How do I know that a tor node won't give me malicious code?

Question

How can one avoid the following scenario?

One downloads an html from http://www.example.com. The exit tor node substitutes it with a malicious js file which will cause a buffer overflow or something and give the computer a virus.

Answer 1

@user But the exit node can block https, and unless HSTS is enabled, one will go to the "http" version (which is conveniently provided by the malicious exit node), and then again push a JS (or PNG/SVG/HTTP) exploit.

I know that it's not safe to use http over tor for any private information (login, etc.), but here, the exit node can push a virus directly from any page

Answer 2

Have a look at https://security.stackexchange.com/tags/man-in-the-middle/info.

The default solution is to make sure the website is accessed via HTTPS, or to check GPG signatures obtained from a trusted source.

As you asked about protocol downgrade attacks and HSTS: As of version 4.0.2, HTTPS Everywhere (which should be baked into the standard Tor-Browser-Bundle) includes a HTTP Nowhere mode, which should avoid this.

Additionally, using NoScript with a default policy of block combined with RequestPolicy might mitigate that attack.