Bug Report: NoScript Blocking postMessage()

Bug reports and enhancement requests
Post Reply
srt19170
Posts: 2
Joined: Thu Dec 01, 2016 11:59 pm

Bug Report: NoScript Blocking postMessage()

Post by srt19170 »

I'm the author of the Rsstler extension for Firefox. My extension creates a chrome: page and within that page, iframes use postMessage to pass information back to the parent page:

Code: Select all

<html>
<head><style type='text/css'>img {max-width: 100%;}</style></head>
<body onload=" parent.postMessage('iframe6:'+document.body.scrollHeight, '*');">
    [ Various HTML deleted ]
</body>
</html>
As of 2.9.5.1?, NoScript broke this functionality, and I started to see "Permission denied to access property 'postMessage'" error messages in the browser console.

With some playing around, I figured out that the "Block every object coming from a site marked as untrusted" option is the problem. Turning this off in at least an early version of 2.9.5.2 allows the postMessage() to complete. Turning it off in the latest version RC5 still blocks the postMessage(). "chrome:" is in the whitelist and is presumably a trusted site, so I'm not sure why NoScript would be blocking postMessage().

Please let me know if I can provide any other information. If NoScript is blocking Javascript within chrome: pages I suspect this may be causing problems with other extensions as well.
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:50.0) Gecko/20100101 Firefox/50.0
Post Reply