Bug (10.1.5.3): site broken with everything trusted

[FranL]

Seen with NoScript 10.1.5.3 in Firefox 57.0.1 on Windows 10.

The following page malfunctions when every listed domain is marked trusted, but it works fine when Scripts Globally Allowed is checked:

http://www.tumbex.com/tumblr/space-wallpapers/photo

This happens because NoScript never shows domain tumblr.com — but it should be shown, so that it can be marked trusted to make the page work. If I change the DEFAULT scope checkboxes to enable everything and reload the page, then the popup lists tumbler.com so it can be marked trusted. The nature of the malfunction is that the page redirects to a custom "404" page instead of showing pictures.

Using the legacy NoScript, this doesn't happen, because tumblr.com is listed on the Recently Blocked Sites sub-menu, where it can be marked trusted.

Hope this helps track down the root cause. Let me know if I can provide any more information.
--
Fran

[barbaz]

Not a bug. That is how the site is designed.

[FranL]

Not a bug. That is how the site is designed.

Yet legacy NoScript is able to see the request to tumblr.com and include that domain in the Recently Blocked Sites list. Shouldn't NoScript 10 add tumblr.com to the popup when it sees the request?

[barbaz]

No, and this is why not - https://forums.informaction.com/viewtop ... 813#p38813

What you are asking is to bring back Recently Blocked Sites in NoScript 10.

[FranL]

No, and this is why not - https://forums.informaction.com/viewtop ... 813#p38813

What you are asking is to bring back Recently Blocked Sites in NoScript 10.

Putting aside the Recently Blocked Sites menu, I think the bug is this: NoScript blocks a request without showing the domain of the blocked request in the popup. Because the blocked domain is not shown, I cannot decide to trust it to make the page work. Yet NoScript shows the blocked domain when I check every checkbox in the Default scope and reload. This allows me to trust that domain and thus make the page work.

[barbaz]

Again, that is how the site is designed. The tumblr.com script is dynamically loaded by other scripts, and if it fails it dumps you on the 404 page. And the 404 page does not load any scripts from tumblr.com.

Again, this is not a NoScript bug.

[FranL]

I'm willing to accept your analysis that this is not a bug. Is NoScript is supposed to show all domains from which content/scripts/etc are fetched when loading a page? If so, this is an example of a page where NoScript blocks content from a domain but never shows that domain in the popup. That seems counter-intuitive.

[barbaz]

Is NoScript is supposed to show all domains from which content/scripts/etc are fetched when loading a page?

Exactly, it's supposed to show all domains from which content/scripts/etc ARE fetched (or blocked). When loading that page with scripts disabled, the tumblr.com script DOES NOT EXIST. It has not been fetched and it has not been blocked. Because it would be added BY THE PAGE'S SCRIPTS, but you are blocking those scripts, so it doesn't get added, see?

If so, this is an example of a page where NoScript blocks content from a domain but never shows that domain in the popup. That seems counter-intuitive.

Yeah, but WHEN should NoScript be showing tumblr.com in the popup? Well, the answer is, when does that script exist on the current page? In the split-second between when the site tries to load the tumblr.com script and when it redirects to the 404 page, that's when.

Do you understand now why the answer is to bring back Recently Blocked Sites?

[FranL]

Yeah, but WHEN should NoScript be showing tumblr.com in the popup? Well, the answer is, when does that script exist on the current page? In the split-second between when the site tries to load the tumblr.com script and when it redirects to the 404 page, that's when.

That makes sense. If I press Escape quickly enough — before the main page has a chance to redirect to the 404 page — NoScript will show ...tumblr.com, giving me the opportunity to mark it trusted. So NoScript is working as expected. The rapid redirect to a different page (with no scripts on it) was the issue.

Thanks, barbaz, for helping me understand this.

[barbaz]

You're welcome.