[tbb-bugs] #18782 [Tor Browser]: media tab in Page Info can bypass NoScript

[Tor Bug Tracker & Wiki]

#18782: media tab in Page Info can bypass NoScript
-------------------------+-----------------------------------
 Reporter:  cypherpunks  |          Owner:  tbb-team
     Type:  defect       |         Status:  needs_information
 Priority:  High         |      Milestone:
Component:  Tor Browser  |        Version:
 Severity:  Major        |     Resolution:
 Keywords:               |  Actual Points:
Parent ID:               |         Points:
 Reviewer:               |        Sponsor:
-------------------------+-----------------------------------

Comment (by cypherpunks):

 By "I don't have such an URL.", do you mean the IP-based one in Media
 Preview? Do you get any URLs at all in Media Preview? Anyway, yes, I am
 talking about an item in the Media Preview.

 I suppose it is possible that some addon I use has circumvented default
 Tor Browser restrictions, but most of my plugins restrict content, none
 enable it. A few enhance it, but not in ways I can see interfering.

 I know the addon hole isn't something you want to fall into, but this
 still might not stem from addons. And in any case, I'd need help narrowing
 it down if it is an addon. Are there specific settings in NoScript or
 Firefox which govern Media Preview?

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/18782#comment:4>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online