[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #5477 [EFF-HTTPS Everywhere]: Surprising DOM origins before HTTPS-E/NoScript redirects have completed
#5477: Surprising DOM origins before HTTPS-E/NoScript redirects have completed
-------------------------------------+--------------------------------------
Reporter: Drugoy | Owner: ma1
Type: defect | Status: reopened
Priority: blocker | Milestone:
Component: EFF-HTTPS Everywhere | Version:
Resolution: | Keywords:
Parent: | Points:
Actualpoints: |
-------------------------------------+--------------------------------------
Comment(by pde):
In parallel, I've been discussing this with the Mozilla security team.
One horrible workaround option (assuming we don't learn anything
actionable from the approach mikeperry mentions) would be to redirect to
about:blank straightaway, and then on to the real destination. It would
probably have to be !about:blank#token in order to keep track of what
we're doing.
I also tested to see if this problem exists with Mozilla's native HSTS
implementation. It doesn't. Unfortunately, all of
[http://mxr.mozilla.org/mozilla-
central/source/netwerk/protocol/http/nsHttpChannel.cpp#1430 that machinery
is asynchronous native code] that's not available to scripts.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/5477#comment:37>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs