How to enable restrictSubdocScripting in NoScript 10?

Post a reply


In an effort to prevent automatic submissions, we require that you complete the following challenge.
Smilies
:D :) ;) :( :o :shock: :? 8-) :lol: :x :P :oops: :cry: :evil: :twisted: :roll: :!: :?: :idea: :arrow: :| :mrgreen: :geek: :ugeek:

BBCode is ON
[img] is ON
[flash] is OFF
[url] is ON
Smilies are ON

Topic review
   

Expand view Topic review: How to enable restrictSubdocScripting in NoScript 10?

Re: How to enable restrictSubdocScripting in NoScript 10?

by musonius » Fri Aug 23, 2019 5:42 am

jawz101 wrote:
Fri Aug 23, 2019 3:39 am
To me this sounds like a looser policy. I would rather a subdocuments' permissions be granted or restricted separately. If I allow script/frame/images/fonts/etc on a primary page that doesn't necessarily mean I want to allow them on a subdocument. Right?
No. It's not about inheriting permissions to subdocuments, it's about inheriting restrictions to subdocuments. For example, if you do not allow 'media' for the first party domain, 'media' won't be allowed for any subdocument (not even for those for which you have allowed 'media').

Re: How to enable restrictSubdocScripting in NoScript 10?

by jawz101 » Fri Aug 23, 2019 3:39 am

I still don't understand this pref. So you are saying checked would mean it is a stricter policy?

"Cascade top document's restrictions to subdocuments"

To me this sounds like a looser policy. I would rather a subdocuments' permissions be granted or restricted separately. If I allow script/frame/images/fonts/etc on a primary page that doesn't necessarily mean I want to allow them on a subdocument. Right?

What stinks is there is absolutely no explanation what this preference is for except that it is for the TOR project. Even so, does that imply the TOR project would want this pref checked or not?

It's dumb.

Re: How to enable restrictSubdocScripting in NoScript 10?

by barbaz » Wed Jun 12, 2019 12:55 am

Ok found it: NoScript Options > General > "Cascade top document's restrictions to subdocuments"

IMO that is somewhat misleading wording. It implies that, for example, if a Trusted page embeds a Default frame, the frame would automatically become Trusted. The actual effect is more like "Block subdocuments from having more permissions than their top document".

How to enable restrictSubdocScripting in NoScript 10?

by barbaz » Sun Jun 09, 2019 5:37 pm

According to viewtopic.php?f=7&t=25395 this feature has already been ported. But in my NoScript 10.6.3rc7 on Waterfox 68, it's disabled. How to enable restrictSubdocScripting?

Top