ma1 pushed to branch tor-browser-153.0esr-16.0-1 at The Tor Project / Applications / Tor Browser Commits: eff748cd by hackademix at 2026-07-29T18:50:33+02:00 fixup! BB 41598: Prevent NoScript from being removed/disabled. TB 45157: Grant "access local file" permission to NoScript. - - - - - 2 changed files: - toolkit/components/extensions/Extension.sys.mjs - toolkit/mozapps/extensions/content/components/addon-permissions-list.mjs Changes: ===================================== toolkit/components/extensions/Extension.sys.mjs ===================================== @@ -4366,12 +4366,14 @@ export class Extension extends ExtensionData { } // tor-browser#40253: Explicitly allow NoScript in Private Browsing mode. + // tor-browser#45157: Grant "access local files" permission to NoScript. if (this.isNoScript) { lazy.ExtensionPermissions.add(this.id, { - permissions: [PRIVATE_ALLOWED_PERMISSION], + permissions: [PRIVATE_ALLOWED_PERMISSION, "internal:fileSchemeAllowed"], origins: [], }); this.permissions.add(PRIVATE_ALLOWED_PERMISSION); + this.permissions.add("internal:fileSchemeAllowed"); } // We only want to update the SVG_CONTEXT_PROPERTIES_PERMISSION during ===================================== toolkit/mozapps/extensions/content/components/addon-permissions-list.mjs ===================================== @@ -87,7 +87,15 @@ class AddonPermissionsList extends AboutAddonsHTMLElement { }, { buildOptionalOrigins: true, - includeFileSchemeAccess: lazy.fileSchemeAccessRequiresOptIn, + // tor-browser#45157: prevent "access local files" from being accidentally + // toggled off in NoScript, causing Safer and Safest security levels to + // fail on file:// URLs. + includeFileSchemeAccess: + lazy.fileSchemeAccessRequiresOptIn && + !( + fileSchemeAllowed && + this.addon.id == "{73a6fe31-595d-460b-a920-fcc0f8843232}" + ), } ); let optionalEntries = [ View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/eff748cd... -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/eff748cd... You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help