[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #27427 [Applications/Tor Browser]: [PATCH] Fix NoScript IPC for about:blank by whitelisting messages
#27427: [PATCH] Fix NoScript IPC for about:blank by whitelisting messages
-------------------------------------------------+-------------------------
Reporter: rustybird | Owner:
| arthuredelstein
Type: defect | Status:
| needs_review
Priority: Very High | Milestone:
Component: Applications/Tor Browser | Version:
Severity: Normal | Resolution:
Keywords: TorBrowserTeam201809R, | Actual Points:
tbb-8.0.1-can |
Parent ID: | Points:
Reviewer: | Sponsor:
-------------------------------------------------+-------------------------
Comment (by rustybird):
Replying to [comment:15 ma1]:
> Replying to [comment:14 rustybird]:
>
> > If this race hypothetically affects real websites (i.e. not just
`about:blank` and empty `data:` pages),
>
> It should not: NoScript defers all the HTTP(S) traffic until its policy
is configured and ready to be enforced.
> about:blank, data: and file: URLs are those which might suffer of this
problem, because NoScript has no means to prevent them from loading before
it's initialized.
Thanks, that makes sense.
Replying to [comment:13 ma1]:
> So, if the Tor Browser can start using `__meta.name` both on the
receiving and the sending end, I'm gonna get rid of the "legacy" redundant
`_messageName` property in one of the next releases.
I've uploaded a
[https://trac.torproject.org/projects/tor/attachment/ticket/27427/v3-Fix-
NoScript-IPC-for-about-blank-by-whitelisting-messages.patch v3 patch for
the receiving end] and a
[https://trac.torproject.org/projects/tor/attachment/ticket/27427/Send-
updateSettings-message-using-NoScript-10.1.9.2-protocol.patch patch for
the sending end].
Assuming that these patches land in Tor Browser 8.0.**1**, maybe NoScript
could keep the legacy code for a little while, e.g. until Tor Browser
8.0.**2** is released. This would be a grace period for Tor Browser
8.0**(.0)** users, so they don't automatically receive an NoScript
extension update to an incompatible version.
Replying to [comment:10 arthuredelstein]:
> I changed it to use the better JS equality operator
Whoops yes, `==` is crappy. The v3 patch uses `Array.prototype.includes()`
to make it shorter, so it's like `===` except that `NaN` would be
considered equal to itself. Hope that's okay, I can change it if not.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/27427#comment:16>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs