Still not sure why the timing or plugin load order would have changed, but I figured out a workaround. Noscript stores its settings in .tb/tor-browser/Browser/TorBrowser/Data/Browser/profile.default/storage-sync.sqlite. Like you found, it loads these with default sites on first start. I dumped the sqlite DB at this point (attached as “defaultsqllite.txt”). I then toggled the slider to Safer and back to Safest to erase the list, and dumped the DB again (“cleansqlite.txt”). I then copied the clean storage-sync.sqlite to my whonix-ws-15 template and put it in /var/cache/tb-binary/.tb/tor-browser/Browser/TorBrowser/Data/Browser/profile.default. Starting DispVMs now has an empty list, because Noscript doesn’t think it is doing a first start.
To automate this, we could dump a clean storage-sync.sqlite blob into master, but that would be irritating to maintain and audit. Would it be too much bloat to create that .sqlite on the fly at startup, using the statements from the “clean” file minus the https-everywhere-eff lines? That plugin should be able to initialize itself. The remaining statements may need occasional updates for new versions of Firefox or Noscript, but their internal upgrade logic should be able to interpret old data until the version difference gets too large.
Looks like it will only let me upload pictures here, not .txt. Should we take it to an issue?
Here are the relevant “default” lines anyways:
INSERT INTO collection_data VALUES('default/{73a6fe31-595d-460b-a920-fcc0f8843232}','key-policy','{"id":"key-policy","key":"policy","data":{"DEFAULT":{"capabilities":["frame","fetch","other"],"temp":false},"TRUSTED":{"capabilities":["script","object","media","frame","font","webgl","fetch","other"],"temp":false},"UNTRUSTED":{"capabilities":[],"temp":false},"sites":{"trusted":["§:addons.mozilla.org","§:afx.ms","§:ajax.aspnetcdn.com","§:ajax.googleapis.com","§:bootstrapcdn.com","§:code.jquery.com","§:firstdata.com","§:firstdata.lv","§:gfx.ms","§:google.com","§:googlevideo.com","§:gstatic.com","§:hotmail.com","§:live.com","§:live.net","§:maps.googleapis.com","§:mozilla.net","§:netflix.com","§:nflxext.com","§:nflximg.com","§:nflxvideo.net","§:noscript.net","§:outlook.com","§:passport.com","§:passport.net","§:passportimages.com","§:paypal.com","§:paypalobjects.com","§:securecode.com","§:securesuite.net","§:sfx.ms","§:tinymce.cachefly.net","§:wlxrs.com","§:yahoo.com","§:yahooapis.com","§:yimg.com","§:youtube.com","§:ytimg.com"],"untrusted":[],"custom":{}},"enforced":true,"autoAllowTop":false},"_status":"created"}');
And “clean”:
INSERT INTO collection_data VALUES('default/{73a6fe31-595d-460b-a920-fcc0f8843232}','key-sync','{"id":"key-sync","key":"sync","data":{"global":false,"xss":true,"cascadeRestrictions":true,"overrideTorBrowserPolicy":false,"clearclick":true,"storage":"sync"},"_status":"created"}');
INSERT INTO collection_data VALUES('default/{73a6fe31-595d-460b-a920-fcc0f8843232}','key-policy','{"id":"key-policy","key":"policy","data":{"DEFAULT":{"capabilities":["frame","other"],"temp":false},"TRUSTED":{"capabilities":["fetch","font","frame","media","object","other","script","webgl"],"temp":false},"UNTRUSTED":{"capabilities":["frame"],"temp":false},"sites":{"trusted":[],"untrusted":[],"custom":{}},"enforced":true,"autoAllowTop":false},"_status":"created"}');