Page 1 of 1

Tor Browser - Toggling svg.disabled deletes all Per-site Permissions

Posted: Sun Nov 28, 2021 1:30 pm
by ppxxbu
Yes I'm aware I shouldn't toggle `svg.disabled` to `True` on Tor Browser due to security reasons, but sometimes I really need to look at a math equation properly on wikipedia :)

Steps to reproduce -

0. NS Version 11.2.12rc3 or the stable version that ships with Tor Browser.

1. Get Tor Browser - https://dist.torproject.org/torbrowser/11.0.1/

2. Tick "Override Tor Browser's Security Level preset" option in NoScript.

3. Visit any website and set a permanent permission so it shows up on the "Per-site Permissions" tab on NoScript Options.

4. Go to about:config and Toggle `svg.disabled` to True and back to False.

5. Check the "Per-site Permissions" tab and all per-site permissions that you may have set, have vanished.

Re: Tor Browser - Toggling svg.disabled deletes all Per-site Permissions

Posted: Sun Nov 28, 2021 1:37 pm
by ppxxbu
EDIT: I know I shouldn't toggle svg.disabled to **False** on Tor Browser.

Re: Tor Browser - Toggling svg.disabled deletes all Per-site Permissions

Posted: Sun Nov 28, 2021 2:50 pm
by barbaz
I don't use Tor Browser, but this sounds outside the scope of NoScript and the following quote suggests it maybe intentional behavior -
Asphyx wrote: Mon Oct 25, 2021 9:27 am unfortunally, Torbrowser bundles this setting with NoScript-settings. When switch off SVG, all individual NoScript-settings are removed. :-(
Have you asked about this in a Tor Browser support venue (or their bug tracker if you think it's a bug)?

Re: Tor Browser - Toggling svg.disabled deletes all Per-site Permissions

Posted: Mon Nov 29, 2021 12:44 pm
by ppxxbu
You're right, the issue doesn't exist in regular Firefox. I might report the issue to the Tor Browser folks.

However they seem to require me to give them my email address https://gitlab.onionize.space/ to be able to talk on their gitlab https://gitlab.torproject.org/?

That seems a little tedious, but okay.

If somebody reading this wants to do the reporting instead, @Asphyx maybe, assuming I haven't already done so, feel free to go ahead.

Regardless, thank you @barbaz :)

Re: Tor Browser - Toggling svg.disabled deletes all Per-site Permissions

Posted: Mon Nov 29, 2021 9:03 pm
by Asphyx
It's already an issue: https://gitlab.torproject.org/tpo/appli ... sues/40666

Because of bugs I still use TB 10. There this setting helps:
user_pref("extensions.torbutton.noscript_persist", true);