Repository: freedomofpress/securedrop

Issue:
Remove NoScript workaround instructions from Source Interface
In #4153, we introduced instructions to the Source Interface for working around a NoScript/Firefox issue which causes some uploads to fail. The upstream NoScript issue (closed as a Firefox issue is being pinpointed as the root cause) is https://github.com/hackademix/noscript/issues/64; the best candidate for the underlying Firefox issue appears to be: https://bugzilla.mozilla.org/show_bug.cgi?id=1506562

These instructions are cumbersome and the upstream issue will hopefully be resolved ASAP. We'll need to continue to monitor upstream and remove the instructions once a fix has landed in the latest releases of Tor Browser Bundle & Tails.


Discussion:
I've filed https://bugzilla.mozilla.org/show_bug.cgi?id=1532530 for additional follow-up.
Is this Issue more of a "to do" for once the issue has been fixed on the Mozilla/NS end?
Yes, exactly. Hence the "blocked" label, which I'll remove once the upstream issue is fixed and the fix can be expected to reach most Tor browser users by the time of the next SecureDrop release milestone.
See tbb-dev thread [Firefox/NoScript bug with major downstream effects](https://lists.torproject.org/pipermail/tbb-dev/2019-March/thread.html#970) for discussion with Tor browser developers, as well.
Upstream Tor browser issue proposing to change the default, & discussion: https://trac.torproject.org/projects/tor/ticket/29733
The NoScript fix is included in Tor 8.0.8 (released March 21) so we should be able to revert the warning potentially for 0.12.2, pending QA:

https://blog.torproject.org/new-release-tor-browser-808

Resolving patch:
diff --git a/securedrop/source_app/info.py b/securedrop/source_app/info.py
--- a/securedrop/source_app/info.py
+++ b/securedrop/source_app/info.py
@@ -7,10 +7,6 @@
 def make_blueprint(config):
     view = Blueprint('info', __name__)
 
-    @view.route('/disable-noscript-xss')
-    def disable_noscript_xss():
-        return render_template("disable-noscript-xss.html")
-
     @view.route('/tor2web-warning')
     def tor2web_warning():
         return render_template("tor2web-warning.html")


Test patch:
diff --git a/securedrop/tests/functional/source_navigation_steps.py b/securedrop/tests/functional/source_navigation_steps.py
--- a/securedrop/tests/functional/source_navigation_steps.py
+++ b/securedrop/tests/functional/source_navigation_steps.py
@@ -223,9 +223,6 @@ def _source_tor2web_warning(self):
     def _source_why_journalist_key(self):
         self.driver.get(self.source_location + "/why-journalist-key")
 
-    def _source_disable_noscript_xss(self):
-        self.driver.get(self.source_location + "/disable-noscript-xss")
-
     def _source_waits_for_session_to_timeout(self, session_length_minutes):
         time.sleep(session_length_minutes * 60 + 0.1)
 
diff --git a/securedrop/tests/functional/test_source.py b/securedrop/tests/functional/test_source.py
--- a/securedrop/tests/functional/test_source.py
+++ b/securedrop/tests/functional/test_source.py
@@ -17,6 +17,3 @@ def test_lookup_codename_hint(self):
         self._source_chooses_to_login()
         self._source_proceeds_to_login()
         self._source_sees_no_codename()
-
-    def test_disable_noscript_xss(self):
-        self._source_disable_noscript_xss()
diff --git a/securedrop/tests/test_source.py b/securedrop/tests/test_source.py
--- a/securedrop/tests/test_source.py
+++ b/securedrop/tests/test_source.py
@@ -516,14 +516,6 @@ def test_why_journalist_key(source_app):
         assert "Why download the journalist's public key?" in text
 
 
-def test_disable_noscript_xss(source_app):
-    with source_app.test_client() as app:
-        resp = app.get(url_for('info.disable_noscript_xss'))
-        assert resp.status_code == 200
-        text = resp.data.decode('utf-8')
-        assert "<h1>Turn off NoScript's cross-site request sanitization setting</h1>" in text
-
-
 def test_metadata_route(source_app):
     with patch.object(source_app_api.platform, "linux_distribution") as mocked_platform:
         mocked_platform.return_value = ("Ubuntu", "16.04", "xenial")