[tbb-bugs] #26520 [Applications/Tor Browser]: NoScript is broken with TOR_SKIP_LAUNCH=1 in ESR 60-based Tor Browser

[Tor Bug Tracker & Wiki]

#26520: NoScript is broken with TOR_SKIP_LAUNCH=1 in ESR 60-based Tor Browser
-------------------------------------------------+-------------------------
 Reporter:  gk                                   |          Owner:
                                                 |  pospeselr
     Type:  defect                               |         Status:
                                                 |  needs_information
 Priority:  High                                 |      Milestone:
Component:  Applications/Tor Browser             |        Version:
 Severity:  Normal                               |     Resolution:
 Keywords:  ff60-esr, TorBrowserTeam201808,      |  Actual Points:
  noscript                                       |
Parent ID:                                       |         Points:
 Reviewer:                                       |        Sponsor:
-------------------------------------------------+-------------------------

Comment (by rustybird):

 Okay, I've updated my one-liner NoScript patch (that makes it send a
 "started" message) to its new messaging system - this is
 [https://trac.torproject.org/projects/tor/attachment/ticket/26520/v2
 -noscript-started.diff v2-noscript-started.diff]​ and it supersedes
 noscript-NoScript.started.diff​. See comment:14 for how to apply it to an
 unpacked NoScript extension directory. I'm going to open a NoScript pull
 request if nobody objects, maybe it can land in time for the Tor Browser
 8.0 release.

 As for my other patch,
 [https://trac.torproject.org/projects/tor/attachment/ticket/26520
 /torbutton-NoScript.started.diff torbutton-NoScript.started.diff], on
 second thought I think it shouldn't be applied. Because in the unlikely
 case that the NoScript WebExtension finishes startup sooner than the
 unbootstrapped XPCOM Torbutton extension, which would mean that Torbutton
 (patched with arthuredelstein's
 [https://github.com/arthuredelstein/torbutton/commit/26520+1 proposed +1
 patch] rebased on top of
 [https://gitweb.torproject.org/torbutton.git/commit/?id=aa379dcc5c06ee542a1c63adc769678700e32eaa
 aa379dc]) misses the "started" message, it would be a more graceful
 failure mode to at least submit the slider settings after the first
 webpage has loaded and NoScript has sent a non-"started" message (instead
 of never submitting the slider settings at all). NoScript currently
 doesn't seem to send any messages //before// its own initialization phase
 has finished, so it wouldn't clobber the configuration (see comment:11) if
 Torbutton just reacts to the first message, whatever it may be.

 **To summarize**, IMHO Tor Browser 8.0 final should ship with:

 - Torbutton with arthuredelstein's
 [https://github.com/arthuredelstein/torbutton/commit/26520+1 proposed +1
 patch] rebased on top of
 [https://gitweb.torproject.org/torbutton.git/commit/?id=aa379dcc5c06ee542a1c63adc769678700e32eaa
 aa379dc]/
 - NoScript with
 [https://trac.torproject.org/projects/tor/attachment/ticket/26520/v2
 -noscript-started.diff v2-noscript-started.diff]​, hopefully as an
 upstream release

 As far as I can tell, this allows an escape from the maze of race
 conditions...

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/26520#comment:26>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online