[tor-bugs] #5744 [TorBrowserButton]: TBB-Firefox allows style change on mouseover (JS disabled)

[Tor Bug Tracker & Wiki]

#5744: TBB-Firefox allows style change on mouseover (JS disabled)
------------------------------+---------------------------------------------
 Reporter:  rransom           |          Owner:  mikeperry
     Type:  defect            |         Status:  new      
 Priority:  normal            |      Milestone:           
Component:  TorBrowserButton  |        Version:           
 Keywords:                    |         Parent:           
   Points:                    |   Actualpoints:           
------------------------------+---------------------------------------------

Comment(by gk):

 > I currently have JS disabled by NoScript (by clicking the ‘Forbid
 Scripts Globally’ option), so this is a change caused by CSS only.  I
 don't know whether that's considered harmful, but I suspect that it is.

 I can't reproduce this with JonDoFox but that's because we currently set
 browser.display.use_document_fonts to 0. If you do this as well your
 "problem" vanishes. Considering the recent efforts to deploy a font
 limiting patch I guess this ticket is a WON'T FIX, though. Mike?
 Nevertheless, maybe there is more to it as the behavior is not
 reproducible either having a TBB with JS activated
 (browser.display.use_document_fonts untouched). I don't know much about
 the internal workings of the TBB but that is somewhat surprising to me.

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/5744#comment:2>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online