[tor-bugs] #26520 [Applications/Tor Browser]: NoScript is broken with TOR_SKIP_LAUNCH=1 in ESR 60-based Tor Browser

[Tor Bug Tracker & Wiki]

#26520: NoScript is broken with TOR_SKIP_LAUNCH=1 in ESR 60-based Tor Browser
--------------------------------------------+------------------------------
 Reporter:  gk                              |          Owner:  tbb-team
     Type:  defect                          |         Status:
                                            |  needs_revision
 Priority:  Very High                       |      Milestone:
Component:  Applications/Tor Browser        |        Version:
 Severity:  Normal                          |     Resolution:
 Keywords:  ff60-esr, TorBrowserTeam201808  |  Actual Points:
Parent ID:                                  |         Points:
 Reviewer:                                  |        Sponsor:
--------------------------------------------+------------------------------

Comment (by rustybird):

 Replying to [comment:12 intrigeri]:
 > Tails does not use `TOR_SKIP_LAUNCH=1`. Instead we set
 `TOR_CONFIGURE_ONLY=1` before starting Tor Launcher (as an independent XUL
 application).

 I think it's equivalent for this bug (except with maybe a slightly
 different timing in the race?) to use `TOR_SKIP_LAUNCH=1`, or
 `extensions.torlauncher.start_tor=false`, or to completely disable/remove
 the TorLauncher extension in the main Tor Browser profile (e.g. because
 you're starting it independently).

 > * I see `JavaScript error: resource://gre/modules/ExtensionCommon.jsm,
 line 456: Error: Could not establish connection. Receiving end does not
 exist.` in the logs.

 Yup, there it is. :\

 > * If I raise the security slider to "Safest" then JavaScript is
 correctly disabled.
 > * I don't know how to test whether "the communication between Torbutton
 and NoScript" works.

 The symptom to look out for is JavaScript //not// working on websites even
 though it should be enabled, especially in the default state after
 installation. If you start a fresh browser and don't open the Torbutton
 Security Settings dialog at all, the slider level defaults to Standard, so
 JavaScript should be enabled - but:

 - situation on vanilla 8.0a9 and 8.0a10: You can only make JavaScript work
 if you move the slider away from Standard to Safer or Safest, confirm with
 OK, and then move it back to Standard again
 - situation with the proposed second patch: JavaScript only works (and the
 slider only becomes functional) after the first website has been loaded

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/26520#comment:13>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online