Page 1 of 1

BUG: NS10 interferes with accessibility.blockautorefresh

Posted: Fri Feb 09, 2018 8:23 pm
by tom1
NoScript 10.1.6.4
Firefox 58.0.1

Steps to reproduce:
1. Set in about:config "accessibility.blockautorefresh" to "true"
2. Go to a website that redirects e.g. https://duckduckgo.com/?q=firefox

With NoScript disabled Firefox displays a warning, but with NoScript enabled the page redirects.

Re: BUG: NS10 interferes with accessibility.blockautorefresh

Posted: Sat Feb 10, 2018 2:25 am
by geek99
I followed the steps provided by tom1, and got a slightly different result ...

NoScript 10.1.6.5
Firefox 58.0.2

First, I verified that "accessibility.blockautorefresh" was set to "true".

Then, with NoScript enabled, I navigated to: https://duckduckgo.com/?q=firefox

I saw a page briefly appear on the screen, then I saw the DuckDuckGo search results page.

I followed the same steps, and pressed the "Print Screen" key while the first page briefly appeared. The captured page said this:

Ignore this box please.
DuckDuckGo
firefox X S

You are being redirected to the non-JavaScript site.

Click here if it doesn't happen automatically.


I then disabled NoScript (using Firefox's add-on manager), and again navigated to: https://duckduckgo.com/?q=firefox


The only difference was that (with NoScript disabled) I did not see the first page briefly appear ... I immediately saw the DuckDuckGo search results page.

Hope this helps diagnose this issue.

Re: BUG: NS10 interferes with accessibility.blockautorefresh

Posted: Sat Feb 10, 2018 8:59 am
by tom1
I checked again (on a new Firefox profile) and I think it's because I originally had uMatrix disable JavaScript on duckduckgo.com.
With JavaScript enabled I got the results that geek99 got, but with
1) either uMatrix or setting javascript.enabled to false in about:config; and
2) NoScript disabled
Firefox displays "Firefox prevented this page from automatically redirecting to another page" and the page doesn't redirect to the HTML site, whereas with NoScript enabled the page does redirect.

Re: BUG: NS10 interferes with accessibility.blockautorefresh

Posted: Sat Feb 10, 2018 11:46 am
by skriptimaahinen
Can confirm. The redirect seems to be due to meta refresh inside noscript-tag.

For the Firefox's redirect blocking to work (shows redirect warning), you need to have:

1) javascript.enabled; false
2) accessibility.blockautorefresh; true
3) NoScript disabled or has the "script" allowed for the page

Regardless of the state of "javascript.enabled", if NoScript has "script" disabled for the page, no redirect warning is shown and the redirect happens automatically.

Re: BUG: NS10 interferes with accessibility.blockautorefresh

Posted: Sat Feb 10, 2018 1:38 pm
by skriptimaahinen
Well, looks like this is another case of intended behaviour.

Code: Select all

  if (!canScript) {
    for (let noscript of document.querySelectorAll("noscript")) {
      // force show NOSCRIPT elements content
      let replacement = document.createElement("div");
      replacement.innerHTML = noscript.innerHTML;
      noscript.parentNode.replaceChild(replacement, noscript);
      // emulate meta-refresh
      let meta = replacement.querySelector('meta[http-equiv="refresh"]');
      if (meta) {
        let content = meta.getAttribute("content");
        if (content) {
          let [secs, url] = content.split(/\s*;\s*url\s*=\s*/i);
          if (url) {
            try {
              let urlObj = new URL(url);
              if (!/^https?:/.test(urlObj.protocol)) {
                continue;
              }
            } catch (e) {
            }
            window.setTimeout(() => location.href = url, (parseInt(secs) || 0) * 1000);
          }
        }
      }
    }
  }
However, quick testing shows that the meta redirect works even without the timer. Is this block of code even needed?

In any case, I hope there is a way to bring back the redirect warning.

Re: BUG: NS10 interferes with accessibility.blockautorefresh

Posted: Wed Nov 07, 2018 5:48 pm
by Giorgio Maone
skriptimaahinen wrote:Well, looks like this is another case of intended behaviour.

In any case, I hope there is a way to bring back the redirect warning.
I've tried some approaches in the last few hours and I concluded there's no way for a WebExtension to "organically" emulate a meta refresh in a way that could be intercepted by Firefox's optional blocking.
Therefore I'm afraid the only thing I can do is emulating the blocking notification myself (in content, ouch!) and put it behind a separate NoScript options, since I cannot access the built-in Firefox one :(

Re: BUG: NS10 interferes with accessibility.blockautorefresh

Posted: Sat Nov 17, 2018 6:49 am
by skriptimaahinen
Did you consider the possibility of sending the redirect info to the background, reloading the page and then writing the info to the header in onHeadersReceived? Though I'm somewhat conflicted if this is any better than the alternatives.

Re: BUG: NS10 interferes with accessibility.blockautorefresh

Posted: Sat Nov 17, 2018 9:23 pm
by Giorgio Maone
skriptimaahinen wrote:Did you consider the possibility of sending the redirect info to the background, reloading the page and then writing the info to the header in onHeadersReceived? Though I'm somewhat conflicted if this is any better than the alternatives.
You've just gave me inspiration for a pretty clever and simple trick I did not think about, and taking advantage of the fact the page is scriptless by definition (so it shouldn't have any side effects other than perhaps loading some subresource twice):

Code: Select all

// in onScriptDisabled.js
window.addEventListener("DOMContentLoaded", e => {
  if (moveAnyMetaRefreshOutsideNoScriptElements()) {
     let html = document.documentElement.outerHTML;
     document.open();
     document.write(html);
     document.close();
  }
}
Very quick preliminary testing says it does work :D

Re: BUG: NS10 interferes with accessibility.blockautorefresh

Posted: Sat Nov 17, 2018 9:57 pm
by Giorgio Maone

Re: BUG: NS10 interferes with accessibility.blockautorefresh

Posted: Sun Nov 18, 2018 12:18 am
by skriptimaahinen
Very nice trick indeed. Definitely better than the alternatives. And seems to work well.