[tbb-bugs] #27427 [Applications/Tor Browser]: [PATCH] Fix NoScript IPC for about:blank by whitelisting messages

[Tor Bug Tracker & Wiki]

#27427: [PATCH] Fix NoScript IPC for about:blank by whitelisting messages
-------------------------------------------------+-------------------------
 Reporter:  rustybird                            |          Owner:
                                                 |  arthuredelstein
     Type:  defect                               |         Status:
                                                 |  needs_review
 Priority:  Very High                            |      Milestone:
Component:  Applications/Tor Browser             |        Version:
 Severity:  Normal                               |     Resolution:
 Keywords:  TorBrowserTeam201809R,               |  Actual Points:
  tbb-8.0.1-can                                  |
Parent ID:                                       |         Points:
 Reviewer:                                       |        Sponsor:
-------------------------------------------------+-------------------------

Comment (by ma1):

 Replying to [comment:10 arthuredelstein]:
 > After testing in Tor Browser, Rusty Bird's patch looks good to me. I
 changed it to use the better JS equality operator, but otherwise it's the
 same:
 >
 > Here it is rebased to origin/master:
 >
 > https://github.com/arthuredelstein/torbutton/commit/27427


 Please notice that this patch, using message._messageName, will work on
 NoScript 10.1.9.6rc3 (or 10.1.9.6 stable) and above, which gracefully
 handles "legacy" message recipient by adding this property for them:
 https://github.com/hackademix/noscript/commit/71c82b50849d8d70bb5bc410fcdf814837358143.

 Currently all the message metadata, also the name, is meant to be confined
 in a ```__meta``` (notice the double underscore) object, which always
 includes a "name" property, like


 {{{
 message.__meta = {
   name: "start",
   recipientInfo: {},
   //... possibly other properties in future
 }
 }}}

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/27427#comment:12>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online