[tor-bugs] #34144 [Applications]: user.js is ignored after Tor (part) starts

["Tor Bug Tracker & Wiki" <blackhole@xxxxxxxxxxxxxx>]

#34144: user.js is ignored after Tor (part) starts
--------------------------+------------------------------
 Reporter:  davidnewcomb  |          Owner:  (none)
     Type:  defect        |         Status:  new
 Priority:  Medium        |      Component:  Applications
  Version:                |       Severity:  Normal
 Keywords:                |  Actual Points:
Parent ID:                |         Points:
 Reviewer:                |        Sponsor:
--------------------------+------------------------------
 Steps to reproduce:

 1)
 create file Browser/TorBrowser/Data/Browser/profile.default/user.js with
 contents:

 // blank 1st line
 user_pref("javascript.enabled", false);
 user_pref("app.update.auto", false);

 2)
 Start Tor and wait for Tor connection pop up.

 3)
 Make sure user.js was included:
 $ grep -e app.update.auto -e javascript.enabled
 Browser/TorBrowser/Data/Browser/profile.default/prefs.js
 user_pref("app.update.auto", false);
 user_pref("javascript.enabled", false);

 4)
 Click "Connect" to and wait for browser to start

 5)
 Check prefs.js again, and javascript.enabled is gone
 $ grep -e app.update.auto -e javascript.enabled
 Browser/TorBrowser/Data/Browser/profile.default/prefs.js
 user_pref("app.update.auto", false);


 Expected behaviour:
 According to Firefox documentation user.js may override any preference.
 There's a warning that plugins that ignore this won't pass certification.
 After Tor has finished playing with the configuration it must apply the
 user.js again.
 With the current setup there doesn't seem to be a way to start the Tor
 browser with javascript.enabled set to false and allow the user to change
 it to true if that want.

 Background:
 We are running Tor inside docker, so constantly downloading updates until
 we can update the docker image seems like unnecessary waste of precious
 onion bandwidth.

 With app.update.auto set to false, we get a pop up which says there is a
 new version available so we can update in our own time.

 With the current setup there doesn't seem to be a way to start the Tor
 browser with javascript.enabled set to false and allow the user to change
 it to true if that want.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/34144>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online

_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs