[tbb-bugs] #25014 [Applications/Tor Browser]: Options UX for Extensions isn't allowing JS execution

[Tor Bug Tracker & Wiki]

#25014: Options UX for Extensions isn't allowing JS execution
------------------------------------------+----------------------
     Reporter:  legind                    |      Owner:  tbb-team
         Type:  defect                    |     Status:  new
     Priority:  Medium                    |  Milestone:
    Component:  Applications/Tor Browser  |    Version:
     Severity:  Normal                    |   Keywords:
Actual Points:                            |  Parent ID:
       Points:                            |   Reviewer:
      Sponsor:                            |
------------------------------------------+----------------------
 When you visit `about:addons` within Tor Browser while TorButton is in the
 middle ("Safer") or highest ("Safest") security levels, the HTTPS
 Everywhere options UX does not work.  This is because it is dependent on
 JavaScript execution, which is disabled in those security levels, but
 should not be disabled for extension UX in general.

 This problem is also exhibited when JavaScript is disabled in Firefox ESR,
 so this is an underlying Firefox problem.  A fix has been made as the
 latest Firefox does not exhibit this problem, but they haven't bothered
 backporting it to ESR.

 This problem is very similar to what we encountered in
 https://trac.torproject.org/projects/tor/ticket/23258.  In that case, UX
 elements for the HTTPS Everywhere extension popup were not working
 properly.  This is the same, but applied to the options UX.  We had to
 apply a backported patch to the TB build then in order to restore
 functionality.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/25014>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online