NoScript restartless update breaks Security Slider and its icon disappears

added TorBrowserTeam201710 component::applications/tor browser noscript owner::tbb-team priority::high resolution::fixed severity::critical status::closed type::defect labels

This might be related to #23723 (moved) but that is unclear right now.

Repeating my comment:12:ticket:23718 here:

I tested updating Noscript to 5.1.1 both in Tor Browser 7.0.6 and 7.5a5 and while I saw the same error in the browser console I kept a working NoScript and the security slider was not messed up as comment:16 reports (and other users, too, on IRC). Thus, we have at least one additional bug that is causing this or could that somehow be a result of Tor Browser breaking the entity resolution? If so, how can I reproduce this?

I followed the steps in comment:22:ticket:23718 but could not reproduce it because a restart is required.

I wonder if that only happend when updating from a version with the new NoScript code to a newer one, like it happened from 5.1.0 to 5.1.1 while the problem is not visible when updating from the old code (e.g. 5.0.10) to 5.1.1 directly.

FWIW: it got reported that a restart gives functionality back (although the icon seems still to be replaced, now it's showing up on the right side next to the hamburger menu).

I wonder if that only happend when updating from a version with the new NoScript code to a newer one, like it happened from 5.1.0 to 5.1.1 while the problem is not visible when updating from the old code (e.g. 5.0.10) to 5.1.1 directly.

I bet it's that since from the NoScript changelog,

5.1.x is the first restartless NoScript desktop version

I wonder if that only happend when updating from a version with the new NoScript code to a newer one, like it happened from 5.1.0 to 5.1.1 while the problem is not visible when updating from the old code (e.g. 5.0.10) to 5.1.1 directly. comment 23 is the answer, 22 is by another cpunk. NoScript resets to its defaults, not TBB's!

Trac:
Summary: NoScript update breaks Security Slider and its icon disappears to NoScript restartless update breaks Security Slider and its icon disappears
Severity: Major to Critical
Keywords: N/A deleted, noscript added

Replying to cypherpunks:

I wonder if that only happend when updating from a version with the new NoScript code to a newer one, like it happened from 5.1.0 to 5.1.1 while the problem is not visible when updating from the old code (e.g. 5.0.10) to 5.1.1 directly. comment 23 is the answer, 22 is by another cpunk. NoScript resets to its defaults, not TBB's!

Yes. This results in e.g.

TypeError: ABE is undefined[Weitere Informationen]  ABE.js:1198:21
TypeError: WAN is undefined[Weitere Informationen]  ABE.js:1186:23

ma1: I just reproduced this with a clean new profile in a vanilla Firefox 52 ESR. This is no Tor Browser issue. Could you please look at that one before pushing a new NoScript update? Here are my steps to reproduce:

Create a new profile to be used with a Firefox 52 ESR
Copy a NoScript 5.0.10 into the extensions directory and start the browser with the new profile
NoScript should be ready, close the browser if so
Copy NoScript 5.1.0 over 5.0.10 and create a preferences folder in the profile directory + customize NoScript by copying https://gitweb.torproject.org/builders/tor-browser-bundle.git/tree/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js into it. That just flips some NoScript defaults
Restart and make sure it is working
Now, update to NoScript 5.1.1 (via the in-browser extension update means)
NoScript's prefs are reset and the errors in the browser console pop up
After restart it seems NoScript is working again as expected.

Trac:
Cc: ma1 to ma1, arthuredelstein

This madness was reported for 5.1rc2, but it was released untested! See https://forums.informaction.com/viewtopic.php?f=7&t=23333

After restart NoScript resets to TBB's defaults (Low), ignoring the Security Slider settings.

[10-04 08:01:29] Torbutton WARN: New Identity: Error clearing NoScript Temporary Permissions: [Exception... "Component returned failure code: 0x80570016 (NS_ERROR_XPC_GS_RETURNED_FAILURE) [nsIJSCID.getService]"  nsresult: "0x80570016 (NS_ERROR_XPC_GS_RETURNED_FAILURE)"  location: "JS frame :: chrome://torbutton/content/torbutton.js :: torbutton_do_new_identity :: line 1058"  data: no]

On Win 10 TBB 7.5a5 updates itself to 5.1.0 (why?) and icon doesn't appear after restart. Also

1507179043900	addons.xpi	WARN	Exception running bootstrap method shutdown on {73a6fe31-595d-460b-a920-fcc0f8843232}: TypeError: module.shutdown is not a function (re[/gre/modules/addons/XPIProvider.jsm](/gre/modules/addons/XPIProvider.jsm) -> jar:file:///C:/Tor%20Browser/Browser/TorBrowser/Data/Browser/profile.default/extensions/%7B73a6fe31-595d-460b-a920-fcc0f8843232%7D.xpi!/bootstrap.js:30:5) JS Stack trace: shutdown@bootstrap.js:30:5 < this.XPIProvider.callBootstrapMethod@XPIProvider.jsm:5041:9 < startInstall/<@XPIProvider.jsm:5932:15

Seems NoScript conflicts with other add-ons (calls their chrome.manifest), fails to move its file to /trash and so on...

#23776 (moved) is a duplicate.

Trac:
Cc: ma1, arthuredelstein to ma1, arthuredelstein, Dbryrtfbcbhgf

Just released rc2, which should partially fix this: preference overrides by Tor Browser (or any .js file in $PROFD/preferences/, for the matter) are honored now, per !comment:4.

I'm not sure this suffices, since some of the stuff showing up in the console seems (e.g. in !comment:7) due to the Tor customization machinery not expecting NoScript to be updated / disabled / re-enabled on the fly, and therefore references to objects from the previous instance becoming invalid.

Icon jumps to the right.

1507347423800	addons.xpi	DEBUG	Starting install of {73a6fe31-595d-460b-a920-fcc0f8843232} from https://addons.mozilla.org/firefox/downloads/latest-beta/noscript/addon-722-latest.xpi?src=ss
1507347423900	addons.xpi	DEBUG	Addon {73a6fe31-595d-460b-a920-fcc0f8843232} will be installed as a packed xpi
CustomizableUI:Widget 'noscript-tbb' not found, unable to move  CustomizableUI.jsm:1149

You start updating with removal of the tbb, and it has different id, correct?

1507347424100	addons.xpi	DEBUG	Calling bootstrap method shutdown on {73a6fe31-595d-460b-a920-fcc0f8843232} version 5.1.1
can't access dead object  WebExt.js:17

What are you trying to 'tell' here?

1507347424200	addons.xpi	DEBUG	Removing manifest for C:\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
Bootstrapped manifest not allowed to use 'component' directive.  chrome.manifest:60

Why does it call HTTPS-Everywhere's chrome.manifest?

1507347424500	addons.xpi	DEBUG	Install of https://addons.mozilla.org/firefox/downloads/latest-beta/noscript/addon-722-latest.xpi?src=ss completed.
No chrome package registered for chrome://noscript/locale/about.properties
1507347424600	addons.xpi	DEBUG	Registering manifest for C:\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi

Firefox wants better code.

1507347424600	addons.xpi	DEBUG	Calling bootstrap method startup on {73a6fe31-595d-460b-a920-fcc0f8843232} version 5.1.2rc2
TypeError: ABE is undefined[Learn More]  ABE.js:1198:21
TypeError: WAN is undefined[Learn More]  ABE.js:1186:23

Heh.

No matching message handler for the given recipient.  MessageChannel.jsm:621
Torbutton NOTE: Failed to update NoScript status for security setings: TypeError: win.noscriptOverlay is undefined
1507347425700	addons.webextension.{73a6fe31-595d-460b-a920-fcc0f8843232}	WARN	Loading extension '{73a6fe31-595d-460b-a920-fcc0f8843232}': Reading manifest: Error processing permissions.1: Unknown permission "privacy"
TypeError: Date is undefined[Learn More]  ClearClickHandler.js:318:9

So we have a short period of time with broken settings, and then

Torbutton INFO: Updated NoScript status for security settings

But why do we have ClearClick checkbox still selected?

Trac:
Status: new to needs_information

Replying to ma1:

Just released rc2, which should partially fix this: preference overrides by Tor Browser (or any .js file in $PROFD/preferences/, for the matter) are honored now, per !comment:4.

I'm not sure this suffices, since some of the stuff showing up in the console seems (e.g. in !comment:7) due to the Tor customization machinery not expecting NoScript to be updated / disabled / re-enabled on the fly, and therefore references to objects from the previous instance becoming invalid.

I see. I think if it's just that single issue that is still unsolved that's okay for now and we can try to fix that on our side. But it seems there still remain more things that are worrisome, see comment:11. For instance, we don't have ABE enabled and it seems there should not be any errors in the console regarding it. Furthermore, the icon should not jump to the right either I think. AFAICT that's not due to any interfering Torbutton/Tor Browser code and I was able to reproduce that in a clean Firefox 52ESR as well as outlined in comment:4.

(Note: I have not tested rc2 yet but just assumed that the issues the cypherpunk mentioned in comment:11 are indeed showing up when updating to rc2)

Replying to ma1:

Just released rc2, which should partially fix this: preference overrides by Tor Browser (or any .js file in $PROFD/preferences/, for the matter) are honored now, per !comment:4.

Okay, I followed my steps in a clean, new Firefox 52 ESR (just using 5.1.2rc1 and updating it to 5.1.2rc2). It seems the preferences are indeed honored, thanks. But there are still concerning things in the browser console visible:

No chrome package registered for chrome://noscript/locale/about.properties
TypeError: ABE is undefined  ABE.js:1198:21
TypeError: WAN is undefined  ABE.js:1186:23
TypeError: ABE is undefined  ABE.js:1198:21
TypeError: WAN is undefined  ABE.js:1186:23
TypeError: Ci is undefined  Main.js:138:1
TypeError: Date is undefined  ClearClickHandler.js:318:9

Those errors go away after a restart of the browser, though. If you look at the prefs file in comment:4 there are no special Tor Browser related ones in it. It's just NoScript configuration (disabling ABE etc.).

Trac:
Status: needs_information to needs_revision

With a clean Tor Browser, replacing the NoScript version we ship with 5.1.2rc1 before starting it with the first time works as expected, however the update results in the errors mentioned in comment:13 plus I see:

CustomizableUI:Widget 'noscript-tbb' not found, unable to move  CustomizableUI.jsm:1149

and the icon jumping to the right. On subsequent restarts I get

[Exception... "Failure"  nsresult: "0x80004005 (NS_ERROR_FAILURE)"  location: "JS frame :: chrome://noscript/content/Restartless.jsm?0.8314032359350465.1507411166800 :: loadIntoWindow :: line 193"  data: no]  (unknown)
Could not overlay chrome://browser/content/browser.xul  Restartless.jsm:224

.

Actually, I already see

noscript-tbb not found!
[Exception... "Failure"  nsresult: "0x80004005 (NS_ERROR_FAILURE)"  location: "JS frame :: chrome://noscript/content/Restartless.jsm?0.5651077320914104.1507411556800 :: loadIntoWindow :: line 166"  data: no]  (unknown)
Could not overlay chrome://browser/content/browser.xul  Restartless.jsm:197

before doing the update to 5.1.2rc2 just by copying 5.1.2rc1 over 5.0.10 before even starting the browser once. Interstingly, the icon is still on the left side as it should be in that case. It only moves to the right side next to the search bar with the update.

Please check https://addons.mozilla.org/en-US/firefox/addon/noscript/versions/5.1.2rc3

Notice that the HTTPS Everywhere manifest thing is unrelated to NoScript specifically (but maybe triggered by the restartless upgrade routine).

Replying to cypherpunks: ma1 keeps silence, so updating for rc3:

Icon jumps to the right. No jumping, but already broken TBB installations need a fixup.

1507347423800	addons.xpi	DEBUG	Starting install of {73a6fe31-595d-460b-a920-fcc0f8843232} from https://addons.mozilla.org/firefox/downloads/latest-beta/noscript/addon-722-latest.xpi?src=ss
1507347423900	addons.xpi	DEBUG	Addon {73a6fe31-595d-460b-a920-fcc0f8843232} will be installed as a packed xpi
CustomizableUI:Widget 'noscript-tbb' not found, unable to move  CustomizableUI.jsm:1149
}}}
You start updating with removal of the tbb, and it has different id, correct?

Patched.

{{{ 1507347424100 addons.xpi DEBUG Calling bootstrap method shutdown on {73a6fe31-595d-460b-a920-fcc0f8843232} version 5.1.1 can't access dead object WebExt.js:17 }}} What are you trying to 'tell' here? Still trying... {{{ 1507347424200 addons.xpi DEBUG Removing manifest for C:\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\extensions{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi Bootstrapped manifest not allowed to use 'component' directive. chrome.manifest:60 }}} Why does it call HTTPS-Everywhere's chrome.manifest? You say Firefox re-registering manifests after removal of one, right? {{{ 1507347424500 addons.xpi DEBUG Install of https://addons.mozilla.org/firefox/downloads/latest-beta/noscript/addon-722-latest.xpi?src=ss completed. No chrome package registered for chrome://noscript/locale/about.properties 1507347424600 addons.xpi DEBUG Registering manifest for C:\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\extensions{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi }}} Firefox wants better code. It wants registering addon first. {{{ No chrome package registered for chrome://noscript/skin/icon32.png

> ```
> 1507347424600	addons.xpi	DEBUG	Calling bootstrap method startup on {73a6fe31-595d-460b-a920-fcc0f8843232} version 5.1.2rc2
> TypeError: ABE is undefined[Learn More]  ABE.js:1198:21
> TypeError: WAN is undefined[Learn More]  ABE.js:1186:23
> }}}
> Heh.
Patched.
> {{{
> No matching message handler for the given recipient.  MessageChannel.jsm:621
> Torbutton NOTE: Failed to update NoScript status for security setings: TypeError: win.noscriptOverlay is undefined
> 1507347425700	addons.webextension.{73a6fe31-595d-460b-a920-fcc0f8843232}	WARN	Loading extension '{73a6fe31-595d-460b-a920-fcc0f8843232}': Reading manifest: Error processing permissions.1: Unknown permission "privacy"
> }}}
> So we have a short period of time with broken settings, and then
It's enough to break the Security Slider.
> {{{
> Torbutton INFO: Updated NoScript status for security settings
> }}}
> But why do we have ClearClick checkbox still selected?
Patched.
But why doesn't it honor Forbid A/V settings?

Unrelated issues:
{{{
06:51:47.366 TypeError: Cu is undefined 1 PasteHandler.jsm:16:3

Misc.

10:05:32.529 about:blank : Unable to run script because scripts are blocked internally. 1 (unknown)

Why does NoScript try to do that?

gk:

13:53:06.588 NoScript could not disable scripts for system global [System Principal] 1 WinScript.js:13:11

See ticket:20752#comment:2:

BTW, does the Tor Browser have its own customized mandatory whitelist? If so, you should add [System+Principal] (yes, with the "+" instead of " "), which is in NoScript's default and should fix half of the cases.

02:05:11.786 TypeError: overlayQueue is undefined 1 Restartless.jsm:134:5

Torbutton misses NoScript...

Replying to ma1:

Please check https://addons.mozilla.org/en-US/firefox/addon/noscript/versions/5.1.2rc3

Notice that the HTTPS Everywhere manifest thing is unrelated to NoScript specifically (but maybe triggered by the restartless upgrade routine).

This looks better, thanks. But I still get:

TypeError: ABE is undefined[Learn More]  ABE.js:1198:21
TypeError: WAN is undefined[Learn More]  ABE.js:1186:23
TypeError: ABE is undefined[Learn More]  ABE.js:1198:21
TypeError: WAN is undefined[Learn More]  ABE.js:1186:23
No matching message handler for the given recipient.  MessageChannel.jsm:621

in the browser console.

And the icon is still jumping to the right. Any idea why this one in particular is happening?

Replying to gk:

This looks better, thanks. But I still get: {{{ TypeError: ABE is undefined[Learn More] ABE.js:1198:21 TypeError: WAN is undefined[Learn More] ABE.js:1186:23 TypeError: ABE is undefined[Learn More] ABE.js:1198:21 TypeError: WAN is undefined[Learn More] ABE.js:1186:23 No matching message handler for the given recipient. MessageChannel.jsm:621 }}} in the browser console.

If you're installing over a previous restartless version (5.1.x) that's normal, noisy but no side effect, and nothing we can't do about it because those messages are from the previous instance. It shouldn't happen for new installations and/or upgrading / disabling+enabling over 5.1.2rc3 and above.

And the icon is still jumping to the right. Any idea why this one in particular is happening?

Again, if the icon has already "jumped" on the right there's nothing to do about it, because you cannot tell whether it happened because of a previous restartless version or becuase the user customized the position manually.

However it should not change the icon position from where it's found initially (e.g. if you install on a fresh Tor Browser it should stay on the left).

NoScript restartless update breaks Security Slider and its icon disappears

Child items 0

Activity