Two Bugs related to clicking NoScript icon before page loads

Bug reports and enhancement requests
Post Reply
geek99
Junior Member
Posts: 20
Joined: Wed Dec 13, 2017 12:36 am

Two Bugs related to clicking NoScript icon before page loads

Post by geek99 » Mon Dec 18, 2017 1:04 am

BUGs in Noscript.

NoScript v10.1.5.9 (these bugs have also appeared in earlier versions)
Firefox v 57.0.2
Windows 7

The bugs show themselves in two ways, but I think both ways
are timing related.

The FIRST way the bug shows itself is when I navigate to a site
that only has a few scripts (such as hackademix.net).
Before the site is completely loaded,
if I quickly single click the NoScript icon in the Firefox bookmarks bar,
instead of the expected dropdown appearing with permissions for various URLs,
I get a dropdown with the message "In order to operate on this tab,
NoScript needs to reload it. Proceed?" There are OK and Cancel buttons.

The bug does not occur every time, but I can usually make it happen
once out of 10 tries. Navigate to page, click Firefox reload icon, then
quickly single click the NoScript icon (before the page loads and dropdown appears).



The SECOND way the bug shows itself is when I navigate to a site
that has many scripts and takes many seconds to load.
While the site is loading, if I quickly click
the NoScript icon in the Firefox bookmarks bar MULTIPLE TIMES,
then instead of getting a dropdown (showing URLs),
I will get the contents of the dropdown in a separate window
(with re-sizable frame, title bar, and min/max/close icons
on the right side of the title bar).

This window is independent of the Firefox window,
and it can be moved, re-sized, covered by other windows,
shows up in the Windows taskbar, and will remain open when
the Firefox window is closed). The title bar says:
mox-extension://d05b5c18-27f3 ... ef30 - NoScript Settings - Mozilla Firefox

Sometimes client part of this window shows the list of permissions (URLs), and sometimes
that part is blank. The client portion of the window has the usual
NoScript close, reload, and options icons in the upper left,
and the Revoke Temporary and Temporarily Allow icons
in the upper right.

The bug does not occur every time, but I can usually make it happen once
out of 10 tries. While navigated to a desired page (with many scripts that takes
several seconds to load) ... first click the Firefox reload icon, then click
the NoScript icon multiple times while Firefox shows that the page is
being loaded (reload icon has changed to X). Note that sometimes the separate
window will appear "on top" and be quickly visible, and sometimes the separate window
is "under" the Firefox window. You may have to check the Windows taskbar,
or minimize Firefox, to see if the separate window exists.



Again, my guess is that these two bugs are caused by a timing issue that occurs when
the user clicks the NoScript icon before the page is fully loaded.

Suggested solution: disable (grey out) the NoScript icon while
the page is being loaded, and re-enable the icon once the page
has been fully loaded. In that way, if a user mistakenly clicks the
NoScript icon while the page is being loaded, it will have no effect.

If it is not possible to disable the NoScript icon while page is being loaded,
then perhaps you can disable mouse/keyboard input while page is being loaded?


Can anyone else reproduce these bugs?
Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0

barbaz
Senior Member
Posts: 9268
Joined: Sat Aug 03, 2013 5:45 pm

Re: Two Bugs related to clicking NoScript icon before page l

Post by barbaz » Mon Dec 18, 2017 1:17 am

geek99 wrote:when I navigate to a site
that only has a few scripts (such as hackademix.net).
Before the site is completely loaded,
if I quickly single click the NoScript icon in the Firefox bookmarks bar,
instead of the expected dropdown appearing with permissions for various URLs,
I get a dropdown with the message "In order to operate on this tab,
NoScript needs to reload it. Proceed?" There are OK and Cancel buttons.
I can confirm this one. These steps seem to consistently reproduce it, starting from a clean profile -

1) go to https://noscript.net/getit, install NoScript

2) open the NoScript popup

3) close the NoScript popup by clicking outside it

4) click the "what is it?" link on the open noscript.net/getit page

5) Before it finishes loading, open the NoScript popup.

Closing and re-opening the NoScript popup brings it back to normal.
*Always* check the changelogs BEFORE updating that important software!
-

barbaz
Senior Member
Posts: 9268
Joined: Sat Aug 03, 2013 5:45 pm

Re: Two Bugs related to clicking NoScript icon before page l

Post by barbaz » Mon Dec 18, 2017 1:21 am

geek99 wrote:if I quickly click
the NoScript icon in the Firefox bookmarks bar MULTIPLE TIMES,
then instead of getting a dropdown (showing URLs),
I will get the contents of the dropdown in a separate window
(with re-sizable frame, title bar, and min/max/close icons
on the right side of the title bar).

This window is independent of the Firefox window,
and it can be moved, re-sized, covered by other windows,
shows up in the Windows taskbar, and will remain open when
the Firefox window is closed). The title bar says:
mox-extension://d05b5c18-27f3 ... ef30 - NoScript Settings - Mozilla Firefox
Can confirm this as well. Page doesn't have to be loading to reproduce this. If you rapid-fire click the NoScript icon quickly enough, for long enough, it'll open that window.

When the window is blank, re-sizing it makes it fill with the contents of the NoScript popup.
*Always* check the changelogs BEFORE updating that important software!
-

Tomatix
Senior Member
Posts: 60
Joined: Tue Dec 05, 2017 3:05 pm

Re: Two Bugs related to clicking NoScript icon before page l

Post by Tomatix » Mon Dec 18, 2017 12:51 pm

barbaz wrote:
geek99 wrote: I get a dropdown with the message "In order to operate on this tab,
NoScript needs to reload it. Proceed?" There are OK and Cancel buttons.
I can confirm this one. These steps seem to consistently reproduce it, starting from a clean profile -

1) go to https://noscript.net/getit, install NoScript

2) open the NoScript popup

3) close the NoScript popup by clicking outside it

4) click the "what is it?" link on the open noscript.net/getit page

5) Before it finishes loading, open the NoScript popup.

Closing and re-opening the NoScript popup brings it back to normal.
Couldn't try on noscript.net, loading was too fast. Could reproduce on https://www.amazon.com/
I don't really see a bug here. Doesn't this message simply indicate, that loading hasn't finished/failed?
Last edited by Tomatix on Mon Dec 18, 2017 8:27 pm, edited 1 time in total.
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:57.0) Gecko/20100101 Firefox/57.0

barbaz
Senior Member
Posts: 9268
Joined: Sat Aug 03, 2013 5:45 pm

Re: Two Bugs related to clicking NoScript icon before page l

Post by barbaz » Mon Dec 18, 2017 4:21 pm

Tomatix wrote:In don't really see a bug here. Doesn't this message simply indicate, that loading hasn't finished/failed?
No. That message is supposed to be shown for existing tabs when NoScript is first installed. NoScript wasn't installed when those tabs were loaded, so it could not operate on those tabs. So it shows the message.

Now, surely NoScript *is* operating on a partially-loaded page, isn't it? Because if it wasn't, bypassing NoScript would only require loading a script quickly enough. Clearly that would be absurd for a security tool. So NoScript shouldn't be showing that message.

That is the bug here.
*Always* check the changelogs BEFORE updating that important software!
-

Tomatix
Senior Member
Posts: 60
Joined: Tue Dec 05, 2017 3:05 pm

Re: Two Bugs related to clicking NoScript icon before page l

Post by Tomatix » Tue Dec 19, 2017 2:59 pm

barbaz wrote: No. That message is supposed to be shown for existing tabs when NoScript is first installed. NoScript wasn't installed when those tabs were loaded, so it could not operate on those tabs. So it shows the message.
Yes, I think so too.
barbaz wrote: Now, surely NoScript *is* operating on a partially-loaded page, isn't it? Because if it wasn't, bypassing NoScript would only require loading a script quickly enough. Clearly that would be absurd for a security tool. So NoScript shouldn't be showing that message.
Misunderstanding: I never meant that NS is not operating on a partially-loaded page = meaning letting scripts execute unfiltered.
I thought the dialog was some sort of warning, when NS thinks that screening of the page code shows faults f.i. code missing (= clicking in the middle of page loading) or no content at all (= old tabs before install).
In order to operate on this tab, NoScript needs to reload it. Proceed?
But reading it again closely makes me think as well, that it means operate it the first time instead of operate+show it correctly. Thanks. :)


It seems, that it occurs, when
* everything is on DEFAULT for the page (as you said: fresh install)
and
* the script counter shows nothing (0) for the page
Could be that's how NS determines/d, if the tab was already processed.

Actually in my test with 10.1.6 this dialog isn't shown anymore after NS install or reactivation on already open tabs.
Automatically just screens the "unoperated" tabs htmls?

EDIT: highlighted some words
Last edited by Tomatix on Thu Dec 21, 2017 7:12 pm, edited 1 time in total.
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:57.0) Gecko/20100101 Firefox/57.0

geek99
Junior Member
Posts: 20
Joined: Wed Dec 13, 2017 12:36 am

Re: Two Bugs related to clicking NoScript icon before page l

Post by geek99 » Wed Dec 20, 2017 1:03 am

Tomatix:

Both of the bugs that I reported still occur in v10.1.6

To reproduce the first one:
Navigate to a site that only has a few scripts (such as hackademix.net).
Before the site is completely loaded, quickly single click the NoScript icon in the Firefox bookmarks bar.

You may have to try this a few times, but eventually the dropdown will contain this message:

"In order to operate on this tab, NoScript needs to reload it. Proceed?"

The second bug can also be easily reproduced ... follow instructions in my original post for this thread.

I think the solution might require that the NoScript icon be disabled until the page is fully loaded and fully processed by NoScript. In that way, the user cannot click the icon while the page is opening (and being processed by NoScript).
Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0

Lurion
Junior Member
Posts: 36
Joined: Wed Jul 23, 2014 12:38 pm

Re: Two Bugs related to clicking NoScript icon before page l

Post by Lurion » Wed Dec 20, 2017 7:08 am

I've also seen both of these bugs happen, but I've also seen something else:
Sometimes when I rapidly click the NS10 icon while the page is loading (due to me being frustrated about long loading times) instead of showing the menu it will open up the Noscript options page.
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:57.0) Gecko/20100101 Firefox/57.0

Tomatix
Senior Member
Posts: 60
Joined: Tue Dec 05, 2017 3:05 pm

Re: Two Bugs related to clicking NoScript icon before page l

Post by Tomatix » Thu Dec 21, 2017 7:17 pm

@geek99
Tomatix wrote: Actually in my test with 10.1.6 this dialog isn't shown anymore after NS install or reactivation on already open tabs.
Automatically just screens the "unoperated" tabs htmls?
I am talking about the real purpose of this dialog that barbaz described.. when old tabs are not yet processed by Noscript.
Can you reproduce this?
geek99 wrote:Both of the bugs that I reported still occur in v10.1.6
Yes, your bugs I can still reproduce as you describe in 10.1.6 as well.
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:57.0) Gecko/20100101 Firefox/57.0

Post Reply