[tor-bugs] #5477 [EFF-HTTPS Everywhere]: Surprising DOM origins before HTTPS-E/NoScript redirects have completed

[Tor Bug Tracker & Wiki]

#5477: Surprising DOM origins before HTTPS-E/NoScript redirects have completed
------------------------------------------------------+---------------------
 Reporter:  Drugoy                                    |          Owner:  ma1     
     Type:  defect                                    |         Status:  accepted
 Priority:  major                                     |      Milestone:          
Component:  EFF-HTTPS Everywhere                      |        Version:          
 Keywords:  address spoofing, critical vulnerability  |         Parent:          
   Points:                                            |   Actualpoints:          
------------------------------------------------------+---------------------
Changes (by ma1):

  * status:  new => accepted
  * owner:  pde => ma1


Comment:

 OK, I thing I've found it.

 HTTPS Everywhere uses a very old version of NoScript's ChannelReplacement
 machinery, which has several known issues with Gecko >= 2.

 Patch coming in minutes...

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/5477#comment:16>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online