Page 1 of 1

better indication for iframes in the blocked objects menu

Posted: Tue Jan 04, 2011 2:58 am
by al_9x
Iframes are currently sometimes listed with a generic icon and a text unknown@site, and only the tooltip reveals that it's an iframe. That it's a blocked iframe is more valuable information than its unknown mime. Both the icon and the text should clearly indicate that its an iframe.

Re: better indication for iframes in the blocked objects men

Posted: Wed Jan 19, 2011 12:41 am
by Giorgio Maone
It's not always a easy info to retrieve, but I'll see what can be done.

Re: better indication for iframes in the blocked objects men

Posted: Wed Jan 19, 2011 1:37 am
by al_9x
Giorgio Maone wrote:It's not always a easy info to retrieve, but I'll see what can be done.
I am not sure what you mean, the tooltip shows that it's an iframe, so all the info is there, it's only a question of presentation. What I am suggesting is: that it's a blocked iframe, is the useful information, the mime (which I think would always be unknown) is irrelevant.

"<IFRAME>@site" with a memorable iframe icon is considerably more useful (for quickly taking in the status of the page) than "unknown@site" with a generic icon.

One related question. In some cases (e.g. new yahoo mail beta) a blocked iframe is shown as "text/html@host," since it's blocked how/why do you get the mime?

Re: better indication for iframes in the blocked objects men

Posted: Sat Jan 29, 2011 3:41 pm
by Giorgio Maone
al_9x wrote:
Giorgio Maone wrote:It's not always a easy info to retrieve, but I'll see what can be done.
I am not sure what you mean, the tooltip shows that it's an iframe, so all the info is there, it's only a question of presentation. What I am suggesting is: that it's a blocked iframe, is the useful information, the mime (which I think would always be unknown) is irrelevant.

"<IFRAME>@site" with a memorable iframe icon is considerably more useful (for quickly taking in the status of the page) than "unknown@site" with a generic icon.
I agree.
al_9x wrote: One related question. In some cases (e.g. new yahoo mail beta) a blocked iframe is shown as "text/html@host," since it's blocked how/why do you get the mime?
I couldn't reproduce on Yahoo! Mail, hence my answer is tentative, but the following markup obviously causes text/html@host to be displayed:

Code: Select all

<object data="http://noscript.net" type="text/html" width="400" height="400"></object>

Re: better indication for iframes in the blocked objects men

Posted: Sat Jan 29, 2011 7:11 pm
by al_9x
Giorgio Maone wrote:I couldn't reproduce on Yahoo! Mail, hence my answer is tentative, but the following markup obviously causes text/html@host to be displayed:

Code: Select all

<object data="http://noscript.net" type="text/html" width="400" height="400"></object>
Such an object has an object tooltip, I am referring specifically to iframes shown with a known mime, which I encounter regularly, here is one:

Fx 3.6.13, NS 2.0.9.7rc4, new profile, forbid iframes

On https://mail.yahoo.com/ there is an iframe. AFAICT its mime is neither in the html nor is it it sniffed (which is good, it shouldn't be), yet it's shown as text/html in blocked objects. I can post other examples as I encounter them.

Re: better indication for iframes in the blocked objects men

Posted: Sat Jan 29, 2011 9:37 pm
by Giorgio Maone
al_9x wrote: On https://mail.yahoo.com/ there is an iframe. AFAICT its mime is neither in the html nor is it it sniffed (which is good, it shouldn't be), yet it's shown as text/html in blocked objects. I can post other examples as I encounter them.
Firefox "guesses" the mime type when possible by looking up a file extension mapping (in this case .html maps to text/html, obviously).
Of course, if you allow the frame and it's found to actually be plugin content according to its true HTTP headers, notwithstanding the extension, NoScript will detect this and interrupt the load anyway before it gets processed.

Re: better indication for iframes in the blocked objects men

Posted: Sat Jan 29, 2011 11:02 pm
by al_9x
Giorgio Maone wrote:
al_9x wrote: On https://mail.yahoo.com/ there is an iframe. AFAICT its mime is neither in the html nor is it it sniffed (which is good, it shouldn't be), yet it's shown as text/html in blocked objects. I can post other examples as I encounter them.
Firefox "guesses" the mime type when possible by looking up a file extension mapping (in this case .html maps to text/html, obviously).
Of course, if you allow the frame and it's found to actually be plugin content according to its true HTTP headers, notwithstanding the extension, NoScript will detect this and interrupt the load anyway before it gets processed.
I think it would better, for all blocked iframes (regardless of guessing, not just unknown), to show the same <IFRAME>@site with the same icon. The guessed mime you can then stick in the tooltip, if at all.

Re: better indication for iframes in the blocked objects men

Posted: Sun Jan 30, 2011 9:23 am
by Giorgio Maone
al_9x wrote:I think it would better, for all blocked iframes (regardless of guessing, not just unknown), to show the same <IFRAME>@site with the same icon. The guessed mime you can then stick in the tooltip, if at all.
<IFRAME> label, OK, same icon, not so. I think one more hint is better than nothing.

Re: better indication for iframes in the blocked objects men

Posted: Sun Nov 10, 2013 8:32 pm
by al_9x
currently the menu entry for the specific blocked iframe shows "<IFRAME>@" but the corresponding entry for "embedding (embedder)" shows "unknown@", it should be <IFRAME> too. Having a different type@ suggests that the entries are not for the same entity.

Also, the icon for both appears to be one for an unknown mime rather than an iframe. If that is an iframe icon, never mind, but if not, something more iframy would be better.