Thrawn wrote:The XSS filter can sometimes become very slow, if there are very large numbers of suspicious requests. How long did you wait for it?
I did finally reproduce the problem in a
clean profile after going through the elimination process trying to find out which of my other addons might be interacting with NoScript in a copy of my full profile. It appears to be
Custom Buttons (CB).
I figured that maybe one of my many custom buttons might be the culprit since I couldn't reproduce the problem in a clean profile with only NoScript and CB because in that case there are no custom buttons defined. So I took my CB data base (the custombuttons directory within my full profile) and moved it into the clean profile. Thus I had a clean profile with only NoScript 2.9.5.1 and CB installed along with my full collection of custom buttons. Thus at this point all the buttons can be seen in the customize window because none of them have been placed on tool bars in the clean profile setup.
The "hang" reproduced in the clean profile with just NoScript 2.9.5.1 and CB and my full set of custom buttons. It is strange since none of the custom buttons are actually installed on tool bars so I would think none of their code should be executed. At any rate I went on the "hunt" deleting my custom buttons in this clean profile. The "hang" continued to reproduce but eventually I saw the Get Addons appear after a long delay.
On a hunch I deleted more of the buttons (remember none of them are actually active -- you can only see them in customize) and sure enough the Get Addons page started to appear when I clicked it with a shorter and shorter delay as I deleted more and more buttons. Just to check out that the "hang" was only a long delay I put back my full set of custom buttons (simply copy the custombuttons directory again from my full profile back into the clean profile I'm testing with). With the full set of my custom buttons I clicked the Get Addons and just left it alone. I didn't time it but I think the "hang" took over an hour to come up on my 3.33 GHz machine. But the point is the Get Addons page
did show up.
It looks to me that the length of the hang may be exponentially long as a function of the number of custom buttons I have defined. I really don't understand why an otherwise passive data base of button definitions (some of which are bookmarklets) should have any affect on NoScript, let alone its XSS sanitize option. Weird.
barbaz wrote:I can't reproduce this problem in Firefox 48.0.2...on Linux.
Please create a clean
profile from scratch. Install only NoScript
latest development build, leaving all the defaults.
Does the problem still exist?
If not, what if you then import your NS settings into the clean profile using the Import and Export buttons *on the very bottom* of NS Options?
See above for most of this. As for using the
latest development build I tried it as suggested. The problem could not be reproduced. But I am confused about this. The version on that development build is 2.9.0.14 which is the same number I was using prior to updating to 2.9.5.1. So is there any difference between that 2.9.0.14 development build and the 2.9.0.14 on AMO? If not of course I would expect it to work because I said 2.9.0.14 worked prior to updating to 2.9.5.1. If that dev build is diffferent and you simply haven't updated its version number yet, then great, whatever you did fixes the problem.
Note, if you want a copy of my custombuttons directory from my profile just let me know and where to send it.
[quote="Thrawn"]The XSS filter can sometimes become very slow, if there are very large numbers of suspicious requests. How long did you wait for it?[/quote]
I did finally reproduce the problem in a [u]clean profile[/u] after going through the elimination process trying to find out which of my other addons might be interacting with NoScript in a copy of my full profile. It appears to be [url=https://addons.mozilla.org/en-US/firefox/addon/custom-buttons/]Custom Buttons[/url] (CB).
I figured that maybe one of my many custom buttons might be the culprit since I couldn't reproduce the problem in a clean profile with only NoScript and CB because in that case there are no custom buttons defined. So I took my CB data base (the custombuttons directory within my full profile) and moved it into the clean profile. Thus I had a clean profile with only NoScript 2.9.5.1 and CB installed along with my full collection of custom buttons. Thus at this point all the buttons can be seen in the customize window because none of them have been placed on tool bars in the clean profile setup.
The "hang" reproduced in the clean profile with just NoScript 2.9.5.1 and CB and my full set of custom buttons. It is strange since none of the custom buttons are actually installed on tool bars so I would think none of their code should be executed. At any rate I went on the "hunt" deleting my custom buttons in this clean profile. The "hang" continued to reproduce but eventually I saw the Get Addons appear after a long delay.
On a hunch I deleted more of the buttons (remember none of them are actually active -- you can only see them in customize) and sure enough the Get Addons page started to appear when I clicked it with a shorter and shorter delay as I deleted more and more buttons. Just to check out that the "hang" was only a long delay I put back my full set of custom buttons (simply copy the custombuttons directory again from my full profile back into the clean profile I'm testing with). With the full set of my custom buttons I clicked the Get Addons and just left it alone. I didn't time it but I think the "hang" took over an hour to come up on my 3.33 GHz machine. But the point is the Get Addons page [b]did[/b] show up.
It looks to me that the length of the hang may be exponentially long as a function of the number of custom buttons I have defined. I really don't understand why an otherwise passive data base of button definitions (some of which are bookmarklets) should have any affect on NoScript, let alone its XSS sanitize option. Weird.
[quote="barbaz"]I can't reproduce this problem in Firefox 48.0.2...on Linux.
Please create a clean [url=http://kb.mozillazine.org/Profile]profile[/url] from scratch. Install only NoScript [url=https://noscript.net/getit#devel]latest development build[/url], leaving all the defaults.
Does the problem still exist?
If not, what if you then import your NS settings into the clean profile using the Import and Export buttons *on the very bottom* of NS Options?[/quote]
See above for most of this. As for using the [url=https://noscript.net/getit#devel]latest development build[/url] I tried it as suggested. The problem could not be reproduced. But I am confused about this. The version on that development build is 2.9.0.14 which is the same number I was using prior to updating to 2.9.5.1. So is there any difference between that 2.9.0.14 development build and the 2.9.0.14 on AMO? If not of course I would expect it to work because I said 2.9.0.14 worked prior to updating to 2.9.5.1. If that dev build is diffferent and you simply haven't updated its version number yet, then great, whatever you did fixes the problem.
Note, if you want a copy of my custombuttons directory from my profile just let me know and where to send it.