[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #5477 [EFF-HTTPS Everywhere]: Surprising DOM origins before HTTPS-E/NoScript redirects have completed
#5477: Surprising DOM origins before HTTPS-E/NoScript redirects have completed
------------------------------------------------------+---------------------
Reporter: Drugoy | Owner: pde
Type: defect | Status: new
Priority: major | Milestone:
Component: EFF-HTTPS Everywhere | Version:
Keywords: address spoofing, critical vulnerability | Parent:
Points: | Actualpoints:
------------------------------------------------------+---------------------
Comment(by ma1):
From a first cursory look, latest stable NoScript (2.3.7) on latest
Nightly does not seem affected (while I could reproduce with stable HTTPS
Everywhere).
Tested with default configuration + ''NoScript Options|General|Scripts
globally allowed'' + ''NoScript Options|Advanced|HTTPS'' with
''apple.com'' forced to HTTPS (i.e. apple.com and subdomains).
I apparently get the same behavior as a clean profile with no extensions
(i.e. the load gets early aborted by document.write(), which therefore
outputs in a window which still displays the origin of its opener.
Hence, if these observations are confirmed, the question is: where does
HTTPS-Everywhere's HTTPS enforcement implementation diverge from
NoScript's?
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/5477#comment:15>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs