I'm getting persistent warning on every Tor start: 'plugin container via firefox trying to access "{...}.xpi file". Is it normal?

Question

I'm using TorBrowser 7.0.10 on macOS 10.12.6. I have "Little Flocker" application installed which warns me every time an App is trying to access some file. Every time I start TorBrowser I get the warning about the following application is trying to access the following file:

Filename: /Users/XXX/Library/Application Support/TorBrowser-Data/Browser/pdf1dcp3.default/extension/{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi

Application path: /Applications/TorBrowser.app/Contents/MacOS/plugin-container.app/Contents/MacOS/plugin-container (1146)

Codesign Identity: Developer ID Application: The Tor Project, Inc (MADPSAYN6T)

This warning survived multiple TorBrowser updates.

I tried both allowing and denying this file access with Little Flocker. I can't tell what's the difference in consequent browsing experience.

Is this normal behavior or sign of a bug or malware presence? Shell I allow this file access forever?

On a side note: is there a way I can attach images (screenshots for example) and other files to my posts here?

Thanks for helping out. Cheers!

Answer 1

Yes, this is normal.

The .xpi file extension is the format for Firefox/Mozilla extensions.

The .xpi file is a .zip file which contains resources for the extension, normally just some javascript/html/css files and other resources it might need, like image files.

In this case, {73a6fe31-595d-460b-a920-fcc0f8843232}.xpi is the NoScript extension that is bundled with Tor Browser. The file is extracted from the .app on installation to the user profile under ~/Library/Application Support/TorBrowser-Data/.

It's not an indicator of malware or any malicious activity.