[Macintosh] MacScripter.net website problem

[Schmye Bubbula]

The MacScripter.net website for AppleScript aficionados has a special feature for forum posts in which one can put AppleScript code within tags that allow the reader to click a link that passes the code text to their default script editor app. For example, in this post, if you click the link, Open this Scriplet in your Editor, it will launch Apple Script Editor and insert the code in a new document.

My problem is that whenever NoScript is an enabled Firefox extension, even if I Allow Scripts Globally, the text that gets passed to Apple Script Editor has all its line breaks converted to space characters, and the script won't compile. The only way I could find to stop that behavior is if I disable the NoScript extension and re-launch Firefox without it.

Is there some NoScript pref option I'm missing?

Memo: Looking at a MacScripter.net forum thread's page source code, the scripts are in ecaped HTML form in the URLs embedded in the "Open this Scriplet in your Editor:" links, and they contain linefeeds rather than returns... maybe that's a hint:

Code: Select all

<a href="applescript://com.apple.scripteditor?action=new&script=%0A%E2%80%A6%0Aset%20outputFile%20to%20%28%28path%20to%20desktop%20as%20text%29%20%26%20%22LaunchAgent_Alert.txt%22%29%20--%20represents%20%22MacHD%3AUsers%3Adavid%3ADesktop%3ALaunchAgent_Alert.txt%22%0Atry%0A%09set%20fileReference%20to%20open%20for%20access%20file%20outputFile%20with%20write%20permission%0A%09write%20theBody%20to%20fileReference%0A%09close%20access%20fileReference%0Aon%20error%0A%09try%0A%09%09close%20access%20file%20outputFile%0A%09end%20try%0Aend%20try%0A">Open this Scriplet in your Editor</a>

[therube]

See what this might do for you:

Code: Select all

+ Added a "noscript.fixURI.exclude" about:config preference where
  protocols which should not be escaped by NoScript can be specified
  as a space-separated list

So add applescript to that pref & see if it helps.

[Schmye Bubbula]

Bingo! Wow... just wow. Thanks, therube! I'll post your solution over on the aforementioned MacScripters.net thread. I'm sure many Firefox AppleScripters who use NoScript will be most grateful.

about:config
noscript.fixURI.exclude | user set | string | applescript

So tell me, why does NoScript escape that - "fixURI" protocol, is it? - in the first place? Why is it needed? And why does it still do it even in what I would think is the most extreme case when Allow Scripts Globally is enabled? (I previously presumed that was tantamount to disabling NoScript completely, but I guess not.)

(This must be what it's all about. I'll Google around on "fix URI" some more.)

[Giorgio Maone]

(This must be what it's all about. I'll Google around on "fix URI" some more.)

Yes it is, and it's not the only instance of stuff like that happening.
Generally speaking, any application which register itself system-wide to handle URIs (e.g. a torrent client for magnet: URIs or a media player for mms: URIs) can be affected vulnerabilities like that, which may even allow remote code execution attacks.

[Schmye Bubbula]

So somebody explain to me... Until now I thought that the gross (dangerous) setting of NoScript's Allow Scripts Globally was like disabling it completely. But this fixURI thing kept happening even then, as well as when I whitelisted the website that invoked it. So is there an "on/off" switch in NoScript? (I was having to manually disable the extension completely and re-launch Firefox when I visited the AppleScript website until I learned of the about:config pref setting.)