMO only serves +// langpacks for release and beta. Unsupported releases (like Nightly) can be +// manually tested with the following preference: +// extensions.getAddons.langpacks.url: https://mock-amo-language-tools.glitch.me/?app=firefox&type=language&appversion=%VERSION% +// *.liveReload - Switching a langpack will change the language without a restart. +// *.liveReloadBidirectional - Allows switching when moving between LTR and RTL +// languages without a full restart. +// *.aboutWelcome.languageMismatchEnabled - Enables an onboarding menu in about:welcome +// to allow a user to change their language when there is a language mismatch between +// the app and browser. +#if defined(RELEASE_OR_BETA) && !defined(MOZ_DEV_EDITION) + pref("intl.multilingual.enabled", true); + pref("intl.multilingual.downloadEnabled", true); + pref("intl.multilingual.liveReload", true); + pref("intl.multilingual.liveReloadBidirectional", false); + pref("intl.multilingual.aboutWelcome.languageMismatchEnabled", true); +#else + pref("intl.multilingual.enabled", false); + pref("intl.multilingual.downloadEnabled", false); + pref("intl.multilingual.liveReload", false); + pref("intl.multilingual.liveReloadBidirectional", false); + pref("intl.multilingual.aboutWelcome.languageMismatchEnabled", false); +#endif + +// Coverage ping is disabled by default. +pref("toolkit.coverage.enabled", false); +pref("toolkit.coverage.endpoint.base", "https://coverage.mozilla.org"); + +// Discovery prefs +pref("browser.discovery.enabled", true); +pref("browser.discovery.containers.enabled", true); +pref("browser.discovery.sites", "addons.mozilla.org"); + +pref("browser.engagement.recent_visited_origins.expiry", 86400); // 24 * 60 * 60 (24 hours in seconds) +pref("browser.engagement.downloads-button.has-used", false); +pref("browser.engagement.fxa-toolbar-menu-button.has-used", false); +pref("browser.engagement.home-button.has-used", false); +pref("browser.engagement.sidebar-button.has-used", false); +pref("browser.engagement.library-button.has-used", false); +pref("browser.engagement.ctrlTab.has-used", false); + +pref("browser.aboutConfig.showWarning", true); + +pref("browser.toolbars.keyboard_navigation", true); + +// The visibility of the bookmarks toolbar. +// "newtab": Show on the New Tab Page +// "always": Always show +// "never": Never show +pref("browser.toolbars.bookmarks.visibility", "newtab"); + +// Visibility of the "Show Other Bookmarks" menuitem in the +// bookmarks toolbar contextmenu. +pref("browser.toolbars.bookmarks.showOtherBookmarks", true); + +// Prefs to control the Firefox Account toolbar menu. +// This pref will surface existing Firefox Account information +// as a button next to the hamburger menu. It allows +// quick access to sign-in and manage your Firefox Account. +pref("identity.fxaccounts.toolbar.enabled", true); +pref("identity.fxaccounts.toolbar.accessed", false); + +// Prefs for different services supported by Firefox Account +pref("identity.fxaccounts.service.monitorLoginUrl", "https://monitor.firefox.com/"); + +// Check bundled omni JARs for corruption. +pref("corroborator.enabled", true); + +// Toolbox preferences +pref("devtools.toolbox.footer.height", 250); +pref("devtools.toolbox.sidebar.width", 500); +pref("devtools.toolbox.host", "bottom"); +pref("devtools.toolbox.previousHost", "right"); +pref("devtools.toolbox.selectedTool", "inspector"); +pref("devtools.toolbox.zoomValue", "1"); +pref("devtools.toolbox.splitconsoleEnabled", false); +pref("devtools.toolbox.splitconsoleHeight", 100); +pref("devtools.toolbox.tabsOrder", ""); +// This is only used for local Web Extension debugging, +// and allows to keep the window on top of all others, +// so that you can debug the Firefox window, while keeping the devtools +// always visible +pref("devtools.toolbox.alwaysOnTop", true); + +// When the Multiprocess Browser Toolbox is enabled, you can configure the scope of it: +// - "everything" will enable debugging absolutely everything in the browser +// All processes, all documents, all workers, all add-ons. +// - "parent-process" will restrict debugging to the parent process +// All privileged javascript, documents and workers running in the parent process. +pref("devtools.browsertoolbox.scope", "parent-process"); + +// This preference will enable watching top-level targets from the server side. +pref("devtools.target-switching.server.enabled", true); + +// In DevTools, create a target for each frame (i.e. not only for top-level document and +// remote frames). +pref("devtools.every-frame-target.enabled", true); + +// Controls the hability to debug popups from the same DevTools +// of the original tab the popups are coming from +pref("devtools.popups.debug", false); + +// Toolbox Button preferences +pref("devtools.command-button-pick.enabled", true); +pref("devtools.command-button-frames.enabled", true); +pref("devtools.command-button-splitconsole.enabled", true); +pref("devtools.command-button-responsive.enabled", true); +pref("devtools.command-button-screenshot.enabled", false); +pref("devtools.command-button-rulers.enabled", false); +pref("devtools.command-button-measure.enabled", false); +pref("devtools.command-button-noautohide.enabled", false); +pref("devtools.command-button-errorcount.enabled", true); +#ifndef MOZILLA_OFFICIAL + pref("devtools.command-button-experimental-prefs.enabled", true); +#endif + +// Inspector preferences +// Enable the Inspector +pref("devtools.inspector.enabled", true); +// What was the last active sidebar in the inspector +pref("devtools.inspector.selectedSidebar", "layoutview"); +pref("devtools.inspector.activeSidebar", "layoutview"); +pref("devtools.inspector.remote", false); + +// Enable the 3 pane mode in the inspector +pref("devtools.inspector.three-pane-enabled", true); +// Enable the 3 pane mode in the chrome inspector +pref("devtools.inspector.chrome.three-pane-enabled", false); +// Collapse pseudo-elements by default in the rule-view +pref("devtools.inspector.show_pseudo_elements", false); +// The default size for image preview tooltips in the rule-view/computed-view/markup-view +pref("devtools.inspector.imagePreviewTooltipSize", 300); +// Enable user agent style inspection in rule-view +pref("devtools.inspector.showUserAgentStyles", false); +// Show native anonymous content and user agent shadow roots +pref("devtools.inspector.showAllAnonymousContent", false); +// Enable the inline CSS compatiblity warning in inspector rule view +pref("devtools.inspector.ruleview.inline-compatibility-warning.enabled", false); +// Enable the compatibility tool in the inspector. +pref("devtools.inspector.compatibility.enabled", true); +// Enable overflow debugging in the inspector. +pref("devtools.overflow.debugging.enabled", true); +// Enable drag to edit properties in the inspector rule view. +pref("devtools.inspector.draggable_properties", true); + +// Grid highlighter preferences +pref("devtools.gridinspector.gridOutlineMaxColumns", 50); +pref("devtools.gridinspector.gridOutlineMaxRows", 50); +pref("devtools.gridinspector.showGridAreas", false); +pref("devtools.gridinspector.showGridLineNumbers", false); +pref("devtools.gridinspector.showInfiniteLines", false); +// Max number of grid highlighters that can be displayed +pref("devtools.gridinspector.maxHighlighters", 3); + +// Whether or not the box model panel is opened in the layout view +pref("devtools.layout.boxmodel.opened", true); +// Whether or not the flexbox panel is opened in the layout view +pref("devtools.layout.flexbox.opened", true); +// Whether or not the flexbox container panel is opened in the layout view +pref("devtools.layout.flex-container.opened", true); +// Whether or not the flexbox item panel is opened in the layout view +pref("devtools.layout.flex-item.opened", true); +// Whether or not the grid inspector panel is opened in the layout view +pref("devtools.layout.grid.opened", true); + +// Enable hovering Box Model values and jumping to their source CSS rule in the +// rule-view. +#if defined(NIGHTLY_BUILD) + pref("devtools.layout.boxmodel.highlightProperty", true); +#else + pref("devtools.layout.boxmodel.highlightProperty", false); +#endif + +// By how many times eyedropper will magnify pixels +pref("devtools.eyedropper.zoom", 6); + +// Enable to collapse attributes that are too long. +pref("devtools.markup.collapseAttributes", true); +// Length to collapse attributes +pref("devtools.markup.collapseAttributeLength", 120); +// Whether to auto-beautify the HTML on copy. +pref("devtools.markup.beautifyOnCopy", false); +// Whether or not the DOM mutation breakpoints context menu are enabled in the +// markup view. +pref("devtools.markup.mutationBreakpoints.enabled", true); + +// DevTools default color unit +pref("devtools.defaultColorUnit", "authored"); + +// Enable the Memory tools +pref("devtools.memory.enabled", true); + +pref("devtools.memory.custom-census-displays", "{}"); +pref("devtools.memory.custom-label-displays", "{}"); +pref("devtools.memory.custom-tree-map-displays", "{}"); + +pref("devtools.memory.max-individuals", 1000); +pref("devtools.memory.max-retaining-paths", 10); + +// Enable the Performance tools +pref("devtools.performance.enabled", true); + +// The default cache UI setting +pref("devtools.cache.disabled", false); + +// The default service workers UI setting +pref("devtools.serviceWorkers.testing.enabled", false); + +// Enable the Network Monitor +pref("devtools.netmonitor.enabled", true); + +pref("devtools.netmonitor.features.search", true); +pref("devtools.netmonitor.features.requestBlocking", true); + +// Enable the Application panel +pref("devtools.application.enabled", true); + +// Enable the custom formatters feature +// TODO remove once the custom formatters feature is stable (see bug 1734614) +pref("devtools.custom-formatters", false); +// This preference represents the user's choice to enable the custom formatters feature. +// While the preference above will be removed once the feature is stable, this one is menat to stay. +pref("devtools.custom-formatters.enabled", false); + +// The default Network Monitor UI settings +pref("devtools.netmonitor.panes-network-details-width", 550); +pref("devtools.netmonitor.panes-network-details-height", 450); +pref("devtools.netmonitor.panes-search-width", 550); +pref("devtools.netmonitor.panes-search-height", 450); +pref("devtools.netmonitor.filters", "[\"all\"]"); +pref("devtools.netmonitor.visibleColumns", + "[\"status\",\"method\",\"domain\",\"file\",\"initiator\",\"type\",\"transferred\",\"contentSize\",\"waterfall\"]" +); +pref("devtools.netmonitor.columnsData", + '[{"name":"status","minWidth":30,"width":5}, {"name":"method","minWidth":30,"width":5}, {"name":"domain","minWidth":30,"width":10}, {"name":"file","minWidth":30,"width":25}, {"name":"url","minWidth":30,"width":25},{"name":"initiator","minWidth":30,"width":10},{"name":"type","minWidth":30,"width":5},{"name":"transferred","minWidth":30,"width":10},{"name":"contentSize","minWidth":30,"width":5},{"name":"waterfall","minWidth":150,"width":15}]'); +pref("devtools.netmonitor.msg.payload-preview-height", 128); +pref("devtools.netmonitor.msg.visibleColumns", + '["data", "time"]' +); +pref("devtools.netmonitor.msg.displayed-messages.limit", 500); + +pref("devtools.netmonitor.response.ui.limit", 10240); + +// Save request/response bodies yes/no. +pref("devtools.netmonitor.saveRequestAndResponseBodies", true); + +// The default Network monitor HAR export setting +pref("devtools.netmonitor.har.defaultLogDir", ""); +pref("devtools.netmonitor.har.defaultFileName", "%hostname_Archive [%date]"); +pref("devtools.netmonitor.har.jsonp", false); +pref("devtools.netmonitor.har.jsonpCallback", ""); +pref("devtools.netmonitor.har.includeResponseBodies", true); +pref("devtools.netmonitor.har.compress", false); +pref("devtools.netmonitor.har.forceExport", false); +pref("devtools.netmonitor.har.pageLoadedTimeout", 1500); +pref("devtools.netmonitor.har.enableAutoExportToFile", false); + +// netmonitor audit +pref("devtools.netmonitor.audits.slow", 500); + +// Enable the new Edit and Resend panel + pref("devtools.netmonitor.features.newEditAndResend", true); + +pref("devtools.netmonitor.customRequest", '{}'); + +// Enable the Storage Inspector +pref("devtools.storage.enabled", true); + +// Enable the Style Editor. +pref("devtools.styleeditor.enabled", true); +pref("devtools.styleeditor.autocompletion-enabled", true); +pref("devtools.styleeditor.showAtRulesSidebar", true); +pref("devtools.styleeditor.atRulesSidebarWidth", 238); +pref("devtools.styleeditor.navSidebarWidth", 245); +pref("devtools.styleeditor.transitions", true); + +// Screenshot Option Settings. +pref("devtools.screenshot.clipboard.enabled", false); +pref("devtools.screenshot.audio.enabled", true); + +// Make sure the DOM panel is hidden by default +pref("devtools.dom.enabled", false); + +// Enable the Accessibility panel. +pref("devtools.accessibility.enabled", true); + +// Web console filters +pref("devtools.webconsole.filter.error", true); +pref("devtools.webconsole.filter.warn", true); +pref("devtools.webconsole.filter.info", true); +pref("devtools.webconsole.filter.log", true); +pref("devtools.webconsole.filter.debug", true); +pref("devtools.webconsole.filter.css", false); +pref("devtools.webconsole.filter.net", false); +pref("devtools.webconsole.filter.netxhr", false); + +// Webconsole autocomplete preference +pref("devtools.webconsole.input.autocomplete",true); + +// Show context selector in console input +pref("devtools.webconsole.input.context", true); + +// Set to true to eagerly show the results of webconsole terminal evaluations +// when they don't have side effects. +pref("devtools.webconsole.input.eagerEvaluation", true); + +// Browser console filters +pref("devtools.browserconsole.filter.error", true); +pref("devtools.browserconsole.filter.warn", true); +pref("devtools.browserconsole.filter.info", true); +pref("devtools.browserconsole.filter.log", true); +pref("devtools.browserconsole.filter.debug", true); +pref("devtools.browserconsole.filter.css", false); +pref("devtools.browserconsole.filter.net", false); +pref("devtools.browserconsole.filter.netxhr", false); + +// Max number of inputs to store in web console history. +pref("devtools.webconsole.inputHistoryCount", 300); + +// Persistent logging: |true| if you want the relevant tool to keep all of the +// logged messages after reloading the page, |false| if you want the output to +// be cleared each time page navigation happens. +pref("devtools.webconsole.persistlog", false); +pref("devtools.netmonitor.persistlog", false); + +// Web Console timestamp: |true| if you want the logs and instructions +// in the Web Console to display a timestamp, or |false| to not display +// any timestamps. +pref("devtools.webconsole.timestampMessages", false); + +// Enable the webconsole sidebar toggle in Nightly builds. +#if defined(NIGHTLY_BUILD) + pref("devtools.webconsole.sidebarToggle", true); +#else + pref("devtools.webconsole.sidebarToggle", false); +#endif + +// Saved editor mode state in the console. +pref("devtools.webconsole.input.editor", false); +pref("devtools.browserconsole.input.editor", false); + +// Editor width for webconsole and browserconsole. +pref("devtools.webconsole.input.editorWidth", 0); +pref("devtools.browserconsole.input.editorWidth", 0); + +// Display an onboarding UI for the Editor mode. +pref("devtools.webconsole.input.editorOnboarding", true); + +// Enable message grouping in the console, true by default +pref("devtools.webconsole.groupWarningMessages", true); + +// Enable network monitoring the browser toolbox console/browser console. +pref("devtools.browserconsole.enableNetworkMonitoring", false); + +// Enable client-side mapping service for source maps +pref("devtools.source-map.client-service.enabled", true); + +// The number of lines that are displayed in the web console. +pref("devtools.hud.loglimit", 10000); + +// The developer tools editor configuration: +// - tabsize: how many spaces to use when a Tab character is displayed. +// - expandtab: expand Tab characters to spaces. +// - keymap: which keymap to use (can be 'default', 'emacs' or 'vim') +// - autoclosebrackets: whether to permit automatic bracket/quote closing. +// - detectindentation: whether to detect the indentation from the file +// - enableCodeFolding: Whether to enable code folding or not. +pref("devtools.editor.tabsize", 2); +pref("devtools.editor.expandtab", true); +pref("devtools.editor.keymap", "default"); +pref("devtools.editor.autoclosebrackets", true); +pref("devtools.editor.detectindentation", true); +pref("devtools.editor.enableCodeFolding", true); +pref("devtools.editor.autocomplete", true); + +// The angle of the viewport. +pref("devtools.responsive.viewport.angle", 0); +// The width of the viewport. +pref("devtools.responsive.viewport.width", 320); +// The height of the viewport. +pref("devtools.responsive.viewport.height", 480); +// The pixel ratio of the viewport. +pref("devtools.responsive.viewport.pixelRatio", 0); +// Whether or not the viewports are left aligned. +pref("devtools.responsive.leftAlignViewport.enabled", false); +// Whether to reload when touch simulation is toggled +pref("devtools.responsive.reloadConditions.touchSimulation", false); +// Whether to reload when user agent is changed +pref("devtools.responsive.reloadConditions.userAgent", false); +// Whether to show the notification about reloading to apply emulation +pref("devtools.responsive.reloadNotification.enabled", true); +// Whether or not touch simulation is enabled. +pref("devtools.responsive.touchSimulation.enabled", false); +// The user agent of the viewport. +pref("devtools.responsive.userAgent", ""); +// Show the custom user agent input by default +pref("devtools.responsive.showUserAgentInput", true); + +// Show tab debug targets for This Firefox (on by default for local builds). +#ifdef MOZILLA_OFFICIAL + pref("devtools.aboutdebugging.local-tab-debugging", false); +#else + pref("devtools.aboutdebugging.local-tab-debugging", true); +#endif + +// Show process debug targets. +pref("devtools.aboutdebugging.process-debugging", true); +// Stringified array of network locations that users can connect to. +pref("devtools.aboutdebugging.network-locations", "[]"); +// Debug target pane collapse/expand settings. +pref("devtools.aboutdebugging.collapsibilities.installedExtension", false); +pref("devtools.aboutdebugging.collapsibilities.otherWorker", false); +pref("devtools.aboutdebugging.collapsibilities.serviceWorker", false); +pref("devtools.aboutdebugging.collapsibilities.sharedWorker", false); +pref("devtools.aboutdebugging.collapsibilities.tab", false); +pref("devtools.aboutdebugging.collapsibilities.temporaryExtension", false); + +// about:debugging: only show system and hidden extensions in local builds by +// default. +#ifdef MOZILLA_OFFICIAL + pref("devtools.aboutdebugging.showHiddenAddons", false); +#else + pref("devtools.aboutdebugging.showHiddenAddons", true); +#endif + +// Map top-level await expressions in the console +pref("devtools.debugger.features.map-await-expression", true); + +// This relies on javascript.options.asyncstack as well or it has no effect. +pref("devtools.debugger.features.async-captured-stacks", true); +pref("devtools.debugger.features.async-live-stacks", false); + +// Disable autohide for DevTools popups and tooltips. +// This is currently not exposed by any UI to avoid making +// about:devtools-toolbox tabs unusable by mistake. +pref("devtools.popup.disable_autohide", false); + +// FirstStartup service time-out in ms +pref("first-startup.timeout", 30000); + +// Enable the default browser agent. +// The agent still runs as scheduled if this pref is disabled, +// but it exits immediately before taking any action. +#ifdef XP_WIN + pref("default-browser-agent.enabled", true); +#endif + +// Test Prefs that do nothing for testing +#if defined(EARLY_BETA_OR_EARLIER) + pref("app.normandy.test-prefs.bool", false); + pref("app.normandy.test-prefs.integer", 0); + pref("app.normandy.test-prefs.string", ""); +#endif + +// Shows 'View Image Info' item in the image context menu +#ifdef MOZ_DEV_EDITION + pref("browser.menu.showViewImageInfo", true); +#else + pref("browser.menu.showViewImageInfo", false); +#endif + +// Mozilla-controlled domains that are allowed to use non-standard +// context properties for SVG images for use in the browser UI. Please +// keep this list short. This preference (and SVG `context-` keyword support) +// are expected to go away once a standardized alternative becomes +// available. +pref("svg.context-properties.content.allowed-domains", "profile.accounts.firefox.com,profile.stage.mozaws.net"); + +// Preference that allows individual users to disable Firefox Translations. +#ifdef NIGHTLY_BUILD + pref("extensions.translations.disabled", true); +#endif + +// Turn on interaction measurements in Nightly only +#ifdef NIGHTLY_BUILD + pref("browser.places.interactions.enabled", true); +#endif + +// If the user has seen the Firefox View feature tour this value reflects +// the id of the last screen they saw and whether they completed the tour +pref("browser.firefox-view.feature-tour", "{\"screen\":\"FIREFOX_VIEW_SPOTLIGHT\",\"complete\":false}"); +// Number of times the user visited about:firefoxview +pref("browser.firefox-view.view-count", 0); + +// If the user has seen the pdf.js feature tour this value reflects the tour +// message id, the id of the last screen they saw, and whether they completed the tour +pref("browser.pdfjs.feature-tour", "{\"screen\":\"\",\"complete\":false}"); + +// Enables cookie banner handling in Nightly in Private Browsing Mode. See +// StaticPrefList.yaml for a description of the prefs. +#ifdef NIGHTLY_BUILD + pref("cookiebanners.service.mode.privateBrowsing", 1); +#endif + +// Enables the cookie banner desktop UI. +pref("cookiebanners.ui.desktop.enabled", false); diff --git a/browser/app/splash.rc b/browser/app/splash.rc new file mode 100644 index 0000000000..259a8068c3 --- /dev/null +++ b/browser/app/splash.rc @@ -0,0 +1,20 @@ +/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#include <windows.h> +#include "nsNativeAppSupportWin.h" + +IDI_APPICON ICON FIREFOX_ICO +IDI_DOCUMENT ICON DOCUMENT_ICO +IDI_APPLICATION ICON FIREFOX_ICO +IDI_NEWWINDOW ICON NEWWINDOW_ICO +IDI_NEWTAB ICON NEWTAB_ICO +IDI_PBMODE ICON PBMODE_ICO +IDI_DOCUMENT_PDF ICON DOCUMENT_PDF_ICO + +STRINGTABLE DISCARDABLE +BEGIN + IDS_STARTMENU_APPNAME, "@MOZ_APP_DISPLAYNAME@" +END diff --git a/browser/app/winlauncher/DllBlocklistInit.cpp b/browser/app/winlauncher/DllBlocklistInit.cpp new file mode 100644 index 0000000000..813189a495 --- /dev/null +++ b/browser/app/winlauncher/DllBlocklistInit.cpp @@ -0,0 +1,238 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* vim: set ts=8 sts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. */ + +#define MOZ_USE_LAUNCHER_ERROR + +#include "nsWindowsDllInterceptor.h" +#include "mozilla/ArrayUtils.h" +#include "mozilla/Attributes.h" +#include "mozilla/BinarySearch.h" +#include "mozilla/ImportDir.h" +#include "mozilla/NativeNt.h" +#include "mozilla/PolicyChecks.h" +#include "mozilla/ScopeExit.h" +#include "mozilla/Types.h" +#include "mozilla/WindowsDllBlocklist.h" +#include "mozilla/WinHeaderOnlyUtils.h" + +#include "DllBlocklistInit.h" +#include "freestanding/DllBlocklist.h" +#include "freestanding/SharedSection.h" + +namespace mozilla { + +#if defined(MOZ_ASAN) || defined(_M_ARM64) + +// This DLL blocking code is incompatible with ASAN because +// it is able to execute before ASAN itself has even initialized. +// Also, AArch64 has not been tested with this. +LauncherVoidResultWithLineInfo InitializeDllBlocklistOOP( + const wchar_t* aFullImagePath, HANDLE aChildProcess, + const IMAGE_THUNK_DATA*, const bool aIsUtilityProcess, + const bool aIsSocketProcess) { + return mozilla::Ok(); +} + +LauncherVoidResultWithLineInfo InitializeDllBlocklistOOPFromLauncher( + const wchar_t* aFullImagePath, HANDLE aChildProcess, + const bool aDisableDynamicBlocklist, + Maybe<std::wstring> aBlocklistFileName) { + return mozilla::Ok(); +} + +#else + +static LauncherVoidResultWithLineInfo InitializeDllBlocklistOOPInternal( + const wchar_t* aFullImagePath, nt::CrossExecTransferManager& aTransferMgr, + const IMAGE_THUNK_DATA* aCachedNtdllThunk, const bool aIsUtilityProcess, + const bool aIsSocketProcess) { + CrossProcessDllInterceptor intcpt(aTransferMgr.RemoteProcess()); + intcpt.Init(L"ntdll.dll"); + + bool ok = freestanding::stub_NtMapViewOfSection.SetDetour( + aTransferMgr, intcpt, "NtMapViewOfSection", + &freestanding::patched_NtMapViewOfSection); + if (!ok) { + return LAUNCHER_ERROR_FROM_DETOUR_ERROR(intcpt.GetLastDetourError()); + } + + ok = freestanding::stub_LdrLoadDll.SetDetour( + aTransferMgr, intcpt, "LdrLoadDll", &freestanding::patched_LdrLoadDll); + if (!ok) { + return LAUNCHER_ERROR_FROM_DETOUR_ERROR(intcpt.GetLastDetourError()); + } + + // Because aChildProcess has just been created in a suspended state, its + // dynamic linker has not yet been initialized, thus its executable has + // not yet been linked with ntdll.dll. If the blocklist hook intercepts a + // library load prior to the link, the hook will be unable to invoke any + // ntdll.dll functions. + // + // We know that the executable for our *current* process's binary is already + // linked into ntdll, so we obtain the IAT from our own executable and graft + // it onto the child process's IAT, thus enabling the child process's hook to + // safely make its ntdll calls. + + const nt::PEHeaders& ourExeImage = aTransferMgr.LocalPEHeaders(); + + // As part of our mitigation of binary tampering, copy our import directory + // from the original in our executable file. + LauncherVoidResult importDirRestored = + RestoreImportDirectory(aFullImagePath, aTransferMgr); + if (importDirRestored.isErr()) { + return importDirRestored; + } + + mozilla::nt::PEHeaders ntdllImage(::GetModuleHandleW(L"ntdll.dll")); + if (!ntdllImage) { + return LAUNCHER_ERROR_FROM_WIN32(ERROR_BAD_EXE_FORMAT); + } + + // If we have a cached IAT i.e. |aCachedNtdllThunk| is non-null, we can + // safely copy it to |aChildProcess| even if the local IAT has been modified. + // If |aCachedNtdllThunk| is null, we've failed to cache the IAT or we're in + // the launcher process where there is no chance to cache the IAT. In those + // cases, we retrieve the IAT with the boundary check to avoid a modified IAT + // from being copied into |aChildProcess|. + Maybe<Span<IMAGE_THUNK_DATA> > ntdllThunks; + if (aCachedNtdllThunk) { + ntdllThunks = ourExeImage.GetIATThunksForModule("ntdll.dll"); + } else { + Maybe<Range<const uint8_t> > ntdllBoundaries = ntdllImage.GetBounds(); + if (!ntdllBoundaries) { + return LAUNCHER_ERROR_FROM_WIN32(ERROR_BAD_EXE_FORMAT); + } + + // We can use GetIATThunksForModule() to check whether IAT is modified + // or not because no functions exported from ntdll.dll is forwarded. + ntdllThunks = + ourExeImage.GetIATThunksForModule("ntdll.dll", ntdllBoundaries.ptr()); + } + if (!ntdllThunks) { + return LAUNCHER_ERROR_FROM_WIN32(ERROR_INVALID_DATA); + } + + { // Scope for prot + PIMAGE_THUNK_DATA firstIatThunkDst = ntdllThunks.value().data(); + const IMAGE_THUNK_DATA* firstIatThunkSrc = + aCachedNtdllThunk ? aCachedNtdllThunk : firstIatThunkDst; + SIZE_T iatLength = ntdllThunks.value().LengthBytes(); + + AutoVirtualProtect prot = + aTransferMgr.Protect(firstIatThunkDst, iatLength, PAGE_READWRITE); + if (!prot) { + return LAUNCHER_ERROR_FROM_MOZ_WINDOWS_ERROR(prot.GetError()); + } + + LauncherVoidResult writeResult = + aTransferMgr.Transfer(firstIatThunkDst, firstIatThunkSrc, iatLength); + if (writeResult.isErr()) { + return writeResult.propagateErr(); + } + } + + // Tell the mozglue blocklist that we have bootstrapped + uint32_t newFlags = eDllBlocklistInitFlagWasBootstrapped; + + if (gBlocklistInitFlags & eDllBlocklistInitFlagWasBootstrapped) { + // If we ourselves were bootstrapped, then we are starting a child process + // and need to set the appropriate flag. + newFlags |= eDllBlocklistInitFlagIsChildProcess; + } + + if (aIsUtilityProcess) { + newFlags |= eDllBlocklistInitFlagIsUtilityProcess; + } + if (aIsSocketProcess) { + newFlags |= eDllBlocklistInitFlagIsSocketProcess; + } + + LauncherVoidResult writeResult = + aTransferMgr.Transfer(&gBlocklistInitFlags, &newFlags, sizeof(newFlags)); + if (writeResult.isErr()) { + return writeResult.propagateErr(); + } + + return Ok(); +} + +LauncherVoidResultWithLineInfo InitializeDllBlocklistOOP( + const wchar_t* aFullImagePath, HANDLE aChildProcess, + const IMAGE_THUNK_DATA* aCachedNtdllThunk, const bool aIsUtilityProcess, + const bool aIsSocketProcess) { + nt::CrossExecTransferManager transferMgr(aChildProcess); + if (!transferMgr) { + return LAUNCHER_ERROR_FROM_WIN32(ERROR_BAD_EXE_FORMAT); + } + + // We come here when the browser process launches a sandbox process. + // If the launcher process already failed to bootstrap the browser process, + // we should not attempt to bootstrap a child process because it's likely + // to fail again. Instead, we only restore the import directory entry. + if (!(gBlocklistInitFlags & eDllBlocklistInitFlagWasBootstrapped)) { + return RestoreImportDirectory(aFullImagePath, transferMgr); + } + + // Transfer a readonly handle to the child processes because all information + // are already written to the section by the launcher and main process. + LauncherVoidResult transferResult = + freestanding::gSharedSection.TransferHandle(transferMgr, GENERIC_READ); + if (transferResult.isErr()) { + return transferResult.propagateErr(); + } + + return InitializeDllBlocklistOOPInternal(aFullImagePath, transferMgr, + aCachedNtdllThunk, aIsUtilityProcess, + aIsSocketProcess); +} + +LauncherVoidResultWithLineInfo InitializeDllBlocklistOOPFromLauncher( + const wchar_t* aFullImagePath, HANDLE aChildProcess, + const bool aDisableDynamicBlocklist, + Maybe<std::wstring> aBlocklistFileName) { + nt::CrossExecTransferManager transferMgr(aChildProcess); + if (!transferMgr) { + return LAUNCHER_ERROR_FROM_WIN32(ERROR_BAD_EXE_FORMAT); + } + + // The launcher process initializes a section object, whose handle is + // transferred to the browser process, and that transferred handle in + // the browser process is transferred to the sandbox processes. + LauncherVoidResultWithLineInfo result = freestanding::gSharedSection.Init(); + if (result.isErr()) { + return result; + } + + if (aBlocklistFileName.isSome() && + !PolicyCheckBoolean(L"DisableThirdPartyModuleBlocking")) { + DynamicBlockList blockList(aBlocklistFileName->c_str()); + result = freestanding::gSharedSection.SetBlocklist( + blockList, aDisableDynamicBlocklist); + if (result.isErr()) { + return result; + } + } + + // Transfer a writable handle to the main process because it needs to append + // dependent module paths to the section. + LauncherVoidResult transferResult = + freestanding::gSharedSection.TransferHandle(transferMgr, + GENERIC_READ | GENERIC_WRITE); + if (transferResult.isErr()) { + return transferResult.propagateErr(); + } + + auto clearInstance = MakeScopeExit([]() { + // After transfer, the launcher process does not need the object anymore. + freestanding::gSharedSection.Reset(nullptr); + }); + return InitializeDllBlocklistOOPInternal(aFullImagePath, transferMgr, nullptr, + false, false); +} + +#endif // defined(MOZ_ASAN) || defined(_M_ARM64) + +} // namespace mozilla diff --git a/browser/app/winlauncher/DllBlocklistInit.h b/browser/app/winlauncher/DllBlocklistInit.h new file mode 100644 index 0000000000..291283a7f6 --- /dev/null +++ b/browser/app/winlauncher/DllBlocklistInit.h @@ -0,0 +1,31 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* vim: set ts=8 sts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. */ + +#ifndef mozilla_DllBlocklistInit_h +#define mozilla_DllBlocklistInit_h + +#include <windows.h> + +#if defined(MOZ_LAUNCHER_PROCESS) +# include "mozilla/LauncherRegistryInfo.h" +#endif +#include "mozilla/WinHeaderOnlyUtils.h" + +namespace mozilla { + +LauncherVoidResultWithLineInfo InitializeDllBlocklistOOP( + const wchar_t* aFullImagePath, HANDLE aChildProcess, + const IMAGE_THUNK_DATA* aCachedNtdllThunk, const bool aIsUtilityProcess, + const bool aIsSocketProcess); + +LauncherVoidResultWithLineInfo InitializeDllBlocklistOOPFromLauncher( + const wchar_t* aFullImagePath, HANDLE aChildProcess, + const bool aDisableDynamicBlocklist, + Maybe<std::wstring> aBlocklistFileName); + +} // namespace mozilla + +#endif // mozilla_DllBlocklistInit_h diff --git a/browser/app/winlauncher/ErrorHandler.cpp b/browser/app/winlauncher/ErrorHandler.cpp new file mode 100644 index 0000000000..1286e0f90f --- /dev/null +++ b/browser/app/winlauncher/ErrorHandler.cpp @@ -0,0 +1,782 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* vim: set ts=8 sts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. */ + +#include "ErrorHandler.h" + +#include <utility> + +#include "mozilla/ArrayUtils.h" +#include "mozilla/CmdLineAndEnvUtils.h" +#include "mozilla/DebugOnly.h" +#include "mozilla/JSONWriter.h" +#include "mozilla/UniquePtr.h" +#include "mozilla/Unused.h" +#include "mozilla/WinTokenUtils.h" +#include "mozilla/WindowsVersion.h" +#include "mozilla/XREAppData.h" +#include "mozilla/glue/WindowsDllServices.h" +#include "mozilla/mscom/ProcessRuntime.h" +#include "nsWindowsHelpers.h" + +#if defined(MOZ_LAUNCHER_PROCESS) +# include "mozilla/LauncherRegistryInfo.h" +#endif // defined(MOZ_LAUNCHER_PROCESS) + +#include <algorithm> +#include <process.h> +#include <sstream> +#include <string> +#include <stdio.h> +#include <string.h> +#include <time.h> + +#include <objbase.h> +#include <rpc.h> +#if !defined(__MINGW32__) +# include <comutil.h> +# include <iwscapi.h> +# include <wscapi.h> +#endif // !defined(__MINGW32__) +#include <tlhelp32.h> + +#if !defined(RRF_SUBKEY_WOW6464KEY) +# define RRF_SUBKEY_WOW6464KEY 0x00010000 +#endif // !defined(RRF_SUBKEY_WOW6464KEY) + +#define QUOTE_ME2(x) #x +#define QUOTE_ME(x) QUOTE_ME2(x) + +#define TELEMETRY_BASE_URL L"https://incoming.telemetry.mozilla.org/submit" +#define TELEMETRY_NAMESPACE L"/firefox-launcher-process" +#define TELEMETRY_LAUNCHER_PING_DOCTYPE L"/launcher-process-failure" +#define TELEMETRY_LAUNCHER_PING_VERSION L"/1" + +static const wchar_t kUrl[] = TELEMETRY_BASE_URL TELEMETRY_NAMESPACE + TELEMETRY_LAUNCHER_PING_DOCTYPE TELEMETRY_LAUNCHER_PING_VERSION L"/"; +static const uint32_t kGuidCharLenWithNul = 39; +static const uint32_t kGuidCharLenNoBracesNoNul = 36; +static const mozilla::StaticXREAppData* gAppData; + +// Ordinarily, errors are only reported to the Windows Event Log when they are +// not reported upstream via telemetry (usually due either to telemetry being +// disabled or to network failure). +// +// If `--log-launcher-error` is given at the command line, launcher errors will +// always be reported to the Windows Event Log, regardless of whether or not +// they're sent upstream. +static bool gForceEventLog = false; + +namespace { + +constexpr wchar_t kEventSourceName[] = L"" MOZ_APP_DISPLAYNAME " Launcher"; + +struct EventSourceDeleter { + using pointer = HANDLE; + + void operator()(pointer aEvtSrc) { ::DeregisterEventSource(aEvtSrc); } +}; + +using EventLog = mozilla::UniquePtr<HANDLE, EventSourceDeleter>; + +struct SerializedEventData { + HRESULT mHr; + uint32_t mLine; + char mFile[1]; +}; + +} // anonymous namespace + +static void PostErrorToLog(const mozilla::LauncherError& aError) { + // This is very bare-bones; just enough to spit out an HRESULT to the + // Application event log. + EventLog log(::RegisterEventSourceW(nullptr, kEventSourceName)); + + if (!log) { + return; + } + + size_t fileLen = strlen(aError.mFile); + size_t dataLen = sizeof(HRESULT) + sizeof(uint32_t) + fileLen; + auto evtDataBuf = mozilla::MakeUnique<char[]>(dataLen); + SerializedEventData& evtData = + *reinterpret_cast<SerializedEventData*>(evtDataBuf.get()); + evtData.mHr = aError.mError.AsHResult(); + evtData.mLine = aError.mLine; + // Since this is binary data, we're not concerning ourselves with null + // terminators. + memcpy(evtData.mFile, aError.mFile, fileLen); + + ::ReportEventW(log.get(), EVENTLOG_ERROR_TYPE, 0, aError.mError.AsHResult(), + nullptr, 0, dataLen, nullptr, evtDataBuf.get()); +} + +#if defined(MOZ_TELEMETRY_REPORTING) + +namespace { + +// This JSONWriteFunc writes directly to a temp file. By creating this file +// with the FILE_ATTRIBUTE_TEMPORARY attribute, we hint to the OS that this +// file is short-lived. The OS will try to avoid flushing it to disk if at +// all possible. +class TempFileWriter final : public mozilla::JSONWriteFunc { + public: + TempFileWriter() : mFailed(false), mSuccessfulHandoff(false) { + wchar_t name[MAX_PATH + 1] = {}; + if (_wtmpnam_s(name)) { + mFailed = true; + return; + } + + mTempFileName = name; + + mTempFile.own(::CreateFileW(name, GENERIC_WRITE, FILE_SHARE_READ, nullptr, + CREATE_NEW, FILE_ATTRIBUTE_TEMPORARY, nullptr)); + if (mTempFile.get() == INVALID_HANDLE_VALUE) { + mFailed = true; + } + } + + ~TempFileWriter() { + if (mSuccessfulHandoff) { + // It is no longer our responsibility to delete the temp file if we have + // successfully handed it off to pingsender. + return; + } + + mTempFile.reset(); + ::DeleteFileW(mTempFileName.c_str()); + } + + explicit operator bool() const { return !mFailed; } + + void Write(const mozilla::Span<const char>& aStr) final { + if (mFailed) { + return; + } + + DWORD bytesWritten = 0; + if (!::WriteFile(mTempFile, aStr.data(), aStr.size(), &bytesWritten, + nullptr) || + bytesWritten != aStr.size()) { + mFailed = true; + } + } + + const std::wstring& GetFileName() const { return mTempFileName; } + + void SetSuccessfulHandoff() { mSuccessfulHandoff = true; } + + private: + bool mFailed; + bool mSuccessfulHandoff; + std::wstring mTempFileName; + nsAutoHandle mTempFile; +}; + +using SigMap = mozilla::Vector<std::wstring, 0, InfallibleAllocPolicy>; + +} // anonymous namespace + +// This is the guideline for maximum string length for telemetry intake +static const size_t kMaxStrLen = 80; + +static mozilla::UniquePtr<char[]> WideToUTF8(const wchar_t* aStr, + const size_t aStrLenExclNul) { + // Yes, this might not handle surrogate pairs correctly. Let's just let + // WideCharToMultiByte fail in that unlikely case. + size_t cvtLen = std::min(aStrLenExclNul, kMaxStrLen); + + int numConv = ::WideCharToMultiByte(CP_UTF8, 0, aStr, cvtLen, nullptr, 0, + nullptr, nullptr); + if (!numConv) { + return nullptr; + } + + // Include room for the null terminator by adding one + auto buf = mozilla::MakeUnique<char[]>(numConv + 1); + + numConv = ::WideCharToMultiByte(CP_UTF8, 0, aStr, cvtLen, buf.get(), numConv, + nullptr, nullptr); + if (!numConv) { + return nullptr; + } + + // Add null termination. numConv does not include the terminator, so we don't + // subtract 1 when indexing into buf. + buf[numConv] = 0; + + return buf; +} + +static mozilla::UniquePtr<char[]> WideToUTF8(const wchar_t* aStr) { + return WideToUTF8(aStr, wcslen(aStr)); +} + +static mozilla::UniquePtr<char[]> WideToUTF8(const std::wstring& aStr) { + return WideToUTF8(aStr.c_str(), aStr.length()); +} + +// MinGW does not support the Windows Security Center APIs. +# if !defined(__MINGW32__) + +static mozilla::UniquePtr<char[]> WideToUTF8(const _bstr_t& aStr) { + return WideToUTF8(static_cast<const wchar_t*>(aStr), aStr.length()); +} + +namespace { + +struct ProviderKey { + WSC_SECURITY_PROVIDER mProviderType; + const char* mKey; +}; + +} // anonymous namespace + +static bool EnumWSCProductList(RefPtr<IWSCProductList>& aProdList, + mozilla::JSONWriter& aJson) { + LONG count; + HRESULT hr = aProdList->get_Count(&count); + if (FAILED(hr)) { + return false; + } + + // Unlikely, but put a bound on the max length of the output array for the + // purposes of telemetry intake. + count = std::min(count, 1000L); + + // Record the name(s) of each active registered product in this category + for (LONG index = 0; index < count; ++index) { + RefPtr<IWscProduct> product; + hr = aProdList->get_Item(index, getter_AddRefs(product)); + if (FAILED(hr)) { + return false; + } + + WSC_SECURITY_PRODUCT_STATE state; + hr = product->get_ProductState(&state); + if (FAILED(hr)) { + return false; + } + + // We only care about products that are active + if (state == WSC_SECURITY_PRODUCT_STATE_OFF || + state == WSC_SECURITY_PRODUCT_STATE_SNOOZED || + state == WSC_SECURITY_PRODUCT_STATE_EXPIRED) { + continue; + } + + _bstr_t bName; + hr = product->get_ProductName(bName.GetAddress()); + if (FAILED(hr)) { + return false; + } + + auto buf = WideToUTF8(bName); + if (!buf) { + return false; + } + + aJson.StringElement(mozilla::MakeStringSpan(buf.get())); + } + + return true; +} + +static const ProviderKey gProvKeys[] = { + {WSC_SECURITY_PROVIDER_ANTIVIRUS, "av"}, + {WSC_SECURITY_PROVIDER_ANTISPYWARE, "antispyware"}, + {WSC_SECURITY_PROVIDER_FIREWALL, "firewall"}}; + +static bool AddWscInfo(mozilla::JSONWriter& aJson) { + if (!mozilla::IsWin8OrLater()) { + // We haven't written anything yet, so we can return true here and continue + // capturing data. + return true; + } + + // We need COM for this. Using ProcessRuntime so that process-global COM + // configuration is done correctly + mozilla::mscom::ProcessRuntime mscom( + mozilla::mscom::ProcessRuntime::ProcessCategory::Launcher); + if (!mscom) { + // We haven't written anything yet, so we can return true here and continue + // capturing data. + return true; + } + + aJson.StartObjectProperty("security"); + + const CLSID clsid = __uuidof(WSCProductList); + const IID iid = __uuidof(IWSCProductList); + + for (uint32_t index = 0; index < mozilla::ArrayLength(gProvKeys); ++index) { + // NB: A separate instance of IWSCProductList is needed for each distinct + // security provider type; MSDN says that we cannot reuse the same object + // and call Initialize() to pave over the previous data. + RefPtr<IWSCProductList> prodList; + HRESULT hr = ::CoCreateInstance(clsid, nullptr, CLSCTX_INPROC_SERVER, iid, + getter_AddRefs(prodList)); + if (FAILED(hr)) { + return false; + } + + hr = prodList->Initialize(gProvKeys[index].mProviderType); + if (FAILED(hr)) { + return false; + } + + aJson.StartArrayProperty(mozilla::MakeStringSpan(gProvKeys[index].mKey)); + + if (!EnumWSCProductList(prodList, aJson)) { + return false; + } + + aJson.EndArray(); + } + + aJson.EndObject(); + + return true; +} +# endif // !defined(__MINGW32__) + +// Max array length for telemetry intake. +static const size_t kMaxArrayLen = 1000; + +static bool AddModuleInfo(const nsAutoHandle& aSnapshot, + mozilla::JSONWriter& aJson) { + if (aSnapshot.get() == INVALID_HANDLE_VALUE) { + // We haven't written anything yet, so we can return true here and continue + // capturing data. + return true; + } + + SigMap signatures; + size_t moduleCount = 0; + + MODULEENTRY32W module = {sizeof(module)}; + if (!::Module32FirstW(aSnapshot, &module)) { + // We haven't written anything yet, so we can return true here and continue + // capturing data. + return true; + } + + mozilla::glue::BasicDllServices dllServices; + + aJson.StartObjectProperty("modules"); + + // For each module, add its version number (or empty string if not present), + // followed by an optional index into the signatures array + do { + ++moduleCount; + + wchar_t leaf[_MAX_FNAME] = {}; + if (::_wsplitpath_s(module.szExePath, nullptr, 0, nullptr, 0, leaf, + mozilla::ArrayLength(leaf), nullptr, 0)) { + return false; + } + + if (_wcslwr_s(leaf, mozilla::ArrayLength(leaf))) { + return false; + } + + auto leafUtf8 = WideToUTF8(leaf); + if (!leafUtf8) { + return false; + } + + aJson.StartArrayProperty(mozilla::MakeStringSpan(leafUtf8.get())); + + std::string version; + DWORD verInfoSize = ::GetFileVersionInfoSizeW(module.szExePath, nullptr); + if (verInfoSize) { + auto verInfoBuf = mozilla::MakeUnique<BYTE[]>(verInfoSize); + + if (::GetFileVersionInfoW(module.szExePath, 0, verInfoSize, + verInfoBuf.get())) { + VS_FIXEDFILEINFO* fixedInfo = nullptr; + UINT fixedInfoLen = 0; + + if (::VerQueryValueW(verInfoBuf.get(), L"\\", + reinterpret_cast<LPVOID*>(&fixedInfo), + &fixedInfoLen)) { + std::ostringstream oss; + oss << HIWORD(fixedInfo->dwFileVersionMS) << '.' + << LOWORD(fixedInfo->dwFileVersionMS) << '.' + << HIWORD(fixedInfo->dwFileVersionLS) << '.' + << LOWORD(fixedInfo->dwFileVersionLS); + version = oss.str(); + } + } + } + + aJson.StringElement(version); + + mozilla::Maybe<ptrdiff_t> sigIndex; + auto signedBy = dllServices.GetBinaryOrgName(module.szExePath); + if (signedBy) { + std::wstring strSignedBy(signedBy.get()); + auto entry = std::find(signatures.begin(), signatures.end(), strSignedBy); + if (entry == signatures.end()) { + mozilla::Unused << signatures.append(std::move(strSignedBy)); + entry = &signatures.back(); + } + + sigIndex = mozilla::Some(entry - signatures.begin()); + } + + if (sigIndex) { + aJson.IntElement(sigIndex.value()); + } + + aJson.EndArray(); + } while (moduleCount < kMaxArrayLen && ::Module32NextW(aSnapshot, &module)); + + aJson.EndObject(); + + aJson.StartArrayProperty("signatures"); + + // Serialize each entry in the signatures array + for (auto&& itr : signatures) { + auto sigUtf8 = WideToUTF8(itr); + if (!sigUtf8) { + continue; + } + + aJson.StringElement(mozilla::MakeStringSpan(sigUtf8.get())); + } + + aJson.EndArray(); + + return true; +} + +namespace { + +struct PingThreadContext { + explicit PingThreadContext(const mozilla::LauncherError& aError, + const char* aProcessType) + : mLauncherError(aError), + mModulesSnapshot(::CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, 0)), + mProcessType(aProcessType ? aProcessType : "") {} + mozilla::LauncherError mLauncherError; + nsAutoHandle mModulesSnapshot; + std::string mProcessType; +}; + +} // anonymous namespace + +static bool PrepPing(const PingThreadContext& aContext, const std::wstring& aId, + mozilla::JSONWriter& aJson) { +# if defined(DEBUG) + const mozilla::JSONWriter::CollectionStyle style = + mozilla::JSONWriter::MultiLineStyle; +# else + const mozilla::JSONWriter::CollectionStyle style = + mozilla::JSONWriter::SingleLineStyle; +# endif // defined(DEBUG) + + aJson.Start(style); + + aJson.StringProperty("type", "launcher-process-failure"); + aJson.IntProperty("version", 1); + + auto idUtf8 = WideToUTF8(aId); + if (idUtf8) { + aJson.StringProperty("id", mozilla::MakeStringSpan(idUtf8.get())); + } + + time_t now; + time(&now); + tm gmTm; + if (!gmtime_s(&gmTm, &now)) { + char isoTimeBuf[32] = {}; + if (strftime(isoTimeBuf, mozilla::ArrayLength(isoTimeBuf), "%FT%T.000Z", + &gmTm)) { + aJson.StringProperty("creationDate", isoTimeBuf); + } + } + + aJson.StringProperty("update_channel", QUOTE_ME(MOZ_UPDATE_CHANNEL)); + + if (gAppData) { + aJson.StringProperty("build_id", + mozilla::MakeStringSpan(gAppData->buildID)); + aJson.StringProperty("build_version", + mozilla::MakeStringSpan(gAppData->version)); + } + + OSVERSIONINFOEXW osv = {sizeof(osv)}; + if (::GetVersionExW(reinterpret_cast<OSVERSIONINFOW*>(&osv))) { + std::ostringstream oss; + oss << osv.dwMajorVersion << "." << osv.dwMinorVersion << "." + << osv.dwBuildNumber; + + if (osv.dwMajorVersion == 10 && osv.dwMinorVersion == 0) { + // Get the "Update Build Revision" (UBR) value + DWORD ubrValue; + DWORD ubrValueLen = sizeof(ubrValue); + LSTATUS ubrOk = + ::RegGetValueW(HKEY_LOCAL_MACHINE, + L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", + L"UBR", RRF_RT_DWORD | RRF_SUBKEY_WOW6464KEY, nullptr, + &ubrValue, &ubrValueLen); + if (ubrOk == ERROR_SUCCESS) { + oss << "." << ubrValue; + } + } + + if (oss) { + aJson.StringProperty("os_version", oss.str()); + } + + bool isServer = osv.wProductType == VER_NT_DOMAIN_CONTROLLER || + osv.wProductType == VER_NT_SERVER; + aJson.BoolProperty("server_os", isServer); + } + + WCHAR localeName[LOCALE_NAME_MAX_LENGTH] = {}; + int localeNameLen = + ::GetUserDefaultLocaleName(localeName, mozilla::ArrayLength(localeName)); + if (localeNameLen) { + auto localeNameUtf8 = WideToUTF8(localeName, localeNameLen - 1); + if (localeNameUtf8) { + aJson.StringProperty("os_locale", + mozilla::MakeStringSpan(localeNameUtf8.get())); + } + } + + SYSTEM_INFO sysInfo; + ::GetNativeSystemInfo(&sysInfo); + aJson.IntProperty("cpu_arch", sysInfo.wProcessorArchitecture); + aJson.IntProperty("num_logical_cpus", sysInfo.dwNumberOfProcessors); + + mozilla::LauncherResult<bool> isAdminWithoutUac = + mozilla::IsAdminWithoutUac(); + if (isAdminWithoutUac.isOk()) { + aJson.BoolProperty("is_admin_without_uac", isAdminWithoutUac.unwrap()); + } + + if (!aContext.mProcessType.empty()) { + aJson.StringProperty("process_type", aContext.mProcessType); + } + + MEMORYSTATUSEX memStatus = {sizeof(memStatus)}; + if (::GlobalMemoryStatusEx(&memStatus)) { + aJson.StartObjectProperty("memory"); + aJson.IntProperty("total_phys", memStatus.ullTotalPhys); + aJson.IntProperty("avail_phys", memStatus.ullAvailPhys); + aJson.IntProperty("avail_page_file", memStatus.ullAvailPageFile); + aJson.IntProperty("avail_virt", memStatus.ullAvailVirtual); + aJson.EndObject(); + } + + aJson.StringProperty("xpcom_abi", TARGET_XPCOM_ABI); + + aJson.StartObjectProperty("launcher_error", style); + + std::string srcFileLeaf(aContext.mLauncherError.mFile); + // Obtain the leaf name of the file for privacy reasons + // (In case this is somebody's local build) + auto pos = srcFileLeaf.find_last_of("/\\"); + if (pos != std::string::npos) { + srcFileLeaf = srcFileLeaf.substr(pos + 1); + } + + aJson.StringProperty("source_file", srcFileLeaf); + + aJson.IntProperty("source_line", aContext.mLauncherError.mLine); + aJson.IntProperty("hresult", aContext.mLauncherError.mError.AsHResult()); + +# if defined(NIGHTLY_BUILD) + if (aContext.mLauncherError.mDetourError.isSome()) { + static const char* kHexMap = "0123456789abcdef"; + char hexStr[sizeof(mozilla::DetourError::mOrigBytes) * 2 + 1]; + int cnt = 0; + for (uint8_t byte : aContext.mLauncherError.mDetourError->mOrigBytes) { + hexStr[cnt++] = kHexMap[(byte >> 4) & 0x0f]; + hexStr[cnt++] = kHexMap[byte & 0x0f]; + } + hexStr[cnt] = 0; + aJson.StringProperty("detour_orig_bytes", hexStr); + } +# endif // defined(NIGHTLY_BUILD) + + aJson.EndObject(); + +# if !defined(__MINGW32__) + if (!AddWscInfo(aJson)) { + return false; + } +# endif // !defined(__MINGW32__) + + if (!AddModuleInfo(aContext.mModulesSnapshot, aJson)) { + return false; + } + + aJson.End(); + + return true; +} + +static bool DoSendPing(const PingThreadContext& aContext) { + TempFileWriter tempFile; + mozilla::JSONWriter json(tempFile); + + UUID uuid; + if (::UuidCreate(&uuid) != RPC_S_OK) { + return false; + } + + wchar_t guidBuf[kGuidCharLenWithNul] = {}; + if (::StringFromGUID2(uuid, guidBuf, kGuidCharLenWithNul) != + kGuidCharLenWithNul) { + return false; + } + + // Strip the curly braces off of the guid + std::wstring guidNoBraces(guidBuf + 1, kGuidCharLenNoBracesNoNul); + + // Populate json with the ping information + if (!PrepPing(aContext, guidNoBraces, json)) { + return false; + } + + // Obtain the name of the temp file that we have written + const std::wstring& fileName = tempFile.GetFileName(); + + // Using the path to our executable binary, construct the path to + // pingsender.exe + mozilla::UniquePtr<wchar_t[]> exePath(mozilla::GetFullBinaryPath()); + + wchar_t drive[_MAX_DRIVE] = {}; + wchar_t dir[_MAX_DIR] = {}; + if (_wsplitpath_s(exePath.get(), drive, mozilla::ArrayLength(drive), dir, + mozilla::ArrayLength(dir), nullptr, 0, nullptr, 0)) { + return false; + } + + wchar_t pingSenderPath[MAX_PATH + 1] = {}; + if (_wmakepath_s(pingSenderPath, mozilla::ArrayLength(pingSenderPath), drive, + dir, L"pingsender", L"exe")) { + return false; + } + + // Construct the telemetry URL + wchar_t urlBuf[mozilla::ArrayLength(kUrl) + kGuidCharLenNoBracesNoNul] = {}; + if (wcscpy_s(urlBuf, kUrl)) { + return false; + } + + if (wcscat_s(urlBuf, guidNoBraces.c_str())) { + return false; + } + + // Now build the command line arguments to pingsender + wchar_t* pingSenderArgv[] = {pingSenderPath, urlBuf, + const_cast<wchar_t*>(fileName.c_str())}; + + mozilla::UniquePtr<wchar_t[]> pingSenderCmdLine(mozilla::MakeCommandLine( + mozilla::ArrayLength(pingSenderArgv), pingSenderArgv)); + + // Now start pingsender to handle the rest + PROCESS_INFORMATION pi; + + STARTUPINFOW si = {sizeof(si)}; + si.dwFlags = STARTF_USESHOWWINDOW; + si.wShowWindow = SW_HIDE; + + if (!::CreateProcessW(pingSenderPath, pingSenderCmdLine.get(), nullptr, + nullptr, FALSE, 0, nullptr, nullptr, &si, &pi)) { + return false; + } + + tempFile.SetSuccessfulHandoff(); + + nsAutoHandle proc(pi.hProcess); + nsAutoHandle thread(pi.hThread); + + return true; +} + +static unsigned __stdcall SendPingThread(void* aContext) { + mozilla::UniquePtr<PingThreadContext> context( + reinterpret_cast<PingThreadContext*>(aContext)); + + if (!DoSendPing(*context) || gForceEventLog) { + PostErrorToLog(context->mLauncherError); + } + + return 0; +} + +#endif // defined(MOZ_TELEMETRY_REPORTING) + +static bool SendPing(const mozilla::LauncherError& aError, + const char* aProcessType) { +#if defined(MOZ_TELEMETRY_REPORTING) +# if defined(MOZ_LAUNCHER_PROCESS) + mozilla::LauncherRegistryInfo regInfo; + mozilla::LauncherResult<bool> telemetryEnabled = regInfo.IsTelemetryEnabled(); + if (telemetryEnabled.isErr() || !telemetryEnabled.unwrap()) { + // Do not send anything if telemetry has been opted out + return false; + } +# endif // defined(MOZ_LAUNCHER_PROCESS) + + // We send this ping when the launcher process fails. After we start the + // SendPingThread, this thread falls back from running as the launcher process + // to running as the browser main thread. Once this happens, it will be unsafe + // to set up PoisonIOInterposer (since we have already spun up a background + // thread). + mozilla::SaveToEnv("MOZ_DISABLE_POISON_IO_INTERPOSER=1"); + + // Capture aError and our module list into context for processing on another + // thread. + auto thdParam = mozilla::MakeUnique<PingThreadContext>(aError, aProcessType); + + // The ping does a lot of file I/O. Since we want this thread to continue + // executing browser startup, we should gather that information on a + // background thread. + uintptr_t thdHandle = + _beginthreadex(nullptr, 0, &SendPingThread, thdParam.get(), + STACK_SIZE_PARAM_IS_A_RESERVATION, nullptr); + if (!thdHandle) { + return false; + } + + // We have handed off thdParam to the background thread + mozilla::Unused << thdParam.release(); + + ::CloseHandle(reinterpret_cast<HANDLE>(thdHandle)); + return true; +#else + return false; +#endif +} + +namespace mozilla { + +void HandleLauncherError(const LauncherError& aError, + const char* aProcessType) { +#if defined(MOZ_LAUNCHER_PROCESS) + LauncherRegistryInfo regInfo; + Unused << regInfo.DisableDueToFailure(); +#endif // defined(MOZ_LAUNCHER_PROCESS) + + if (!SendPing(aError, aProcessType)) { + // couldn't (or shouldn't) send telemetry; fall back to event log + PostErrorToLog(aError); + } +} + +void SetLauncherErrorAppData(const StaticXREAppData& aAppData) { + gAppData = &aAppData; +} + +void SetLauncherErrorForceEventLog() { gForceEventLog = true; } + +} // namespace mozilla diff --git a/browser/app/winlauncher/ErrorHandler.h b/browser/app/winlauncher/ErrorHandler.h new file mode 100644 index 0000000000..71fe72cf07 --- /dev/null +++ b/browser/app/winlauncher/ErrorHandler.h @@ -0,0 +1,54 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* vim: set ts=8 sts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. */ + +#ifndef mozilla_ErrorHandler_h +#define mozilla_ErrorHandler_h + +#include "mozilla/Assertions.h" +#include "mozilla/WinHeaderOnlyUtils.h" + +namespace mozilla { + +/** + * All launcher process error handling should live in the implementation of + * this function. + */ +void HandleLauncherError(const LauncherError& aError, + const char* aProcessType = nullptr); + +// This function is simply a convenience overload that automatically unwraps +// the LauncherError from the provided LauncherResult and then forwards it to +// the main implementation. +template <typename T> +inline void HandleLauncherError(const LauncherResult<T>& aResult, + const char* aProcessType = nullptr) { + MOZ_ASSERT(aResult.isErr()); + if (aResult.isOk()) { + return; + } + + HandleLauncherError(aResult.inspectErr(), aProcessType); +} + +// This function is simply a convenience overload that unwraps the provided +// GenericErrorResult<LauncherError> and forwards it to the main implementation. +inline void HandleLauncherError( + const GenericErrorResult<LauncherError>& aResult, + const char* aProcessType = nullptr) { + LauncherVoidResult r(aResult); + HandleLauncherError(r, aProcessType); +} + +// Forward declaration +struct StaticXREAppData; + +void SetLauncherErrorAppData(const StaticXREAppData& aAppData); + +void SetLauncherErrorForceEventLog(); + +} // namespace mozilla + +#endif // mozilla_ErrorHandler_h diff --git a/browser/app/winlauncher/LaunchUnelevated.cpp b/browser/app/winlauncher/LaunchUnelevated.cpp new file mode 100644 index 0000000000..fa4dccb22d --- /dev/null +++ b/browser/app/winlauncher/LaunchUnelevated.cpp @@ -0,0 +1,288 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* vim: set ts=8 sts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. */ + +#define MOZ_USE_LAUNCHER_ERROR + +#include "LaunchUnelevated.h" + +#include "mozilla/Assertions.h" +#include "mozilla/CmdLineAndEnvUtils.h" +#include "mozilla/mscom/ProcessRuntime.h" +#include "mozilla/RefPtr.h" +#include "mozilla/ShellHeaderOnlyUtils.h" +#include "mozilla/WinHeaderOnlyUtils.h" +#include "../BrowserDefines.h" +#include "nsWindowsHelpers.h" + +#include <windows.h> + +static mozilla::LauncherResult<bool> IsHighIntegrity( + const nsAutoHandle& aToken) { + DWORD reqdLen; + if (!::GetTokenInformation(aToken.get(), TokenIntegrityLevel, nullptr, 0, + &reqdLen)) { + DWORD err = ::GetLastError(); + if (err != ERROR_INSUFFICIENT_BUFFER) { + return LAUNCHER_ERROR_FROM_WIN32(err); + } + } + + auto buf = mozilla::MakeUnique<char[]>(reqdLen); + + if (!::GetTokenInformation(aToken.get(), TokenIntegrityLevel, buf.get(), + reqdLen, &reqdLen)) { + return LAUNCHER_ERROR_FROM_LAST(); + } + + auto tokenLabel = reinterpret_cast<PTOKEN_MANDATORY_LABEL>(buf.get()); + + DWORD subAuthCount = *::GetSidSubAuthorityCount(tokenLabel->Label.Sid); + DWORD integrityLevel = + *::GetSidSubAuthority(tokenLabel->Label.Sid, subAuthCount - 1); + return integrityLevel > SECURITY_MANDATORY_MEDIUM_RID; +} + +static mozilla::LauncherResult<HANDLE> GetMediumIntegrityToken( + const nsAutoHandle& aProcessToken) { + HANDLE rawResult; + if (!::DuplicateTokenEx(aProcessToken.get(), 0, nullptr, + SecurityImpersonation, TokenPrimary, &rawResult)) { + return LAUNCHER_ERROR_FROM_LAST(); + } + + nsAutoHandle result(rawResult); + + BYTE mediumIlSid[SECURITY_MAX_SID_SIZE]; + DWORD mediumIlSidSize = sizeof(mediumIlSid); + if (!::CreateWellKnownSid(WinMediumLabelSid, nullptr, mediumIlSid, + &mediumIlSidSize)) { + return LAUNCHER_ERROR_FROM_LAST(); + } + + TOKEN_MANDATORY_LABEL integrityLevel = {}; + integrityLevel.Label.Attributes = SE_GROUP_INTEGRITY; + integrityLevel.Label.Sid = reinterpret_cast<PSID>(mediumIlSid); + + if (!::SetTokenInformation(rawResult, TokenIntegrityLevel, &integrityLevel, + sizeof(integrityLevel))) { + return LAUNCHER_ERROR_FROM_LAST(); + } + + return result.disown(); +} + +static mozilla::LauncherResult<bool> IsAdminByAppCompat( + HKEY aRootKey, const wchar_t* aExecutablePath) { + static const wchar_t kPathToLayers[] = + L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\" + L"AppCompatFlags\\Layers"; + + DWORD dataLength = 0; + LSTATUS status = ::RegGetValueW(aRootKey, kPathToLayers, aExecutablePath, + RRF_RT_REG_SZ | RRF_SUBKEY_WOW6464KEY, + nullptr, nullptr, &dataLength); + if (status == ERROR_FILE_NOT_FOUND) { + return false; + } else if (status != ERROR_SUCCESS) { + return LAUNCHER_ERROR_FROM_WIN32(status); + } + + auto valueData = mozilla::MakeUnique<wchar_t[]>(dataLength); + if (!valueData) { + return LAUNCHER_ERROR_FROM_WIN32(ERROR_OUTOFMEMORY); + } + + status = ::RegGetValueW(aRootKey, kPathToLayers, aExecutablePath, + RRF_RT_REG_SZ | RRF_SUBKEY_WOW6464KEY, nullptr, + valueData.get(), &dataLength); + if (status != ERROR_SUCCESS) { + return LAUNCHER_ERROR_FROM_WIN32(status); + } + + const wchar_t kRunAsAdmin[] = L"RUNASADMIN"; + const wchar_t kDelimiters[] = L" "; + wchar_t* tokenContext = nullptr; + const wchar_t* token = wcstok_s(valueData.get(), kDelimiters, &tokenContext); + while (token) { + if (!_wcsnicmp(token, kRunAsAdmin, mozilla::ArrayLength(kRunAsAdmin))) { + return true; + } + token = wcstok_s(nullptr, kDelimiters, &tokenContext); + } + + return false; +} + +namespace mozilla { + +// If we're running at an elevated integrity level, re-run ourselves at the +// user's normal integrity level. We do this by locating the active explorer +// shell, and then asking it to do a ShellExecute on our behalf. We do it this +// way to ensure that the child process runs as the original user in the active +// session; an elevated process could be running with different credentials than +// those of the session. +// See https://devblogs.microsoft.com/oldnewthing/20131118-00/?p=2643 + +LauncherVoidResult LaunchUnelevated(int aArgc, wchar_t* aArgv[]) { + // We need COM to talk to Explorer. Using ProcessRuntime so that + // process-global COM configuration is done correctly + mozilla::mscom::ProcessRuntime mscom( + mozilla::mscom::ProcessRuntime::ProcessCategory::Launcher); + if (!mscom) { + return LAUNCHER_ERROR_FROM_HRESULT(mscom.GetHResult()); + } + + // Omit the original argv[0] because ShellExecute doesn't need it. Insert + // ATTEMPTING_DEELEVATION_FLAG so that we know not to attempt to restart + // ourselves if deelevation fails. + UniquePtr<wchar_t[]> cmdLine = [&]() { + constexpr wchar_t const* kTagArg = L"--" ATTEMPTING_DEELEVATION_FLAG; + + // This should have already been checked, but just in case... + EnsureBrowserCommandlineSafe(aArgc, aArgv); + + if (mozilla::CheckArg(aArgc, aArgv, "osint", nullptr, CheckArgFlag::None)) { + // If the command line contains -osint, we have to arrange things in a + // particular order. + // + // (We can't just replace -osint with kTagArg, unfortunately: there is + // code in the browser which behaves differently in the presence of an + // `-osint` tag, but which will not have had a chance to react to this. + // See, _e.g._, bug 1243603.) + auto const aArgvCopy = MakeUnique<wchar_t const*[]>(aArgc + 1); + aArgvCopy[0] = aArgv[1]; + aArgvCopy[1] = kTagArg; + for (int i = 2; i < aArgc; ++i) { + aArgvCopy[i] = aArgv[i]; + } + aArgvCopy[aArgc] = nullptr; // because argv[argc] is NULL + return MakeCommandLine(aArgc, aArgvCopy.get(), 0, nullptr); + } else { + // Otherwise, just tack it on at the end. + constexpr wchar_t const* const kTagArgArray[] = {kTagArg}; + return MakeCommandLine(aArgc - 1, aArgv + 1, 1, kTagArgArray); + } + }(); + if (!cmdLine) { + return LAUNCHER_ERROR_GENERIC(); + } + + _bstr_t cmd; + + UniquePtr<wchar_t[]> packageFamilyName = mozilla::GetPackageFamilyName(); + if (packageFamilyName) { + int cmdLen = + // 22 for the prefix + suffix + null terminator below + 22 + wcslen(packageFamilyName.get()); + wchar_t appCmd[cmdLen]; + swprintf(appCmd, cmdLen, L"shell:appsFolder\\%s!App", + packageFamilyName.get()); + cmd = appCmd; + } else { + cmd = aArgv[0]; + } + + _variant_t args(cmdLine.get()); + _variant_t operation(L"open"); + _variant_t directory; + _variant_t showCmd(SW_SHOWNORMAL); + return ShellExecuteByExplorer(cmd, args, operation, directory, showCmd); +} + +LauncherResult<ElevationState> GetElevationState( + const wchar_t* aExecutablePath, mozilla::LauncherFlags aFlags, + nsAutoHandle& aOutMediumIlToken) { + aOutMediumIlToken.reset(); + + const DWORD tokenFlags = TOKEN_QUERY | TOKEN_DUPLICATE | + TOKEN_ADJUST_DEFAULT | TOKEN_ASSIGN_PRIMARY; + HANDLE rawToken; + if (!::OpenProcessToken(::GetCurrentProcess(), tokenFlags, &rawToken)) { + return LAUNCHER_ERROR_FROM_LAST(); + } + + nsAutoHandle token(rawToken); + + LauncherResult<TOKEN_ELEVATION_TYPE> elevationType = GetElevationType(token); + if (elevationType.isErr()) { + return elevationType.propagateErr(); + } + + Maybe<ElevationState> elevationState; + switch (elevationType.unwrap()) { + case TokenElevationTypeLimited: + return ElevationState::eNormalUser; + case TokenElevationTypeFull: + elevationState = Some(ElevationState::eElevated); + break; + case TokenElevationTypeDefault: { + // In this case, UAC is disabled. We do not yet know whether or not we + // are running at high integrity. If we are at high integrity, we can't + // relaunch ourselves in a non-elevated state via Explorer, as we would + // just end up in an infinite loop of launcher processes re-launching + // themselves. + LauncherResult<bool> isHighIntegrity = IsHighIntegrity(token); + if (isHighIntegrity.isErr()) { + return isHighIntegrity.propagateErr(); + } + + if (!isHighIntegrity.unwrap()) { + return ElevationState::eNormalUser; + } + + elevationState = Some(ElevationState::eHighIntegrityNoUAC); + break; + } + default: + MOZ_ASSERT_UNREACHABLE("Was a new value added to the enumeration?"); + return LAUNCHER_ERROR_GENERIC(); + } + + MOZ_ASSERT(elevationState.isSome() && + elevationState.value() != ElevationState::eNormalUser, + "Should have returned earlier for the eNormalUser case."); + + LauncherResult<bool> isAdminByAppCompat = + IsAdminByAppCompat(HKEY_CURRENT_USER, aExecutablePath); + if (isAdminByAppCompat.isErr()) { + return isAdminByAppCompat.propagateErr(); + } + + if (isAdminByAppCompat.unwrap()) { + elevationState = Some(ElevationState::eHighIntegrityByAppCompat); + } else { + isAdminByAppCompat = + IsAdminByAppCompat(HKEY_LOCAL_MACHINE, aExecutablePath); + if (isAdminByAppCompat.isErr()) { + return isAdminByAppCompat.propagateErr(); + } + + if (isAdminByAppCompat.unwrap()) { + elevationState = Some(ElevationState::eHighIntegrityByAppCompat); + } + } + + // A medium IL token is not needed in the following cases. + // 1) We keep the process elevated (= LauncherFlags::eNoDeelevate) + // 2) The process was elevated by UAC (= ElevationState::eElevated) + // AND the launcher process doesn't wait for the browser process + if ((aFlags & mozilla::LauncherFlags::eNoDeelevate) || + (elevationState.value() == ElevationState::eElevated && + !(aFlags & mozilla::LauncherFlags::eWaitForBrowser))) { + return elevationState.value(); + } + + LauncherResult<HANDLE> tokenResult = GetMediumIntegrityToken(token); + if (tokenResult.isOk()) { + aOutMediumIlToken.own(tokenResult.unwrap()); + } else { + return tokenResult.propagateErr(); + } + + return elevationState.value(); +} + +} // namespace mozilla diff --git a/browser/app/winlauncher/LaunchUnelevated.h b/browser/app/winlauncher/LaunchUnelevated.h new file mode 100644 index 0000000000..8c6679edf3 --- /dev/null +++ b/browser/app/winlauncher/LaunchUnelevated.h @@ -0,0 +1,32 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* vim: set ts=8 sts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. */ + +#ifndef mozilla_LaunchUnelevated_h +#define mozilla_LaunchUnelevated_h + +#include "LauncherProcessWin.h" +#include "mozilla/WinHeaderOnlyUtils.h" +#include "mozilla/Maybe.h" +#include "nsWindowsHelpers.h" + +namespace mozilla { + +enum class ElevationState { + eNormalUser = 0, + eElevated = (1 << 0), + eHighIntegrityNoUAC = (1 << 1), + eHighIntegrityByAppCompat = (1 << 2), +}; + +LauncherResult<ElevationState> GetElevationState( + const wchar_t* aExecutablePath, LauncherFlags aFlags, + nsAutoHandle& aOutMediumIlToken); + +LauncherVoidResult LaunchUnelevated(int aArgc, wchar_t* aArgv[]); + +} // namespace mozilla + +#endif // mozilla_LaunchUnelevated_h diff --git a/browser/app/winlauncher/LauncherProcessWin.cpp b/browser/app/winlauncher/LauncherProcessWin.cpp new file mode 100644 index 0000000000..33b8ed52bf --- /dev/null +++ b/browser/app/winlauncher/LauncherProcessWin.cpp @@ -0,0 +1,538 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* vim: set ts=8 sts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. */ + +#define MOZ_USE_LAUNCHER_ERROR + +#include "LauncherProcessWin.h" + +#include <string.h> + +#include "mozilla/Attributes.h" +#include "mozilla/CmdLineAndEnvUtils.h" +#include "mozilla/DebugOnly.h" +#include "mozilla/DynamicallyLinkedFunctionPtr.h" +#include "mozilla/glue/Debug.h" +#include "mozilla/GeckoArgs.h" +#include "mozilla/Maybe.h" +#include "mozilla/SafeMode.h" +#include "mozilla/UniquePtr.h" +#include "mozilla/WindowsConsole.h" +#include "mozilla/WindowsVersion.h" +#include "mozilla/WinHeaderOnlyUtils.h" +#include "nsWindowsHelpers.h" + +#include <windows.h> +#include <processthreadsapi.h> + +#include "DllBlocklistInit.h" +#include "ErrorHandler.h" +#include "LaunchUnelevated.h" +#include "ProcThreadAttributes.h" +#include "../BrowserDefines.h" + +#if defined(MOZ_LAUNCHER_PROCESS) +# include "mozilla/LauncherRegistryInfo.h" +# include "SameBinary.h" +#endif // defined(MOZ_LAUNCHER_PROCESS) + +#if defined(MOZ_SANDBOX) +# include "mozilla/sandboxing/SandboxInitialization.h" +#endif + +namespace mozilla { +// "const" because nothing in this process modifies it. +// "volatile" because something in another process may. +const volatile DeelevationStatus gDeelevationStatus = + DeelevationStatus::DefaultStaticValue; +} // namespace mozilla + +/** + * At this point the child process has been created in a suspended state. Any + * additional startup work (eg, blocklist setup) should go here. + * + * @return Ok if browser startup should proceed + */ +static mozilla::LauncherVoidResult PostCreationSetup( + const wchar_t* aFullImagePath, HANDLE aChildProcess, + HANDLE aChildMainThread, mozilla::DeelevationStatus aDStatus, + const bool aIsSafeMode, const bool aDisableDynamicBlocklist, + mozilla::Maybe<std::wstring> aBlocklistFileName) { + /* scope for txManager */ { + mozilla::nt::CrossExecTransferManager txManager(aChildProcess); + if (!txManager) { + return LAUNCHER_ERROR_FROM_WIN32(ERROR_BAD_EXE_FORMAT); + } + + using mozilla::gDeelevationStatus; + + void* targetAddress = (LPVOID)&gDeelevationStatus; + + auto const guard = txManager.Protect( + targetAddress, sizeof(gDeelevationStatus), PAGE_READWRITE); + + mozilla::LauncherVoidResult result = + txManager.Transfer(targetAddress, &aDStatus, sizeof(aDStatus)); + if (result.isErr()) { + return result; + } + } + + return mozilla::InitializeDllBlocklistOOPFromLauncher( + aFullImagePath, aChildProcess, aDisableDynamicBlocklist, + aBlocklistFileName); +} + +/** + * Create a new Job object and assign |aProcess| to it. If something fails + * in this function, we return nullptr but continue without recording + * a launcher failure because it's not a critical problem to launch + * the browser process. + */ +static nsReturnRef<HANDLE> CreateJobAndAssignProcess(HANDLE aProcess) { + nsAutoHandle empty; + nsAutoHandle job(::CreateJobObjectW(nullptr, nullptr)); + + // Set JOB_OBJECT_LIMIT_BREAKAWAY_OK to allow the browser process + // to put child processes into a job on Win7, which does not support + // nested jobs. See CanUseJob() in sandboxBroker.cpp. + JOBOBJECT_EXTENDED_LIMIT_INFORMATION jobInfo = {}; + jobInfo.BasicLimitInformation.LimitFlags = + JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE | JOB_OBJECT_LIMIT_BREAKAWAY_OK; + if (!::SetInformationJobObject(job.get(), JobObjectExtendedLimitInformation, + &jobInfo, sizeof(jobInfo))) { + return empty.out(); + } + + if (!::AssignProcessToJobObject(job.get(), aProcess)) { + return empty.out(); + } + + return job.out(); +} + +#if !defined( \ + PROCESS_CREATION_MITIGATION_POLICY_IMAGE_LOAD_PREFER_SYSTEM32_ALWAYS_ON) +# define PROCESS_CREATION_MITIGATION_POLICY_IMAGE_LOAD_PREFER_SYSTEM32_ALWAYS_ON \ + (0x00000001ULL << 60) +#endif // !defined(PROCESS_CREATION_MITIGATION_POLICY_IMAGE_LOAD_PREFER_SYSTEM32_ALWAYS_ON) + +#if !defined(PROCESS_CREATION_MITIGATION_POLICY_CONTROL_FLOW_GUARD_ALWAYS_OFF) +# define PROCESS_CREATION_MITIGATION_POLICY_CONTROL_FLOW_GUARD_ALWAYS_OFF \ + (0x00000002ULL << 40) +#endif // !defined(PROCESS_CREATION_MITIGATION_POLICY_CONTROL_FLOW_GUARD_ALWAYS_OFF) + +#if (_WIN32_WINNT < 0x0602) +BOOL WINAPI +SetProcessMitigationPolicy(PROCESS_MITIGATION_POLICY aMitigationPolicy, + PVOID aBuffer, SIZE_T aBufferLen); +#endif // (_WIN32_WINNT >= 0x0602) + +/** + * Any mitigation policies that should be set on the browser process should go + * here. + */ +static void SetMitigationPolicies(mozilla::ProcThreadAttributes& aAttrs, + const bool aIsSafeMode) { + if (mozilla::IsWin10AnniversaryUpdateOrLater()) { + aAttrs.AddMitigationPolicy( + PROCESS_CREATION_MITIGATION_POLICY_IMAGE_LOAD_PREFER_SYSTEM32_ALWAYS_ON); + } + +#if defined(_M_ARM64) + // Disable CFG on older versions of ARM64 Windows to avoid a crash in COM. + if (!mozilla::IsWin10Sep2018UpdateOrLater()) { + aAttrs.AddMitigationPolicy( + PROCESS_CREATION_MITIGATION_POLICY_CONTROL_FLOW_GUARD_ALWAYS_OFF); + } +#endif // defined(_M_ARM64) +} + +static mozilla::LauncherFlags ProcessCmdLine(int& aArgc, wchar_t* aArgv[]) { + mozilla::LauncherFlags result = mozilla::LauncherFlags::eNone; + + if (mozilla::CheckArg(aArgc, aArgv, "wait-for-browser", nullptr, + mozilla::CheckArgFlag::RemoveArg) == + mozilla::ARG_FOUND || + mozilla::CheckArg(aArgc, aArgv, "marionette", nullptr, + mozilla::CheckArgFlag::None) == mozilla::ARG_FOUND || + mozilla::CheckArg(aArgc, aArgv, "backgroundtask", nullptr, + mozilla::CheckArgFlag::None) == mozilla::ARG_FOUND || + mozilla::CheckArg(aArgc, aArgv, "headless", nullptr, + mozilla::CheckArgFlag::None) == mozilla::ARG_FOUND || + mozilla::CheckArg(aArgc, aArgv, "remote-debugging-port", nullptr, + mozilla::CheckArgFlag::None) == mozilla::ARG_FOUND || + mozilla::EnvHasValue("MOZ_AUTOMATION") || + mozilla::EnvHasValue("MOZ_HEADLESS")) { + result |= mozilla::LauncherFlags::eWaitForBrowser; + } + + if (mozilla::CheckArg(aArgc, aArgv, "no-deelevate") == mozilla::ARG_FOUND) { + result |= mozilla::LauncherFlags::eNoDeelevate; + } + + if (mozilla::CheckArg(aArgc, aArgv, ATTEMPTING_DEELEVATION_FLAG) == + mozilla::ARG_FOUND) { + result |= mozilla::LauncherFlags::eDeelevating; + } + + return result; +} + +static void MaybeBreakForBrowserDebugging() { + if (mozilla::EnvHasValue("MOZ_DEBUG_BROWSER_PROCESS")) { + ::DebugBreak(); + return; + } + + const wchar_t* pauseLenS = _wgetenv(L"MOZ_DEBUG_BROWSER_PAUSE"); + if (!pauseLenS || !(*pauseLenS)) { + return; + } + + DWORD pauseLenMs = wcstoul(pauseLenS, nullptr, 10) * 1000; + printf_stderr("\n\nBROWSERBROWSERBROWSERBROWSER\n debug me @ %lu\n\n", + ::GetCurrentProcessId()); + ::Sleep(pauseLenMs); +} + +static bool DoLauncherProcessChecks(int& argc, wchar_t** argv) { + // NB: We run all tests in this function instead of returning early in order + // to ensure that all side effects take place, such as clearing environment + // variables. + bool result = false; + +#if defined(MOZ_LAUNCHER_PROCESS) + // We still prefer to compare file ids. Comparing NT paths i.e. passing + // CompareNtPathsOnly to IsSameBinaryAsParentProcess is much faster, but + // we're not 100% sure that NT path comparison perfectly prevents the + // launching loop of the launcher process. + mozilla::LauncherResult<bool> isSame = mozilla::IsSameBinaryAsParentProcess(); + if (isSame.isOk()) { + result = !isSame.unwrap(); + } else { + HandleLauncherError(isSame.unwrapErr()); + } +#endif // defined(MOZ_LAUNCHER_PROCESS) + + if (mozilla::EnvHasValue("MOZ_LAUNCHER_PROCESS")) { + mozilla::SaveToEnv("MOZ_LAUNCHER_PROCESS="); + result = true; + } + + result |= + mozilla::CheckArg(argc, argv, "launcher", nullptr, + mozilla::CheckArgFlag::RemoveArg) == mozilla::ARG_FOUND; + + return result; +} + +#if defined(MOZ_LAUNCHER_PROCESS) +static mozilla::Maybe<bool> RunAsLauncherProcess( + mozilla::LauncherRegistryInfo& aRegInfo, int& argc, wchar_t** argv) { +#else +static mozilla::Maybe<bool> RunAsLauncherProcess(int& argc, wchar_t** argv) { +#endif // defined(MOZ_LAUNCHER_PROCESS) + bool runAsLauncher = DoLauncherProcessChecks(argc, argv); + +#if defined(MOZ_LAUNCHER_PROCESS) + bool forceLauncher = + runAsLauncher && + mozilla::CheckArg(argc, argv, "force-launcher", nullptr, + mozilla::CheckArgFlag::RemoveArg) == mozilla::ARG_FOUND; + + mozilla::LauncherRegistryInfo::ProcessType desiredType = + runAsLauncher ? mozilla::LauncherRegistryInfo::ProcessType::Launcher + : mozilla::LauncherRegistryInfo::ProcessType::Browser; + + mozilla::LauncherRegistryInfo::CheckOption checkOption = + forceLauncher ? mozilla::LauncherRegistryInfo::CheckOption::Force + : mozilla::LauncherRegistryInfo::CheckOption::Default; + + mozilla::LauncherResult<mozilla::LauncherRegistryInfo::ProcessType> + runAsType = aRegInfo.Check(desiredType, checkOption); + + if (runAsType.isErr()) { + mozilla::HandleLauncherError(runAsType); + return mozilla::Nothing(); + } + + runAsLauncher = runAsType.unwrap() == + mozilla::LauncherRegistryInfo::ProcessType::Launcher; +#endif // defined(MOZ_LAUNCHER_PROCESS) + + if (!runAsLauncher) { + // In this case, we will be proceeding to run as the browser. + // We should check MOZ_DEBUG_BROWSER_* env vars. + MaybeBreakForBrowserDebugging(); + } + + return mozilla::Some(runAsLauncher); +} + +namespace mozilla { + +Maybe<int> LauncherMain(int& argc, wchar_t* argv[], + const StaticXREAppData& aAppData) { + EnsureBrowserCommandlineSafe(argc, argv); + + SetLauncherErrorAppData(aAppData); + + if (CheckArg(argc, argv, "log-launcher-error", nullptr, + mozilla::CheckArgFlag::RemoveArg) == ARG_FOUND) { + SetLauncherErrorForceEventLog(); + } + + // return fast when we're a child process. + // (The remainder of this function has some side effects that are + // undesirable for content processes) + if (mozilla::CheckArg(argc, argv, "contentproc", nullptr, + mozilla::CheckArgFlag::None) == mozilla::ARG_FOUND) { + // A child process should not instantiate LauncherRegistryInfo. + return Nothing(); + } + +#if defined(MOZ_LAUNCHER_PROCESS) + LauncherRegistryInfo regInfo; + Maybe<bool> runAsLauncher = RunAsLauncherProcess(regInfo, argc, argv); + LauncherResult<std::wstring> blocklistFileNameResult = + regInfo.GetBlocklistFileName(); + Maybe<std::wstring> blocklistFileName = + blocklistFileNameResult.isOk() ? Some(blocklistFileNameResult.unwrap()) + : Nothing(); +#else + Maybe<bool> runAsLauncher = RunAsLauncherProcess(argc, argv); + Maybe<std::wstring> blocklistFileName = Nothing(); +#endif // defined(MOZ_LAUNCHER_PROCESS) + if (!runAsLauncher || !runAsLauncher.value()) { +#if defined(MOZ_LAUNCHER_PROCESS) + // Update the registry as Browser + LauncherVoidResult commitResult = regInfo.Commit(); + if (commitResult.isErr()) { + mozilla::HandleLauncherError(commitResult); + } +#endif // defined(MOZ_LAUNCHER_PROCESS) + return Nothing(); + } + + // Make sure that the launcher process itself has image load policies set + if (IsWin10AnniversaryUpdateOrLater()) { + static const StaticDynamicallyLinkedFunctionPtr< + decltype(&SetProcessMitigationPolicy)> + pSetProcessMitigationPolicy(L"kernel32.dll", + "SetProcessMitigationPolicy"); + if (pSetProcessMitigationPolicy) { + PROCESS_MITIGATION_IMAGE_LOAD_POLICY imgLoadPol = {}; + imgLoadPol.PreferSystem32Images = 1; + + DebugOnly<BOOL> setOk = pSetProcessMitigationPolicy( + ProcessImageLoadPolicy, &imgLoadPol, sizeof(imgLoadPol)); + MOZ_ASSERT(setOk); + } + } + +#if defined(MOZ_SANDBOX) + // Ensure the relevant mitigations are enforced. + mozilla::sandboxing::ApplyParentProcessMitigations(); +#endif + + mozilla::UseParentConsole(); + + if (!SetArgv0ToFullBinaryPath(argv)) { + HandleLauncherError(LAUNCHER_ERROR_GENERIC()); + return Nothing(); + } + + LauncherFlags flags = ProcessCmdLine(argc, argv); + + nsAutoHandle mediumIlToken; + LauncherResult<ElevationState> elevationState = + GetElevationState(argv[0], flags, mediumIlToken); + if (elevationState.isErr()) { + HandleLauncherError(elevationState); + return Nothing(); + } + + // Distill deelevation status, and/or attempt to perform launcher deelevation + // via an indirect relaunch. + DeelevationStatus deelevationStatus = DeelevationStatus::Unknown; + if (mediumIlToken.get()) { + // Rather than indirectly relaunch the launcher, we'll attempt to directly + // launch the main process with a reduced-privilege security token. + deelevationStatus = DeelevationStatus::PartiallyDeelevated; + } else if (elevationState.unwrap() == ElevationState::eElevated) { + if (flags & LauncherFlags::eWaitForBrowser) { + // An indirect relaunch won't provide a process-handle to block on, + // so we have to continue onwards with this process. + deelevationStatus = DeelevationStatus::DeelevationProhibited; + } else if (flags & LauncherFlags::eNoDeelevate) { + // Our invoker (hopefully, the user) has explicitly requested that the + // launcher not deelevate itself. + deelevationStatus = DeelevationStatus::DeelevationProhibited; + } else if (flags & LauncherFlags::eDeelevating) { + // We've already tried to deelevate, to no effect. Continue onward. + deelevationStatus = DeelevationStatus::UnsuccessfullyDeelevated; + } else { + // Otherwise, attempt to relaunch the launcher process itself via the + // shell, which hopefully will not be elevated. (But see bug 1733821.) + LauncherVoidResult launchedUnelevated = LaunchUnelevated(argc, argv); + if (launchedUnelevated.isErr()) { + // On failure, don't even try for a launcher process. Continue onwards + // in this one. (TODO: why? This isn't technically fatal...) + HandleLauncherError(launchedUnelevated); + return Nothing(); + } + // Otherwise, tell our caller to exit with a success code. + return Some(0); + } + } else if (elevationState.unwrap() == ElevationState::eNormalUser) { + if (flags & LauncherFlags::eDeelevating) { + // Deelevation appears to have been successful! + deelevationStatus = DeelevationStatus::SuccessfullyDeelevated; + } else { + // We haven't done anything and we don't need to. + deelevationStatus = DeelevationStatus::StartedUnprivileged; + } + } else { + // Some other elevation state with no medium-integrity token. + // (This should probably not happen.) + deelevationStatus = DeelevationStatus::Unknown; + } + +#if defined(MOZ_LAUNCHER_PROCESS) + // Update the registry as Launcher + LauncherVoidResult commitResult = regInfo.Commit(); + if (commitResult.isErr()) { + mozilla::HandleLauncherError(commitResult); + return Nothing(); + } +#endif // defined(MOZ_LAUNCHER_PROCESS) + + // Now proceed with setting up the parameters for process creation + UniquePtr<wchar_t[]> cmdLine(MakeCommandLine(argc, argv)); + if (!cmdLine) { + HandleLauncherError(LAUNCHER_ERROR_GENERIC()); + return Nothing(); + } + + const Maybe<bool> isSafeMode = + IsSafeModeRequested(argc, argv, SafeModeFlag::NoKeyPressCheck); + if (!isSafeMode) { + HandleLauncherError(LAUNCHER_ERROR_FROM_WIN32(ERROR_INVALID_PARAMETER)); + return Nothing(); + } + + ProcThreadAttributes attrs; + SetMitigationPolicies(attrs, isSafeMode.value()); + + HANDLE stdHandles[] = {::GetStdHandle(STD_INPUT_HANDLE), + ::GetStdHandle(STD_OUTPUT_HANDLE), + ::GetStdHandle(STD_ERROR_HANDLE)}; + + attrs.AddInheritableHandles(stdHandles); + + DWORD creationFlags = CREATE_SUSPENDED | CREATE_UNICODE_ENVIRONMENT; + + STARTUPINFOEXW siex; + LauncherResult<bool> attrsOk = attrs.AssignTo(siex); + if (attrsOk.isErr()) { + HandleLauncherError(attrsOk); + return Nothing(); + } + + BOOL inheritHandles = FALSE; + + if (attrsOk.unwrap()) { + creationFlags |= EXTENDED_STARTUPINFO_PRESENT; + + if (attrs.HasInheritableHandles()) { + siex.StartupInfo.dwFlags |= STARTF_USESTDHANDLES; + siex.StartupInfo.hStdInput = stdHandles[0]; + siex.StartupInfo.hStdOutput = stdHandles[1]; + siex.StartupInfo.hStdError = stdHandles[2]; + + // Since attrsOk == true, we have successfully set the handle inheritance + // whitelist policy, so only the handles added to attrs will be inherited. + inheritHandles = TRUE; + } + } + + // Pass on the path of the shortcut used to launch this process, if any. + STARTUPINFOW currentStartupInfo = {.cb = sizeof(STARTUPINFOW)}; + GetStartupInfoW(¤tStartupInfo); + if ((currentStartupInfo.dwFlags & STARTF_TITLEISLINKNAME) && + currentStartupInfo.lpTitle) { + siex.StartupInfo.dwFlags |= STARTF_TITLEISLINKNAME; + siex.StartupInfo.lpTitle = currentStartupInfo.lpTitle; + } + + PROCESS_INFORMATION pi = {}; + BOOL createOk; + + if (mediumIlToken.get()) { + createOk = + ::CreateProcessAsUserW(mediumIlToken.get(), argv[0], cmdLine.get(), + nullptr, nullptr, inheritHandles, creationFlags, + nullptr, nullptr, &siex.StartupInfo, &pi); + } else { + createOk = ::CreateProcessW(argv[0], cmdLine.get(), nullptr, nullptr, + inheritHandles, creationFlags, nullptr, nullptr, + &siex.StartupInfo, &pi); + } + + if (!createOk) { + HandleLauncherError(LAUNCHER_ERROR_FROM_LAST()); + return Nothing(); + } + + nsAutoHandle process(pi.hProcess); + nsAutoHandle mainThread(pi.hThread); + + nsAutoHandle job; + if (flags & LauncherFlags::eWaitForBrowser) { + job = CreateJobAndAssignProcess(process.get()); + } + + bool disableDynamicBlocklist = IsDynamicBlocklistDisabled( + isSafeMode.value(), + mozilla::CheckArg( + argc, argv, mozilla::geckoargs::sDisableDynamicDllBlocklist.sMatch, + nullptr, mozilla::CheckArgFlag::None) == mozilla::ARG_FOUND); + LauncherVoidResult setupResult = PostCreationSetup( + argv[0], process.get(), mainThread.get(), deelevationStatus, + isSafeMode.value(), disableDynamicBlocklist, blocklistFileName); + if (setupResult.isErr()) { + HandleLauncherError(setupResult); + ::TerminateProcess(process.get(), 1); + return Nothing(); + } + + if (::ResumeThread(mainThread.get()) == static_cast<DWORD>(-1)) { + HandleLauncherError(LAUNCHER_ERROR_FROM_LAST()); + ::TerminateProcess(process.get(), 1); + return Nothing(); + } + + if (flags & LauncherFlags::eWaitForBrowser) { + DWORD exitCode; + if (::WaitForSingleObject(process.get(), INFINITE) == WAIT_OBJECT_0 && + ::GetExitCodeProcess(process.get(), &exitCode)) { + // Propagate the browser process's exit code as our exit code. + return Some(static_cast<int>(exitCode)); + } + } else { + const DWORD timeout = + ::IsDebuggerPresent() ? INFINITE : kWaitForInputIdleTimeoutMS; + + // Keep the current process around until the callback process has created + // its message queue, to avoid the launched process's windows being forced + // into the background. + mozilla::WaitForInputIdle(process.get(), timeout); + } + + return Some(0); +} + +} // namespace mozilla diff --git a/browser/app/winlauncher/LauncherProcessWin.h b/browser/app/winlauncher/LauncherProcessWin.h new file mode 100644 index 0000000000..8fd53d7d3f --- /dev/null +++ b/browser/app/winlauncher/LauncherProcessWin.h @@ -0,0 +1,70 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* vim: set ts=8 sts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. */ + +#ifndef mozilla_LauncherProcessWin_h +#define mozilla_LauncherProcessWin_h + +#include "mozilla/Maybe.h" +#include "mozilla/TypedEnumBits.h" + +#include <stdint.h> + +namespace mozilla { + +// Forward declaration +struct StaticXREAppData; + +/** + * Determine whether or not the current process should be run as the launcher + * process, and run if so. If we are not supposed to run as the launcher + * process, or in the event of a launcher process failure, return Nothing, thus + * indicating that we should continue on the original startup code path. + */ +Maybe<int> LauncherMain(int& argc, wchar_t* argv[], + const StaticXREAppData& aAppData); + +enum class LauncherFlags : uint32_t { + eNone = 0, + eWaitForBrowser = (1 << 0), // Launcher should block until browser finishes + eNoDeelevate = (1 << 1), // If elevated, do not attempt to de-elevate + eDeelevating = (1 << 2), // A de-elevation attempt has been made +}; + +MOZ_MAKE_ENUM_CLASS_BITWISE_OPERATORS(LauncherFlags); + +enum class DeelevationStatus : uint32_t { + // The deelevation status could not be determined. Should never actually be + // the value of `gDeelevationStatus`. + Unknown = 0, + + // Deelevation did not need to be performed because the process was started + // without administrative privileges. + StartedUnprivileged = 1, + // Deelevation would have been performed, but was prohibited due to a flag. + DeelevationProhibited = 2, + // The launcher process was successfully deelevated. + SuccessfullyDeelevated = 3, + // The launcher process was not successfully deelevated, but a + // medium-integrity token was used to launch the main process. + PartiallyDeelevated = 4, + // Deelevation was attempted, but failed completely. The main process is + // running with administrative privileges. + UnsuccessfullyDeelevated = 5, + + // This is the static initial value of `gDeelevationStatus`; it acts as a + // sentinel to determine whether the launcher has set it at all. (It's + // therefore the normal value of `gDeelevationStatus` when the launcher is + // disabled.) + DefaultStaticValue = 0x55AA55AA, +}; + +// The result of the deelevation attempt. Set by the launcher process in the +// main process when the two are distinct. +extern const volatile DeelevationStatus gDeelevationStatus; + +} // namespace mozilla + +#endif // mozilla_LauncherProcessWin_h diff --git a/browser/app/winlauncher/NtLoaderAPI.cpp b/browser/app/winlauncher/NtLoaderAPI.cpp new file mode 100644 index 0000000000..97f8a20186 --- /dev/null +++ b/browser/app/winlauncher/NtLoaderAPI.cpp @@ -0,0 +1,33 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* vim: set ts=8 sts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. */ + +#include "mozilla/LoaderAPIInterfaces.h" + +#include "freestanding/CheckForCaller.h" +#include "freestanding/LoaderPrivateAPI.h" + +namespace mozilla { + +extern "C" MOZ_EXPORT nt::LoaderAPI* GetNtLoaderAPI( + nt::LoaderObserver* aNewObserver) { + // Make sure the caller is inside mozglue.dll - we don't want to allow + // external access to this function, as it contains details about + // the SharedSection which is used to sandbox future child processes. + const bool isCallerMozglue = + CheckForAddress(RETURN_ADDRESS(), L"mozglue.dll"); + MOZ_ASSERT(isCallerMozglue); + if (!isCallerMozglue) { + return nullptr; + } + + freestanding::EnsureInitialized(); + freestanding::LoaderPrivateAPI& api = freestanding::gLoaderPrivateAPI; + api.SetObserver(aNewObserver); + + return &api; +} + +} // namespace mozilla diff --git a/browser/app/winlauncher/ProcThreadAttributes.h b/browser/app/winlauncher/ProcThreadAttributes.h new file mode 100644 index 0000000000..74d5fee06c --- /dev/null +++ b/browser/app/winlauncher/ProcThreadAttributes.h @@ -0,0 +1,159 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* vim: set ts=8 sts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. */ + +#ifndef mozilla_ProcThreadAttributes_h +#define mozilla_ProcThreadAttributes_h + +#include <windows.h> + +#include <utility> + +#include "mozilla/Attributes.h" +#include "mozilla/Maybe.h" +#include "mozilla/UniquePtr.h" +#include "mozilla/Vector.h" + +namespace mozilla { + +class MOZ_RAII ProcThreadAttributes final { + struct ProcThreadAttributeListDeleter { + void operator()(LPPROC_THREAD_ATTRIBUTE_LIST aList) { + ::DeleteProcThreadAttributeList(aList); + delete[] reinterpret_cast<char*>(aList); + } + }; + + using ProcThreadAttributeListPtr = + UniquePtr<_PROC_THREAD_ATTRIBUTE_LIST, ProcThreadAttributeListDeleter>; + + public: + ProcThreadAttributes() : mMitigationPolicies(0) {} + + ~ProcThreadAttributes() = default; + + ProcThreadAttributes(const ProcThreadAttributes&) = delete; + ProcThreadAttributes(ProcThreadAttributes&&) = delete; + ProcThreadAttributes& operator=(const ProcThreadAttributes&) = delete; + ProcThreadAttributes& operator=(ProcThreadAttributes&&) = delete; + + void AddMitigationPolicy(DWORD64 aPolicy) { mMitigationPolicies |= aPolicy; } + + bool AddInheritableHandle(HANDLE aHandle) { + DWORD type = ::GetFileType(aHandle); + if (type != FILE_TYPE_DISK && type != FILE_TYPE_PIPE) { + return false; + } + + if (!::SetHandleInformation(aHandle, HANDLE_FLAG_INHERIT, + HANDLE_FLAG_INHERIT)) { + return false; + } + + return mInheritableHandles.append(aHandle); + } + + template <size_t N> + bool AddInheritableHandles(HANDLE (&aHandles)[N]) { + bool ok = true; + for (auto handle : aHandles) { + ok &= AddInheritableHandle(handle); + } + + return ok; + } + + bool HasMitigationPolicies() const { return !!mMitigationPolicies; } + + bool HasInheritableHandles() const { return !mInheritableHandles.empty(); } + + /** + * @return false if the STARTUPINFOEXW::lpAttributeList was set to null + * as expected based on the state of |this|; + * true if the STARTUPINFOEXW::lpAttributeList was set to + * non-null; + */ + LauncherResult<bool> AssignTo(STARTUPINFOEXW& aSiex) { + ZeroMemory(&aSiex, sizeof(STARTUPINFOEXW)); + + // We'll set the size to sizeof(STARTUPINFOW) until we determine whether the + // extended fields will be used. + aSiex.StartupInfo.cb = sizeof(STARTUPINFOW); + + DWORD numAttributes = 0; + if (HasMitigationPolicies()) { + ++numAttributes; + } + + if (HasInheritableHandles()) { + ++numAttributes; + } + + if (!numAttributes) { + return false; + } + + SIZE_T listSize = 0; + if (!::InitializeProcThreadAttributeList(nullptr, numAttributes, 0, + &listSize)) { + DWORD err = ::GetLastError(); + if (err != ERROR_INSUFFICIENT_BUFFER) { + return LAUNCHER_ERROR_FROM_WIN32(err); + } + } + + auto buf = MakeUnique<char[]>(listSize); + + LPPROC_THREAD_ATTRIBUTE_LIST tmpList = + reinterpret_cast<LPPROC_THREAD_ATTRIBUTE_LIST>(buf.get()); + + if (!::InitializeProcThreadAttributeList(tmpList, numAttributes, 0, + &listSize)) { + return LAUNCHER_ERROR_FROM_LAST(); + } + + // Transfer buf to a ProcThreadAttributeListPtr - now that the list is + // initialized, we are no longer dealing with a plain old char array. We + // must now deinitialize the attribute list before deallocating the + // underlying buffer. + ProcThreadAttributeListPtr attrList( + reinterpret_cast<LPPROC_THREAD_ATTRIBUTE_LIST>(buf.release())); + + if (mMitigationPolicies) { + if (!::UpdateProcThreadAttribute( + attrList.get(), 0, PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY, + &mMitigationPolicies, sizeof(mMitigationPolicies), nullptr, + nullptr)) { + return LAUNCHER_ERROR_FROM_LAST(); + } + } + + if (!mInheritableHandles.empty()) { + if (!::UpdateProcThreadAttribute( + attrList.get(), 0, PROC_THREAD_ATTRIBUTE_HANDLE_LIST, + mInheritableHandles.begin(), + mInheritableHandles.length() * sizeof(HANDLE), nullptr, + nullptr)) { + return LAUNCHER_ERROR_FROM_LAST(); + } + } + + mAttrList = std::move(attrList); + aSiex.lpAttributeList = mAttrList.get(); + aSiex.StartupInfo.cb = sizeof(STARTUPINFOEXW); + return true; + } + + private: + static const uint32_t kNumInline = 3; // Inline storage for the std handles + + DWORD64 mMitigationPolicies; + Vector<HANDLE, kNumInline> mInheritableHandles; + ProcThreadAttributeListPtr mAttrList; +}; + +} // namespace mozilla + +#endif // mozilla_ProcThreadAttributes_h diff --git a/browser/app/winlauncher/SameBinary.h b/browser/app/winlauncher/SameBinary.h new file mode 100644 index 0000000000..e8fa78600f --- /dev/null +++ b/browser/app/winlauncher/SameBinary.h @@ -0,0 +1,146 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* vim: set ts=8 sts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. */ + +#ifndef mozilla_SameBinary_h +#define mozilla_SameBinary_h + +#include "mozilla/WinHeaderOnlyUtils.h" +#include "mozilla/NativeNt.h" +#include "nsWindowsHelpers.h" + +namespace mozilla { + +class ProcessImagePath final { + PathType mType; + LauncherVoidResult mLastError; + + // Using a larger buffer because an NT path may exceed MAX_PATH. + WCHAR mPathBuffer[(MAX_PATH * 2) + 1]; + + public: + // Initialize with an NT path string of a given process handle + explicit ProcessImagePath(const nsAutoHandle& aProcess) + : mType(PathType::eNtPath), mLastError(Ok()) { + DWORD len = mozilla::ArrayLength(mPathBuffer); + if (!::QueryFullProcessImageNameW(aProcess.get(), PROCESS_NAME_NATIVE, + mPathBuffer, &len)) { + mLastError = LAUNCHER_ERROR_FROM_LAST(); + return; + } + } + + // Initizlize with a DOS path string of a given imagebase address + explicit ProcessImagePath(HMODULE aImageBase) + : mType(PathType::eDosPath), mLastError(Ok()) { + DWORD len = ::GetModuleFileNameW(aImageBase, mPathBuffer, + mozilla::ArrayLength(mPathBuffer)); + if (!len || len == mozilla::ArrayLength(mPathBuffer)) { + mLastError = LAUNCHER_ERROR_FROM_LAST(); + return; + } + } + + bool IsError() const { return mLastError.isErr(); } + + const WindowsErrorType& GetError() const { return mLastError.inspectErr(); } + + FileUniqueId GetId() const { return FileUniqueId(mPathBuffer, mType); } + + bool CompareNtPaths(const ProcessImagePath& aOther) const { + if (mLastError.isErr() || aOther.mLastError.isErr() || + mType != PathType::eNtPath || aOther.mType != PathType::eNtPath) { + return false; + } + + UNICODE_STRING path1, path2; + ::RtlInitUnicodeString(&path1, mPathBuffer); + ::RtlInitUnicodeString(&path2, aOther.mPathBuffer); + return !!::RtlEqualUnicodeString(&path1, &path2, TRUE); + } +}; + +enum class ImageFileCompareOption { + Default, + CompareNtPathsOnly, +}; + +static inline mozilla::LauncherResult<bool> IsSameBinaryAsParentProcess( + ImageFileCompareOption aOption = ImageFileCompareOption::Default) { + mozilla::LauncherResult<DWORD> parentPid = mozilla::nt::GetParentProcessId(); + if (parentPid.isErr()) { + return parentPid.propagateErr(); + } + + nsAutoHandle parentProcess(::OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, + FALSE, parentPid.unwrap())); + if (!parentProcess.get()) { + DWORD err = ::GetLastError(); + if (err == ERROR_INVALID_PARAMETER || err == ERROR_ACCESS_DENIED) { + // In the ERROR_INVALID_PARAMETER case, the process identified by + // parentPid has already exited. This is a common case when the parent + // process is not Firefox, thus we should return false instead of erroring + // out. + // The ERROR_ACCESS_DENIED case can happen when the parent process is + // something that we don't have permission to query. For example, we may + // encounter this when Firefox is launched by the Windows Task Scheduler. + return false; + } + + return LAUNCHER_ERROR_FROM_WIN32(err); + } + + ProcessImagePath parentExe(parentProcess); + if (parentExe.IsError()) { + return ::mozilla::Err(parentExe.GetError()); + } + + if (aOption == ImageFileCompareOption::Default) { + bool skipFileIdComparison = false; + + FileUniqueId id1 = parentExe.GetId(); + if (id1.IsError()) { + // We saw a number of Win7 users failed to call NtOpenFile with + // STATUS_OBJECT_PATH_NOT_FOUND for an unknown reason. In this + // particular case, we fall back to the logic to compare NT path + // strings instead of a file id which will not fail because we don't + // need to open a file handle. +#if !defined(STATUS_OBJECT_PATH_NOT_FOUND) + constexpr NTSTATUS STATUS_OBJECT_PATH_NOT_FOUND = 0xc000003a; +#endif + const LauncherError& err = id1.GetError(); + if (err.mError != + WindowsError::FromNtStatus(STATUS_OBJECT_PATH_NOT_FOUND)) { + return ::mozilla::Err(err); + } + + skipFileIdComparison = true; + } + + if (!skipFileIdComparison) { + ProcessImagePath ourExe(nullptr); + if (ourExe.IsError()) { + return ::mozilla::Err(ourExe.GetError()); + } + + FileUniqueId id2 = ourExe.GetId(); + if (id2.IsError()) { + return ::mozilla::Err(id2.GetError()); + } + return id1 == id2; + } + } + + nsAutoHandle ourProcess(::GetCurrentProcess()); + ProcessImagePath ourExeNt(ourProcess); + if (ourExeNt.IsError()) { + return ::mozilla::Err(ourExeNt.GetError()); + } + return parentExe.CompareNtPaths(ourExeNt); +} + +} // namespace mozilla + +#endif // mozilla_SameBinary_h diff --git a/browser/app/winlauncher/freestanding/CheckForCaller.h b/browser/app/winlauncher/freestanding/CheckForCaller.h new file mode 100644 index 0000000000..799d16cd1f --- /dev/null +++ b/browser/app/winlauncher/freestanding/CheckForCaller.h @@ -0,0 +1,36 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* vim: set ts=8 sts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. */ + +#ifndef mozilla_freestanding_CheckForCaller_h +#define mozilla_freestanding_CheckForCaller_h + +namespace mozilla { + +#if defined(_MSC_VER) +# include <intrin.h> +# pragma intrinsic(_ReturnAddress) +# define RETURN_ADDRESS() _ReturnAddress() +#elif defined(__GNUC__) || defined(__clang__) +# define RETURN_ADDRESS() \ + __builtin_extract_return_addr(__builtin_return_address(0)) +#endif + +template <int N> +bool CheckForAddress(void* aReturnAddress, const wchar_t (&aName)[N]) { + HMODULE callingModule; + if (!::GetModuleHandleExW(GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS | + GET_MODULE_HANDLE_EX_FLAG_UNCHANGED_REFCOUNT, + reinterpret_cast<LPCWSTR>(aReturnAddress), + &callingModule)) { + return false; + } + + return callingModule && callingModule == ::GetModuleHandleW(aName); +} + +} // namespace mozilla + +#endif // mozilla_freestanding_CheckForCaller_h diff --git a/browser/app/winlauncher/freestanding/DllBlocklist.cpp b/browser/app/winlauncher/freestanding/DllBlocklist.cpp new file mode 100644 index 0000000000..ce5937aeef --- /dev/null +++ b/browser/app/winlauncher/freestanding/DllBlocklist.cpp @@ -0,0 +1,487 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* vim: set ts=8 sts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. */ + +#include "mozilla/ArrayUtils.h" +#include "mozilla/Attributes.h" +#include "mozilla/BinarySearch.h" +#include "mozilla/NativeNt.h" +#include "mozilla/Types.h" +#include "mozilla/WindowsDllBlocklist.h" + +#include "CrashAnnotations.h" +#include "DllBlocklist.h" +#include "LoaderPrivateAPI.h" +#include "ModuleLoadFrame.h" +#include "SharedSection.h" + +#define DLL_BLOCKLIST_ENTRY(name, ...) \ + {MOZ_LITERAL_UNICODE_STRING(L##name), __VA_ARGS__}, +#define DLL_BLOCKLIST_STRING_TYPE UNICODE_STRING + +#if defined(MOZ_LAUNCHER_PROCESS) || defined(NIGHTLY_BUILD) +# include "mozilla/WindowsDllBlocklistLauncherDefs.h" +#else +# include "mozilla/WindowsDllBlocklistCommon.h" +DLL_BLOCKLIST_DEFINITIONS_BEGIN +DLL_BLOCKLIST_DEFINITIONS_END +#endif + +using WritableBuffer = mozilla::glue::detail::WritableBuffer<1024>; + +class MOZ_STATIC_CLASS MOZ_TRIVIAL_CTOR_DTOR NativeNtBlockSet final { + struct NativeNtBlockSetEntry { + NativeNtBlockSetEntry() = default; + ~NativeNtBlockSetEntry() = default; + NativeNtBlockSetEntry(const UNICODE_STRING& aName, uint64_t aVersion, + NativeNtBlockSetEntry* aNext) + : mName(aName), mVersion(aVersion), mNext(aNext) {} + UNICODE_STRING mName; + uint64_t mVersion; + NativeNtBlockSetEntry* mNext; + }; + + public: + // Constructor and destructor MUST be trivial + constexpr NativeNtBlockSet() : mFirstEntry(nullptr) {} + ~NativeNtBlockSet() = default; + + void Add(const UNICODE_STRING& aName, uint64_t aVersion); + void Write(WritableBuffer& buffer); + + private: + static NativeNtBlockSetEntry* NewEntry(const UNICODE_STRING& aName, + uint64_t aVersion, + NativeNtBlockSetEntry* aNextEntry); + + private: + NativeNtBlockSetEntry* mFirstEntry; + mozilla::nt::SRWLock mLock; +}; + +NativeNtBlockSet::NativeNtBlockSetEntry* NativeNtBlockSet::NewEntry( + const UNICODE_STRING& aName, uint64_t aVersion, + NativeNtBlockSet::NativeNtBlockSetEntry* aNextEntry) { + return mozilla::freestanding::RtlNew<NativeNtBlockSetEntry>(aName, aVersion, + aNextEntry); +} + +void NativeNtBlockSet::Add(const UNICODE_STRING& aName, uint64_t aVersion) { + mozilla::nt::AutoExclusiveLock lock(mLock); + + for (NativeNtBlockSetEntry* entry = mFirstEntry; entry; + entry = entry->mNext) { + if (::RtlEqualUnicodeString(&entry->mName, &aName, TRUE) && + aVersion == entry->mVersion) { + return; + } + } + + // Not present, add it + NativeNtBlockSetEntry* newEntry = NewEntry(aName, aVersion, mFirstEntry); + if (newEntry) { + mFirstEntry = newEntry; + } +} + +void NativeNtBlockSet::Write(WritableBuffer& aBuffer) { + // NB: If this function is called, it is long after kernel32 is initialized, + // so it is safe to use Win32 calls here. + char buf[MAX_PATH]; + + // It would be nicer to use RAII here. However, its destructor + // might not run if an exception occurs, in which case we would never release + // the lock (MSVC warns about this possibility). So we acquire and release + // manually. + ::AcquireSRWLockExclusive(&mLock); + + MOZ_SEH_TRY { + for (auto entry = mFirstEntry; entry; entry = entry->mNext) { + int convOk = ::WideCharToMultiByte(CP_UTF8, 0, entry->mName.Buffer, + entry->mName.Length / sizeof(wchar_t), + buf, sizeof(buf), nullptr, nullptr); + if (!convOk) { + continue; + } + + // write name[,v.v.v.v]; + aBuffer.Write(buf, convOk); + + if (entry->mVersion != DllBlockInfo::ALL_VERSIONS) { + aBuffer.Write(",", 1); + uint16_t parts[4]; + parts[0] = entry->mVersion >> 48; + parts[1] = (entry->mVersion >> 32) & 0xFFFF; + parts[2] = (entry->mVersion >> 16) & 0xFFFF; + parts[3] = entry->mVersion & 0xFFFF; + for (size_t p = 0; p < mozilla::ArrayLength(parts); ++p) { + _ltoa_s(parts[p], buf, sizeof(buf), 10); + aBuffer.Write(buf, strlen(buf)); + if (p != mozilla::ArrayLength(parts) - 1) { + aBuffer.Write(".", 1); + } + } + } + aBuffer.Write(";", 1); + } + } + MOZ_SEH_EXCEPT(EXCEPTION_EXECUTE_HANDLER) {} + + ::ReleaseSRWLockExclusive(&mLock); +} + +static NativeNtBlockSet gBlockSet; + +extern "C" void MOZ_EXPORT +NativeNtBlockSet_Write(CrashReporter::AnnotationWriter& aWriter) { + WritableBuffer buffer; + gBlockSet.Write(buffer); + aWriter.Write(CrashReporter::Annotation::BlockedDllList, buffer.Data(), + buffer.Length()); +} + +enum class BlockAction { + Allow, + SubstituteLSP, + Error, + Deny, + NoOpEntryPoint, +}; + +static BlockAction CheckBlockInfo(const DllBlockInfo* aInfo, + const mozilla::nt::PEHeaders& aHeaders, + uint64_t& aVersion) { + aVersion = DllBlockInfo::ALL_VERSIONS; + + if (aInfo->mFlags & (DllBlockInfo::BLOCK_WIN8_AND_OLDER | + DllBlockInfo::BLOCK_WIN7_AND_OLDER)) { + RTL_OSVERSIONINFOW osv = {sizeof(osv)}; + NTSTATUS ntStatus = ::RtlGetVersion(&osv); + if (!NT_SUCCESS(ntStatus)) { + return BlockAction::Error; + } + + if ((aInfo->mFlags & DllBlockInfo::BLOCK_WIN8_AND_OLDER) && + (osv.dwMajorVersion > 6 || + (osv.dwMajorVersion == 6 && osv.dwMinorVersion > 2))) { + return BlockAction::Allow; + } + + if ((aInfo->mFlags & DllBlockInfo::BLOCK_WIN7_AND_OLDER) && + (osv.dwMajorVersion > 6 || + (osv.dwMajorVersion == 6 && osv.dwMinorVersion > 1))) { + return BlockAction::Allow; + } + } + + if ((aInfo->mFlags & DllBlockInfo::CHILD_PROCESSES_ONLY) && + !(gBlocklistInitFlags & eDllBlocklistInitFlagIsChildProcess)) { + return BlockAction::Allow; + } + + if ((aInfo->mFlags & DllBlockInfo::UTILITY_PROCESSES_ONLY) && + !(gBlocklistInitFlags & eDllBlocklistInitFlagIsUtilityProcess)) { + return BlockAction::Allow; + } + + if ((aInfo->mFlags & DllBlockInfo::SOCKET_PROCESSES_ONLY) && + !(gBlocklistInitFlags & eDllBlocklistInitFlagIsSocketProcess)) { + return BlockAction::Allow; + } + + if ((aInfo->mFlags & DllBlockInfo::BROWSER_PROCESS_ONLY) && + (gBlocklistInitFlags & eDllBlocklistInitFlagIsChildProcess)) { + return BlockAction::Allow; + } + + if (aInfo->mMaxVersion == DllBlockInfo::ALL_VERSIONS) { + return BlockAction::Deny; + } + + if (!aHeaders) { + return BlockAction::Error; + } + + if (aInfo->mFlags & DllBlockInfo::USE_TIMESTAMP) { + DWORD timestamp; + if (!aHeaders.GetTimeStamp(timestamp)) { + return BlockAction::Error; + } + + if (timestamp > aInfo->mMaxVersion) { + return BlockAction::Allow; + } + + return BlockAction::Deny; + } + + // Else we try to get the file version information. Note that we don't have + // access to GetFileVersionInfo* APIs. + if (!aHeaders.GetVersionInfo(aVersion)) { + return BlockAction::Error; + } + + if (aInfo->IsVersionBlocked(aVersion)) { + return BlockAction::Deny; + } + + return BlockAction::Allow; +} + +static BOOL WINAPI NoOp_DllMain(HINSTANCE, DWORD, LPVOID) { return TRUE; } + +// This helper function checks whether a given module is included +// in the executable's Import Table. Because an injected module's +// DllMain may revert the Import Table to the original state, we parse +// the Import Table every time a module is loaded without creating a cache. +static bool IsDependentModule( + const UNICODE_STRING& aModuleLeafName, + mozilla::freestanding::Kernel32ExportsSolver& aK32Exports) { + // We enable automatic DLL blocking only in early Beta or earlier for now + // because it caused a compat issue (bug 1682304 and 1704373). +#if defined(EARLY_BETA_OR_EARLIER) + mozilla::nt::PEHeaders exeHeaders(aK32Exports.mGetModuleHandleW(nullptr)); + if (!exeHeaders || !exeHeaders.IsImportDirectoryTampered()) { + // If no tampering is detected, no need to enumerate the Import Table. + return false; + } + + bool isDependent = false; + exeHeaders.EnumImportChunks( + [&isDependent, &aModuleLeafName, &exeHeaders](const char* aDepModule) { + // If |aDepModule| is within the PE image, it's not an injected module + // but a legitimate dependent module. + if (isDependent || exeHeaders.IsWithinImage(aDepModule)) { + return; + } + + UNICODE_STRING depModuleLeafName; + mozilla::nt::AllocatedUnicodeString depModuleName(aDepModule); + mozilla::nt::GetLeafName(&depModuleLeafName, depModuleName); + isDependent = (::RtlCompareUnicodeString( + &aModuleLeafName, &depModuleLeafName, TRUE) == 0); + }); + return isDependent; +#else + return false; +#endif +} + +// Allowing a module to be loaded but detour the entrypoint to NoOp_DllMain +// so that the module has no chance to interact with our code. We need this +// technique to safely block a module injected by IAT tampering because +// blocking such a module makes a process fail to launch. +static bool RedirectToNoOpEntryPoint( + const mozilla::nt::PEHeaders& aModule, + mozilla::freestanding::Kernel32ExportsSolver& aK32Exports) { + mozilla::interceptor::WindowsDllEntryPointInterceptor interceptor( + aK32Exports); + if (!interceptor.Set(aModule, NoOp_DllMain)) { + return false; + } + + return true; +} + +static BlockAction DetermineBlockAction( + const UNICODE_STRING& aLeafName, void* aBaseAddress, + mozilla::freestanding::Kernel32ExportsSolver* aK32Exports) { + if (mozilla::nt::Contains12DigitHexString(aLeafName) || + mozilla::nt::IsFileNameAtLeast16HexDigits(aLeafName)) { + return BlockAction::Deny; + } + + DECLARE_POINTER_TO_FIRST_DLL_BLOCKLIST_ENTRY(info); + DECLARE_DLL_BLOCKLIST_NUM_ENTRIES(infoNumEntries); + + mozilla::freestanding::DllBlockInfoComparator comp(aLeafName); + + size_t match; + bool onBuiltinList = BinarySearchIf(info, 0, infoNumEntries, comp, &match); + const DllBlockInfo* entry = nullptr; + mozilla::nt::PEHeaders headers(aBaseAddress); + uint64_t version; + BlockAction checkResult = BlockAction::Allow; + if (onBuiltinList) { + entry = &info[match]; + checkResult = CheckBlockInfo(entry, headers, version); + } + mozilla::DebugOnly<bool> blockedByDynamicBlocklist = false; + // Make sure we handle a case that older versions are blocked by the static + // list, but the dynamic list blocks all versions. + if (checkResult == BlockAction::Allow) { + if (!mozilla::freestanding::gSharedSection.IsDisabled()) { + entry = mozilla::freestanding::gSharedSection.SearchBlocklist(aLeafName); + if (entry) { + checkResult = CheckBlockInfo(entry, headers, version); + blockedByDynamicBlocklist = checkResult != BlockAction::Allow; + } + } + } + if (checkResult == BlockAction::Allow) { + return BlockAction::Allow; + } + + gBlockSet.Add(entry->mName, version); + + if ((entry->mFlags & DllBlockInfo::REDIRECT_TO_NOOP_ENTRYPOINT) && + aK32Exports && RedirectToNoOpEntryPoint(headers, *aK32Exports)) { + MOZ_ASSERT(!blockedByDynamicBlocklist, "dynamic blocklist has redirect?"); + return BlockAction::NoOpEntryPoint; + } + + return checkResult; +} + +namespace mozilla { +namespace freestanding { + +CrossProcessDllInterceptor::FuncHookType<LdrLoadDllPtr> stub_LdrLoadDll; + +NTSTATUS NTAPI patched_LdrLoadDll(PWCHAR aDllPath, PULONG aFlags, + PUNICODE_STRING aDllName, + PHANDLE aOutHandle) { + ModuleLoadFrame frame(aDllName); + + NTSTATUS ntStatus = stub_LdrLoadDll(aDllPath, aFlags, aDllName, aOutHandle); + + return frame.SetLoadStatus(ntStatus, aOutHandle); +} + +CrossProcessDllInterceptor::FuncHookType<NtMapViewOfSectionPtr> + stub_NtMapViewOfSection; + +NTSTATUS NTAPI patched_NtMapViewOfSection( + HANDLE aSection, HANDLE aProcess, PVOID* aBaseAddress, ULONG_PTR aZeroBits, + SIZE_T aCommitSize, PLARGE_INTEGER aSectionOffset, PSIZE_T aViewSize, + SECTION_INHERIT aInheritDisposition, ULONG aAllocationType, + ULONG aProtectionFlags) { + // We always map first, then we check for additional info after. + NTSTATUS stubStatus = stub_NtMapViewOfSection( + aSection, aProcess, aBaseAddress, aZeroBits, aCommitSize, aSectionOffset, + aViewSize, aInheritDisposition, aAllocationType, aProtectionFlags); + if (!NT_SUCCESS(stubStatus)) { + return stubStatus; + } + + if (aProcess != nt::kCurrentProcess) { + // We're only interested in mapping for the current process. + return stubStatus; + } + + // Do a query to see if the memory is MEM_IMAGE. If not, continue + MEMORY_BASIC_INFORMATION mbi; + NTSTATUS ntStatus = + ::NtQueryVirtualMemory(aProcess, *aBaseAddress, MemoryBasicInformation, + &mbi, sizeof(mbi), nullptr); + if (!NT_SUCCESS(ntStatus)) { + ::NtUnmapViewOfSection(aProcess, *aBaseAddress); + return STATUS_ACCESS_DENIED; + } + + // We don't care about mappings that aren't MEM_IMAGE or executable. + // We check for the AllocationProtect, not the Protect field because + // the first section of a mapped image is always PAGE_READONLY even + // when it's mapped as an executable. + constexpr DWORD kPageExecutable = PAGE_EXECUTE | PAGE_EXECUTE_READ | + PAGE_EXECUTE_READWRITE | + PAGE_EXECUTE_WRITECOPY; + if (!(mbi.Type & MEM_IMAGE) || !(mbi.AllocationProtect & kPageExecutable)) { + return stubStatus; + } + + // Get the section name + nt::MemorySectionNameBuf sectionFileName( + gLoaderPrivateAPI.GetSectionNameBuffer(*aBaseAddress)); + if (sectionFileName.IsEmpty()) { + ::NtUnmapViewOfSection(aProcess, *aBaseAddress); + return STATUS_ACCESS_DENIED; + } + + // Find the leaf name + UNICODE_STRING leafOnStack; + nt::GetLeafName(&leafOnStack, sectionFileName); + + bool isDependent = false; + const UNICODE_STRING k32Name = MOZ_LITERAL_UNICODE_STRING(L"kernel32.dll"); + Kernel32ExportsSolver* k32Exports = nullptr; + BlockAction blockAction; + // Trying to get the Kernel32Exports while loading kernel32.dll causes Firefox + // to crash. (but only during a profile-guided optimization run, oddly) We + // know we're never going to block kernel32.dll, so skip all this + if (::RtlCompareUnicodeString(&k32Name, &leafOnStack, TRUE) == 0) { + blockAction = BlockAction::Allow; + } else { + k32Exports = gSharedSection.GetKernel32Exports(); + // Small optimization: Since loading a dependent module does not involve + // LdrLoadDll, we know isDependent is false if we hold a top frame. + if (k32Exports && !ModuleLoadFrame::ExistsTopFrame()) { + isDependent = IsDependentModule(leafOnStack, *k32Exports); + } + + if (isDependent) { + // Add an NT dv\path to the shared section so that a sandbox process can + // use it to bypass CIG. In a sandbox process, this addition fails + // because we cannot map the section to a writable region, but it's + // ignorable because the paths have been added by the browser process. + Unused << gSharedSection.AddDependentModule(sectionFileName); + + // For a dependent module, try redirection instead of blocking it. + // If we fail, we reluctantly allow the module for free. + mozilla::nt::PEHeaders headers(*aBaseAddress); + blockAction = RedirectToNoOpEntryPoint(headers, *k32Exports) + ? BlockAction::NoOpEntryPoint + : BlockAction::Allow; + } else { + // Check blocklist + blockAction = + DetermineBlockAction(leafOnStack, *aBaseAddress, k32Exports); + } + } + + ModuleLoadInfo::Status loadStatus = ModuleLoadInfo::Status::Blocked; + + switch (blockAction) { + case BlockAction::Allow: + loadStatus = ModuleLoadInfo::Status::Loaded; + break; + + case BlockAction::NoOpEntryPoint: + loadStatus = ModuleLoadInfo::Status::Redirected; + break; + + case BlockAction::SubstituteLSP: + // The process heap needs to be available here because + // NotifyLSPSubstitutionRequired below copies a given string into + // the heap. We use a soft assert here, assuming LSP load always + // occurs after the heap is initialized. + MOZ_ASSERT(nt::RtlGetProcessHeap()); + + // Notify patched_LdrLoadDll that it will be necessary to perform + // a substitution before returning. + ModuleLoadFrame::NotifyLSPSubstitutionRequired(&leafOnStack); + break; + + default: + break; + } + + if (nt::RtlGetProcessHeap()) { + ModuleLoadFrame::NotifySectionMap( + nt::AllocatedUnicodeString(sectionFileName), *aBaseAddress, stubStatus, + loadStatus, isDependent); + } + + if (loadStatus == ModuleLoadInfo::Status::Loaded || + loadStatus == ModuleLoadInfo::Status::Redirected) { + return stubStatus; + } + + ::NtUnmapViewOfSection(aProcess, *aBaseAddress); + return STATUS_ACCESS_DENIED; +} + +} // namespace freestanding +} // namespace mozilla diff --git a/browser/app/winlauncher/freestanding/DllBlocklist.h b/browser/app/winlauncher/freestanding/DllBlocklist.h new file mode 100644 index 0000000000..153a1dfb28 --- /dev/null +++ b/browser/app/winlauncher/freestanding/DllBlocklist.h @@ -0,0 +1,38 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* vim: set ts=8 sts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. */ + +#ifndef mozilla_freestanding_DllBlocklist_h +#define mozilla_freestanding_DllBlocklist_h + +#include "mozilla/NativeNt.h" +#include "nsWindowsDllInterceptor.h" +#include "mozilla/WinHeaderOnlyUtils.h" + +namespace mozilla { +namespace freestanding { + +NTSTATUS NTAPI patched_LdrLoadDll(PWCHAR aDllPath, PULONG aFlags, + PUNICODE_STRING aDllName, PHANDLE aOutHandle); + +NTSTATUS NTAPI patched_NtMapViewOfSection( + HANDLE aSection, HANDLE aProcess, PVOID* aBaseAddress, ULONG_PTR aZeroBits, + SIZE_T aCommitSize, PLARGE_INTEGER aSectionOffset, PSIZE_T aViewSize, + SECTION_INHERIT aInheritDisposition, ULONG aAllocationType, + ULONG aProtectionFlags); + +using LdrLoadDllPtr = decltype(&::LdrLoadDll); + +extern CrossProcessDllInterceptor::FuncHookType<LdrLoadDllPtr> stub_LdrLoadDll; + +using NtMapViewOfSectionPtr = decltype(&::NtMapViewOfSection); + +extern CrossProcessDllInterceptor::FuncHookType<NtMapViewOfSectionPtr> + stub_NtMapViewOfSection; + +} // namespace freestanding +} // namespace mozilla + +#endif // mozilla_freestanding_DllBlocklist_h diff --git a/browser/app/winlauncher/freestanding/Freestanding.h b/browser/app/winlauncher/freestanding/Freestanding.h new file mode 100644 index 0000000000..03999f231e --- /dev/null +++ b/browser/app/winlauncher/freestanding/Freestanding.h @@ -0,0 +1,67 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* vim: set ts=8 sts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. */ + +#ifndef mozilla_freestanding_Freestanding_h +#define mozilla_freestanding_Freestanding_h + +/** + * This header is automatically included in all source code residing in the + * /browser/app/winlauncher/freestanding directory. + */ + +#if defined(__STDC_HOSTED__) && __STDC_HOSTED__ == 1 +# error "This header should only be included by freestanding code" +#endif // defined(__STDC_HOSTED__) && __STDC_HOSTED__ == 1 + +#define MOZ_USE_LAUNCHER_ERROR +#include "mozilla/NativeNt.h" + +namespace mozilla { +namespace freestanding { + +/** + * Since this library is the only part of firefox.exe that needs special + * treatment with respect to the heap, we implement |RtlNew| and |RtlDelete| + * to be used instead of |new| and |delete| for any heap allocations inside + * the freestanding library. + */ +template <typename T, typename... Args> +inline static T* RtlNew(Args&&... aArgs) { + HANDLE processHeap = nt::RtlGetProcessHeap(); + if (!processHeap) { + // Handle the case where the process heap is not initialized because + // passing nullptr to RtlAllocateHeap crashes the process. + return nullptr; + } + + void* ptr = ::RtlAllocateHeap(processHeap, 0, sizeof(T)); + if (!ptr) { + return nullptr; + } + + return new (ptr) T(std::forward<Args>(aArgs)...); +} + +template <typename T> +inline static void RtlDelete(T* aPtr) { + if (!aPtr) { + return; + } + + aPtr->~T(); + ::RtlFreeHeap(nt::RtlGetProcessHeap(), 0, aPtr); +} + +} // namespace freestanding +} // namespace mozilla + +// Initialization code for all statically-allocated data in freestanding is +// placed into a separate section. This allows us to initialize any +// freestanding statics without needing to initialize everything else in this +// binary. +#pragma init_seg(".freestd$g") + +#endif // mozilla_freestanding_Freestanding_h diff --git a/browser/app/winlauncher/freestanding/LoaderPrivateAPI.cpp b/browser/app/winlauncher/freestanding/LoaderPrivateAPI.cpp new file mode 100644 index 0000000000..908ebbdc91 --- /dev/null +++ b/browser/app/winlauncher/freestanding/LoaderPrivateAPI.cpp @@ -0,0 +1,292 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* vim: set ts=8 sts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. */ + +#include "LoaderPrivateAPI.h" + +#include "mozilla/Assertions.h" +#include "mozilla/Types.h" +#include "mozilla/Unused.h" +#include "../DllBlocklistInit.h" +#include "../ErrorHandler.h" + +using GlobalInitializerFn = void(__cdecl*)(void); + +// Allocation of static initialization section for the freestanding library +#pragma section(".freestd$a", read) +__declspec(allocate(".freestd$a")) static const GlobalInitializerFn + FreeStdStart = reinterpret_cast<GlobalInitializerFn>(0); + +#pragma section(".freestd$z", read) +__declspec(allocate(".freestd$z")) static const GlobalInitializerFn FreeStdEnd = + reinterpret_cast<GlobalInitializerFn>(0); + +namespace mozilla { +namespace freestanding { + +static RTL_RUN_ONCE gRunOnce = RTL_RUN_ONCE_INIT; + +// The contract for this callback is identical to the InitOnceCallback from +// Win32 land; we're just using ntdll-layer types instead. +static ULONG NTAPI DoOneTimeInit(PRTL_RUN_ONCE aRunOnce, PVOID aParameter, + PVOID* aContext) { + // Invoke every static initializer in the .freestd section + const GlobalInitializerFn* cur = &FreeStdStart + 1; + while (cur < &FreeStdEnd) { + if (*cur) { + (*cur)(); + } + + ++cur; + } + + return TRUE; +} + +/** + * This observer is only used until the mozglue observer connects itself. + * All we do here is accumulate the module loads into a vector. + * As soon as mozglue connects, we call |Forward| on mozglue's LoaderObserver + * to pass our vector on for further processing. This object then becomes + * defunct. + */ +class MOZ_ONLY_USED_TO_AVOID_STATIC_CONSTRUCTORS DefaultLoaderObserver final + : public nt::LoaderObserver { + public: + constexpr DefaultLoaderObserver() : mModuleLoads(nullptr) {} + + void OnBeginDllLoad(void** aContext, + PCUNICODE_STRING aRequestedDllName) final {} + bool SubstituteForLSP(PCUNICODE_STRING aLSPLeafName, + PHANDLE aOutHandle) final { + return false; + } + void OnEndDllLoad(void* aContext, NTSTATUS aNtStatus, + ModuleLoadInfo&& aModuleLoadInfo) final; + void Forward(nt::LoaderObserver* aNext) final; + void OnForward(ModuleLoadInfoVec&& aInfo) final { + MOZ_ASSERT_UNREACHABLE("Not valid in freestanding::DefaultLoaderObserver"); + } + + private: + mozilla::nt::SRWLock mLock; + ModuleLoadInfoVec* mModuleLoads; +}; + +class MOZ_ONLY_USED_TO_AVOID_STATIC_CONSTRUCTORS LoaderPrivateAPIImp final + : public LoaderPrivateAPI { + public: + // LoaderAPI + ModuleLoadInfo ConstructAndNotifyBeginDllLoad( + void** aContext, PCUNICODE_STRING aRequestedDllName) final; + bool SubstituteForLSP(PCUNICODE_STRING aLSPLeafName, + PHANDLE aOutHandle) final; + void NotifyEndDllLoad(void* aContext, NTSTATUS aLoadNtStatus, + ModuleLoadInfo&& aModuleLoadInfo) final; + nt::AllocatedUnicodeString GetSectionName(void* aSectionAddr) final; + nt::LoaderAPI::InitDllBlocklistOOPFnPtr GetDllBlocklistInitFn() final; + nt::LoaderAPI::HandleLauncherErrorFnPtr GetHandleLauncherErrorFn() final; + nt::SharedSection* GetSharedSection() final; + + // LoaderPrivateAPI + void NotifyBeginDllLoad(void** aContext, + PCUNICODE_STRING aRequestedDllName) final; + void NotifyBeginDllLoad(ModuleLoadInfo& aModuleLoadInfo, void** aContext, + PCUNICODE_STRING aRequestedDllName) final; + void SetObserver(nt::LoaderObserver* aNewObserver) final; + bool IsDefaultObserver() const final; + nt::MemorySectionNameBuf GetSectionNameBuffer(void* aSectionAddr) final; +}; + +static void Init() { + DebugOnly<NTSTATUS> ntStatus = + ::RtlRunOnceExecuteOnce(&gRunOnce, &DoOneTimeInit, nullptr, nullptr); + MOZ_ASSERT(NT_SUCCESS(ntStatus)); +} + +} // namespace freestanding +} // namespace mozilla + +static mozilla::freestanding::DefaultLoaderObserver gDefaultObserver; +static mozilla::freestanding::LoaderPrivateAPIImp gPrivateAPI; + +static mozilla::nt::SRWLock gLoaderObserverLock; +static mozilla::nt::LoaderObserver* gLoaderObserver = &gDefaultObserver; + +namespace mozilla { +namespace freestanding { + +LoaderPrivateAPI& gLoaderPrivateAPI = gPrivateAPI; + +void DefaultLoaderObserver::OnEndDllLoad(void* aContext, NTSTATUS aNtStatus, + ModuleLoadInfo&& aModuleLoadInfo) { + // If the DLL load failed, or if the DLL was loaded by a previous request + // and thus was not mapped by this request, we do not save the ModuleLoadInfo. + if (!NT_SUCCESS(aNtStatus) || !aModuleLoadInfo.WasMapped()) { + return; + } + + nt::AutoExclusiveLock lock(mLock); + if (!mModuleLoads) { + mModuleLoads = RtlNew<ModuleLoadInfoVec>(); + if (!mModuleLoads) { + return; + } + } + + Unused << mModuleLoads->emplaceBack( + std::forward<ModuleLoadInfo>(aModuleLoadInfo)); +} + +/** + * Pass mModuleLoads's data off to |aNext| for further processing. + */ +void DefaultLoaderObserver::Forward(nt::LoaderObserver* aNext) { + MOZ_ASSERT(aNext); + if (!aNext) { + return; + } + + ModuleLoadInfoVec* moduleLoads = nullptr; + + { // Scope for lock + nt::AutoExclusiveLock lock(mLock); + moduleLoads = mModuleLoads; + mModuleLoads = nullptr; + } + + if (!moduleLoads) { + return; + } + + aNext->OnForward(std::move(*moduleLoads)); + RtlDelete(moduleLoads); +} + +ModuleLoadInfo LoaderPrivateAPIImp::ConstructAndNotifyBeginDllLoad( + void** aContext, PCUNICODE_STRING aRequestedDllName) { + ModuleLoadInfo loadInfo(aRequestedDllName); + + NotifyBeginDllLoad(loadInfo, aContext, aRequestedDllName); + + return loadInfo; +} + +bool LoaderPrivateAPIImp::SubstituteForLSP(PCUNICODE_STRING aLSPLeafName, + PHANDLE aOutHandle) { + nt::AutoSharedLock lock(gLoaderObserverLock); + return gLoaderObserver->SubstituteForLSP(aLSPLeafName, aOutHandle); +} + +void LoaderPrivateAPIImp::NotifyEndDllLoad(void* aContext, + NTSTATUS aLoadNtStatus, + ModuleLoadInfo&& aModuleLoadInfo) { + aModuleLoadInfo.SetEndLoadTimeStamp(); + + if (NT_SUCCESS(aLoadNtStatus)) { + aModuleLoadInfo.CaptureBacktrace(); + } + + nt::AutoSharedLock lock(gLoaderObserverLock); + + // We need to notify the observer that the DLL load has ended even when + // |aLoadNtStatus| indicates a failure. This is to ensure that any resources + // acquired by the observer during OnBeginDllLoad are cleaned up. + gLoaderObserver->OnEndDllLoad(aContext, aLoadNtStatus, + std::move(aModuleLoadInfo)); +} + +nt::AllocatedUnicodeString LoaderPrivateAPIImp::GetSectionName( + void* aSectionAddr) { + const HANDLE kCurrentProcess = reinterpret_cast<HANDLE>(-1); + + nt::MemorySectionNameBuf buf; + NTSTATUS ntStatus = + ::NtQueryVirtualMemory(kCurrentProcess, aSectionAddr, MemorySectionName, + &buf, sizeof(buf), nullptr); + if (!NT_SUCCESS(ntStatus)) { + return nt::AllocatedUnicodeString(); + } + + return nt::AllocatedUnicodeString(&buf.mSectionFileName); +} + +nt::LoaderAPI::InitDllBlocklistOOPFnPtr +LoaderPrivateAPIImp::GetDllBlocklistInitFn() { + return &InitializeDllBlocklistOOP; +} + +nt::LoaderAPI::HandleLauncherErrorFnPtr +LoaderPrivateAPIImp::GetHandleLauncherErrorFn() { + return &HandleLauncherError; +} + +nt::SharedSection* LoaderPrivateAPIImp::GetSharedSection() { + return &gSharedSection; +} + +nt::MemorySectionNameBuf LoaderPrivateAPIImp::GetSectionNameBuffer( + void* aSectionAddr) { + const HANDLE kCurrentProcess = reinterpret_cast<HANDLE>(-1); + + nt::MemorySectionNameBuf buf; + NTSTATUS ntStatus = + ::NtQueryVirtualMemory(kCurrentProcess, aSectionAddr, MemorySectionName, + &buf, sizeof(buf), nullptr); + if (!NT_SUCCESS(ntStatus)) { + return nt::MemorySectionNameBuf(); + } + + return buf; +} + +void LoaderPrivateAPIImp::NotifyBeginDllLoad( + void** aContext, PCUNICODE_STRING aRequestedDllName) { + nt::AutoSharedLock lock(gLoaderObserverLock); + gLoaderObserver->OnBeginDllLoad(aContext, aRequestedDllName); +} + +void LoaderPrivateAPIImp::NotifyBeginDllLoad( + ModuleLoadInfo& aModuleLoadInfo, void** aContext, + PCUNICODE_STRING aRequestedDllName) { + NotifyBeginDllLoad(aContext, aRequestedDllName); + aModuleLoadInfo.SetBeginLoadTimeStamp(); +} + +void LoaderPrivateAPIImp::SetObserver(nt::LoaderObserver* aNewObserver) { + nt::LoaderObserver* prevLoaderObserver = nullptr; + + nt::AutoExclusiveLock lock(gLoaderObserverLock); + + MOZ_ASSERT(aNewObserver); + if (!aNewObserver) { + // This is unlikely, but we always want a valid observer, so use the + // gDefaultObserver if necessary. + gLoaderObserver = &gDefaultObserver; + return; + } + + prevLoaderObserver = gLoaderObserver; + gLoaderObserver = aNewObserver; + + MOZ_ASSERT(prevLoaderObserver); + if (!prevLoaderObserver) { + return; + } + + // Now that we have a new observer, the previous observer must forward its + // data on to the new observer for processing. + prevLoaderObserver->Forward(aNewObserver); +} + +bool LoaderPrivateAPIImp::IsDefaultObserver() const { + nt::AutoSharedLock lock(gLoaderObserverLock); + return gLoaderObserver == &gDefaultObserver; +} + +void EnsureInitialized() { Init(); } + +} // namespace freestanding +} // namespace mozilla diff --git a/browser/app/winlauncher/freestanding/LoaderPrivateAPI.h b/browser/app/winlauncher/freestanding/LoaderPrivateAPI.h new file mode 100644 index 0000000000..f21472d689 --- /dev/null +++ b/browser/app/winlauncher/freestanding/LoaderPrivateAPI.h @@ -0,0 +1,62 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* vim: set ts=8 sts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. */ + +#ifndef mozilla_freestanding_LoaderPrivateAPI_h +#define mozilla_freestanding_LoaderPrivateAPI_h + +#include "mozilla/LoaderAPIInterfaces.h" + +namespace mozilla { +namespace freestanding { + +/** + * This part of the API is available only to the launcher process. + */ +class NS_NO_VTABLE LoaderPrivateAPI : public nt::LoaderAPI { + public: + /** + * Notify the nt::LoaderObserver that a module load is beginning + */ + virtual void NotifyBeginDllLoad(void** aContext, + PCUNICODE_STRING aRequestedDllName) = 0; + /** + * Notify the nt::LoaderObserver that a module load is beginning and set the + * begin load timestamp on |aModuleLoadInfo|. + */ + virtual void NotifyBeginDllLoad(ModuleLoadInfo& aModuleLoadInfo, + void** aContext, + PCUNICODE_STRING aRequestedDllName) = 0; + + /** + * Set a new nt::LoaderObserver to be used by the launcher process. NB: This + * should only happen while the current process is still single-threaded! + */ + virtual void SetObserver(nt::LoaderObserver* aNewObserver) = 0; + + /** + * Returns true if the current nt::LoaderObserver is the launcher process's + * built-in observer. + */ + virtual bool IsDefaultObserver() const = 0; + + /** + * Returns the name of a given mapped section address as a local instance of + * nt::MemorySectionNameBuf. This does not involve heap allocation. + */ + virtual nt::MemorySectionNameBuf GetSectionNameBuffer(void* aSectionAddr) = 0; +}; + +/** + * Ensures that any statics in the freestanding library are initialized. + */ +void EnsureInitialized(); + +extern LoaderPrivateAPI& gLoaderPrivateAPI; + +} // namespace freestanding +} // namespace mozilla + +#endif // mozilla_freestanding_LoaderPrivateAPI_h diff --git a/browser/app/winlauncher/freestanding/ModuleLoadFrame.cpp b/browser/app/winlauncher/freestanding/ModuleLoadFrame.cpp new file mode 100644 index 0000000000..3aa043b8c7 --- /dev/null +++ b/browser/app/winlauncher/freestanding/ModuleLoadFrame.cpp @@ -0,0 +1,144 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* vim: set ts=8 sts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. */ + +#include "ModuleLoadFrame.h" + +#include "LoaderPrivateAPI.h" + +namespace mozilla { +namespace freestanding { + +ModuleLoadFrame::ModuleLoadFrame(PCUNICODE_STRING aRequestedDllName) + : mPrev(sTopFrame.get()), + mContext(nullptr), + mLSPSubstitutionRequired(false), + mLoadNtStatus(STATUS_UNSUCCESSFUL), + mLoadInfo(aRequestedDllName) { + EnsureInitialized(); + sTopFrame.set(this); + + gLoaderPrivateAPI.NotifyBeginDllLoad(mLoadInfo, &mContext, aRequestedDllName); +} + +ModuleLoadFrame::ModuleLoadFrame(nt::AllocatedUnicodeString&& aSectionName, + const void* aMapBaseAddr, NTSTATUS aNtStatus, + ModuleLoadInfo::Status aLoadStatus, + bool aIsDependent) + : mPrev(sTopFrame.get()), + mContext(nullptr), + mLSPSubstitutionRequired(false), + mLoadNtStatus(aNtStatus), + mLoadInfo(std::move(aSectionName), aMapBaseAddr, aLoadStatus, + aIsDependent) { + sTopFrame.set(this); + + gLoaderPrivateAPI.NotifyBeginDllLoad(&mContext, mLoadInfo.mSectionName); +} + +ModuleLoadFrame::~ModuleLoadFrame() { + gLoaderPrivateAPI.NotifyEndDllLoad(mContext, mLoadNtStatus, + std::move(mLoadInfo)); + sTopFrame.set(mPrev); +} + +/* static */ +void ModuleLoadFrame::NotifyLSPSubstitutionRequired( + PCUNICODE_STRING aLeafName) { + ModuleLoadFrame* topFrame = sTopFrame.get(); + if (!topFrame) { + return; + } + + topFrame->SetLSPSubstitutionRequired(aLeafName); +} + +void ModuleLoadFrame::SetLSPSubstitutionRequired(PCUNICODE_STRING aLeafName) { + MOZ_ASSERT(!mLoadInfo.mBaseAddr); + if (mLoadInfo.mBaseAddr) { + // If mBaseAddr is not null then |this| has already seen a module load. This + // should not be the case for a LSP substitution, so we bail. + return; + } + + // Save aLeafName, as it will be used by SetLoadStatus when invoking + // SubstituteForLSP + mLoadInfo.mRequestedDllName = aLeafName; + mLSPSubstitutionRequired = true; +} + +/* static */ +void ModuleLoadFrame::NotifySectionMap( + nt::AllocatedUnicodeString&& aSectionName, const void* aMapBaseAddr, + NTSTATUS aMapNtStatus, ModuleLoadInfo::Status aLoadStatus, + bool aIsDependent) { + ModuleLoadFrame* topFrame = sTopFrame.get(); + if (!topFrame) { + // The only time that this data is useful is during initial mapping of + // the executable's dependent DLLs. If mozglue is present then + // IsDefaultObserver will return false, indicating that we are beyond + // initial process startup. + if (gLoaderPrivateAPI.IsDefaultObserver()) { + OnBareSectionMap(std::move(aSectionName), aMapBaseAddr, aMapNtStatus, + aLoadStatus, aIsDependent); + } + return; + } + + topFrame->OnSectionMap(std::move(aSectionName), aMapBaseAddr, aMapNtStatus, + aLoadStatus, aIsDependent); +} + +/* static */ +bool ModuleLoadFrame::ExistsTopFrame() { return !!sTopFrame.get(); } + +void ModuleLoadFrame::OnSectionMap(nt::AllocatedUnicodeString&& aSectionName, + const void* aMapBaseAddr, + NTSTATUS aMapNtStatus, + ModuleLoadInfo::Status aLoadStatus, + bool aIsDependent) { + if (mLoadInfo.mBaseAddr) { + // If mBaseAddr is not null then |this| has already seen a module load. This + // means that we are witnessing a bare section map. + OnBareSectionMap(std::move(aSectionName), aMapBaseAddr, aMapNtStatus, + aLoadStatus, aIsDependent); + return; + } + + mLoadInfo.mSectionName = std::move(aSectionName); + mLoadInfo.mBaseAddr = aMapBaseAddr; + mLoadInfo.mStatus = aLoadStatus; +} + +/* static */ +void ModuleLoadFrame::OnBareSectionMap( + nt::AllocatedUnicodeString&& aSectionName, const void* aMapBaseAddr, + NTSTATUS aMapNtStatus, ModuleLoadInfo::Status aLoadStatus, + bool aIsDependent) { + // We call the special constructor variant that is used for bare mappings. + ModuleLoadFrame frame(std::move(aSectionName), aMapBaseAddr, aMapNtStatus, + aLoadStatus, aIsDependent); +} + +NTSTATUS ModuleLoadFrame::SetLoadStatus(NTSTATUS aNtStatus, + PHANDLE aOutHandle) { + mLoadNtStatus = aNtStatus; + + if (!mLSPSubstitutionRequired) { + return aNtStatus; + } + + if (!gLoaderPrivateAPI.SubstituteForLSP(mLoadInfo.mRequestedDllName, + aOutHandle)) { + return aNtStatus; + } + + return STATUS_SUCCESS; +} + +SafeThreadLocal<ModuleLoadFrame*> ModuleLoadFrame::sTopFrame; + +} // namespace freestanding +} // namespace mozilla diff --git a/browser/app/winlauncher/freestanding/ModuleLoadFrame.h b/browser/app/winlauncher/freestanding/ModuleLoadFrame.h new file mode 100644 index 0000000000..51a179db99 --- /dev/null +++ b/browser/app/winlauncher/freestanding/ModuleLoadFrame.h @@ -0,0 +1,97 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* vim: set ts=8 sts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. */ + +#ifndef mozilla_freestanding_ModuleLoadFrame_h +#define mozilla_freestanding_ModuleLoadFrame_h + +#include "mozilla/LoaderAPIInterfaces.h" +#include "mozilla/NativeNt.h" +#include "mozilla/ThreadLocal.h" + +#include "SafeThreadLocal.h" + +namespace mozilla { +namespace freestanding { + +/** + * This class holds information about a DLL load at a particular frame in the + * current thread's stack. Each instance adds itself to a thread-local linked + * list of ModuleLoadFrames, enabling us to query information about the + * previous module load on the stack. + */ +class MOZ_RAII ModuleLoadFrame final { + public: + /** + * This constructor is for use by the LdrLoadDll hook. + */ + explicit ModuleLoadFrame(PCUNICODE_STRING aRequestedDllName); + ~ModuleLoadFrame(); + + static void NotifyLSPSubstitutionRequired(PCUNICODE_STRING aLeafName); + + /** + * This static method is called by the NtMapViewOfSection hook. + */ + static void NotifySectionMap(nt::AllocatedUnicodeString&& aSectionName, + const void* aMapBaseAddr, NTSTATUS aMapNtStatus, + ModuleLoadInfo::Status aLoadStatus, + bool aIsDependent); + static bool ExistsTopFrame(); + + /** + * Called by the LdrLoadDll hook to indicate the status of the load and for + * us to provide a substitute output handle if necessary. + */ + NTSTATUS SetLoadStatus(NTSTATUS aNtStatus, PHANDLE aOutHandle); + + ModuleLoadFrame(const ModuleLoadFrame&) = delete; + ModuleLoadFrame(ModuleLoadFrame&&) = delete; + ModuleLoadFrame& operator=(const ModuleLoadFrame&) = delete; + ModuleLoadFrame& operator=(ModuleLoadFrame&&) = delete; + + private: + /** + * Called by OnBareSectionMap to construct a frame for a bare load. + */ + ModuleLoadFrame(nt::AllocatedUnicodeString&& aSectionName, + const void* aMapBaseAddr, NTSTATUS aNtStatus, + ModuleLoadInfo::Status aLoadStatus, bool aIsDependent); + + void SetLSPSubstitutionRequired(PCUNICODE_STRING aLeafName); + void OnSectionMap(nt::AllocatedUnicodeString&& aSectionName, + const void* aMapBaseAddr, NTSTATUS aMapNtStatus, + ModuleLoadInfo::Status aLoadStatus, bool aIsDependent); + + /** + * A "bare" section mapping is one that was mapped without the code passing + * through a call to ntdll!LdrLoadDll. This method is invoked when we detect + * that condition. + */ + static void OnBareSectionMap(nt::AllocatedUnicodeString&& aSectionName, + const void* aMapBaseAddr, NTSTATUS aMapNtStatus, + ModuleLoadInfo::Status aLoadStatus, + bool aIsDependent); + + private: + // Link to the previous frame + ModuleLoadFrame* mPrev; + // Pointer to context managed by the nt::LoaderObserver implementation + void* mContext; + // Set to |true| when we need to block a WinSock LSP + bool mLSPSubstitutionRequired; + // NTSTATUS code from the |LdrLoadDll| call + NTSTATUS mLoadNtStatus; + // Telemetry information that will be forwarded to the nt::LoaderObserver + ModuleLoadInfo mLoadInfo; + + // Head of the linked list + static SafeThreadLocal<ModuleLoadFrame*> sTopFrame; +}; + +} // namespace freestanding +} // namespace mozilla + +#endif // mozilla_freestanding_ModuleLoadFrame_h diff --git a/browser/app/winlauncher/freestanding/SafeThreadLocal.h b/browser/app/winlauncher/freestanding/SafeThreadLocal.h new file mode 100644 index 0000000000..e4b869f649 --- /dev/null +++ b/browser/app/winlauncher/freestanding/SafeThreadLocal.h @@ -0,0 +1,96 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* vim: set ts=8 sts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. */ + +#ifndef mozilla_freestanding_SafeThreadLocal_h +#define mozilla_freestanding_SafeThreadLocal_h + +#include <type_traits> + +#include "mozilla/NativeNt.h" +#include "mozilla/ThreadLocal.h" + +namespace mozilla { +namespace freestanding { + +// We cannot fall back to the Tls* APIs because kernel32 might not have been +// loaded yet. +#if defined(__MINGW32__) && !defined(HAVE_THREAD_TLS_KEYWORD) +# error "This code requires the compiler to have native TLS support" +#endif // defined(__MINGW32__) && !defined(HAVE_THREAD_TLS_KEYWORD) + +/** + * This class holds data as a thread-local variable, or as a global variable + * if the thread local storage is not initialized yet. It should be safe + * because in that early stage we assume there is no more than a single thread. + */ +template <typename T> +class SafeThreadLocal final { + static MOZ_THREAD_LOCAL(T) sThreadLocal; + static T sGlobal; + static bool sIsTlsUsed; + + // In normal cases, TLS is always available and the class uses sThreadLocal + // without changing sMainThreadId. So sMainThreadId is likely to be 0. + // + // If TLS is not available, we use sGlobal instead and update sMainThreadId + // so that that thread keeps using sGlobal even after TLS is initialized + // later. + static DWORD sMainThreadId; + + // Need non-inline accessors to prevent the compiler from generating code + // accessing sThreadLocal before checking a condition. + MOZ_NEVER_INLINE static void SetGlobalValue(T aValue) { sGlobal = aValue; } + MOZ_NEVER_INLINE static T GetGlobalValue() { return sGlobal; } + + public: + static void set(T aValue) { + static_assert(std::is_pointer_v<T>, + "SafeThreadLocal must be used with a pointer"); + + if (sMainThreadId == mozilla::nt::RtlGetCurrentThreadId()) { + SetGlobalValue(aValue); + } else if (sIsTlsUsed) { + MOZ_ASSERT(mozilla::nt::RtlGetThreadLocalStoragePointer(), + "Once TLS is used, TLS should be available till the end."); + sThreadLocal.set(aValue); + } else if (mozilla::nt::RtlGetThreadLocalStoragePointer()) { + sIsTlsUsed = true; + sThreadLocal.set(aValue); + } else { + MOZ_ASSERT(sMainThreadId == 0, + "A second thread cannot be created before TLS is available."); + sMainThreadId = mozilla::nt::RtlGetCurrentThreadId(); + SetGlobalValue(aValue); + } + } + + static T get() { + if (sMainThreadId == mozilla::nt::RtlGetCurrentThreadId()) { + return GetGlobalValue(); + } else if (sIsTlsUsed) { + return sThreadLocal.get(); + } + return GetGlobalValue(); + } +}; + +template <typename T> +MOZ_THREAD_LOCAL(T) +SafeThreadLocal<T>::sThreadLocal; + +template <typename T> +T SafeThreadLocal<T>::sGlobal = nullptr; + +template <typename T> +bool SafeThreadLocal<T>::sIsTlsUsed = false; + +template <typename T> +DWORD SafeThreadLocal<T>::sMainThreadId = 0; + +} // namespace freestanding +} // namespace mozilla + +#endif // mozilla_freestanding_SafeThreadLocal_h diff --git a/browser/app/winlauncher/freestanding/SharedSection.cpp b/browser/app/winlauncher/freestanding/SharedSection.cpp new file mode 100644 index 0000000000..19b2f94f74 --- /dev/null +++ b/browser/app/winlauncher/freestanding/SharedSection.cpp @@ -0,0 +1,366 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* vim: set ts=8 sts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. */ + +#include "SharedSection.h" + +#include <algorithm> +#include "CheckForCaller.h" +#include "mozilla/BinarySearch.h" + +namespace { + +bool AddString(mozilla::Span<wchar_t> aBuffer, const UNICODE_STRING& aStr) { + size_t offsetElements = 0; + while (offsetElements < aBuffer.Length()) { + UNICODE_STRING uniStr; + ::RtlInitUnicodeString(&uniStr, aBuffer.data() + offsetElements); + + if (uniStr.Length == 0) { + // Reached to the array's last item. + break; + } + + if (::RtlCompareUnicodeString(&uniStr, &aStr, TRUE) == 0) { + // Already included in the array. + return true; + } + + // Go to the next string. + offsetElements += uniStr.MaximumLength / sizeof(wchar_t); + } + + // Ensure enough space including the last empty string at the end. + if (offsetElements * sizeof(wchar_t) + aStr.Length + sizeof(wchar_t) + + sizeof(wchar_t) > + aBuffer.LengthBytes()) { + return false; + } + + auto newStr = aBuffer.Subspan(offsetElements); + memcpy(newStr.data(), aStr.Buffer, aStr.Length); + memset(newStr.data() + aStr.Length / sizeof(wchar_t), 0, sizeof(wchar_t)); + return true; +} + +} // anonymous namespace + +namespace mozilla { +namespace freestanding { + +SharedSection gSharedSection; + +// Why don't we use ::GetProcAddress? +// If the export table of kernel32.dll is tampered in the current process, +// we cannot transfer an RVA because the function pointed by the RVA may not +// exist in a target process. +// We can use ::GetProcAddress with additional check to detect tampering, but +// FindExportAddressTableEntry fits perfectly here because it returns nullptr +// if the target entry is outside the image, which means it's tampered or +// forwarded to another DLL. +#define INIT_FUNCTION(exports, name) \ + do { \ + auto rvaToFunction = exports.FindExportAddressTableEntry(#name); \ + if (!rvaToFunction) { \ + return; \ + } \ + m##name = reinterpret_cast<decltype(m##name)>(*rvaToFunction); \ + } while (0) + +#define RESOLVE_FUNCTION(base, name) \ + m##name = reinterpret_cast<decltype(m##name)>( \ + base + reinterpret_cast<uintptr_t>(m##name)) + +void Kernel32ExportsSolver::Init() { + interceptor::MMPolicyInProcess policy; + auto k32Exports = nt::PEExportSection<interceptor::MMPolicyInProcess>::Get( + ::GetModuleHandleW(L"kernel32.dll"), policy); + if (!k32Exports) { + return; + } + + // Please make sure these functions are not forwarded to another DLL. + INIT_FUNCTION(k32Exports, FlushInstructionCache); + INIT_FUNCTION(k32Exports, GetModuleHandleW); + INIT_FUNCTION(k32Exports, GetSystemInfo); + INIT_FUNCTION(k32Exports, VirtualProtect); +} + +bool Kernel32ExportsSolver::Resolve() { + const UNICODE_STRING k32Name = MOZ_LITERAL_UNICODE_STRING(L"kernel32.dll"); + + // We cannot use GetModuleHandleW because this code can be called + // before IAT is resolved. + auto k32Module = nt::GetModuleHandleFromLeafName(k32Name); + if (k32Module.isErr()) { + // Probably this is called before kernel32.dll is loaded. + return false; + } + + uintptr_t k32Base = + nt::PEHeaders::HModuleToBaseAddr<uintptr_t>(k32Module.unwrap()); + + RESOLVE_FUNCTION(k32Base, FlushInstructionCache); + RESOLVE_FUNCTION(k32Base, GetModuleHandleW); + RESOLVE_FUNCTION(k32Base, GetSystemInfo); + RESOLVE_FUNCTION(k32Base, VirtualProtect); + + return true; +} + +HANDLE SharedSection::sSectionHandle = nullptr; +SharedSection::Layout* SharedSection::sWriteCopyView = nullptr; +RTL_RUN_ONCE SharedSection::sEnsureOnce = RTL_RUN_ONCE_INIT; + +void SharedSection::Reset(HANDLE aNewSectionObject) { + if (sWriteCopyView) { + nt::AutoMappedView view(sWriteCopyView); + sWriteCopyView = nullptr; + ::RtlRunOnceInitialize(&sEnsureOnce); + } + + if (sSectionHandle != aNewSectionObject) { + if (sSectionHandle) { + ::CloseHandle(sSectionHandle); + } + sSectionHandle = aNewSectionObject; + } +} + +void SharedSection::ConvertToReadOnly() { + if (!sSectionHandle) { + return; + } + + HANDLE readonlyHandle; + if (!::DuplicateHandle(nt::kCurrentProcess, sSectionHandle, + nt::kCurrentProcess, &readonlyHandle, GENERIC_READ, + FALSE, 0)) { + return; + } + + Reset(readonlyHandle); +} + +LauncherVoidResult SharedSection::Init() { + static_assert( + kSharedViewSize >= sizeof(Layout), + "kSharedViewSize is too small to represent SharedSection::Layout."); + + HANDLE section = + ::CreateFileMappingW(INVALID_HANDLE_VALUE, nullptr, PAGE_READWRITE, 0, + kSharedViewSize, nullptr); + if (!section) { + return LAUNCHER_ERROR_FROM_LAST(); + } + Reset(section); + + // The initial contents of the pages in a file mapping object backed by + // the operating system paging file are 0 (zero). No need to zero it out + // ourselves. + // https://docs.microsoft.com/en-us/windows/win32/api/memoryapi/nf-memoryapi-createfilemappingw + nt::AutoMappedView writableView(sSectionHandle, PAGE_READWRITE); + if (!writableView) { + return LAUNCHER_ERROR_FROM_LAST(); + } + + Layout* view = writableView.as<Layout>(); + view->mK32Exports.Init(); + view->mState = Layout::State::kInitialized; + // Leave view->mDependentModulePathArrayStart to be zero to indicate + // we can add blocklist entries + return Ok(); +} + +LauncherVoidResult SharedSection::AddDependentModule(PCUNICODE_STRING aNtPath) { + nt::AutoMappedView writableView(sSectionHandle, PAGE_READWRITE); + if (!writableView) { + return LAUNCHER_ERROR_FROM_WIN32(::RtlGetLastWin32Error()); + } + + Layout* view = writableView.as<Layout>(); + if (!view->mDependentModulePathArrayStart) { + // This is the first time AddDependentModule is called. We set the initial + // value to mDependentModulePathArrayStart, which *closes* the blocklist. + // After this, AddBlocklist is no longer allowed. + view->mDependentModulePathArrayStart = + FIELD_OFFSET(Layout, mFirstBlockEntry) + sizeof(DllBlockInfo); + } + + if (!AddString(view->GetDependentModules(), *aNtPath)) { + return LAUNCHER_ERROR_FROM_WIN32(ERROR_INSUFFICIENT_BUFFER); + } + + return Ok(); +} + +LauncherVoidResult SharedSection::SetBlocklist( + const DynamicBlockList& aBlocklist, bool isDisabled) { + if (!aBlocklist.GetPayloadSize()) { + return Ok(); + } + + nt::AutoMappedView writableView(sSectionHandle, PAGE_READWRITE); + if (!writableView) { + return LAUNCHER_ERROR_FROM_WIN32(::RtlGetLastWin32Error()); + } + + Layout* view = writableView.as<Layout>(); + if (view->mDependentModulePathArrayStart > 0) { + // If the dependent module array is already available, we must not update + // the blocklist. + return LAUNCHER_ERROR_FROM_WIN32(ERROR_INVALID_STATE); + } + + view->mBlocklistIsDisabled = isDisabled ? 1 : 0; + uintptr_t bufferEnd = reinterpret_cast<uintptr_t>(view) + kSharedViewSize; + size_t bytesCopied = aBlocklist.CopyTo( + view->mFirstBlockEntry, + bufferEnd - reinterpret_cast<uintptr_t>(view->mFirstBlockEntry)); + if (!bytesCopied) { + return LAUNCHER_ERROR_FROM_WIN32(ERROR_INSUFFICIENT_BUFFER); + } + + // Setting mDependentModulePathArrayStart to a non-zero value means + // we no longer accept blocklist entries + // Just to be safe, make sure we don't overwrite mFirstBlockEntry even + // if there are no entries. + view->mDependentModulePathArrayStart = + FIELD_OFFSET(Layout, mFirstBlockEntry) + + std::max(bytesCopied, sizeof(DllBlockInfo)); + return Ok(); +} + +/* static */ +ULONG NTAPI SharedSection::EnsureWriteCopyViewOnce(PRTL_RUN_ONCE, PVOID, + PVOID*) { + if (!sWriteCopyView) { + nt::AutoMappedView view(sSectionHandle, PAGE_WRITECOPY); + if (!view) { + return TRUE; + } + sWriteCopyView = view.as<Layout>(); + view.release(); + } + return sWriteCopyView->Resolve() ? TRUE : FALSE; +} + +SharedSection::Layout* SharedSection::EnsureWriteCopyView( + bool requireKernel32Exports /*= false */) { + ::RtlRunOnceExecuteOnce(&sEnsureOnce, &EnsureWriteCopyViewOnce, nullptr, + nullptr); + if (!sWriteCopyView) { + return nullptr; + } + auto requiredState = requireKernel32Exports + ? Layout::State::kResolved + : Layout::State::kLoadedDynamicBlocklistEntries; + return sWriteCopyView->mState >= requiredState ? sWriteCopyView : nullptr; +} + +bool SharedSection::Layout::Resolve() { + if (mState == State::kResolved) { + return true; + } + if (mState == State::kUninitialized) { + return false; + } + if (mState == State::kInitialized) { + if (!mNumBlockEntries) { + uintptr_t arrayBase = reinterpret_cast<uintptr_t>(mFirstBlockEntry); + uint32_t numEntries = 0; + for (DllBlockInfo* entry = mFirstBlockEntry; + entry->mName.Length && numEntries < GetMaxNumBlockEntries(); + ++entry) { + entry->mName.Buffer = reinterpret_cast<wchar_t*>( + arrayBase + reinterpret_cast<uintptr_t>(entry->mName.Buffer)); + ++numEntries; + } + mNumBlockEntries = numEntries; + // Sort by name so that we can binary-search + std::sort(mFirstBlockEntry, mFirstBlockEntry + mNumBlockEntries, + [](const DllBlockInfo& a, const DllBlockInfo& b) { + return ::RtlCompareUnicodeString(&a.mName, &b.mName, TRUE) < + 0; + }); + } + mState = State::kLoadedDynamicBlocklistEntries; + } + + if (!mK32Exports.Resolve()) { + return false; + } + + mState = State::kResolved; + return true; +} + +Span<wchar_t> SharedSection::Layout::GetDependentModules() { + if (!mDependentModulePathArrayStart) { + return nullptr; + } + return Span<wchar_t>( + reinterpret_cast<wchar_t*>(reinterpret_cast<uintptr_t>(this) + + mDependentModulePathArrayStart), + (kSharedViewSize - mDependentModulePathArrayStart) / sizeof(wchar_t)); +} + +bool SharedSection::Layout::IsDisabled() const { + return !!mBlocklistIsDisabled; +} + +const DllBlockInfo* SharedSection::Layout::SearchBlocklist( + const UNICODE_STRING& aLeafName) const { + MOZ_ASSERT(mState >= State::kLoadedDynamicBlocklistEntries); + DllBlockInfoComparator comp(aLeafName); + size_t match; + if (!BinarySearchIf(mFirstBlockEntry, 0, mNumBlockEntries, comp, &match)) { + return nullptr; + } + return &mFirstBlockEntry[match]; +} + +Kernel32ExportsSolver* SharedSection::GetKernel32Exports() { + Layout* writeCopyView = EnsureWriteCopyView(true); + return writeCopyView ? &writeCopyView->mK32Exports : nullptr; +} + +Span<const wchar_t> SharedSection::GetDependentModules() { + Layout* writeCopyView = EnsureWriteCopyView(); + return writeCopyView ? writeCopyView->GetDependentModules() : nullptr; +} + +Span<const DllBlockInfo> SharedSection::GetDynamicBlocklist() { + Layout* writeCopyView = EnsureWriteCopyView(); + return writeCopyView ? writeCopyView->GetModulePathArray() : nullptr; +} + +const DllBlockInfo* SharedSection::SearchBlocklist( + const UNICODE_STRING& aLeafName) { + Layout* writeCopyView = EnsureWriteCopyView(); + return writeCopyView ? writeCopyView->SearchBlocklist(aLeafName) : nullptr; +} + +bool SharedSection::IsDisabled() { + Layout* writeCopyView = EnsureWriteCopyView(); + return writeCopyView ? writeCopyView->IsDisabled() : false; +} + +LauncherVoidResult SharedSection::TransferHandle( + nt::CrossExecTransferManager& aTransferMgr, DWORD aDesiredAccess, + HANDLE* aDestinationAddress) { + HANDLE remoteHandle; + if (!::DuplicateHandle(nt::kCurrentProcess, sSectionHandle, + aTransferMgr.RemoteProcess(), &remoteHandle, + aDesiredAccess, FALSE, 0)) { + return LAUNCHER_ERROR_FROM_LAST(); + } + + return aTransferMgr.Transfer(aDestinationAddress, &remoteHandle, + sizeof(remoteHandle)); +} + +} // namespace freestanding +} // namespace mozilla diff --git a/browser/app/winlauncher/freestanding/SharedSection.h b/browser/app/winlauncher/freestanding/SharedSection.h new file mode 100644 index 0000000000..496f577c80 --- /dev/null +++ b/browser/app/winlauncher/freestanding/SharedSection.h @@ -0,0 +1,199 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* vim: set ts=8 sts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. */ + +#ifndef mozilla_freestanding_SharedSection_h +#define mozilla_freestanding_SharedSection_h + +#include "mozilla/DynamicBlocklist.h" +#include "mozilla/glue/SharedSection.h" +#include "mozilla/NativeNt.h" +#include "mozilla/interceptor/MMPolicies.h" + +// clang-format off +#define MOZ_LITERAL_UNICODE_STRING(s) \ + { \ + /* Length of the string in bytes, less the null terminator */ \ + sizeof(s) - sizeof(wchar_t), \ + /* Length of the string in bytes, including the null terminator */ \ + sizeof(s), \ + /* Pointer to the buffer */ \ + const_cast<wchar_t*>(s) \ + } +// clang-format on + +namespace mozilla { +namespace freestanding { +class SharedSectionTestHelper; + +struct DllBlockInfoComparator { + explicit DllBlockInfoComparator(const UNICODE_STRING& aTarget) + : mTarget(&aTarget) {} + + int operator()(const DllBlockInfo& aVal) const { + return static_cast<int>( + ::RtlCompareUnicodeString(mTarget, &aVal.mName, TRUE)); + } + + PCUNICODE_STRING mTarget; +}; + +// This class calculates RVAs of kernel32's functions and transfers them +// to a target process, where the transferred RVAs are resolved into +// function addresses so that the target process can use them after +// kernel32.dll is loaded and before IAT is resolved. +struct MOZ_TRIVIAL_CTOR_DTOR Kernel32ExportsSolver final + : interceptor::MMPolicyInProcessEarlyStage::Kernel32Exports { + void Init(); + bool Resolve(); +}; + +// This class manages a section which is created in the launcher process and +// mapped in the browser process and the sandboxed processes. The section's +// layout is represented as SharedSection::Layout. +// +// (1) Kernel32's functions required for MMPolicyInProcessEarlyStage +// Formatted as Kernel32ExportsSolver. +// +// (2) Various flags and offsets +// +// (3) Entries in the dynamic blocklist, in DllBlockInfo format. There +// are mNumBlockEntries of these, followed by one that has mName.Length +// of 0. Note that the strings that contain +// the names of the entries in the blocklist are stored concatenated +// after the last entry. The mName pointers in each DllBlockInfo point +// to these strings correctly in Resolve(), so clients don't need +// to do anything special to read these strings. +// +// (4) Array of NT paths of the executable's dependent modules +// Formatted as a null-delimited wide-character string set ending with +// an empty string. These entries start at offset +// mDependentModulePathArrayStart (in bytes) from the beginning +// of the structure +// +// +--------------------------------------------------------------+ +// | (1) | FlushInstructionCache | +// | | GetModuleHandleW | +// | | GetSystemInfo | +// | | VirtualProtect | +// | | State [kUninitialized|kInitialized|kResolved] | +// +--------------------------------------------------------------+ +// | (2) | (flags and offsets) | +// +--------------------------------------------------------------+ +// | (3) | <DllBlockInfo for first entry in dynamic blocklist> | +// | | <DllBlockInfo for second entry in dynamic blocklist> | +// | | ... | +// | | <DllBlockInfo for last entry in dynamic blocklist> | +// | | <DllBlockInfo with mName.Length of 0> | +// | | L"string1.dllstring2.dll...stringlast.dll" | +// +--------------------------------------------------------------+ +// | (4) | L"NT path 1" | +// | | L"NT path 2" | +// | | ... | +// | | L"" | +// +--------------------------------------------------------------+ +class MOZ_TRIVIAL_CTOR_DTOR SharedSection final : public nt::SharedSection { + struct Layout final { + enum class State { + kUninitialized, + kInitialized, + kLoadedDynamicBlocklistEntries, + kResolved, + } mState; + + Kernel32ExportsSolver mK32Exports; + // 1 if the blocklist is disabled, 0 otherwise. + // If the blocklist is disabled, the entries are still loaded to make it + // easy for the user to remove any they don't want, but none of the DLLs + // here are actually blocked. + // Stored as a uint32_t for alignment reasons. + uint32_t mBlocklistIsDisabled; + // The offset, in bytes, from the beginning of the Layout structure to the + // first dependent module entry. + // When the Layout object is created, this value is 0, indicating that no + // dependent modules have been added and it is safe to add DllBlockInfo + // entries. + // After this value is set to something non-0, no more DllBlockInfo entries + // can be added. + uint32_t mDependentModulePathArrayStart; + // The number of blocklist entries. + uint32_t mNumBlockEntries; + DllBlockInfo mFirstBlockEntry[1]; + + Span<DllBlockInfo> GetModulePathArray() { + return Span<DllBlockInfo>( + mFirstBlockEntry, + (kSharedViewSize - (reinterpret_cast<uintptr_t>(mFirstBlockEntry) - + reinterpret_cast<uintptr_t>(this))) / + sizeof(DllBlockInfo)); + } + // Can be used to make sure we don't step past the end of the shared memory + // section. + static constexpr uint32_t GetMaxNumBlockEntries() { + return (kSharedViewSize - (offsetof(Layout, mFirstBlockEntry))) / + sizeof(DllBlockInfo); + } + Layout() = delete; // disallow instantiation + bool Resolve(); + bool IsDisabled() const; + const DllBlockInfo* SearchBlocklist(const UNICODE_STRING& aLeafName) const; + Span<wchar_t> GetDependentModules(); + }; + + // As we define a global variable of this class and use it in our blocklist + // which is excuted in a process's early stage. If we have a complex dtor, + // the static initializer tries to register that dtor with onexit() of + // ucrtbase.dll which is not loaded yet, resulting in crash. Thus, we have + // a raw handle and a pointer as a static variable and manually release them + // by calling Reset() where possible. + static HANDLE sSectionHandle; + static Layout* sWriteCopyView; + static RTL_RUN_ONCE sEnsureOnce; + + static ULONG NTAPI EnsureWriteCopyViewOnce(PRTL_RUN_ONCE, PVOID, PVOID*); + static Layout* EnsureWriteCopyView(bool requireKernel32Exports = false); + + static constexpr size_t kSharedViewSize = 0x1000; + + // For test use only + friend class SharedSectionTestHelper; + + public: + // Replace |sSectionHandle| with a given handle. + static void Reset(HANDLE aNewSectionObject = sSectionHandle); + + // Replace |sSectionHandle| with a new readonly handle. + static void ConvertToReadOnly(); + + // Create a new writable section and initialize the Kernel32ExportsSolver + // part. + static LauncherVoidResult Init(); + + // Append a new string to the |sSectionHandle| + static LauncherVoidResult AddDependentModule(PCUNICODE_STRING aNtPath); + static LauncherVoidResult SetBlocklist(const DynamicBlockList& aBlocklist, + bool isDisabled); + + // Map |sSectionHandle| to a copy-on-write page and return a writable pointer + // to each structure, or null if Layout failed to resolve exports. + Kernel32ExportsSolver* GetKernel32Exports(); + Span<const wchar_t> GetDependentModules() final override; + Span<const DllBlockInfo> GetDynamicBlocklist() final override; + + static bool IsDisabled(); + static const DllBlockInfo* SearchBlocklist(const UNICODE_STRING& aLeafName); + + // Transfer |sSectionHandle| to a process associated with |aTransferMgr|. + static LauncherVoidResult TransferHandle( + nt::CrossExecTransferManager& aTransferMgr, DWORD aDesiredAccess, + HANDLE* aDestinationAddress = &sSectionHandle); +}; + +extern SharedSection gSharedSection; + +} // namespace freestanding +} // namespace mozilla + +#endif // mozilla_freestanding_SharedSection_h diff --git a/browser/app/winlauncher/freestanding/gen_ntdll_freestanding_lib.py b/browser/app/winlauncher/freestanding/gen_ntdll_freestanding_lib.py new file mode 100644 index 0000000000..d9fe86d78e --- /dev/null +++ b/browser/app/winlauncher/freestanding/gen_ntdll_freestanding_lib.py @@ -0,0 +1,28 @@ +# -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*- +# vim: set filetype=python: +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, You can obtain one at http://mozilla.org/MPL/2.0/. + +import os +import subprocess +import tempfile + + +def main(output_fd, def_file, llvm_dlltool, *llvm_dlltool_args): + # llvm-dlltool can't output to stdout, so we create a temp file, use that + # to write out the lib, and then copy it over to output_fd + (tmp_fd, tmp_output) = tempfile.mkstemp() + os.close(tmp_fd) + + try: + cmd = [llvm_dlltool] + cmd.extend(llvm_dlltool_args) + cmd += ["-d", def_file, "-l", tmp_output] + + subprocess.check_call(cmd) + + with open(tmp_output, "rb") as tmplib: + output_fd.write(tmplib.read()) + finally: + os.remove(tmp_output) diff --git a/browser/app/winlauncher/freestanding/moz.build b/browser/app/winlauncher/freestanding/moz.build new file mode 100644 index 0000000000..03a3dffe80 --- /dev/null +++ b/browser/app/winlauncher/freestanding/moz.build @@ -0,0 +1,58 @@ +# -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*- +# vim: set filetype=python: +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, You can obtain one at http://mozilla.org/MPL/2.0/. + +Library("winlauncher-freestanding") + +FORCE_STATIC_LIB = True + +# Our patched NtMapViewOfSection can be called before the process's import +# table is populated. Don't let the compiler insert any instrumentation +# that might call an import. +NO_PGO = True + +UNIFIED_SOURCES += [ + "DllBlocklist.cpp", + "LoaderPrivateAPI.cpp", + "ModuleLoadFrame.cpp", + "SharedSection.cpp", +] + +# This library must be compiled in a freestanding environment, as its code must +# not assume that it has access to any runtime libraries. +if CONFIG["CC_TYPE"] == "clang-cl": + CXXFLAGS += ["-Xclang"] + +CXXFLAGS += [ + "-ffreestanding", +] + +# Forcibly include Freestanding.h into all source files in this library. +if CONFIG["CC_TYPE"] == "clang-cl": + CXXFLAGS += ["-FI"] +else: + CXXFLAGS += ["-include"] + +CXXFLAGS += [SRCDIR + "/Freestanding.h"] + +OS_LIBS += [ + "ntdll", + "ntdll_freestanding", +] + +if CONFIG["COMPILE_ENVIRONMENT"] and CONFIG["LLVM_DLLTOOL"]: + GeneratedFile( + "%sntdll_freestanding.%s" % (CONFIG["LIB_PREFIX"], CONFIG["LIB_SUFFIX"]), + script="gen_ntdll_freestanding_lib.py", + inputs=["ntdll_freestanding.def"], + flags=[CONFIG["LLVM_DLLTOOL"]] + CONFIG["LLVM_DLLTOOL_FLAGS"], + ) + +DisableStlWrapping() + +with Files("**"): + BUG_COMPONENT = ("Firefox", "Launcher Process") + +REQUIRES_UNIFIED_BUILD = True diff --git a/browser/app/winlauncher/freestanding/ntdll_freestanding.def b/browser/app/winlauncher/freestanding/ntdll_freestanding.def new file mode 100644 index 0000000000..6e5e2685fe --- /dev/null +++ b/browser/app/winlauncher/freestanding/ntdll_freestanding.def @@ -0,0 +1,25 @@ +; This Source Code Form is subject to the terms of the Mozilla Public +; License, v. 2.0. If a copy of the MPL was not distributed with this +; file, You can obtain one at http://mozilla.org/MPL/2.0/. + +LIBRARY ntdll + +; When we compile with -freestanding, the compiler still requires implementation +; of the four functions listed below. +; +; We could implement our own naive versions of these functions, but that +; solution is less than ideal since the implementations must be extern and are +; thus picked up by the entire firefox.exe binary. This denies the rest of +; firefox.exe the benefit of optimized implementations. On Windows the +; sandbox is linked into firefox.exe, so we cannot just shrug and +; assume that a naive implementation will not have any effect on anything. +; +; There are, however, optimized implementations of these functions that are +; exported by ntdll.dll. OTOH, they are not included in the ntdll.lib +; import library. This .def file is used to build an import library that "fills +; in the blanks" and allows us to link into the ntdll implementations. +EXPORTS + memcmp + memcpy + memmove + memset diff --git a/browser/app/winlauncher/moz.build b/browser/app/winlauncher/moz.build new file mode 100644 index 0000000000..290f7d98ee --- /dev/null +++ b/browser/app/winlauncher/moz.build @@ -0,0 +1,61 @@ +# -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*- +# vim: set filetype=python: +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, You can obtain one at http://mozilla.org/MPL/2.0/. + +Library("winlauncher") + +FORCE_STATIC_LIB = True + +UNIFIED_SOURCES += [ + "/ipc/mscom/COMWrappers.cpp", + "/ipc/mscom/ProcessRuntime.cpp", + "/toolkit/xre/WinTokenUtils.cpp", + "/widget/windows/WindowsConsole.cpp", + "DllBlocklistInit.cpp", + "ErrorHandler.cpp", + "LauncherProcessWin.cpp", + "LaunchUnelevated.cpp", + "NtLoaderAPI.cpp", +] + +OS_LIBS += [ + "oleaut32", + "ole32", + "rpcrt4", + "version", +] + +DIRS += [ + "freestanding", +] + +USE_LIBS += [ + "winlauncher-freestanding", +] + +TEST_DIRS += [ + "test", +] + +if CONFIG["MOZ_LAUNCHER_PROCESS"]: + LOCAL_INCLUDES += [ + "/other-licenses/nsis/Contrib/CityHash/cityhash", + "/toolkit/mozapps/update/common", + ] + UNIFIED_SOURCES += [ + "/other-licenses/nsis/Contrib/CityHash/cityhash/city.cpp", + "/toolkit/mozapps/update/common/commonupdatedir.cpp", + "/toolkit/xre/LauncherRegistryInfo.cpp", + ] + +for var in ("MOZ_APP_BASENAME", "MOZ_APP_VENDOR", "MOZ_APP_DISPLAYNAME"): + DEFINES[var] = '"%s"' % CONFIG[var] + +DisableStlWrapping() + +with Files("**"): + BUG_COMPONENT = ("Firefox", "Launcher Process") + +REQUIRES_UNIFIED_BUILD = True diff --git a/browser/app/winlauncher/test/TestCrossProcessWin.cpp b/browser/app/winlauncher/test/TestCrossProcessWin.cpp new file mode 100644 index 0000000000..cd92ff2570 --- /dev/null +++ b/browser/app/winlauncher/test/TestCrossProcessWin.cpp @@ -0,0 +1,703 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* vim: set ts=8 sts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. */ + +#include <thread> +#include <winternl.h> + +#define MOZ_USE_LAUNCHER_ERROR + +#include <atomic> +#include <thread> +#include "freestanding/SharedSection.cpp" +#include "mozilla/CmdLineAndEnvUtils.h" +#include "mozilla/DynamicBlocklist.h" +#include "mozilla/NativeNt.h" +#include "mozilla/Vector.h" + +#define DLL_BLOCKLIST_ENTRY(name, ...) \ + {MOZ_LITERAL_UNICODE_STRING(L##name), __VA_ARGS__}, +#define DLL_BLOCKLIST_STRING_TYPE UNICODE_STRING + +#include "mozilla/WindowsDllBlocklistLauncherDefs.h" + +const wchar_t kChildArg[] = L"--child"; +const char* kTestDependentModulePaths[] = { + "\\Device\\HarddiskVolume4\\Windows\\system32\\A B C", + "\\Device\\HarddiskVolume4\\Windows\\system32\\a b c.dll", + "\\Device\\HarddiskVolume4\\Windows\\system32\\A B C.exe", + "\\Device\\HarddiskVolume4\\Windows\\system32\\X Y Z.dll", + "\\Device\\HarddiskVolume1\\a b C", + "\\Device\\HarddiskVolume2\\A b c.DLL", + "\\Device\\HarddiskVolume3\\A B c.exe", + "\\Device\\HarddiskVolume4\\X y Z.dll", +}; +const wchar_t kExpectedDependentModules[] = + L"A B C\0" + L"a b c.dll\0" + L"A B C.exe\0" + L"X Y Z.dll\0"; + +const UNICODE_STRING kStringNotInBlocklist = + MOZ_LITERAL_UNICODE_STRING(L"Test_NotInBlocklist.dll"); +const UNICODE_STRING kTestDependentModuleString = + MOZ_LITERAL_UNICODE_STRING(L"Test_DependentModule.dll"); + +// clang-format off +const DllBlockInfo kDllBlocklistShort[] = { + // The entries do not have to be sorted. + DLL_BLOCKLIST_ENTRY("X Y Z_Test", MAKE_VERSION(1, 2, 65535, 65535), + DllBlockInfo::BLOCK_WIN8_AND_OLDER) + DLL_BLOCKLIST_ENTRY("\u30E9\u30FC\u30E1\u30F3_Test") + DLL_BLOCKLIST_ENTRY("Avmvirtualsource_Test.ax", MAKE_VERSION(1, 0, 0, 3), + DllBlockInfo::BROWSER_PROCESS_ONLY) + DLL_BLOCKLIST_ENTRY("1ccelerator_Test.dll", MAKE_VERSION(3, 2, 1, 6)) + DLL_BLOCKLIST_ENTRY("atkdx11disp_Test.dll", DllBlockInfo::ALL_VERSIONS) + {}, +}; +// clang-format on + +using namespace mozilla; +using namespace mozilla::freestanding; + +namespace mozilla::freestanding { +class SharedSectionTestHelper { + public: + static constexpr size_t GetModulePathArraySize() { + return SharedSection::kSharedViewSize - + (offsetof(SharedSection::Layout, mFirstBlockEntry) + + sizeof(DllBlockInfo)); + } +}; +} // namespace mozilla::freestanding + +class TempFile final { + wchar_t mFullPath[MAX_PATH + 1]; + + public: + TempFile() : mFullPath{0} { + wchar_t tempDir[MAX_PATH + 1]; + DWORD len = ::GetTempPathW(ArrayLength(tempDir), tempDir); + if (!len) { + return; + } + + len = ::GetTempFileNameW(tempDir, L"blocklist", 0, mFullPath); + if (!len) { + return; + } + } + + operator const wchar_t*() const { return mFullPath[0] ? mFullPath : nullptr; } +}; + +template <typename T, int N> +void PrintLauncherError(const LauncherResult<T>& aResult, + const char (&aMsg)[N]) { + const LauncherError& err = aResult.inspectErr(); + printf("TEST-FAILED | TestCrossProcessWin | %s - %lx at %s:%d\n", aMsg, + err.mError.AsHResult(), err.mFile, err.mLine); +} + +#define VERIFY_FUNCTION_RESOLVED(mod, exports, name) \ + do { \ + if (reinterpret_cast<FARPROC>(exports->m##name) != \ + ::GetProcAddress(mod, #name)) { \ + printf( \ + "TEST-FAILED | TestCrossProcessWin | " \ + "Kernel32ExportsSolver::" #name " did not match.\n"); \ + return false; \ + } \ + } while (0) + +static bool VerifySharedSection(SharedSection& aSharedSection) { + Kernel32ExportsSolver* k32Exports = aSharedSection.GetKernel32Exports(); + if (!k32Exports) { + printf( + "TEST-FAILED | TestCrossProcessWin | Failed to map a shared section\n"); + return false; + } + + HMODULE k32mod = ::GetModuleHandleW(L"kernel32.dll"); + VERIFY_FUNCTION_RESOLVED(k32mod, k32Exports, FlushInstructionCache); + VERIFY_FUNCTION_RESOLVED(k32mod, k32Exports, GetModuleHandleW); + VERIFY_FUNCTION_RESOLVED(k32mod, k32Exports, GetSystemInfo); + VERIFY_FUNCTION_RESOLVED(k32mod, k32Exports, VirtualProtect); + + Span<const wchar_t> modulesArray = aSharedSection.GetDependentModules(); + bool matched = memcmp(modulesArray.data(), kExpectedDependentModules, + sizeof(kExpectedDependentModules)) == 0; + if (!matched) { + // Print actual strings on error + for (const wchar_t* p = modulesArray.data(); *p;) { + printf("%p: %S\n", p, p); + while (*p) { + ++p; + } + ++p; + } + return false; + } + + for (const DllBlockInfo* info = kDllBlocklistShort; info->mName.Buffer; + ++info) { + const DllBlockInfo* matched = aSharedSection.SearchBlocklist(info->mName); + if (!matched) { + printf( + "TEST-FAILED | TestCrossProcessWin | No blocklist entry match for " + "entry in blocklist.\n"); + return false; + } + } + + if (aSharedSection.SearchBlocklist(kStringNotInBlocklist)) { + printf( + "TEST-FAILED | TestCrossProcessWin | Found blocklist entry match for " + "something not in the blocklist.\n"); + } + + if (aSharedSection.IsDisabled()) { + printf("TEST-FAILED | TestCrossProcessWin | Wrong disabled value.\n"); + } + + return true; +} + +static bool TestAddString() { + wchar_t testBuffer[3] = {0}; + UNICODE_STRING ustr; + + // This makes |testBuffer| full. + ::RtlInitUnicodeString(&ustr, L"a"); + if (!AddString(testBuffer, ustr)) { + printf( + "TEST-FAILED | TestCrossProcessWin | " + "AddString failed.\n"); + return false; + } + + // Adding a string to a full buffer should fail. + ::RtlInitUnicodeString(&ustr, L"b"); + if (AddString(testBuffer, ustr)) { + printf( + "TEST-FAILED | TestCrossProcessWin | " + "AddString caused OOB memory access.\n"); + return false; + } + + bool matched = memcmp(testBuffer, L"a\0", sizeof(testBuffer)) == 0; + if (!matched) { + printf( + "TEST-FAILED | TestCrossProcessWin | " + "AddString wrote wrong values.\n"); + return false; + } + + return true; +} + +// Convert |aBlockEntries|, which is an array ending with an empty instance +// of DllBlockInfo, to DynamicBlockList by storing it to a temp file, loading +// as DynamicBlockList, and deleting the temp file. +static DynamicBlockList ConvertStaticBlocklistToDynamic( + const DllBlockInfo aBlockEntries[]) { + size_t originalLength = 0; + CheckedUint32 totalStringLen = 0; + for (const DllBlockInfo* entry = aBlockEntries; entry->mName.Length; + ++entry) { + totalStringLen += entry->mName.Length; + MOZ_RELEASE_ASSERT(totalStringLen.isValid()); + ++originalLength; + } + + // Pack all strings in this buffer without null characters + UniquePtr<uint8_t[]> stringBuffer = + MakeUnique<uint8_t[]>(totalStringLen.value()); + + // The string buffer is placed immediately after the array of DllBlockInfo + const size_t stringBufferOffset = (originalLength + 1) * sizeof(DllBlockInfo); + + // Entries in the dynamic blocklist do have to be sorted, + // unlike in the static blocklist. + UniquePtr<DllBlockInfo[]> sortedBlockEntries = + MakeUnique<DllBlockInfo[]>(originalLength); + memcpy(sortedBlockEntries.get(), aBlockEntries, + sizeof(DllBlockInfo) * originalLength); + std::sort(sortedBlockEntries.get(), sortedBlockEntries.get() + originalLength, + [](const DllBlockInfo& a, const DllBlockInfo& b) { + return ::RtlCompareUnicodeString(&a.mName, &b.mName, TRUE) < 0; + }); + + Vector<DllBlockInfo> copied; + Unused << copied.resize(originalLength + 1); // aBlockEntries + sentinel + + size_t currentStringOffset = 0; + for (size_t i = 0; i < originalLength; ++i) { + copied[i].mMaxVersion = sortedBlockEntries[i].mMaxVersion; + copied[i].mFlags = sortedBlockEntries[i].mFlags; + + // Copy the module's name to the string buffer and store its offset + // in mName.Buffer + memcpy(stringBuffer.get() + currentStringOffset, + sortedBlockEntries[i].mName.Buffer, + sortedBlockEntries[i].mName.Length); + copied[i].mName.Buffer = + reinterpret_cast<wchar_t*>(stringBufferOffset + currentStringOffset); + // Only keep mName.Length and leave mName.MaximumLength to be zero + copied[i].mName.Length = sortedBlockEntries[i].mName.Length; + + currentStringOffset += sortedBlockEntries[i].mName.Length; + } + + TempFile blocklistFile; + nsAutoHandle file(::CreateFileW(blocklistFile, GENERIC_WRITE, FILE_SHARE_READ, + nullptr, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, + nullptr)); + MOZ_RELEASE_ASSERT(file); + + DynamicBlockListBase::FileHeader header; + header.mSignature = DynamicBlockListBase::kSignature; + header.mFileVersion = DynamicBlockListBase::kCurrentVersion; + header.mPayloadSize = + sizeof(DllBlockInfo) * copied.length() + totalStringLen.value(); + + DWORD written = 0; + MOZ_RELEASE_ASSERT( + ::WriteFile(file.get(), &header, sizeof(header), &written, nullptr)); + MOZ_RELEASE_ASSERT(::WriteFile(file.get(), copied.begin(), + sizeof(DllBlockInfo) * copied.length(), + &written, nullptr)); + MOZ_RELEASE_ASSERT(::WriteFile(file.get(), stringBuffer.get(), + totalStringLen.value(), &written, nullptr)); + + DynamicBlockList blockList(blocklistFile); + ::DeleteFileW(blocklistFile); + return blockList; +} + +const DynamicBlockList gFullList = + ConvertStaticBlocklistToDynamic(gWindowsDllBlocklist); +const DynamicBlockList gShortList = + ConvertStaticBlocklistToDynamic(kDllBlocklistShort); + +static bool TestDependentModules() { + LauncherVoidResult result = gSharedSection.Init(); + if (result.isErr()) { + PrintLauncherError(result, "SharedSection::Init failed"); + return false; + } + + constexpr size_t sizeInBytes = + SharedSectionTestHelper::GetModulePathArraySize(); + UniquePtr<uint8_t[]> bufferData = MakeUnique<uint8_t[]>(sizeInBytes); + Span<uint8_t> buffer(bufferData, sizeInBytes); + memset(buffer.data(), 0x88, buffer.size()); + + // Try to add a long string that does not fit in the section, + // since there's no room for the NULL character to indicate the final string. + UNICODE_STRING ustr; + ustr.Buffer = reinterpret_cast<wchar_t*>(buffer.data()); + ustr.Length = ustr.MaximumLength = buffer.size(); + + result = gSharedSection.AddDependentModule(&ustr); + if (result.isOk() || result.inspectErr() != WindowsError::FromWin32Error( + ERROR_INSUFFICIENT_BUFFER)) { + printf( + "TEST-FAILED | TestCrossProcessWin | " + "Adding a too long string should fail.\n"); + return false; + } + + result = gSharedSection.Init(); + if (result.isErr()) { + PrintLauncherError(result, "SharedSection::Init failed"); + return false; + } + + // Keep adding a single-char string until it fails and + // make sure no crash. + // We want to make sure no strings match any earlier strings so + // we can get the expected count. This is a little tricky since + // it includes case-insensitivity, so start at the "CJK Unified Ideographs + // Extension A" block of Unicode, which has no two characters that compare + // equal under a case insensitive comparison. + *(reinterpret_cast<wchar_t*>(buffer.data())) = 0x3400; + ustr.Length = ustr.MaximumLength = sizeof(wchar_t); + wchar_t numberOfStringsAdded = 0; + while (gSharedSection.AddDependentModule(&ustr).isOk()) { + ++numberOfStringsAdded; + // Make sure the string doesn't match any earlier strings + wchar_t oldValue = *(reinterpret_cast<wchar_t*>(buffer.data())); + *(reinterpret_cast<wchar_t*>(buffer.data())) = oldValue + 1; + } + + int numberOfCharactersInBuffer = + SharedSectionTestHelper::GetModulePathArraySize() / sizeof(wchar_t); + // Each string is two characters long (one "real" character and a null), but + // the whole buffer needs an additional null at the end. + int expectedNumberOfStringsAdded = (numberOfCharactersInBuffer - 1) / 2; + if (numberOfStringsAdded != expectedNumberOfStringsAdded) { + printf( + "TEST-FAILED | TestCrossProcessWin | " + "Added %d dependent strings before failing (expected %d).\n", + static_cast<int>(numberOfStringsAdded), expectedNumberOfStringsAdded); + return false; + } + + // SetBlocklist is not allowed after AddDependentModule + result = gSharedSection.SetBlocklist(gShortList, false); + if (result.isOk() || result.inspectErr() != + WindowsError::FromWin32Error(ERROR_INVALID_STATE)) { + printf( + "TEST-FAILED | TestCrossProcessWin | " + "SetBlocklist is not allowed after AddDependentModule\n"); + return false; + } + + gSharedSection.Reset(); + return true; +} + +static bool TestDynamicBlocklist() { + if (!gFullList.GetPayloadSize() || !gShortList.GetPayloadSize()) { + printf( + "TEST-FAILED | TestCrossProcessWin | DynamicBlockList::LoadFile " + "failed\n"); + return false; + } + + LauncherVoidResult result = gSharedSection.Init(); + if (result.isErr()) { + PrintLauncherError(result, "SharedSection::Init failed"); + return false; + } + + // Set gShortList, and gShortList + // 1. Setting gShortList succeeds + // 2. Next try to set gShortList fails + result = gSharedSection.SetBlocklist(gShortList, false); + if (result.isErr()) { + PrintLauncherError(result, "SetBlocklist(gShortList) failed"); + return false; + } + result = gSharedSection.SetBlocklist(gShortList, false); + if (result.isOk() || result.inspectErr() != + WindowsError::FromWin32Error(ERROR_INVALID_STATE)) { + printf( + "TEST-FAILED | TestCrossProcessWin | " + "SetBlocklist is allowed only once\n"); + return false; + } + + result = gSharedSection.Init(); + if (result.isErr()) { + PrintLauncherError(result, "SharedSection::Init failed"); + return false; + } + + // Add gFullList and gShortList + // 1. Adding gFullList always fails because it doesn't fit the section + // 2. Adding gShortList succeeds because no entry is added yet + MOZ_RELEASE_ASSERT( + gFullList.GetPayloadSize() > + SharedSectionTestHelper::GetModulePathArraySize(), + "Test assumes gFullList is too big to fit in shared section"); + result = gSharedSection.SetBlocklist(gFullList, false); + if (result.isOk() || result.inspectErr() != WindowsError::FromWin32Error( + ERROR_INSUFFICIENT_BUFFER)) { + printf( + "TEST-FAILED | TestCrossProcessWin | " + "SetBlocklist(gFullList) should fail\n"); + return false; + } + result = gSharedSection.SetBlocklist(gShortList, false); + if (result.isErr()) { + PrintLauncherError(result, "SetBlocklist(gShortList) failed"); + return false; + } + + // AddDependentModule is allowed after SetBlocklist + result = gSharedSection.AddDependentModule(&kTestDependentModuleString); + if (result.isErr()) { + PrintLauncherError(result, "SharedSection::AddDependentModule failed"); + return false; + } + + gSharedSection.Reset(); + return true; +} + +class ChildProcess final { + nsAutoHandle mChildProcess; + nsAutoHandle mChildMainThread; + DWORD mProcessId; + + public: + // The following variables are updated from the parent process via + // WriteProcessMemory while the process is suspended as a part of + // TestWithChildProcess(). + // + // Having both a non-const and a const is important because a constant + // is separately placed in the .rdata section which is read-only, so + // the region's attribute needs to be changed before modifying data via + // WriteProcessMemory. + // The keyword "volatile" is needed for a constant, otherwise the compiler + // evaluates a constant as a literal without fetching data from memory. + static HMODULE sExecutableImageBase; + static volatile const DWORD sReadOnlyProcessId; + + static int Main() { + SRWLOCK lock = SRWLOCK_INIT; + ::AcquireSRWLockExclusive(&lock); + + Vector<std::thread> threads; + std::atomic<bool> success = true; + for (int i = 0; i < 10; ++i) { + Unused << threads.emplaceBack( + [&success](SRWLOCK* aLock) { + // All threads call GetKernel32Exports(), but only the first thread + // maps a write-copy section and populates it. + ::AcquireSRWLockShared(aLock); + if (gSharedSection.GetKernel32Exports() == nullptr) { + success = false; + } + ::ReleaseSRWLockShared(aLock); + }, + &lock); + } + + // Wait a msec for all threads to be ready and release the lock + ::Sleep(1); + ::ReleaseSRWLockExclusive(&lock); + + for (auto& thread : threads) { + thread.join(); + } + + if (!success) { + printf( + "TEST-FAILED | TestCrossProcessWin | " + "GetKernel32Exports() returned null.\n"); + return 1; + } + + if (sExecutableImageBase != ::GetModuleHandle(nullptr)) { + printf( + "TEST-FAILED | TestCrossProcessWin | " + "sExecutableImageBase is expected to be %p, but actually was %p.\n", + ::GetModuleHandle(nullptr), sExecutableImageBase); + return 1; + } + + if (sReadOnlyProcessId != ::GetCurrentProcessId()) { + printf( + "TEST-FAILED | TestCrossProcessWin | " + "sReadOnlyProcessId is expected to be %lx, but actually was %lx.\n", + ::GetCurrentProcessId(), sReadOnlyProcessId); + return 1; + } + + if (!VerifySharedSection(gSharedSection)) { + return 1; + } + + // Test a scenario to transfer a transferred section as a readonly handle + gSharedSection.ConvertToReadOnly(); + + // AddDependentModule fails as the handle is readonly. + LauncherVoidResult result = + gSharedSection.AddDependentModule(&kTestDependentModuleString); + if (result.inspectErr() != + WindowsError::FromWin32Error(ERROR_ACCESS_DENIED)) { + PrintLauncherError(result, "The readonly section was writable"); + return 1; + } + + if (!VerifySharedSection(gSharedSection)) { + return 1; + } + + return 0; + } + + ChildProcess(const wchar_t* aExecutable, const wchar_t* aOption) + : mProcessId(0) { + const wchar_t* childArgv[] = {aExecutable, aOption}; + auto cmdLine( + mozilla::MakeCommandLine(mozilla::ArrayLength(childArgv), childArgv)); + + STARTUPINFOW si = {sizeof(si)}; + PROCESS_INFORMATION pi; + BOOL ok = + ::CreateProcessW(aExecutable, cmdLine.get(), nullptr, nullptr, FALSE, + CREATE_SUSPENDED, nullptr, nullptr, &si, &pi); + if (!ok) { + printf( + "TEST-FAILED | TestCrossProcessWin | " + "CreateProcessW falied - %08lx.\n", + GetLastError()); + return; + } + + mProcessId = pi.dwProcessId; + + mChildProcess.own(pi.hProcess); + mChildMainThread.own(pi.hThread); + } + + ~ChildProcess() { ::TerminateProcess(mChildProcess, 0); } + + operator HANDLE() const { return mChildProcess; } + DWORD GetProcessId() const { return mProcessId; } + + bool ResumeAndWaitUntilExit() { + if (::ResumeThread(mChildMainThread) == 0xffffffff) { + printf( + "TEST-FAILED | TestCrossProcessWin | " + "ResumeThread failed - %08lx\n", + GetLastError()); + return false; + } + + if (::WaitForSingleObject(mChildProcess, 60000) != WAIT_OBJECT_0) { + printf( + "TEST-FAILED | TestCrossProcessWin | " + "Unexpected result from WaitForSingleObject\n"); + return false; + } + + DWORD exitCode; + if (!::GetExitCodeProcess(mChildProcess, &exitCode)) { + printf( + "TEST-FAILED | TestCrossProcessWin | " + "GetExitCodeProcess failed - %08lx\n", + GetLastError()); + return false; + } + + return exitCode == 0; + } +}; + +HMODULE ChildProcess::sExecutableImageBase = 0; +volatile const DWORD ChildProcess::sReadOnlyProcessId = 0; + +int wmain(int argc, wchar_t* argv[]) { + printf("Process: %-8lx Base: %p\n", ::GetCurrentProcessId(), + ::GetModuleHandle(nullptr)); + + if (argc == 2 && wcscmp(argv[1], kChildArg) == 0) { + return ChildProcess::Main(); + } + + ChildProcess childProcess(argv[0], kChildArg); + if (!childProcess) { + return 1; + } + + if (!TestAddString()) { + return 1; + } + + if (!TestDependentModules()) { + return 1; + } + + if (!TestDynamicBlocklist()) { + return 1; + } + + LauncherResult<HMODULE> remoteImageBase = + nt::GetProcessExeModule(childProcess); + if (remoteImageBase.isErr()) { + PrintLauncherError(remoteImageBase, "nt::GetProcessExeModule failed"); + return 1; + } + + nt::CrossExecTransferManager transferMgr(childProcess); + if (!transferMgr) { + printf( + "TEST-FAILED | TestCrossProcessWin | " + "CrossExecTransferManager instantiation failed.\n"); + return 1; + } + + LauncherVoidResult result = + transferMgr.Transfer(&ChildProcess::sExecutableImageBase, + &remoteImageBase.inspect(), sizeof(HMODULE)); + if (result.isErr()) { + PrintLauncherError(result, "ChildProcess::WriteData(Imagebase) failed"); + return 1; + } + + DWORD childPid = childProcess.GetProcessId(); + + DWORD* readOnlyData = const_cast<DWORD*>(&ChildProcess::sReadOnlyProcessId); + result = transferMgr.Transfer(readOnlyData, &childPid, sizeof(DWORD)); + if (result.isOk()) { + printf( + "TEST-UNEXPECTED | TestCrossProcessWin | " + "A constant was located in a writable section."); + return 1; + } + + AutoVirtualProtect prot = + transferMgr.Protect(readOnlyData, sizeof(uint32_t), PAGE_READWRITE); + if (!prot) { + printf( + "TEST-FAILED | TestCrossProcessWin | " + "VirtualProtect failed - %08lx\n", + prot.GetError().AsHResult()); + return 1; + } + + result = transferMgr.Transfer(readOnlyData, &childPid, sizeof(DWORD)); + if (result.isErr()) { + PrintLauncherError(result, "ChildProcess::WriteData(PID) failed"); + return 1; + } + + result = gSharedSection.Init(); + if (result.isErr()) { + PrintLauncherError(result, "SharedSection::Init failed"); + return 1; + } + + result = gSharedSection.SetBlocklist(gShortList, false); + if (result.isErr()) { + PrintLauncherError(result, "SetBlocklist(gShortList) failed"); + return false; + } + + for (const char* testString : kTestDependentModulePaths) { + // Test AllocatedUnicodeString(const char*) that is used + // in IsDependentModule() + nt::AllocatedUnicodeString depModule(testString); + UNICODE_STRING depModuleLeafName; + nt::GetLeafName(&depModuleLeafName, depModule); + result = gSharedSection.AddDependentModule(&depModuleLeafName); + if (result.isErr()) { + PrintLauncherError(result, "SharedSection::AddDependentModule failed"); + return 1; + } + } + + result = + gSharedSection.TransferHandle(transferMgr, GENERIC_READ | GENERIC_WRITE); + if (result.isErr()) { + PrintLauncherError(result, "SharedSection::TransferHandle failed"); + return 1; + } + + // Close the section in the parent process before resuming the child process + gSharedSection.Reset(nullptr); + + if (!childProcess.ResumeAndWaitUntilExit()) { + return 1; + } + + printf("TEST-PASS | TestCrossProcessWin | All checks passed\n"); + return 0; +} diff --git a/browser/app/winlauncher/test/TestSafeThreadLocal.cpp b/browser/app/winlauncher/test/TestSafeThreadLocal.cpp new file mode 100644 index 0000000000..31af93c375 --- /dev/null +++ b/browser/app/winlauncher/test/TestSafeThreadLocal.cpp @@ -0,0 +1,84 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* vim: set ts=8 sts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. */ + +#define MOZ_USE_LAUNCHER_ERROR + +#include "freestanding/SafeThreadLocal.h" + +#include "mozilla/NativeNt.h" +#include "nsWindowsHelpers.h" + +#include <process.h> +#include <stdio.h> + +// Need a non-inline function to bypass compiler optimization that the thread +// local storage pointer is cached in a register before accessing a thread-local +// variable. +MOZ_NEVER_INLINE PVOID SwapThreadLocalStoragePointer(PVOID aNewValue) { + auto oldValue = mozilla::nt::RtlGetThreadLocalStoragePointer(); + mozilla::nt::RtlSetThreadLocalStoragePointerForTestingOnly(aNewValue); + return oldValue; +} + +static mozilla::freestanding::SafeThreadLocal<int*> gTheStorage; + +// Need non-inline functions to bypass compiler optimization that the thread +// local storage pointer is cached in a register before accessing a thread-local +// variable. See bug 1803322 for a motivating example. +MOZ_NEVER_INLINE int* getTheStorage() { return gTheStorage.get(); } +MOZ_NEVER_INLINE void setTheStorage(int* p) { gTheStorage.set(p); } + +static unsigned int __stdcall TestNonMainThread(void* aArg) { + for (int i = 0; i < 100; ++i) { + setTheStorage(&i); + if (getTheStorage() != &i) { + printf( + "TEST-FAILED | TestSafeThreadLocal | " + "A value is not correctly stored in the thread-local storage.\n"); + return 1; + } + } + return 0; +} + +extern "C" int wmain(int argc, wchar_t* argv[]) { + int dummy = 0x1234; + + auto origHead = SwapThreadLocalStoragePointer(nullptr); + // Setting gTheStorage when TLS is null. + setTheStorage(&dummy); + SwapThreadLocalStoragePointer(origHead); + + nsAutoHandle handles[8]; + for (auto& handle : handles) { + handle.own(reinterpret_cast<HANDLE>( + ::_beginthreadex(nullptr, 0, TestNonMainThread, nullptr, 0, nullptr))); + } + + for (int i = 0; i < 100; ++i) { + if (getTheStorage() != &dummy) { + printf( + "TEST-FAILED | TestSafeThreadLocal | " + "A value is not correctly stored in the global scope.\n"); + return 1; + } + } + + for (auto& handle : handles) { + ::WaitForSingleObject(handle, INFINITE); + +#if !defined(MOZ_ASAN) + // ASAN builds under Windows 11 can have unexpected thread exit codes. + // See bug 1798796 + DWORD exitCode; + if (!::GetExitCodeThread(handle, &exitCode) || exitCode) { + return 1; + } +#endif // !defined(MOZ_ASAN) + } + + return 0; +} diff --git a/browser/app/winlauncher/test/TestSameBinary.cpp b/browser/app/winlauncher/test/TestSameBinary.cpp new file mode 100644 index 0000000000..2cb45f546f --- /dev/null +++ b/browser/app/winlauncher/test/TestSameBinary.cpp @@ -0,0 +1,255 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* vim: set ts=8 sts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at https://mozilla.org/MPL/2.0/. */ + +#define MOZ_USE_LAUNCHER_ERROR + +#include <stdio.h> +#include <stdlib.h> + +#include <utility> + +#include "SameBinary.h" +#include "mozilla/ArrayUtils.h" +#include "mozilla/Assertions.h" +#include "mozilla/CmdLineAndEnvUtils.h" +#include "mozilla/NativeNt.h" +#include "mozilla/Unused.h" +#include "mozilla/Vector.h" +#include "mozilla/WinHeaderOnlyUtils.h" +#include "nsWindowsHelpers.h" + +#define EXPECT_SAMEBINARY_IS(expected, option, message) \ + do { \ + mozilla::LauncherResult<bool> isSame = \ + mozilla::IsSameBinaryAsParentProcess(option); \ + if (isSame.isErr()) { \ + PrintLauncherError(isSame, \ + "IsSameBinaryAsParentProcess returned error " \ + "when we were expecting success."); \ + return 1; \ + } \ + if (isSame.unwrap() != expected) { \ + PrintErrorMsg(message); \ + return 1; \ + } \ + } while (0) + +/** + * This test involves three processes: + * 1. The "Monitor" process, which is executed by |MonitorMain|. This process + * is responsible for integrating with the test harness, so it spawns the + * "Parent" process (2), and then waits for the other two processes to + * finish. + * 2. The "Parent" process, which is executed by |ParentMain|. This process + * creates the "Child" process (3) and then waits indefinitely. + * 3. The "Child" process, which is executed by |ChildMain| and carries out + * the actual test. It terminates the Parent process during its execution, + * using the Child PID as the Parent process's exit code. This serves as a + * hacky yet effective way to signal to the Monitor process which PID it + * should wait on to ensure that the Child process has exited. + */ + +static const char kMsgStart[] = "TEST-FAILED | SameBinary | "; + +inline void PrintErrorMsg(const char* aMsg) { + printf("%s%s\n", kMsgStart, aMsg); +} + +inline void PrintWinError(const char* aMsg) { + mozilla::WindowsError err(mozilla::WindowsError::FromLastError()); + printf("%s%s: %S\n", kMsgStart, aMsg, err.AsString().get()); +} + +template <typename T> +inline void PrintLauncherError(const mozilla::LauncherResult<T>& aResult, + const char* aMsg = nullptr) { + const char* const kSep = aMsg ? ": " : ""; + const char* msg = aMsg ? aMsg : ""; + const mozilla::LauncherError& err = aResult.inspectErr(); + printf("%s%s%s%S (%s:%d)\n", kMsgStart, msg, kSep, + err.mError.AsString().get(), err.mFile, err.mLine); +} + +static int ChildMain(DWORD aExpectedParentPid) { + mozilla::LauncherResult<DWORD> parentPid = mozilla::nt::GetParentProcessId(); + if (parentPid.isErr()) { + PrintLauncherError(parentPid); + return 1; + } + + if (parentPid.inspect() != aExpectedParentPid) { + PrintErrorMsg("Unexpected mismatch of parent PIDs"); + return 1; + } + + const DWORD kAccess = PROCESS_QUERY_LIMITED_INFORMATION | PROCESS_TERMINATE; + nsAutoHandle parentProcess( + ::OpenProcess(kAccess, FALSE, parentPid.inspect())); + if (!parentProcess) { + PrintWinError("Unexpectedly failed to call OpenProcess on parent"); + return 1; + } + + EXPECT_SAMEBINARY_IS( + true, mozilla::ImageFileCompareOption::Default, + "IsSameBinaryAsParentProcess returned incorrect result for identical " + "binaries"); + EXPECT_SAMEBINARY_IS( + true, mozilla::ImageFileCompareOption::CompareNtPathsOnly, + "IsSameBinaryAsParentProcess(CompareNtPathsOnly) returned incorrect " + "result for identical binaries"); + + // Total hack, but who cares? We'll set the parent's exit code as our PID + // so that the monitor process knows who to wait for! + if (!::TerminateProcess(parentProcess.get(), ::GetCurrentProcessId())) { + PrintWinError("Unexpected failure in TerminateProcess"); + return 1; + } + + // Close our handle to the parent process so that no references are held. + ::CloseHandle(parentProcess.disown()); + + // Querying a pid on a terminated process may still succeed some time after + // that process has been terminated. For the purposes of this test, we'll poll + // the OS until we cannot succesfully open the parentPid anymore. + const uint32_t kMaxAttempts = 100; + uint32_t curAttempt = 0; + while (HANDLE p = ::OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, FALSE, + parentPid.inspect())) { + ::CloseHandle(p); + ::Sleep(100); + ++curAttempt; + if (curAttempt >= kMaxAttempts) { + PrintErrorMsg( + "Exhausted retry attempts waiting for parent pid to become invalid"); + return 1; + } + } + + EXPECT_SAMEBINARY_IS( + false, mozilla::ImageFileCompareOption::Default, + "IsSameBinaryAsParentProcess returned incorrect result for dead parent " + "process"); + EXPECT_SAMEBINARY_IS( + false, mozilla::ImageFileCompareOption::CompareNtPathsOnly, + "IsSameBinaryAsParentProcess(CompareNtPathsOnly) returned incorrect " + "result for dead parent process"); + + return 0; +} + +static nsReturnRef<HANDLE> CreateSelfProcess(int argc, wchar_t* argv[]) { + nsAutoHandle empty; + + DWORD myPid = ::GetCurrentProcessId(); + + wchar_t strPid[11] = {}; +#if defined(__MINGW32__) + _ultow(myPid, strPid, 16); +#else + if (_ultow_s(myPid, strPid, 16)) { + PrintErrorMsg("_ultow_s failed"); + return empty.out(); + } +#endif // defined(__MINGW32__) + + wchar_t* extraArgs[] = {strPid}; + + auto cmdLine = mozilla::MakeCommandLine( + argc, argv, mozilla::ArrayLength(extraArgs), extraArgs); + if (!cmdLine) { + PrintErrorMsg("MakeCommandLine failed"); + return empty.out(); + } + + STARTUPINFOW si = {sizeof(si)}; + PROCESS_INFORMATION pi; + BOOL ok = + ::CreateProcessW(argv[0], cmdLine.get(), nullptr, nullptr, FALSE, + CREATE_UNICODE_ENVIRONMENT, nullptr, nullptr, &si, &pi); + if (!ok) { + PrintWinError("CreateProcess failed"); + return empty.out(); + } + + nsAutoHandle proc(pi.hProcess); + nsAutoHandle thd(pi.hThread); + + return proc.out(); +} + +static int ParentMain(int argc, wchar_t* argv[]) { + nsAutoHandle childProc(CreateSelfProcess(argc, argv)); + if (!childProc) { + return 1; + } + + if (::WaitForSingleObject(childProc.get(), INFINITE) != WAIT_OBJECT_0) { + PrintWinError( + "Unexpected result from WaitForSingleObject on child process"); + return 1; + } + + MOZ_ASSERT_UNREACHABLE("This process should be terminated by now"); + return 0; +} + +static int MonitorMain(int argc, wchar_t* argv[]) { + // In this process, "parent" means the process that will be running + // ParentMain, which is our child process (confusing, I know...) + nsAutoHandle parentProc(CreateSelfProcess(argc, argv)); + if (!parentProc) { + return 1; + } + + if (::WaitForSingleObject(parentProc.get(), 60000) != WAIT_OBJECT_0) { + PrintWinError("Unexpected result from WaitForSingleObject on parent"); + return 1; + } + + DWORD childPid; + if (!::GetExitCodeProcess(parentProc.get(), &childPid)) { + PrintWinError("GetExitCodeProcess failed"); + return 1; + } + + nsAutoHandle childProc(::OpenProcess(SYNCHRONIZE, FALSE, childPid)); + if (!childProc) { + // Nothing to wait on anymore, which is OK. + return 0; + } + + // We want no more references to parentProc + ::CloseHandle(parentProc.disown()); + + if (::WaitForSingleObject(childProc.get(), 60000) != WAIT_OBJECT_0) { + PrintWinError("Unexpected result from WaitForSingleObject on child"); + return 1; + } + + return 0; +} + +extern "C" int wmain(int argc, wchar_t* argv[]) { + if (argc == 3) { + return ChildMain(wcstoul(argv[2], nullptr, 16)); + } + + if (!mozilla::SetArgv0ToFullBinaryPath(argv)) { + return 1; + } + + if (argc == 1) { + return MonitorMain(argc, argv); + } + + if (argc == 2) { + return ParentMain(argc, argv); + } + + PrintErrorMsg("Unexpected argc"); + return 1; +} diff --git a/browser/app/winlauncher/test/moz.build b/browser/app/winlauncher/test/moz.build new file mode 100644 index 0000000000..a8503ddf55 --- /dev/null +++ b/browser/app/winlauncher/test/moz.build @@ -0,0 +1,30 @@ +# -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*- +# vim: set filetype=python: +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, You can obtain one at http://mozilla.org/MPL/2.0/. + +DisableStlWrapping() + +GeckoCppUnitTests( + [ + "TestCrossProcessWin", + "TestSafeThreadLocal", + "TestSameBinary", + ], + linkage=None, +) + +LOCAL_INCLUDES += [ + "/browser/app/winlauncher", +] + +OS_LIBS += [ + "ntdll", +] + +if CONFIG["CC_TYPE"] in ("gcc", "clang"): + # This allows us to use wmain as the entry point on mingw + LDFLAGS += [ + "-municode", + ] |