Opened 7 weeks ago

Last modified 7 weeks ago

#32225 new defect

Saving whole web pages broken on "Safest" security setting on Tor Browser 9.0

Reported by: 7TR0Or Owned by: tbb-team
Priority: Medium Milestone:
Component: Applications/Tor Browser Version:
Severity: Normal Keywords: tbb-9.0-issues, tbb-9.0.1-can, tbb-regression, GeorgKoppen201910, noscript
Cc: ma1 Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

When saving pages using the "Save page as" dialog, the download fails immediately after starting and is displayed as "failed" in the download panel. The page still seems to be saved correctly. So far, I've only tested 9.0 (based on Mozilla Firefox 68.2.0esr) (64-bit) on Windows 10.

Child Tickets

Change History (9)

comment:1 Changed 7 weeks ago by gk

Keywords: tbb-9.0-issues added; downloads removed
Status: newneeds_information

So, that's a particular issue on the "Safest" level and the other levels are not showing the bug?

comment:2 Changed 7 weeks ago by Thorin

I just tested each slider setting (Win7 here) by saving the TZP page. On standard and safer, everything is successful. Files download, the download indicator finishes and shows success, files are intact and properly named, and the now local files load and run just fine.

On Safest, the download fails, indicator has a yellow dot on it. The downloaded files are not all there etc, the failure also stops at some point where temp file names are used. Loading the local files will fail miserably.

Edit: nothing in the console, except 47 errors for (not sure if that's specific to TZP)

Content Security Policy: The page’s settings blocked the loading of a resource at inline (“script-src”). 49 TorZillaPrint.html

---

On Safest I loaded https://www.example.com/ and saved without issues, so I guess it depends on the content

Last edited 7 weeks ago by Thorin (previous) (diff)

comment:3 Changed 7 weeks ago by 7TR0Or

Example.com is the first site I encountered where downloading works correctly on safest. It's also the first page I tested where no additional _files folder was created. Maybe the error is related to that.

comment:4 Changed 7 weeks ago by gk

Keywords: tbb-9.0.1-can added
Status: needs_informationnew

Seen on a Linux box, too.

comment:5 Changed 7 weeks ago by gk

Keywords: tbb-regression added

comment:6 Changed 7 weeks ago by gk

Keywords: GeorgKoppen201910 added

Okay, let's track that one down.

comment:7 Changed 7 weeks ago by Thorin

The problem does not exist if you disable NoScript, so I guess we better call in ma1

comment:8 in reply to:  7 ; Changed 7 weeks ago by gk

Cc: ma1 added
Keywords: noscript added

Replying to Thorin:

The problem does not exist if you disable NoScript, so I guess we better call in ma1

Yeah, I can see this happening with a clean vanilla Firefox 68 ESR and NoScript installed. If I configure NoScript the same way as we do in the Safest settings I hit the bug in Firefox, too.

So, it seems to be a NoScript issue then. ma1: what do you think?

comment:9 in reply to:  8 Changed 7 weeks ago by ma1

Replying to gk:

So, it seems to be a NoScript issue then. ma1: what do you think?

Not NoScript specific, affecting any content blocker:
https://bugzilla.mozilla.org/show_bug.cgi?id=1445211

(notice that you can, indeed, complete the download by hitting the retry button in the download manager popup).

Last edited 7 weeks ago by ma1 (previous) (diff)
Note: See TracTickets for help on using tickets.