[tor-bugs] #27427 [Applications/Tor Browser]: [PATCH] Fix NoScript IPC for about:blank by whitelisting messages

[Tor Bug Tracker & Wiki]

#27427: [PATCH] Fix NoScript IPC for about:blank by whitelisting messages
-------------------------------------------------+-------------------------
 Reporter:  rustybird                            |          Owner:
                                                 |  arthuredelstein
     Type:  defect                               |         Status:
                                                 |  needs_review
 Priority:  Very High                            |      Milestone:
Component:  Applications/Tor Browser             |        Version:
 Severity:  Normal                               |     Resolution:
 Keywords:  TorBrowserTeam201809R,               |  Actual Points:
  tbb-8.0.1-can                                  |
Parent ID:                                       |         Points:
 Reviewer:                                       |        Sponsor:
-------------------------------------------------+-------------------------

Comment (by rustybird):

 Replying to [comment:15 ma1]:
 > Replying to [comment:14 rustybird]:
 >
 > > If this race hypothetically affects real websites (i.e. not just
 `about:blank` and empty `data:` pages),
 >
 > It should not: NoScript defers all the HTTP(S) traffic until its policy
 is configured and ready to be enforced.
 > about:blank, data: and file: URLs are those which might suffer of this
 problem, because NoScript has no means to prevent them from loading before
 it's initialized.

 Thanks, that makes sense.

 Replying to [comment:13 ma1]:
 > So, if the Tor Browser can start using `__meta.name` both on the
 receiving and the sending end, I'm gonna get rid of the "legacy" redundant
 `_messageName` property in one of the next releases.

 I've uploaded a
 [https://trac.torproject.org/projects/tor/attachment/ticket/27427/v3-Fix-
 NoScript-IPC-for-about-blank-by-whitelisting-messages.patch v3 patch for
 the receiving end] and a
 [https://trac.torproject.org/projects/tor/attachment/ticket/27427/Send-
 updateSettings-message-using-NoScript-10.1.9.2-protocol.patch patch for
 the sending end].

 Assuming that these patches land in Tor Browser 8.0.**1**, maybe NoScript
 could keep the legacy code for a little while, e.g. until Tor Browser
 8.0.**2** is released. This would be a grace period for Tor Browser
 8.0**(.0)** users, so they don't automatically receive an NoScript
 extension update to an incompatible version.

 Replying to [comment:10 arthuredelstein]:
 > I changed it to use the better JS equality operator

 Whoops yes, `==` is crappy. The v3 patch uses `Array.prototype.includes()`
 to make it shorter, so it's like `===` except that `NaN` would be
 considered equal to itself. Hope that's okay, I can change it if not.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/27427#comment:16>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online