[tor-bugs] #21396 [Applications/Tor Browser]: Torbutton breaks Session Manager addon

[Tor Bug Tracker & Wiki]

#21396: Torbutton breaks Session Manager addon
-------------------------------------------------+-------------------------
 Reporter:  HolD                                 |          Owner:  tbb-
                                                 |  team
     Type:  defect                               |         Status:
                                                 |  needs_information
 Priority:  Medium                               |      Milestone:
Component:  Applications/Tor Browser             |        Version:
 Severity:  Normal                               |     Resolution:
 Keywords:  tbb-6.5-regression,                  |  Actual Points:
  TorBrowserTeam201702, GeorgKoppen201702        |
Parent ID:                                       |         Points:
 Reviewer:                                       |        Sponsor:
-------------------------------------------------+-------------------------

Comment (by yawning):

 Replying to [comment:9 gk]:
 > `moz-nullprincipal:{1f22744b-c4db-41b6-8d6e-3d06c176578e}`. Looking at
 the docs it seems like checking for that one would be okay. But this is
 not a solution that scales well. I wonder if we should just add a
 preference `extensions.torbutton_resource_and_chrome_uri_fingerprinting`
 and set that to `false` by default allowing users to override it and to
 disable the content policy hack. Maybe UX folks have an idea.

 An alternative approach would be to have a pref that changes the CSP
 behavior from being whitelist based to blacklist based so that it will
 still defend against say... loading torbutton resources.  The current
 behavior is more robust and more resilient against this particular
 fingerprinting method (since it protects all resources), so it should be
 the default regardless of how the actual pref ends up being implemented.

 Installing extra addons never has been something considered safe, or part
 of Tor Browser's threat model as far as I am aware, and people that chose
 to do so should be doing it with the understanding that it may open them
 up to various fingerprinting attacks.

 The real fix would be for upstream Firefox to plug the chrome/resource URI
 scheme issues correctly, naturally.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/21396#comment:10>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online