XSS examples not blocked by Noscript?

[al_9x]

Please check latest development build 2.1.8rc1

1. this should have a toggle or context pref
2. possibly exceptions
3. it double logs
4. logs when script domain is not whitelisted

[tlu]

Please check latest development build 2.1.8rc1

Thanks again! Those examples are indeed successfully blocked! (Somehow I was pretty sure that you would come up with a solution - you're really incredible )

[saywot]

Please check latest development build 2.1.8rc1

Confirmed. After AMO caught up with the version

[Giorgio Maone]

1. this should have a toggle or context pref
2. possibly exceptions
3. it double logs

Done/fixed in latest development build 2.1.8rc2

4. logs when script domain is not whitelisted

By design. You may want to know in advance if a site wants to engage in potentially hostile activities.

[al_9x]

1. this should have a toggle or context pref
2. possibly exceptions
3. it double logs

Done/fixed in latest development build 2.1.8rc2

This may not be very important, but I noticed in at least couple of places (rapidFireCheck, checkInclusions) that you check the pref at the last minute having done all the preparatory work for the feature in question. In general, I think it's a good idea for a toggle pref to completely bypass the codepath of the functionality it disables, since that could be the reason for and the benefit of disabling it.

[Giorgio Maone]

I think it's a good idea for a toggle pref to completely bypass the codepath of the functionality it disables, since that could be the reason for and the benefit of disabling it.

It's an optimization for the common case, since preference access (through XPCOM) is relatively expensive and these features are very unlikely to be turned off (hence it makes little sense to observe & cache yet another pref value).