[tor-bugs] #13053 [Quality Assurance and Testing]: Write regression tests for new NoScript options

[Tor Bug Tracker & Wiki]

#13053: Write regression tests for new NoScript options
-------------------------------------+-------------------------------------
     Reporter:  mikeperry            |      Owner:  boklm
         Type:  task                 |     Status:  new
     Priority:  normal               |  Milestone:
    Component:  Quality Assurance    |    Version:
  and Testing                        |   Keywords:  tbb-testcase,
   Resolution:                       |  tbb-4.5-alpha
Actual Points:                       |  Parent ID:  #9387
       Points:                       |
-------------------------------------+-------------------------------------

Comment (by boklm):

 I started adding some pages to test the globalHTTPSWhitelist option.

 http and https pages that source an http url:
 (1) https://test-data.tbb.torproject.org/noscript/http_src.html
 (2) http://test-data.tbb.torproject.org/noscript/http_src.html

 http and https pages that source an https url:
 (3) http://test-data.tbb.torproject.org/noscript/https_src.html
 (4) https://test-data.tbb.torproject.org/noscript/https_src.html

 An http iframe in http and https pages:
 (5) http://test-data.tbb.torproject.org/noscript/http_iframe.html
 (6) https://test-data.tbb.torproject.org/noscript/http_iframe.html

 An https iframe in http and https pages:
 (7) http://test-data.tbb.torproject.org/noscript/https_iframe.html
 (8) https://test-data.tbb.torproject.org/noscript/https_iframe.html

 When noscript.global is set to false, noscript.cascadePermissions to false
 and noscript.globalHttpsWhitelist to true, this seems to work as expected:
 1, 2, 3, 5, 6, 7 are blocked, but 4 and 8 are not.

 However, if noscript.cascadePermissions is set to true, then 1 and 6 are
 no longer blocked: an https page can source http URLs. I don't think it's
 the expected behavior.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/13053#comment:8>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online