NoScript Crashes TOR When Dragging the Logon ID

[NS001]

NoScript under Tor has only two settings 'Allow Scripts Globally (dangerous)' and allow the site you are visiting.

Launching Tor and going directly to this forum http://forums.informaction.com/ucp.php?mode=login with it blocked by NoScript and then using the mouse to drag the forums logon ID to its box causes the Tor browser to crash. Any one else experiencing this?

When you install the Windows Tor Bundle the first time the browser appears it's set to 'Allow Scripts Globally (dangerous)'. Is this wise or does it have to be this way in order to allow the Tor Firefox browser to launch?

[Giorgio Maone]

1) I've no idea if TOR bundles a modified version of NoScript, and if it does, which are the changes
2) Have you got crash reports from about:crashes?

[therube]

I have always replaced whatever version of NoScript is bundled with TOR with the most recent version.

You can set NoScript up in any manner that you wish.

TOR defaults it to certain settings, but they can be changed.

NoScript included in tor-browser-2.3.25-4 is EXACTLY the same as noscript-2.6.5.7.xpi.
The only difference is that they install it "flat" (rather then as an XPI) & whatever settings they may default to.


> When you install the Windows Tor Bundle the first time the browser appears it's set
> to 'Allow Scripts Globally (dangerous)'. Is this wise or does it have to be this way in
> order to allow the Tor Firefox browser to launch?

Yes they do that, but I don't know their rational for doing so? Suppose if you peruse their FAQ or whatever, you (or I) could find out.

[therube]

> then using the mouse to drag the forums logon ID

What do you mean by that?
Drag it to the Tab bar (rather then clicking it) ?

[NS001]

I use a windows app password manager that allows you to drag the logon ID and password from text boxes to the web form. No problem whatsoever in Firefox but doing this in the Tor browser crashes it dead and the crash reporter doesn't launch (about:crashes. Nice one!). This was a bug reported to Mozilla back in 2012 which supposedly got fixed. Nah! Its still there. I tried pasting (using right click) the Logon ID and password into the web form - no problem it works fine. Do the Tor people know that NoScript on a new install is effectively turned off and that a bug has returned to the Tor Firefox browser? Can't report it to Mozilla until others can reproduce the problem.

[therube]

And if you remove NoScript, you can drag without crashing?

[NS001]

And if you remove NoScript, you can drag without crashing?

Still had the problem.

But when I disabled the extension 'Tor Button 1.5' the problem went away.

What next?

[therube]

Complain to TOR/FF/Tor Button, because it is certainly not a NoScript issue .

[NS001]

The problem was posted to https://blog.torproject.org/blog/new-to ... ment-18996 and is awaiting moderation.

1) Windows Bundle: The browser crashes in an uncontrolled manner whenever an image is dragged from a windows app such as a password manager to an online web form textbox.

To reproduce the problem open
http://forums.informaction.com/ucp.php?mode=login
Open your password manger and drag anything to the 'username' box on the web form. Observe that both Vidalia and Firefox close down in an uncontrolled manner without reporting.

Disabling the add-on Tor Button 1.5 extension prevents the problem from happening.

2) The Windows Bundle is being shipped for new installs with NoScript set to 'Allow Scripts Globally (dangerous)'. It should be shipped with NoScript set to 'Forbid Scripts Globally (advised)'. A user unfamiliar with NoScript would be at risk with the present install arrangement.

[NS001]

This problem is now fixed as of bundle tor-browser-2.3.25-5_en-US

Tor Button has gone from 1.5 to 1.5.1?

Thank you everybody for your help with this.