[tor-bugs] #19200 [Applications/Tor Browser]: HTML5 video not blocked with placeholder, plays automatically

[Tor Bug Tracker & Wiki]

#19200: HTML5 video not blocked with placeholder, plays automatically
-------------------------------------------------+-------------------------
 Reporter:  potato                               |          Owner:  tbb-
     Type:  defect                               |  team
 Priority:  High                                 |         Status:
Component:  Applications/Tor Browser             |  needs_revision
 Severity:  Major                                |      Milestone:
 Keywords:  tbb-security-slider,                 |        Version:
  tbb-6.0-issues, GeorgKoppen201607,             |     Resolution:
  TorBrowserTeam201607                           |  Actual Points:
Parent ID:                                       |         Points:
 Reviewer:                                       |        Sponsor:
-------------------------------------------------+-------------------------
Changes (by gk):

 * cc: ma1 (added)
 * status:  needs_review => needs_revision
 * keywords:
     tbb-security-slider, tbb-6.0-issues, GeorgKoppen201607,
     TorBrowserTeam201607R
     =>
     tbb-security-slider, tbb-6.0-issues, GeorgKoppen201607,
     TorBrowserTeam201607


Comment:

 Replying to [comment:14 mcs]:
 > Replying to [comment:13 gk]:
 > > Upon further thought I wonder whether the approach in my patch is
 actually a good one. I mean we don't set `media.webm.enable` to `false`
 either to get WebM videos to adhere to click-to-play governed by NoScript.
 I fear we are essentially breaking MSEs on higher security level this way
 instead of making it click-to-play.
 >
 > So are you now thinking that the correct solution is to fix NoScript to
 work correctly when both noscript.forbidMedia and
 media.mediasource.enabled are set to true?

 Yes.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/19200#comment:15>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online