Repository: freedomofpress/securedrop

Issue:
Source Interface instructions contain broken/bad URL
When a Source follows the instructions to bump up the Security Slider settings in Tor Browser, we provide rationale for why, and include two links:

* https://www.wired.com/threatlevel/2013/09/freedom-hosting-fbi
* https://www.theguardian.com/world/interactive/2013/oct/04/egotistical-giraffe-nsa-tor-document

The second link is broken. It returns an HTTP 200, but the document it's linking to is not displayed. At first glance it appears to be a mixed content/CSP error, in which case we could contact TG folks to correct it. Maybe it's simpler to find different coverage and link to that.


Discussion:
See also https://github.com/freedomofpress/securedrop/issues/1475 (read the follow-up comments too).
Looking into this a bit deeper, it appears that `/howto-disable-js` is dead code and as such we should just remove the entire page. An explanation follows.

## Source uses Tor Browser with JS enabled

Currently the user flow on the source interface as follows:

1. Source is using Tor Browser but does not have the Tor security slider set to high. They see this page indicating how to set it to high:

![screen shot 2017-06-06 at 10 08 43 am](https://user-images.githubusercontent.com/7832803/26842036-4dcde0e4-4aa0-11e7-8dd9-09e0dfe03454.png)

2. Source clicks "Learn how to set it to high"
3. If a source is using Tor Browser, then `is_likely_tor_browser()` in `source.js` is True, and following the logic in `source.js` the default browser behavior of following that link will not occur (due to the `return false` on line 42).
4. Instead, a bubble will appear providing easy instructions on how to turn the security slider to high:

![screen shot 2017-06-06 at 10 08 47 am](https://user-images.githubusercontent.com/7832803/26842303-2fe98776-4aa1-11e7-8799-8100ece788b4.png)

## Source uses Tor Browser with JS disabled

If a source has JS disabled, then the purple bar will not be shown, as the top code stanza in `source.js` that displays the bar will not execute. 

## Source is not using Tor Browser

If a source is not using Tor Browser, they cannot access the hidden service. If they use Tor2Web to access it anyway, we flash a warning telling them they are not anonymous. Asking them to disable JS or turn the security slider to high is irrelevant at this stage. 

## tl;dr

The source never sees `/howto-disable-js`, a search through the SecureDrop document tree indicates that it is not linked to anywhere, and we should remove this dead code. 

Resolving patch:
diff --git a/securedrop/source.py b/securedrop/source.py
--- a/securedrop/source.py
+++ b/securedrop/source.py
@@ -400,16 +400,16 @@ def logout():
     return redirect(url_for('index'))
 
 
-@app.route('/howto-disable-js')
-def howto_disable_js():
-    return render_template("howto-disable-js.html")
-
-
 @app.route('/tor2web-warning')
 def tor2web_warning():
     return render_template("tor2web-warning.html")
 
 
+@app.route('/use-tor')
+def recommend_tor_browser():
+    return render_template("use-tor-browser.html")
+
+
 @app.route('/journalist-key')
 def download_journalist_pubkey():
     journalist_pubkey = crypto_util.gpg.export_keys(config.JOURNALIST_KEY)


Test patch:
diff --git a/securedrop/tests/functional/test_source_warnings.py b/securedrop/tests/functional/test_source_warnings.py
new file mode 100644
--- /dev/null
+++ b/securedrop/tests/functional/test_source_warnings.py
@@ -0,0 +1,25 @@
+from selenium import webdriver
+import unittest
+
+import source_navigation_steps
+import functional_test
+
+
+class SourceInterfaceBannerWarnings(
+        unittest.TestCase,
+        functional_test.FunctionalTest,
+        source_navigation_steps.SourceNavigationSteps):
+
+    def setUp(self):
+        functional_test.FunctionalTest.setUp(self)
+
+    def tearDown(self):
+        functional_test.FunctionalTest.tearDown(self)
+
+    def test_warning_appears_if_tor_browser_not_in_use(self):
+        self.driver.get(self.source_location)
+
+        warning_banner = self.driver.find_element_by_class_name('use-tor-browser')
+
+        self.assertIn("We recommend using Tor Browser to access SecureDrop",
+                      warning_banner.text)
diff --git a/securedrop/tests/test_source.py b/securedrop/tests/test_source.py
--- a/securedrop/tests/test_source.py
+++ b/securedrop/tests/test_source.py
@@ -277,17 +277,16 @@ def test_tor2web_warning(self):
         self.assertEqual(resp.status_code, 200)
         self.assertIn("Why is there a warning about Tor2Web?", resp.data)
 
+    def test_why_use_tor_browser(self):
+        resp = self.client.get('/use-tor')
+        self.assertEqual(resp.status_code, 200)
+        self.assertIn("You Should Use Tor Browser", resp.data)
+
     def test_why_journalist_key(self):
         resp = self.client.get('/why-journalist-key')
         self.assertEqual(resp.status_code, 200)
         self.assertIn("Why download the journalist's public key?", resp.data)
 
-    def test_howto_disable_js(self):
-        resp = self.client.get('/howto-disable-js')
-        self.assertEqual(resp.status_code, 200)
-        self.assertIn("Turn the Security Slider to High to Protect Your "
-                      "Anonymity", resp.data)
-
     def test_metadata_route(self):
         resp = self.client.get('/metadata')
         self.assertEqual(resp.status_code, 200)