BUG: NS10 interferes with accessibility.blockautorefresh

Bug reports and enhancement requests

BUG: NS10 interferes with accessibility.blockautorefresh

Postby tom1 » Fri Feb 09, 2018 8:23 pm

NoScript 10.1.6.4
Firefox 58.0.1

Steps to reproduce:
1. Set in about:config "accessibility.blockautorefresh" to "true"
2. Go to a website that redirects e.g. https://duckduckgo.com/?q=firefox

With NoScript disabled Firefox displays a warning, but with NoScript enabled the page redirects.
Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:52.0) Gecko/20100101 Firefox/52.0
tom1
 
Posts: 2
Joined: Fri Feb 09, 2018 8:02 pm

Re: BUG: NS10 interferes with accessibility.blockautorefresh

Postby geek99 » Sat Feb 10, 2018 2:25 am

I followed the steps provided by tom1, and got a slightly different result ...

NoScript 10.1.6.5
Firefox 58.0.2

First, I verified that "accessibility.blockautorefresh" was set to "true".

Then, with NoScript enabled, I navigated to: https://duckduckgo.com/?q=firefox

I saw a page briefly appear on the screen, then I saw the DuckDuckGo search results page.

I followed the same steps, and pressed the "Print Screen" key while the first page briefly appeared. The captured page said this:

Ignore this box please.
DuckDuckGo
firefox X S

You are being redirected to the non-JavaScript site.

Click here if it doesn't happen automatically.


I then disabled NoScript (using Firefox's add-on manager), and again navigated to: https://duckduckgo.com/?q=firefox


The only difference was that (with NoScript disabled) I did not see the first page briefly appear ... I immediately saw the DuckDuckGo search results page.

Hope this helps diagnose this issue.
Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:58.0) Gecko/20100101 Firefox/58.0
geek99
Junior Member
 
Posts: 20
Joined: Wed Dec 13, 2017 12:36 am

Re: BUG: NS10 interferes with accessibility.blockautorefresh

Postby tom1 » Sat Feb 10, 2018 8:59 am

I checked again (on a new Firefox profile) and I think it's because I originally had uMatrix disable JavaScript on duckduckgo.com.
With JavaScript enabled I got the results that geek99 got, but with
1) either uMatrix or setting javascript.enabled to false in about:config; and
2) NoScript disabled
Firefox displays "Firefox prevented this page from automatically redirecting to another page" and the page doesn't redirect to the HTML site, whereas with NoScript enabled the page does redirect.
Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:52.0) Gecko/20100101 Firefox/52.0
tom1
 
Posts: 2
Joined: Fri Feb 09, 2018 8:02 pm

Re: BUG: NS10 interferes with accessibility.blockautorefresh

Postby skriptimaahinen » Sat Feb 10, 2018 11:46 am

Can confirm. The redirect seems to be due to meta refresh inside noscript-tag.

For the Firefox's redirect blocking to work (shows redirect warning), you need to have:

1) javascript.enabled; false
2) accessibility.blockautorefresh; true
3) NoScript disabled or has the "script" allowed for the page

Regardless of the state of "javascript.enabled", if NoScript has "script" disabled for the page, no redirect warning is shown and the redirect happens automatically.
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:58.0) Gecko/20100101 Firefox/58.0
skriptimaahinen
Senior Member
 
Posts: 120
Joined: Wed Jan 10, 2018 7:37 am

Re: BUG: NS10 interferes with accessibility.blockautorefresh

Postby skriptimaahinen » Sat Feb 10, 2018 1:38 pm

Well, looks like this is another case of intended behaviour.

Code: Select all
  if (!canScript) {
    for (let noscript of document.querySelectorAll("noscript")) {
      // force show NOSCRIPT elements content
      let replacement = document.createElement("div");
      replacement.innerHTML = noscript.innerHTML;
      noscript.parentNode.replaceChild(replacement, noscript);
      // emulate meta-refresh
      let meta = replacement.querySelector('meta[http-equiv="refresh"]');
      if (meta) {
        let content = meta.getAttribute("content");
        if (content) {
          let [secs, url] = content.split(/\s*;\s*url\s*=\s*/i);
          if (url) {
            try {
              let urlObj = new URL(url);
              if (!/^https?:/.test(urlObj.protocol)) {
                continue;
              }
            } catch (e) {
            }
            window.setTimeout(() => location.href = url, (parseInt(secs) || 0) * 1000);
          }
        }
      }
    }
  }

However, quick testing shows that the meta redirect works even without the timer. Is this block of code even needed?

In any case, I hope there is a way to bring back the redirect warning.
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:58.0) Gecko/20100101 Firefox/58.0
skriptimaahinen
Senior Member
 
Posts: 120
Joined: Wed Jan 10, 2018 7:37 am

Re: BUG: NS10 interferes with accessibility.blockautorefresh

Postby Giorgio Maone » Wed Nov 07, 2018 5:48 pm

skriptimaahinen wrote:Well, looks like this is another case of intended behaviour.

In any case, I hope there is a way to bring back the redirect warning.

I've tried some approaches in the last few hours and I concluded there's no way for a WebExtension to "organically" emulate a meta refresh in a way that could be intercepted by Firefox's optional blocking.
Therefore I'm afraid the only thing I can do is emulating the blocking notification myself (in content, ouch!) and put it behind a separate NoScript options, since I cannot access the built-in Firefox one :(
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:64.0) Gecko/20100101 Firefox/64.0
User avatar
Giorgio Maone
Site Admin
 
Posts: 8634
Joined: Wed Mar 18, 2009 11:22 pm
Location: Palermo - Italy


Return to NoScript Development

Who is online

Users browsing this forum: No registered users and 6 guests