[Fixed] Ability to refresh page file:///tmp/page#13 with scripts enabled

Bug reports and enhancement requests
Post Reply
szpak
Posts: 5
Joined: Sat Nov 25, 2017 11:15 pm

[Fixed] Ability to refresh page file:///tmp/page#13 with scripts enabled

Post by szpak » Thu Aug 13, 2020 4:30 pm

I write presentations in Remark.js. It's nice and for local development I just open the file from disk. With NoScript I can allow scripts for that given file (nice!) and it works fine. However there is one issue.

Being at:
file:///home/foo/Documents/presentation5/pres.html#17 (page 17 of that presentation)

NoScript doesn't recognized it as file:///home/foo/Documents/presentation5/pres.html anylonger and F5 results in:
> Content Security Policy: The page’s settings blocked the loading of a resource at inline (“script-src”).

I need to change url to file:///home/foo/Documents/presentation5/pres.html , reload and then type #17 at the end. It's very tedious. I tried to define rules with * at the end, but NoScript ignores it. It works fine for regular URLs, e.g. https://remarkjs.com/#17 works fine for https://remarkjs.com/ exception and can be used as a workaround, but anyway.

To recap. It would good to be able treat file:///tmp/pres.html#17 (for local files) as allowed, if file:///tmp/pres.html has been on the trusted list (the same as with URL).

Marcin
Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0

skriptimaahinen
Senior Member
Posts: 213
Joined: Wed Jan 10, 2018 7:37 am

Re: Ability to refresh page file:///tmp/page#13 with scripts enabled

Post by skriptimaahinen » Sat Aug 15, 2020 1:38 pm

Can confirm.

Problem is in Policy.js: Sites.parse()

Code: Select all

    let path = url.pathname;
    siteKey = url.origin;
    if (siteKey === "null") {
      siteKey = site;
    } else if (path !== '/') {
      siteKey += path;
    }
Since origin is null for file:, the fragment (hash) ends up in the siteKey and the url is not matched.

It looks like browsers have some differences here. For example Chromium gives "file://" as origin instead of Firefox's "null".
Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0

User avatar
Giorgio Maone
Site Admin
Posts: 8940
Joined: Wed Mar 18, 2009 11:22 pm
Location: Palermo - Italy
Contact:

Re: Ability to refresh page file:///tmp/page#13 with scripts enabled

Post by Giorgio Maone » Mon Aug 17, 2020 11:00 pm

Please check latest development build:
v 11.0.39rc2
============================================================
x Let temporary permissions survive NoScript updates
(shameless hack)
x Fixed some traps around Messages abstraction
x Ignore search / hash on policy matching of domain-less
URLs (e.g. file:///...)

x Removed useless CSS property
x Updated TLDs
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:80.0) Gecko/20100101 Firefox/80.0

szpak
Posts: 5
Joined: Sat Nov 25, 2017 11:15 pm

Re: Ability to refresh page file:///tmp/page#13 with scripts enabled

Post by szpak » Wed Aug 19, 2020 6:10 pm

With 11.0.39rc5 it works fine, thanks!
Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:79.0) Gecko/20100101 Firefox/79.0

Post Reply