[tbb-commits] [torbutton/maint-2.0] Bug 27175: Add pref to allow users to persist custom noscript settings

[gk at torproject.org]

commit d0adb5ad47e97e2143bac6595084a33e6355acb8
Author: Arthur Edelstein <arthuredelstein at gmail.com>
Date:   Mon Sep 17 23:03:26 2018 -0700

    Bug 27175: Add pref to allow users to persist custom noscript settings
    
    The pref is called "extensions.torbutton.noscript_persist".
    Warning! It is dangerous and could reveal what sites you have visited
    in the past.
    
    (We also use a pref named "extensions.torbutton.noscript_inited" to keep
    track of the first run.)
---
 src/defaults/preferences/preferences.js |  3 +++
 src/modules/noscript-control.js         | 31 +++++++++++++++++++++++--------
 2 files changed, 26 insertions(+), 8 deletions(-)

diff --git a/src/defaults/preferences/preferences.js b/src/defaults/preferences/preferences.js
index b991a3ae..eb055a65 100644
--- a/src/defaults/preferences/preferences.js
+++ b/src/defaults/preferences/preferences.js
@@ -48,6 +48,9 @@ pref("extensions.torbutton.prompt_torbrowser", true);
 pref("extensions.torbutton.confirm_plugins", true);
 pref("extensions.torbutton.confirm_newnym", true);
 
+pref("extensions.torbutton.noscript_inited", false);
+pref("extensions.torbutton.noscript_persist", false);
+
 // Browser home page:
 pref("browser.startup.homepage", "chrome://torbutton/content/locale/non-localized.properties");
 
diff --git a/src/modules/noscript-control.js b/src/modules/noscript-control.js
index 621f2b7f..275f9dba 100644
--- a/src/modules/noscript-control.js
+++ b/src/modules/noscript-control.js
@@ -5,9 +5,10 @@
 // ## Utilities
 
 const { utils: Cu } = Components;
+const { Services } = Cu.import("resource://gre/modules/Services.jsm", {});
 const { LegacyExtensionContext } =
       Cu.import("resource://gre/modules/LegacyExtensionsUtils.jsm", {});
-const { bindPrefAndInit } =
+const { bindPref } =
       Cu.import("resource://torbutton/modules/utils.js", {});
 let logger = Components.classes["@torproject.org/torbutton-logger;1"]
     .getService(Components.interfaces.nsISupports).wrappedJSObject;
@@ -128,14 +129,28 @@ var initialize = () => {
     // Wait for the first message from NoScript to arrive, and then
     // bind the security_slider pref to the NoScript settings.
     let messageListener = (a,b,c) => {
-      log(3, `Message received from NoScript: ${JSON.stringify([a,b,c])}`);
-      if (!["started", "pageshow"].includes(a.__meta.name)) {
-        return;
+      try {
+        log(3, `Message received from NoScript: ${JSON.stringify([a,b,c])}`);
+        if (!["started", "pageshow"].includes(a.__meta.name)) {
+          return;
+        }
+        extensionContext.api.browser.runtime.onMessage.removeListener(messageListener);
+        let noscriptPersist = Services.prefs.getBoolPref("extensions.torbutton.noscript_persist", false);
+        let noscriptInited = Services.prefs.getBoolPref("extensions.torbutton.noscript_inited", false);
+        // Set the noscript safety level once if we have never run noscript
+        // before, or if we are not allowing noscript per-site settings to be
+        // persisted between browser sessions. Otherwise make sure that the
+        // security slider position, if changed, will rewrite the noscript
+        // settings.
+        bindPref("extensions.torbutton.security_slider",
+                 sliderState => setNoScriptSafetyLevel(securitySliderToSafetyLevel(sliderState)),
+                 !noscriptPersist || !noscriptInited);
+        if (!noscriptInited) {
+          Services.prefs.setBoolPref("extensions.torbutton.noscript_inited", true);
+        }
+      } catch (e) {
+        log(5, e.message);
       }
-      extensionContext.api.browser.runtime.onMessage.removeListener(messageListener);
-      bindPrefAndInit(
-        "extensions.torbutton.security_slider",
-        sliderState => setNoScriptSafetyLevel(securitySliderToSafetyLevel(sliderState)));
     };
     extensionContext.api.browser.runtime.onMessage.addListener(messageListener);
     log(3, "Listening for message from NoScript.");