[tor-bugs] #23747 [Applications/Tor Browser]: "Temporarily allow all this page" breaks JS on all other tabs

[Tor Bug Tracker & Wiki]

#23747: "Temporarily allow all this page" breaks JS on all other tabs
--------------------------------------+--------------------------------
 Reporter:  cypherpunks               |          Owner:  tbb-team
     Type:  defect                    |         Status:  needs_revision
 Priority:  High                      |      Milestone:
Component:  Applications/Tor Browser  |        Version:
 Severity:  Major                     |     Resolution:
 Keywords:  noscript                  |  Actual Points:
Parent ID:                            |         Points:
 Reviewer:                            |        Sponsor:
--------------------------------------+--------------------------------

Comment (by cypherpunks):

 Replying to [comment:9 ma1]:
 > Replying to [comment:8 cypherpunks]:
 >
 >
 >
 > > > No. It turns out temporarily allowed page wasn't reloaded at that
 moment (a bug too), and this is critical for testing this issue. Reloading
 of the allowed page leads to JS breakage on other tabs with rc7 and after
 restart too.
 >
 > It's not what I can see here (BTW, please switch to
 [https://noscript.net/getit#devel rc8], just released with more lifecycle-
 related fixes).
 Another STR = another results (BTW, public repo can't be updated so
 quickly ;)
 > My test, meant to exclude "confounding factors":
 Hmm...
 >  1. Install NoScript 5.1.2rc8 over a "stock" Tor Browser, set the
 Security Slider to "High" and restart the browser
 "stock" Tor Browser has "bundled" NoScript. Do you mean to replace it
 before the first run? There are many scenarios to get rc8, but let's
 assume that it's enough to update any previous version with it, restart
 and then set the Security Slider to "Medium" (to ensure it updates rc8
 settings).
 >  1. Open https://maone.net/ in a new tab
 >  1. Open https://noscript.net/ in a new tab, then on this tab use
 "Temporarily allow all this page"
 >  1. With this tab still active, open a Scratchpad (shift+F4) and run the
 following scriptlet:
 > {{{
 >  document.body.innerHTML=`<button onclick="alert('JS
 Active')">test</button>`
 > }}}
 > This will make a [Test] button appear on the noscript.net page: if you
 click, a "JS Active" alert should be shown as long as Javascript is
 enabled there
 > 5. Go back to the maone.net tab, and use "Temporarily allow all". Watch
 the page autoreload. You can also "Forbid maone.net" and repeat as many
 time as you want.
 That's the reason why it works: JS breaks on non-temporarily allowed sites
 only.
 > 6. Switch to the noscript.net tab and hit the button to verify
 Javascript is still enabled
 Confirmed.

 FWIW: `about:debugging#addons` has a great feature "Load Temporarily Add-
 on" for on-the-fly patching/debugging of bootstrapped extensions.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/23747#comment:10>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online