Opening multiple tabs with XSS enabled consistently fails to load specific tabs

Post a reply

Smilies
:D :) ;) :( :o :shock: :? 8-) :lol: :x :P :oops: :cry: :evil: :twisted: :roll: :!: :?: :idea: :arrow: :| :mrgreen: :geek: :ugeek:

BBCode is ON
[img] is ON
[url] is ON
Smilies are ON

Topic review
   

Expand view Topic review: Opening multiple tabs with XSS enabled consistently fails to load specific tabs

Re: Opening multiple tabs with XSS enabled consistently fails to load specific tabs

by Guest » Mon Sep 14, 2020 12:06 pm

Okay, thank you for the update.

Notify me in this thread if additional information is needed to recreate the issue. I'm keeping track of the thread.

Thank you once again!

Re: Opening multiple tabs with XSS enabled consistently fails to load specific tabs

by Giorgio Maone » Sat Sep 12, 2020 7:24 pm

Guest wrote: Sat Sep 12, 2020 6:46 am Has this issue been abandoned?
No, it's not abandoned.
Your information is very good to work on it, but I'm afraid it will take time because it's quite a complex issue and also a not so common use case.

Re: Opening multiple tabs with XSS enabled consistently fails to load specific tabs

by Guest » Sat Sep 12, 2020 6:46 am

Hello again,

Has this issue been abandoned?

Is there anything else I could do? Record the process?

Re: Opening multiple tabs with XSS enabled consistently fails to load specific tabs

by guest2 » Sat Sep 05, 2020 7:16 pm

Hello again!

Additional information.

I've have recreated the same issue on my Linux box on a new profile. I used the same procedure as I described in the previous post. I'm now certain that it's a combination of Firefox Multi-Account Container add-on, NoScript and perhaps the use of Close Tabs to the Right feature. It all sounds so strange :)

These are the bookmarks that I execute in a bookmarks folder after Firefox starts:

Code: Select all

Tried to paste the urls here but I cant without triggering the antispam filter. You can just do this:
any 3 youtube links
any 5 subreddits
First time all tabs load.

I then close them by right clicking on the original tab (the tab prior to the tab that becomes active after loading the bookmarks) and selecting Close Mutliple Tabs > Close Tabs to the Right

I then execute the bookmark folder again and the youtube links load but the rest do not.

Thank you again and I hope you are having a nice weekend!

Re: Opening multiple tabs with XSS enabled consistently fails to load specific tabs

by Guest » Fri Sep 04, 2020 9:30 pm

First off, thank you for taking your time trying to recreate the problem!

Secondly, I just want to say thank you for this great add-on! I have been using NoScript since its origin. It's always the first add-on that I install on a fresh Firefox install. Always!


Back to the issue at hand. I've tried to recreate the problem in a new Firefox 80.0.1 profile by installing NoScript from the addons.mozilla.org and I couldn't recreate the problem like you couldn't. I then returned to my original profile, installed the development version and it pretty much behaves in the same manner by failing to load all of the pages. Again I looked at the console log just out of curiosity and I got some new messages but I suspect that I just missed those "new" ones when I was using the Stable version. One of these messages mention something about a container:

Code: Select all

Unchecked lastError value: Error: ID already exists: remove-open-in-this-container	ExtensionCommon.jsm:764
Unchecked lastError value: Error: ID already exists: separator				ExtensionCommon.jsm:764
Unchecked lastError value: Error: ID already exists: hide-container			ExtensionCommon.jsm:764
Unchecked lastError value: Error: ID already exists: move-to-new-window-container	ExtensionCommon.jsm:764
Unchecked lastError value: Error: ID already exists: remove-open-in-this-container	ExtensionCommon.jsm:764
Unchecked lastError value: Error: ID already exists: separator				ExtensionCommon.jsm:764
Unchecked lastError value: Error: ID already exists: hide-container			ExtensionCommon.jsm:764
Unchecked lastError value: Error: ID already exists: move-to-new-window-container	ExtensionCommon.jsm:764
...
...
So I disabled the Firefox Multi-Account Containers add-on temporarily and now all of the bookmarks could load fine, just like in the fresh profile. I now remembered that 4 of the websites in my bookmarks folder are YouTube channels that automatically load in their own container. So now that the Firefox Multi-Account Containers is disabled, the websites load fine but now I can see a new message in the console which is XSS related (including it, just in case):

Code: Select all

[NoScript] XSS filter processing  
Object { unparsedRequest: {…}, srcUrl: "https://www.reddit.com/r/blender/", destUrl: "https://www.redditmedia.com/gtm/jail?id=GTM-5XVNS82", srcObj: {…}, destObj: {…}, srcOrigin: "https://www.reddit.com", destOrigin: "https://www.redditmedia.com", srcDomain: "reddit.com", destDomain: "redditmedia.com", originKey: "https://www.reddit.com>https://www.redditmedia.com", … }
 Error: Timing: request interrupted while being filtered, no need to go on.
    onNavError moz-extension://abfa3820-9995-4dda-baef-6ad353402e2c/xss/XSS.js:286
 Timing: request interrupted while being filtered, no need to go on. onNavError@moz-extension://abfa3820-9995-4dda-baef-6ad353402e2c/xss/XSS.js:286:20
Just out of curiosity, I went back to try to recreate the problem in a new fresh profile:

1. Created a new Firefox profile
2. Installed NoScript (left on default settings) and Firefox Multi-Account Containers from addons.mozilla.org
3. Open youtube.com, click the Multi-Account Container icon > Always Open This Site in... > Pick any container
4. Open a new regular tab, load youtube.com and confirm the Multi-Account Container message to always open youtube.com in the assigned container, ie: [x] Remember my decision for this site
5. Added a couple of YouTube bookmarks to a bookmarks folder, and some random sites, including some subreddits
6. Restarted Firefox (seems to be necessary after the containers are setup) with the new profile
7. Execute the bookmark folder content (middle mouse button), and again, the subreddit tabs failed to load and the other random websites sometimes load other times they don't
8. I also repeat the process in the same session by closing all of the tabs with the Close Tabs to the Right feature and re-execute the bookmarks folder and it all repeats itself with youtube sites always loading and the rest of the websites sometimes load and sometimes not

I'm so tired right now. Not sure if this makes any sense at all. But maybe you can replicate it now?

My Firefox version is 80.0.1

Re: Opening multiple tabs with XSS enabled consistently fails to load specific tabs

by Giorgio Maone » Fri Sep 04, 2020 6:32 pm

I'm sorry, I've tried to reproduce by creating a bookmarks folder with 9 random pages, 4 of which where subreddits, and opening all at once.
I've also tried various permutations of the bookmarks, hoping that shuffling the loading order would trigger the issue, but nothing.
Could you please provide me with the exact ordered list of the URLs in that bookmark folder?
Does the problem persist even in a clean profile with just NoScript installed?
Which Firefox version?

Also, regarding the message you got in the console, that's likely unrelated, but I've fixed the source which could cause other potential problems.
Just in case, could you check whether if latest development build actually fixes your issues as well? Thanks!
v 11.0.42rc8
============================================================
x Avoid useless "seen" reports from onBeforeRequest()
x Catch broadcast messaging errors
x Make build.sh tag push even already created tags

Re: Opening multiple tabs with XSS enabled consistently fails to load specific tabs

by Giorgio Maone » Fri Sep 04, 2020 5:36 pm

Thank you very much for your report and your follow-up information.
I'm investigating...

Re: Opening multiple tabs with XSS enabled consistently fails to load specific tabs

by Guest » Fri Sep 04, 2020 11:20 am

Additional info:
In:

Code: Select all

about:debugging > This Firefox > NoScript > Inspect > Console
I have 40+ rows of the following message in red color:

Code: Select all

Uncaught (in promise) Error: Could not establish connection. Receiving end does not exist.
And in each and every one of those messages, I have the following information:

Code: Select all

    send moz-extension://05041585-d6b5-4963-8668-8a75b7782bfe/lib/Messages.js:70
    AsyncFunctionThrow self-hosted:688
    (Async: async)
    reportTo moz-extension://05041585-d6b5-4963-8668-8a75b7782bfe/bg/RequestGuard.js:249
    AsyncFunctionNext self-hosted:684
    (Async: async)
    onBeforeRequest moz-extension://05041585-d6b5-4963-8668-8a75b7782bfe/bg/RequestGuard.js:370
    apply self-hosted:2654
    applySafeWithoutClone resource://gre/modules/ExtensionCommon.jsm:613
    fire resource://gre/modules/ExtensionChild.jsm:806
    recvRunListener resource://gre/modules/ExtensionChild.jsm:810
    recvRunListener self-hosted:1171
    _recv resource://gre/modules/ConduitsChild.jsm:78
    receiveMessage resource://gre/modules/ConduitsChild.jsm:169
    run resource://gre/modules/ConduitsChild.jsm:160
    receiveMessage resource://gre/modules/ConduitsChild.jsm:161
    map self-hosted:231
    receiveMessage resource://gre/modules/ConduitsChild.jsm:161

Opening multiple tabs with XSS enabled consistently fails to load specific tabs

by tempaccount » Fri Sep 04, 2020 6:39 am

Hello!

With "Sanitize cross-site suspicious requests" enabled and opening multiple tabs (9) from a bookmark directory always fails to load certain websites. The small dot indicator on the tab just keeps going back and forth forever.

I have tried the following without any success:

1. Pressing "Clear XSS Choices" button
2. "Reset" button to reset NoScript to its default settings

When I disable "Sanitize cross-site suspicious requests" the websites always load.

The sites that never load are:
- https://www.reddit.com/r/blender/, https://old.reddit.com/r/linux/, etc. pretty much any reddit.com website.
- blendernation.com

Here is the tricky part. When I have a bookmark folder with only reddit websites, then they always load. It seems that it's necessary for one reddit website to start loading only then does the rest start working.

Anyone?

Top