Seen with NoScript 10.1.5.3 in Firefox 57.0.1 on Windows 10.
The following page malfunctions when every listed domain is marked trusted, but it works fine when Scripts Globally Allowed is checked:
http://www.tumbex.com/tumblr/space-wallpapers/photo
This happens because NoScript never shows domain tumblr.com — but it should be shown, so that it can be marked trusted to make the page work. If I change the DEFAULT scope checkboxes to enable everything and reload the page, then the popup lists tumbler.com so it can be marked trusted. The nature of the malfunction is that the page redirects to a custom "404" page instead of showing pictures.
Using the legacy NoScript, this doesn't happen, because tumblr.com is listed on the Recently Blocked Sites sub-menu, where it can be marked trusted.
Hope this helps track down the root cause. Let me know if I can provide any more information.
--
Fran
Bug (10.1.5.3): site broken with everything trusted
Bug (10.1.5.3): site broken with everything trusted
Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0
Re: Bug (10.1.5.3): site broken with everything trusted
Not a bug. That is how the site is designed.
*Always* check the changelogs BEFORE updating that important software!
-
Re: Bug (10.1.5.3): site broken with everything trusted
Yet legacy NoScript is able to see the request to tumblr.com and include that domain in the Recently Blocked Sites list. Shouldn't NoScript 10 add tumblr.com to the popup when it sees the request?barbaz wrote:Not a bug. That is how the site is designed.
Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0
Re: Bug (10.1.5.3): site broken with everything trusted
No, and this is why not - https://forums.informaction.com/viewtop ... 813#p38813
What you are asking is to bring back Recently Blocked Sites in NoScript 10.
What you are asking is to bring back Recently Blocked Sites in NoScript 10.
*Always* check the changelogs BEFORE updating that important software!
-
Re: Bug (10.1.5.3): site broken with everything trusted
Putting aside the Recently Blocked Sites menu, I think the bug is this: NoScript blocks a request without showing the domain of the blocked request in the popup. Because the blocked domain is not shown, I cannot decide to trust it to make the page work. Yet NoScript shows the blocked domain when I check every checkbox in the Default scope and reload. This allows me to trust that domain and thus make the page work.barbaz wrote:No, and this is why not - https://forums.informaction.com/viewtop ... 813#p38813
What you are asking is to bring back Recently Blocked Sites in NoScript 10.
Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0
Re: Bug (10.1.5.3): site broken with everything trusted
Again, that is how the site is designed. The tumblr.com script is dynamically loaded by other scripts, and if it fails it dumps you on the 404 page. And the 404 page does not load any scripts from tumblr.com.
Again, this is not a NoScript bug.
Again, this is not a NoScript bug.
*Always* check the changelogs BEFORE updating that important software!
-
Re: Bug (10.1.5.3): site broken with everything trusted
I'm willing to accept your analysis that this is not a bug. Is NoScript is supposed to show all domains from which content/scripts/etc are fetched when loading a page? If so, this is an example of a page where NoScript blocks content from a domain but never shows that domain in the popup. That seems counter-intuitive.
Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0
Re: Bug (10.1.5.3): site broken with everything trusted
Exactly, it's supposed to show all domains from which content/scripts/etc ARE fetched (or blocked). When loading that page with scripts disabled, the tumblr.com script DOES NOT EXIST. It has not been fetched and it has not been blocked. Because it would be added BY THE PAGE'S SCRIPTS, but you are blocking those scripts, so it doesn't get added, see?FranL wrote:Is NoScript is supposed to show all domains from which content/scripts/etc are fetched when loading a page?
Yeah, but WHEN should NoScript be showing tumblr.com in the popup? Well, the answer is, when does that script exist on the current page? In the split-second between when the site tries to load the tumblr.com script and when it redirects to the 404 page, that's when.FranL wrote:If so, this is an example of a page where NoScript blocks content from a domain but never shows that domain in the popup. That seems counter-intuitive.
Do you understand now why the answer is to bring back Recently Blocked Sites?
*Always* check the changelogs BEFORE updating that important software!
-
Re: Bug (10.1.5.3): site broken with everything trusted
That makes sense. If I press Escape quickly enough — before the main page has a chance to redirect to the 404 page — NoScript will show ...tumblr.com, giving me the opportunity to mark it trusted. So NoScript is working as expected. The rapid redirect to a different page (with no scripts on it) was the issue.barbaz wrote:Yeah, but WHEN should NoScript be showing tumblr.com in the popup? Well, the answer is, when does that script exist on the current page? In the split-second between when the site tries to load the tumblr.com script and when it redirects to the 404 page, that's when.
Thanks, barbaz, for helping me understand this.
Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0
Re: Bug (10.1.5.3): site broken with everything trusted
You're welcome.
*Always* check the changelogs BEFORE updating that important software!
-