Feature request:booklet script allow

[pjb]

I would like to run booklet's on pages that are not white listed.

booklet : bookmark eg : "Share on facebook"
Javascript:var%20d=document,f='http://www.new.facebook.com/share',l=d.location,e=encodeURIComponent,p='.php?src=bm&v=4&i=nnnnnnn&u='+e(l.href)+'&t='+e(d.title);1;try{if%20(!/^(.*\.)?facebook\.[^.]*$/.test(l.host))throw(0);share_internal_bookmarklet(p)}catch(z)%20{a=function()%20{if%20(!window.open(f+'r'+p,'sharer','toolbar=0,status=0,resizable=1,width=626,height=436'))l.href=f+p};if%20(/Firefox/.test(navigator.userAgent))setTimeout(a,0);else{a()}}void(0)

[Giorgio Maone]

It should work with latest development build, 1.9.2.93

[GµårÐïåñ]

confirmed, works fine.

[Lam]

I'm using 1.9.3.3 and a javascript bookmark I'm trying to use is not working unless I disable NoScript. Forbid bookmarklets in the Advanced tab is off. What am I doing wrong?

[Alan Baxter]

@Lam:
Please try again with the latest development build, NoScript 1.9.3.92. http://noscript.net/getit#devel
If you still have a problem, please provide more information, such as the bookmark code, its intended effect, and an example web page where the problem is encountered.

[therube]

I gather why facebook (or Readability) is now intended to work is because, execute trusted imported scripts (e.g. in the Readability bookmarklet).

Now just what is a "trusted imported script"?
And is it trusted where? Only in the context of the bookmarklet itself?
Does this apply for both bookmarklets & the equivalent extension (if one exists)?

Is the URL reference to the external website in the bookmarklet that would not work prior, but (theoretically) is working now?

Why does the facebook bookmarklet work (at least I do get a popup dialog), where Readability & Tidyread bookmarklets appear not to?

Readability:

Code: Select all

javascript:(function(){readStyle='style-newspaper';readSize='size-large';readMargin='margin-wide';_readability_script=document.createElement('SCRIPT');_readability_script.type='text/javascript';_readability_script.src='http://lab.arc90.com/experiments/readability/js/readability.js?x='+(Math.random());document.getElementsByTagName('head')[0].appendChild(_readability_script);_readability_css=document.createElement('LINK');_readability_css.rel='stylesheet';_readability_css.href='http://lab.arc90.com/experiments/readability/css/readability.css';_readability_css.type='text/css';_readability_css.media='screen';document.getElementsByTagName('head')[0].appendChild(_readability_css);_readability_print_css=document.createElement('LINK');_readability_print_css.rel='stylesheet';_readability_print_css.href='http://lab.arc90.com/experiments/readability/css/readability-print.css';_readability_print_css.media='print';_readability_print_css.type='text/css';document.getElementsByTagName('head')[0].appendChild(_readability_print_css);})();


Tidyread:

Code: Select all

javascript:(function(){var s=document.createElement(%22script%22);s.charset=%22UTF-8%22;s.language=%22javascript%22;s.type=%22text/javascript%22;s.src=%22http://www.tidyread.com/tidyread.js?u=%22+encodeURIComponent(document.location.href)+%22&t=%22+encodeURIComponent(document.title);document.body.appendChild(s)})();


[Giorgio Maone]

The latest reported issue is about Firefox 3.5 breaking (again) NoScript's bookmarklet emulation code.
It's fixed in 1.9.4 RC1.

Now just what is a "trusted imported script"?

It depends on the value of the bookmarklets.import about:config preference:

• 0 - no script gets imported during bookmarklet emulated execution
• 1 - scripts from trusted (whitelisted sites) get imported (default)
• 2 - any script added by the bookmarklet gets imported

And is it trusted where? Only in the context of the bookmarklet itself?

It's easier to say "when": during bookmarklet execution, in the page where the bookmarklet runs.

Does this apply for both bookmarklets & the equivalent extension (if one exists)?

Bookmarklets only.

Is the URL reference to the external website in the bookmarklet that would not work prior, but (theoretically) is working now?

Yes.

Why does the facebook bookmarklet work (at least I do get a popup dialog), where Readability & Tidyread bookmarklets appear not to?

Because you keep using Gecko 1.8
All the recent bookmarklet enhancements are for 1.9 and above.

[Lam]

Alan, Giorgio: Thank you for your replies, the 1.9.4 RC1 solved the problem!

[cewood]

I am currently using 1.9.4.3 and using a normal bookmarklet or via a ubiquity script neither is being allowed.

Is anyone else experiencing this behavior?


Application: Firefox 3.5b99 (20090605162636)
Operating System: WINNT (x86-msvc)

- NoScript 1.9.4.3
- Ubiquity 0.1.8

[therube]

NoScript Options | Advanced | Untrusted (tab) -> Forbid bookmarklets, deselected?

[GµårÐïåñ]

If the site is allowed (whitelisted) then the forbid bookmarklet on untrusted tab is moot and no longer asserted. Its not really asserted on untrusted sites either but provides error control.

[cewood]

I should have included that I had checked my options.

NoScript Options | Advanced | Untrusted (tab) -> Forbid bookmarklets, deselected?

Yes; I have this option deselected/disabled

If the site is allowed (whitelisted) then the forbid bookmarklet on untrusted tab is moot and no longer asserted. Its not really asserted on untrusted sites either but provides error control.

I have to disagree with that last part. If the site is allowed (whitelisted) bookmarklets work fine, however if the site is untrusted then no joy, and this behaviour is repeatable every time.

[Giorgio Maone]

I have to disagree with that last part. If the site is allowed (whitelisted) bookmarklets work fine, however if the site is untrusted then no joy, and this behaviour is repeatable every time.

Does it happen with every bookmarklet or a specific bookmarklet?
Could you show me one bookmarklet which fails to work?
(For the Ubiquity issue I'm afraid you should ask Ubiquity developers, since they are Mozilla Corp employees and should know how to make a script work on a script-forbidden page, if necessary and safe).

[cewood]

Does it happen with every bookmarklet or a specific bookmarklet?
Could you show me one bookmarklet which fails to work?
(For the Ubiquity issue I'm afraid you should ask Ubiquity developers, since they are Mozilla Corp employees and should know how to make a script work on a script-forbidden page, if necessary and safe).

It happens with all bookmarklets. I should note that using the NoScript Dev build on a 2.5.x install of Firefox works as expected, so I suspect this might be an issue with Firefox 3.5 again.


Two examples of bookmarklets which work if allowed, but are failing to work otherwise, are...

Code: Select all

javascript:%20var%20u%20=%20window.location.href;%20u%20=%20'http://digg.com/'%20+%20escape(u);%20window.location%20=%20u;

Code: Select all

javascript:(function(){var%20w=window;var%20d=document;var%20g=w.open('https://www.google.com/contacts/ui/ContactManager','gcontactsWin','location=no,menubar=no,scrollbars=no,status=no,toolbar=no,width=600,height=500,resizable');}).call({});";

[GµårÐïåñ]

You may disagree but the stated "technical" insight is correct. Try asking Giorgio why we don't have forbid bookmarklets for trusted sites too and maybe his response would clear it up for you what I meant.