[RESOLVED] Noscript, squid proxy and ftp

[invider]

Hey folks,

I am using FF 41.0.2, NOscript 2.6.9.38 and a squid proxy for web access (http, https, ftp).
Whenever I try to open an ftp link, it does not load, only when I add the host to the whitelist or when im deactivating the noscript addon.
I tried a fresh profile with only noscript installed.
I also tried to setup an ftp-whitelist (added ftp:// and ftp://* to the whitelist), but it is not working.

Any suggestions?
Thanks

[barbaz]

Whenever I try to open an ftp link, it does not load,

What exactly happens instead?

[invider]

It tries to load the site, but nothing happens. The loading bar from firefox stays empty (so no endless reloading)

[barbaz]

This is just odd, it's as if the connection were dropped by the receiving end yet it's due to NS?
When this issue occurs, do you see anything related in the Browser Console? (Ctrl-Shift-J)
(if you don't know what's related, turn off CSS warnings and post everything else you see)

EDIT Oh, and anything informative in the proxy's logs when the issue occurs?

[invider]

ok, here are the logs (ip addresses removed)
noscript not installed

squid log
---
1445082040.243 539 x.x.x.x TCP_MISS/200 837 GET ftp://ftp.proftpd.org/ - FIRSTUP_PARENT/x.x.x.x text/html
---
browser console
------
The character encoding of the HTML document was not declared. The document will render with garbled text in some browser configurations if the document contains characters from outside the US-ASCII range. The character encoding of the page must be declared in the document or in the transfer protocol.
(I think this comes from the virusscanner inside the proxy, it rewrites the ftp listing)

noscript installed and enabled

squid log
---
nothing
------
browser console
---
[NoScript XSS] xss.reason.TypeError: keys[0].match(...) is null --- ns.checkShorthands@jar:file:///C:/Users/invider/AppData/Roaming/Mozilla/Firefox/Profiles/dcl6i3ue.test/extensions/%7B73a6fe31-595d-460b-a920-fcc0f8843232%7D.xpi!/components/noscriptService.js20
RequestWatchdog.prototype.filterXSS@chrome://noscript/content/RequestWatchdog.js:502:15
RequestWatchdog.prototype.onHttpStart/<@chrome://noscript/content/RequestWatchdog.js:158:18
DOSChecker.prototype.run@chrome://noscript/content/RequestWatchdog.js22
RequestWatchdog.prototype.onHttpStart@chrome://noscript/content/RequestWatchdog.js:156:1
ns.httpObserver.observe@jar:file:///C:/Users/invider/AppData/Roaming/Mozilla/Firefox/Profiles/dcl6i3ue.test/extensions/%7B73a6fe31-595d-460b-a920-fcc0f8843232%7D.xpi!/components/noscriptService.js24

noscript installed and ftp.profptd.org added to whitelist

squid log
---
1445082395.642 241 x.x.x.x TCP_MISS/200 836 GET ftp://ftp.proftpd.org/ - FIRSTUP_PARENT/x.x.x.x text/html
---
browser console
------
The character encoding of the HTML document was not declared. The document will render with garbled text in some browser configurations if the document contains characters from outside the US-ASCII range. The character encoding of the page must be declared in the document or in the transfer protocol.
(I think this comes from the virusscanner inside the proxy, it rewrites the ftp listing)

Thanks

[barbaz]

I have never seen a XSS message looking like that. Does old version(s) of NoScript work, if so which?
Old NoScript @
https://addons.mozilla.org/addon/noscript/versions
*or*
https://noscript.net/feed?c=100&t=a

Also since you decided to register I've put your Guest posts under your account so that you can edit the OP if you want.

[invider]

will try asap, but i think not before monday

Best regards

[invider]

Hi,

Version 2.6.9.35 is working.
beginning from 2.6.9.36rc1 its not working

With 2.6.9.35, there is no message in the browser console, and the squid log is normal like without using noscript.
With 2.6.9.36rc1 the same message in the browser console like in the newer versions.

Best Regards

[Thrawn]

Hmm...I don't see anything XSS-related in the changelog. However, as it's a JavaScript error, Giorgio would have a better handle on it.

[invider]

Hi,

after a longer time with 2.6.9.35, i have updated to 2.7. With that version it works also.
Thread can be closed now.

Thanks

[barbaz]

Thanks for letting us know and glad it's working for you.

Thread can be closed now.

I see no reason to lock this atm. The closest thing in the NS changelogs is this:

Code: Select all

x Fixed shorthands not checked for ftp(s) sites (thanks
  Leon Winter for patch)

I would suspect your issue is something of a ghost, and we would prefer you post again in this thread if the problem resurfaces later.