Commit 7d97e9c2 authored Feb 19, 2018 by Georg Koppen

Bug 25000: Add [System+Principal] to the NoScript whitelist

We need to whitelist `[System+Principal]` for functioning settings
frames of WebExtensions on the about:addons page. On higher security
slider levels this is broken otherwise.

To quote Giorgio Maone (see: #25000 comment:14):

"The Tor Browser enforces permissions cascading, and in the Add-ons
Options window the top frame is about:addons, whose principal's origin
is [System+Principal]. Since this origin is omitted from Tor Browser's
version of NoScript mandatory whitelist, the top site by default is
considered forbidden, cascading down script blocking to the
WebExtension's subframe."

parent 10b6ffd8

projects/tor-browser/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js

+3 −3

Original line number	Diff line number	Diff line
		@@ -8,9 +8,9 @@ pref("extensions.https_everywhere.toolbar_hint_shown", true);

		# NoScript Preferences:
		pref("capability.policy.maonoscript.javascript.enabled", "allAccess");
		pref("capability.policy.maonoscript.sites", "about: about:tbupdate about:tor chrome: resource: blob: mediasource: moz-extension: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed about:cache");
		pref("noscript.default", "about: about:tbupdate about:tor chrome: resource: blob: mediasource: moz-extension: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed about:cache");
		pref("noscript.mandatory", "about: about:tbupdate about:tor chrome: resource: blob: mediasource: moz-extension: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed about:cache");
		pref("capability.policy.maonoscript.sites", "[System+Principal] about: about:tbupdate about:tor chrome: resource: blob: mediasource: moz-extension: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed about:cache");
		pref("noscript.default", "[System+Principal] about: about:tbupdate about:tor chrome: resource: blob: mediasource: moz-extension: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed about:cache");
		pref("noscript.mandatory", "[System+Principal] about: about:tbupdate about:tor chrome: resource: blob: mediasource: moz-extension: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed about:cache");
		pref("noscript.ABE.enabled", false);
		pref("noscript.ABE.notify", false);
		pref("noscript.ABE.wanIpAsLocal", false);

projects/tor-browser/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js

+3 −3

Original line number	Diff line number	Diff line
		@@ -8,9 +8,9 @@ pref("extensions.https_everywhere.toolbar_hint_shown", true);

		# NoScript Preferences:
		pref("capability.policy.maonoscript.javascript.enabled", "allAccess");
		pref("capability.policy.maonoscript.sites", "about: about:tbupdate about:tor chrome: resource: blob: mediasource: moz-extension: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed about:cache");
		pref("noscript.default", "about: about:tbupdate about:tor chrome: resource: blob: mediasource: moz-extension: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed about:cache");
		pref("noscript.mandatory", "about: about:tbupdate about:tor chrome: resource: blob: mediasource: moz-extension: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed about:cache");
		pref("capability.policy.maonoscript.sites", "[System+Principal] about: about:tbupdate about:tor chrome: resource: blob: mediasource: moz-extension: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed about:cache");
		pref("noscript.default", "[System+Principal] about: about:tbupdate about:tor chrome: resource: blob: mediasource: moz-extension: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed about:cache");
		pref("noscript.mandatory", "[System+Principal] about: about:tbupdate about:tor chrome: resource: blob: mediasource: moz-extension: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed about:cache");
		pref("noscript.ABE.enabled", false);
		pref("noscript.ABE.notify", false);
		pref("noscript.ABE.wanIpAsLocal", false);

projects/tor-browser/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js

+3 −3

Original line number	Diff line number	Diff line
		@@ -8,9 +8,9 @@ pref("extensions.https_everywhere.toolbar_hint_shown", true);

		# NoScript Preferences:
		pref("capability.policy.maonoscript.javascript.enabled", "allAccess");
		pref("capability.policy.maonoscript.sites", "about: about:tbupdate about:tor chrome: resource: blob: mediasource: moz-extension: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed about:cache");
		pref("noscript.default", "about: about:tbupdate about:tor chrome: resource: blob: mediasource: moz-extension: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed about:cache");
		pref("noscript.mandatory", "about: about:tbupdate about:tor chrome: resource: blob: mediasource: moz-extension: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed about:cache");
		pref("capability.policy.maonoscript.sites", "[System+Principal] about: about:tbupdate about:tor chrome: resource: blob: mediasource: moz-extension: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed about:cache");
		pref("noscript.default", "[System+Principal] about: about:tbupdate about:tor chrome: resource: blob: mediasource: moz-extension: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed about:cache");
		pref("noscript.mandatory", "[System+Principal] about: about:tbupdate about:tor chrome: resource: blob: mediasource: moz-extension: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed about:cache");
		pref("noscript.ABE.enabled", false);
		pref("noscript.ABE.notify", false);
		pref("noscript.ABE.wanIpAsLocal", false);