Security issues with codes embedded in clearnet websites or Zites (it would be useful to have a own closed ZeroNet Tor browser)

Step 1: Please describe your environment

• ZeroNet version: 0.7.1 (rev 4496)
• Operating system: Windows 10
• Web browser: Firefox 79.0
• Tor status: not available/always/disabled
• Opened port: No

Step 2: Describe the problem:

Security issue with particularly HTML scripts when the user visit a clearnet website, or a zite contain a HTML script they may leak sensitive information about the user. The problem lies in communicating with external sites. One problem is that possible to scan what zites a user stores on their machine. And possible to detect the IP address too using a simple HTML script. If the user use TOR browser to access ZeroNet service and allow the localhost access to ZeroNet. Then this access works through it as well. A lot thing is leaking through the browser. Involuntarily if someone copy a website from clearnet it may contain dangerous codes which can leak unwanted things about users to third parties. Not a good idea to allow localhost access in Tor browser because it is not only used for ZeroNet. The other problem is ZeroNet open Firefox browser and not the Tor browser.

Steps to reproduce:

http://127.0.0.1:43110/1ScanCY9fjmjanDt7NwvyNQCL16hqWnVM/

There are pages in ZeroNet that can be visited to extract the user's IP address with a simple HTML script.

Zites can communicate externial clearnet sites using simple HTML scripts without the user's knowledge.

Expected Results:

In TOR always mode more security:

A special browser would also be useful which would only work with ZeroNet. And this browser would launch ZeroNet. Could be a TOR browser modified for zeronet and connect the zeronet TOR network. And prevents IP address leakage. Allow only the localhost communication excluding the fact that security can be circumvented through the browser. And to rule out all access to ZeroNet through all another browsers. The default TOR browser is not a good solution, it opens a gate to ZeroNet since it is not only used the user for ZeroNet. It could be a noscript option which could be disabled for advanced users any unnecessary scripts. Currently, blocking scripts blocks the entire software. This could be a much safer way if someone use TOR always mode.

Start with the reproduction URL and the described ZeroNet localhost access through Firefox or Tor Browser. Trace how HTML scripts in Zites communicate with clearnet sites and expose stored Zites or the user's IP. Done requires a defined, tested security boundary that prevents the reported leakage without disabling ZeroNet use.