Skip to content
Snippets Groups Projects
New look: Off

discourse/github breakage with custom slider settings: `svg.disabled` is on

    • Open Issue created by cypherpunks @cypherpunks

    Tested with Tor Browser 14.0.6 on Whonix

    STR:

    1. Remove/Disable NoScript
    2. Put Tor Browser in "Safest" mode.
    3. Explicitly make sure in about:config" that svg.disabledandjavascript.enabled` are both set to true.
    4. Open and watch browser console
    5. Open any Discourse forum homepage (that of Tor Project included) or some GitHub project (e.g. https://github.com/torvalds/linux)

    Expected

    Pages should load correctly.

    Actual

    Discourse:

    Shows 5 animated dots and doesn't load further, thus making impossible to use the forums (e.g. to sign in etc).

    GitHub:

    Shows:

    Error Looks like something went wrong!

    For both Discourse and GitHub the console shows SVG-related error messages.

    Further STR:

    1. Set svg.disabled to false
    2. Reload

    Result

    Everything works as expected.

    Additional note

    The issue with Discourse forums started appearing for me just recently. Speculation: perhaps due to update of Tor Browser, or all Discourse forums on the web (unlikely), or some combination of the two.

    Designs

    Child items ...

    • Activity

    • Thorin
      Thorin @thorin ·
      Developer

      STR:

      1. Remove/Disable NoScript

      Invalid

    • Thorin closed

      closed

      • C
        cypherpunks @cypherpunks ·
        Author

        What do you mean by "new threads"? I am simply using the "create a new note" for the current issue through the anonticket system. There is no reply button.

        To answer your question: Open the web page, right click on an empty space, choose NoScript, then click the "S with a clock" button to mark the page trusted and reload. This enables JavaScript.

      • Thorin
        Thorin @thorin ·
        Developer

        What do you mean by "new threads

        threads

        To answer your question

        That's NOT the same as removing or disabling NoScript

        STR

        can't make sense what you're trying to do or the order. So you load the webpage in order to apply a NoScript site exception - do you reload the page?. The you change the security slider which by default will set JS disabled and svg as disabled - do you reload the page? Then you explicitly say to open about:config and make sure JS and SVG are changed from Safest settings - you are now in some sort of CUSTOM slider setup which is not supported and you have gone into about:config and changed pref values which is also not supported - do you reload the page?

        What are you trying to achieve? If you want JS and svg to work then just use safer

        inclined to mark this as a duplicate of #43213 (closed) or #27607 - reopening, adding needs info and someone else can deal with this like @ma1 @morgan or @pierov - there is also another issue somewhere about NoScript + adding SVG as click to play or something

      • Please register or sign in to reply
    • Thorin added All Platforms Needs Information NoScript labels

      added All Platforms Needs Information NoScript labels

    • Thorin reopened

      reopened

    • Thorin marked this issue as related to #42572

      marked this issue as related to #42572

    • Thorin changed title from Tor Browser breaks Discourse and GitHub when svg.disabled is on to discourse/github breakage with custom slider settings: svg.disabled is on

      changed title from Tor Browser breaks Discourse and GitHub when svg.disabled is on to discourse/github breakage with custom slider settings: svg.disabled is on

    • C
      cypherpunks @cypherpunks ·
      Author

      So you load the webpage in order to apply a NoScript site exception - do you reload the page?

      Yes.

      The you change the security slider which by default will set JS disabled and svg as disabled - do you reload the page?

      No. But that is insignificant.

      Then you explicitly say to open about:config and make sure JS and SVG are changed from Safest settings - you are now in some sort of CUSTOM slider setup

      I guess so.

      which is not supported

      I don't know what this means.

      and you have gone into about:config and changed pref values which is also not supported - do you reload the page?

      For this, I also don't know what this "not supported" means. If it is supposed not to be touched, then why is it even enabled?

      Yes, I reload.

      What are you trying to achieve?

      Improved privacy, hopefully, by following the general security principle to enable only what is actually necessary (in this case - only JS), rather than a whole set of additional things (what "Safer" would do). Until recently, this worked fine for Discourse.

      If you want JS and svg to work

      No. The goal is to enable only JS but not SVG.

      duplicate of #43213 (closed) or #27607

      I am aware of those issues but the current one doesn't seem duplicate. The issue here is the breakage of Discourse which started to happen recently. Approx. a week ago it was not an issue.

      To avoid further confusion, please let me clarify the STR:

      1. Put Tor Browser in "Safest" mode. In about:config, set javascript.enabled=true
      2. NoScript: either Disable restrictions globally, or do it for the site only after loading the page, as described previously.
      3. Open https://forum.torproject.org/ or https://github.com/torvalds/linux and watch for errors in browser console

      Result:

      There will be errors in console and the pages won't load correctly, as described initially.

      Why I think this may be a bug:

      • Because till recently Discourse worked fine with this procedure
      • Because loading an SVG image should not be a reason to break the whole functionality of a web page
    • morgan added Apps::Type::Bug label

      added Apps::Type::Bug label

    • morgan added Apps::Impact::High label

      added Apps::Impact::High label

    Please register or sign in to reply