InformAction Forums

Thanks for the replies. @therube I see the pdfjs.enableScripting pref in FF 87, so I tried toggling that to true and testing that PDF, but couldn't get the script to work? @Giorgio Can NoScript tell whether a page it can't control is pdf.js? If so, should the NoScript popup on FF 88+ recommend setti...

From FF 88 release notes -

https://www.mozilla.org/en-US/firefox/88.0beta/releasenotes/ wrote:We keep on working on improving our PDF forms support and now support JavaScript embedded in PDF files (some PDF forms use JavaScript for validation and other interactive features).

Does NoScript control this JS or will it be able to?

I didn't reply because I don't use Android, so I have no idea on this one, sorry.

I like "unchecked-css" :) It's the most descriptive and technically accurate. I would still suggest formulating it more like "no-check-css" or "skip-check-css", because this is not about an inherent property of the CSS in general, it's about whether NoScript should not run its mitigation. (alternate...

Thanks Giorgio for the explanation. I've updated the sticky. Two things: 1) "csspp0" is not the best name for this capability IMO. No one who knows what CSS PP0 is would want to explicitly allow it. And every other capability controls what's served by the site, while this one is aimed at what can be...

Fixed in 11.2.5rc1. Thanks!

Fixed, thanks

On update this capability is un-checked for DEFAULT/UNTRUSTED but checked for TRUSTED. Does the box being checked mean (somewhat confusingly) that CSS PP0 is NOT mitigated? Does this capability control whether the mitigation is active when visiting the site? Or does it control whether the mitigation...

In your FAQ you write about ABE, but i cannot see any ABE panel inside Options -> Advanced... is there something i'm missing? That FAQ was written for NoScript Classic, which is no longer supported. NoScript Webext does not have ABE yet. Also is there a way to have encryption for white-black domain...

Firefox 87.0 NoScript 11.2.4rc5 Feed Preview 12 new profile STR: 1) install NoScript, Feed Preview 2) visit any RSS feed on any site set to DEFAULT permission - e.g. visit noscript.net/feed and set noscript.net to DEFAULT With noscript.net (or whatever site hosting the feed) set to DEFAULT, the page...

+1 for this as a troubleshooting tool.

Does that element contain any blocked content, e.g. a video?

Can you work around this with a Stylus style for the specific site?

script - JavaScript, e.g. <script> tags object - plugin objects media - HTML5 audio/video frame - subdocuments, e.g. <frame> and <iframe> font - remote fonts webgl - WebGL fetch - whether other sites can make XMLHttpRequest and Fetch request to this site ping - destination of navigator.sendBeacon an...

Clicking this link trips the XSS filter - https://valadoc.org/gtk+-3.0/Gtk.Window.set_title.html#! NoScript detected a potential Cross-Site Scripting attack from https://forums.informaction.com to https://valadoc.org. Suspicious data: (URL) https://valadoc.org/gtk+-3.0/Gtk.Window.set_title.html#! Bu...

Only if you don't allow script from the sites hosting the focus-tracking scripts.