no "meta redirection blocked" message

Ask for help about NoScript, no registration needed to post
z117

no "meta redirection blocked" message

Post by z117 » Thu Dec 15, 2016 1:42 pm

Hi,
after upgrade from 2.9.0.14 to 2.9.5.1 the message "NoScript blocked a <META> redirection inside a <NOSCRIPT> element ..." does not appear regardless of corresponding checkbox setting.

Steps to Reproduce:
1. Upgrade noscript.
2. Disable meta redirection inside noscript element, enable corresponding message.
3. Go to a site with such a redirection. (In my case, it's http://[any livejournal user].livejournal.com/feed.)

Actual results:
No redirection, no message.

Expected results:
No redirection, but a message at the top of the page.
Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:50.0) Gecko/20100101 Firefox/50.0

barbaz
Senior Member
Posts: 9448
Joined: Sat Aug 03, 2013 5:45 pm

Re: no "meta redirection blocked" message

Post by barbaz » Thu Dec 15, 2016 4:00 pm

When this issue occurs, do you see anything related in the Browser Console? (Ctrl-Shift-J)
(if you don't know what's related, turn off CSS warnings and post everything else you see)
*Always* check the changelogs BEFORE updating that important software!
-

z117

Re: no "meta redirection blocked" message

Post by z117 » Fri Dec 16, 2016 4:11 am

As far as I could see, with CSS off it is literally nothing - except

Password fields present on an insecure (http://) page. This is a security risk that allows user login credentials to be stolen.[Learn More]

which obviously has nothing to do with the issue.
Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:50.0) Gecko/20100101 Firefox/50.0

z117

Re: no "meta redirection blocked" message

Post by z117 » Fri Dec 16, 2016 4:14 am

Wait, I see this

[NoScript]: ReferenceError: ctx is not defined notifying meta refresh at http://[a username deleted].livejournal.com/feed/

In the terminal window where firefox was started.
Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:50.0) Gecko/20100101 Firefox/50.0

z117

Re: no "meta redirection blocked" message

Post by z117 » Sat Dec 24, 2016 10:41 am

Any activity on the issue?
Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:50.0) Gecko/20100101 Firefox/50.0

User avatar
Thrawn
Senior Member
Posts: 3106
Joined: Mon Jan 16, 2012 3:46 am
Location: Australia
Contact:

Re: no "meta redirection blocked" message

Post by Thrawn » Tue Jan 03, 2017 10:42 pm

Does the same message appear in the Browser Console?

If so, does it include a link to the JavaScript file that encountered the error? Name and line number would be quite helpful.
======
Thrawn
------------
Religion is not the opium of the masses. Daily life is the opium of the masses.

True religion, which dares to acknowledge death and challenge the way we live, is an attempt to wake up.
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0

dnolan
Posts: 9
Joined: Wed Nov 23, 2016 9:11 am

Re: no "meta redirection blocked" message

Post by dnolan » Sun Jan 08, 2017 6:54 pm

This appears only once in the source code, in function 'processMetaRefresh': /xpi/chrome/content/noscript/MainChild.js:352.

The exception is thrown from inside the 'notifyCallback' callback. The only caller of 'processMetaRefresh' is at /xpi/chrome/content/noscript/UISync.jsm:98, function 'onContentLoad'. There we see 'notifyCallback' is actually 'notifyMetaRefresh', just above.

I'm guessing the bug is in trying to use this 'non-static' member function without binding it to the appropriate UISync.

Here's an untested patch:

Code: Select all

diff --git a/xpi/chrome/content/noscript/UISync.jsm b/xpi/chrome/content/noscript/UISync.jsm
index 343d7c5..d83819e 100644
--- a/xpi/chrome/content/noscript/UISync.jsm
+++ b/xpi/chrome/content/noscript/UISync.jsm
@@ -95,7 +95,7 @@ UISync.prototype = {
           let url = doc.URL;
           let jsBlocked = /^https?:/.test(url) && !ns.isJSEnabled(ns.getSite(url), w);
           if (jsBlocked) {
-            ns.processMetaRefresh(doc, this.notifyMetaRefresh);
+            ns.processMetaRefresh(doc, this.notifyMetaRefresh.bind(this));
             w.addEventListener("pageshow", ev => this.onPageShowNS(ev), false);
           }
         } else {
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:50.0) Gecko/20100101 Firefox/50.0

barbaz
Senior Member
Posts: 9448
Joined: Sat Aug 03, 2013 5:45 pm

Re: no "meta redirection blocked" message

Post by barbaz » Sun Jan 08, 2017 7:56 pm

dnolan wrote:This appears only once in the source code, in function 'processMetaRefresh': /xpi/chrome/content/noscript/MainChild.js:352.

The exception is thrown from inside the 'notifyCallback' callback. The only caller of 'processMetaRefresh' is at /xpi/chrome/content/noscript/UISync.jsm:98, function 'onContentLoad'. There we see 'notifyCallback' is actually 'notifyMetaRefresh', just above.

Nice find, thanks for investigating.

dnolan wrote:I'm guessing the bug is in trying to use this 'non-static' member function without binding it to the appropriate UISync.

Here's an untested patch:

I haven't tested either, but it looks to me more like UISync.jsm is just missing this line in a couple places -

Code: Select all

let ctx = this.ctx;


Specifically, in the functions unwire and notifyMetaRefresh.
*Always* check the changelogs BEFORE updating that important software!
-

dnolan
Posts: 9
Joined: Wed Nov 23, 2016 9:11 am

Re: no "meta redirection blocked" message

Post by dnolan » Sun Jan 08, 2017 8:29 pm

barbaz wrote:I haven't tested either, but it looks to me more like UISync.jsm is just missing this line in a couple places -

Code: Select all

let ctx = this.ctx;


Specifically, in the functions unwire and notifyMetaRefresh.

Umm, I think you would know better than me, I don't really *know* javascript (I hate it too much) so I simply imagined that using 'ctx' was the same as 'this.ctx' (a la C++). Regardless, I think binding the method is also necessary, though maybe Giorgio prefers the lambda style (as in the next line).
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:50.0) Gecko/20100101 Firefox/50.0

Post Reply