[tor-bugs] #5477 [EFF-HTTPS Everywhere]: Surprising DOM origins before HTTPS-E/NoScript redirects have completed

[Tor Bug Tracker & Wiki]

#5477: Surprising DOM origins before HTTPS-E/NoScript redirects have completed
------------------------------------------------------+---------------------
 Reporter:  Drugoy                                    |          Owner:  ma1           
     Type:  defect                                    |         Status:  needs_revision
 Priority:  major                                     |      Milestone:                
Component:  EFF-HTTPS Everywhere                      |        Version:                
 Keywords:  address spoofing, critical vulnerability  |         Parent:                
   Points:                                            |   Actualpoints:                
------------------------------------------------------+---------------------
Changes (by mikeperry):

  * status:  needs_review => needs_revision


Comment:

 ma1: We're running into some issues getting those patches to apply with
 'git am' for some reason.. I first suspected dos line breaks as the issue,
 but removing them didn't seem to help. Applying the patch manually with
 'patch' causes an exception to be generated: http://pastebin.com/t8KvVQJr

 Also, I think I'd prefer it if we can keep our codebases closer in sync. I
 am assuming that if I just rename IOUtil.js to ChannelReplacement.js, I
 should be able to re-produce that patch, right? (Note the last time we
 synced with NoScript was noscript-2.0.9.8rc1).

 I'm going to give that a shot right now.

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/5477#comment:18>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online