Re: [tor-bugs] #34305 [Applications/Tor Browser]: NoScript inconsistent behaviour in Firefox 77 (currently beta)

[Tor Bug Tracker & Wiki]

#34305: NoScript inconsistent behaviour in Firefox 77 (currently beta)
-+-
 Reporter:  acat |  Owner:  acat
 Type:  defect   | Status:  closed
 Priority:  Medium   |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:  fixed
 Keywords:  noscript, ff78-esr,  |  Actual Points:
  TorBrowserTeam202006   |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-
Changes (by acat):

 * status:  new => closed
 * resolution:   => fixed


Comment:

 Thanks, this is fixed for me with `noscript-11.0.27rc4.xpi`.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #34305 [Applications/Tor Browser]: NoScript inconsistent behaviour in Firefox 77 (currently beta)

[Tor Bug Tracker & Wiki]

#34305: NoScript inconsistent behaviour in Firefox 77 (currently beta)
-+-
 Reporter:  acat |  Owner:  acat
 Type:  defect   | Status:  new
 Priority:  Medium   |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:
 Keywords:  noscript TorBrowserTeam202005,   |  Actual Points:
  ff78-esr   |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by ma1):

 Replying to [comment:9 acat]:

 > I think it may be simply because `navigator.userAgent` is spoofed.

 Correct. However what's the point of spoofing in a WebExtension background
 page? Maybe another blocker for
 https://bugzilla.mozilla.org/show_bug.cgi?id=1450398 ?

 > Maybe you could use `browser.runtime.getBrowserInfo()`, which always
 reports the right version?

 Yes, I had considered this, but I preferred to avoid it in early
 initialization code because it's an asynchronous API. However I've got
 hacks in places to make it a lesser issue, so I guess I can live with
 that. Switching to getBrowserInfo() in rc2.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #34305 [Applications/Tor Browser]: NoScript inconsistent behaviour in Firefox 77 (currently beta)

[Tor Bug Tracker & Wiki]

#34305: NoScript inconsistent behaviour in Firefox 77 (currently beta)
-+-
 Reporter:  acat |  Owner:  acat
 Type:  defect   | Status:  new
 Priority:  Medium   |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:
 Keywords:  noscript TorBrowserTeam202005,   |  Actual Points:
  ff78-esr   |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by acat):

 In any case, this would not be an issue for Tor Browser ESR78.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #34305 [Applications/Tor Browser]: NoScript inconsistent behaviour in Firefox 77 (currently beta)

[Tor Bug Tracker & Wiki]

#34305: NoScript inconsistent behaviour in Firefox 77 (currently beta)
-+-
 Reporter:  acat |  Owner:  acat
 Type:  defect   | Status:  new
 Priority:  Medium   |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:
 Keywords:  noscript TorBrowserTeam202005,   |  Actual Points:
  ff78-esr   |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by acat):

 Thanks! It now works with the steps I mentioned, but the issue is still
 present with `privacy.resistFingerprinting = true`. More concretely, I can
 reproduce if I enable that pref and restart the browser, and then continue
 with the steps from the ticket description.

 I think it may be simply because `navigator.userAgent` is spoofed. Maybe
 you could use `browser.runtime.getBrowserInfo()`, which always reports the
 right version?

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #34305 [Applications/Tor Browser]: NoScript inconsistent behaviour in Firefox 77 (currently beta)

[Tor Bug Tracker & Wiki]

#34305: NoScript inconsistent behaviour in Firefox 77 (currently beta)
-+-
 Reporter:  acat |  Owner:  acat
 Type:  defect   | Status:  new
 Priority:  Medium   |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:
 Keywords:  noscript TorBrowserTeam202005,   |  Actual Points:
  ff78-esr   |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by ma1):

 Replying to [comment:7 acat]:
 > Thanks! I think the response was actually pretty fast :)
 >

 Please check
 https://github.com/hackademix/noscript/releases/tag/11.0.27rc1

 Thanks you.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #34305 [Applications/Tor Browser]: NoScript inconsistent behaviour in Firefox 77 (currently beta)

[Tor Bug Tracker & Wiki]

#34305: NoScript inconsistent behaviour in Firefox 77 (currently beta)
-+-
 Reporter:  acat |  Owner:  acat
 Type:  defect   | Status:  new
 Priority:  Medium   |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:
 Keywords:  noscript TorBrowserTeam202005,   |  Actual Points:
  ff78-esr   |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-
Changes (by acat):

 * status:  needs_information => new


Comment:

 Thanks! I think the response was actually pretty fast :)

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #34305 [Applications/Tor Browser]: NoScript inconsistent behaviour in Firefox 77 (currently beta)

[Tor Bug Tracker & Wiki]

#34305: NoScript inconsistent behaviour in Firefox 77 (currently beta)
-+-
 Reporter:  acat |  Owner:  acat
 Type:  defect   | Status:
 |  needs_information
 Priority:  Medium   |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:
 Keywords:  noscript TorBrowserTeam202005,   |  Actual Points:
  ff78-esr   |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by ma1):

 Sorry for the late answer, but I was unable to comment (the textarea was
 missing).
 As correctly guessed by acat, the culprit isan implementation detail of
 https://bugzilla.mozilla.org/show_bug.cgi?id=1462989 (a webRequest
 listener can only either delete or merge CSP headers now, not both in the
 same callback), which combined to the fact CSP headers injected by
 extensions get cached by the browser and automatically reinserted in
 cached responses, can cause all sorts of confusions when policies change
 without cache-purging reloads.
 The (quite annoying, but effective) work-around is uniquely "tagging"
 NoScript's CSP headers, to not interfere with page's own policies or other
 extensions (something NoScript already did) and registering a second
 auxiliary listener which just does the cleanup by removing the previously
 cached  CSP headers.

 I hope to release a development build containing this work-around later
 today or tomorrow, and a stable AMO auto-update within this week.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #34305 [Applications/Tor Browser]: NoScript inconsistent behaviour in Firefox 77 (currently beta)

[Tor Bug Tracker & Wiki]

#34305: NoScript inconsistent behaviour in Firefox 77 (currently beta)
-+-
 Reporter:  acat |  Owner:  acat
 Type:  defect   | Status:
 |  needs_information
 Priority:  Medium   |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:
 Keywords:  noscript TorBrowserTeam202005,   |  Actual Points:
  ff78-esr   |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-
Changes (by acat):

 * status:  assigned => needs_information


--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #34305 [Applications/Tor Browser]: NoScript inconsistent behaviour in Firefox 77 (currently beta)

[Tor Bug Tracker & Wiki]

#34305: NoScript inconsistent behaviour in Firefox 77 (currently beta)
-+-
 Reporter:  acat |  Owner:  acat
 Type:  defect   | Status:
 |  assigned
 Priority:  Medium   |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:
 Keywords:  noscript TorBrowserTeam202005,   |  Actual Points:
  ff78-esr   |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-
Changes (by acat):

 * status:  needs_information => assigned
 * cc: tbb-team (added)
 * owner:  tbb-team => acat


--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #34305 [Applications/Tor Browser]: NoScript inconsistent behaviour in Firefox 77 (currently beta)

[Tor Bug Tracker & Wiki]

#34305: NoScript inconsistent behaviour in Firefox 77 (currently beta)
-+-
 Reporter:  acat |  Owner:  tbb-
 |  team
 Type:  defect   | Status:
 |  needs_information
 Priority:  Medium   |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:
 Keywords:  noscript TorBrowserTeam202005,   |  Actual Points:
  ff78-esr   |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-
Changes (by gk):

 * keywords:  noscript TorBrowserTeam202005 => noscript
 TorBrowserTeam202005, ff78-esr


--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #34305 [Applications/Tor Browser]: NoScript inconsistent behaviour in Firefox 77 (currently beta)

[Tor Bug Tracker & Wiki]

#34305: NoScript inconsistent behaviour in Firefox 77 (currently beta)
---+---
 Reporter:  acat   |  Owner:  tbb-team
 Type:  defect | Status:
   |  needs_information
 Priority:  Medium |  Milestone:
Component:  Applications/Tor Browser   |Version:
 Severity:  Normal | Resolution:
 Keywords:  noscript TorBrowserTeam202005  |  Actual Points:
Parent ID: | Points:
 Reviewer: |Sponsor:
---+---
Changes (by gk):

 * keywords:  noscript TorBrowserTeam201905 => noscript TorBrowserTeam202005


--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #34305 [Applications/Tor Browser]: NoScript inconsistent behaviour in Firefox 77 (currently beta)

[Tor Bug Tracker & Wiki]

#34305: NoScript inconsistent behaviour in Firefox 77 (currently beta)
---+---
 Reporter:  acat   |  Owner:  tbb-team
 Type:  defect | Status:
   |  needs_information
 Priority:  Medium |  Milestone:
Component:  Applications/Tor Browser   |Version:
 Severity:  Normal | Resolution:
 Keywords:  noscript TorBrowserTeam201905  |  Actual Points:
Parent ID: | Points:
 Reviewer: |Sponsor:
---+---
Changes (by acat):

 * cc: ma1 (added)
 * keywords:  noscript => noscript TorBrowserTeam201905
 * status:  new => needs_information


Comment:

 I bisected the issue down to
 https://bugzilla.mozilla.org/show_bug.cgi?id=1462989. Without that change,
 I cannot reproduce the bug. Of course, the underlying problem might be
 different, but at least it looks like that change exposed this.

 ma1, could you please confirm this is a Firefox issue and not a NoScript
 one (which by some reason got exposed by
 https://bugzilla.mozilla.org/show_bug.cgi?id=1462989)? If so, I think we
 should file a bugzilla ticket for this.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs