[tor-bugs] #31287 [Applications/Tor Browser]: NoScript leaks browser locale if objects are blocked and JavaScript is allowed

[Tor Bug Tracker & Wiki]

#31287: NoScript leaks browser locale if objects are blocked and JavaScript is
allowed
-------------------------------------+-------------------------------------
     Reporter:  gk                   |      Owner:  tbb-team
         Type:  defect               |     Status:  new
     Priority:  Medium               |  Milestone:
    Component:  Applications/Tor     |    Version:
  Browser                            |   Keywords:  tbb-fingerprinting-
     Severity:  Normal               |  locale, noscript
Actual Points:                       |  Parent ID:
       Points:                       |   Reviewer:
      Sponsor:                       |
-------------------------------------+-------------------------------------
 If one customizes NoScript in a way that objects are blocked and
 JavaScript is enabled then the browser locale is leaked even if the user
 opted in in hiding it.
 This issue got reported to our HackerOne bug bounty program by ryotak,
 thanks!

 A copy of the developed PoC can be found at:
 https://people.torproject.org/~gk/tests/poc_noscript_locale_leak.html.

 Note: Tor Browser is not vulnerable to this attack in any of the supported
 default settings (that is on any of the security settings levels).

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/31287>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online