drag-n-drop bypasses tor on Unity

Requests for drag-and-drop thumbnails in Tor Browser is not sent through the Tor network, but instead plain-text HTTP request.

How to reproduce:

  • Download and start Tor Browser Bundle version 2.2.34-2 (current, this one)
  • Start up Wireshark and start logging your network interactively
  • Using the Tor Browser, visit "www.gnome.org" (or any other HTTP site)
  • See Wireshark sending all traffic encrypted to various Tor nodes
  • When the site have loaded, drag the big image on the site
  • See Wireshark logging a DNS request for "www.gnome.org" with reply
  • See Wireshark logging a HTTP HEAD request for "/wp-content/uploads/2011/09/gnome-3.2.png" on host "www.gnome.org", sending this directly unencrypted to the IP returned from the DNS request.
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information