Firefox hangs when accessing zeit.de with noscript enabled

[Beza]

Last night I ran into the problem that whenever I try to access zeit.de with firefox (latest version) the browser stalls and I have to kill it via the taskmanager. Today I disabled and then step-by-step re-enabled all addons and found noscript to be the culprit. The page starts loading but after a second or so the browser stalls. I have removed zeit.de from my whitelist but no luck either. Anything else I could try to make it work again? I tend to use the site every day and up until now never had a problem with it, just as I have happily used noscript for several years now.

[barbaz]

Not seeing that on http://www.zeit.de/index with scripts blocked. I'm using NoScript 5.0.4rc1.

Does it work for you in a clean profile with only NoScript installed and all defaults?

[Franzi]

It does that for me too, started happening 2 days ago. It's not just NoScript, any javascript blocker will cause Firefox 53.0.x to hang when you allow scripts on certain websites, e.g. everything is blocked by default and then you allow zeit.de FF would hang, pointing to xul.dll:

Faulting application name: firefox.exe, version: 53.0.3.6347, time stamp: 0x591d56cc
Faulting module name: xul.dll, version: 53.0.3.6347, time stamp: 0x591d5b08
Exception code: 0x80000003
Fault offset: 0x00000000004eb068
Faulting process ID: 0x11fc
Faulting application start time: 0x01d2d57571696efb
Faulting application path: C:\Program Files\Mozilla Firefox\firefox.exe
Faulting module path: C:\Program Files\Mozilla Firefox\xul.dll
Report ID: 4b315e5e-38c1-497d-8434-da3a0c1e4eb1
Faulting package full name:
Faulting package-relative application ID:

I can reproduce this with both NoScript and uMatrix on several other websites besides zeit.de that worked just fine a few days ago:

https://store.eu.square-enix.com/eu/search?p=chocobo

http://www.vestiairecollective.com/

Firefox would hang the moment you select to temporarily allow scripts on the page.

Not sure whats going on here, nothing has changed on my side, no updates for FF (53.0.3, 64Bit, Windows) and the extensions (only NoScript at the time of testing). Clean profile doesn't make a difference.

[barbaz]

@Franzi You don't seem to have the same problem as the OP -

I have removed zeit.de from my whitelist but no luck either.

any javascript blocker will cause Firefox 53.0.x to hang when you allow scripts

(emphasis mine)

In your case it sounds like something changed on the site's end. Try Allow Scripts Globally and work backwards to find the required permissions.

[therube]

any javascript blocker

So if you remove NoScript (so no extensions installed), & disable javascript...

about:config, set javascript.enabled to false

Visit, http://www.zeit.de/index...

about:config, set javascript.enabled to true

Reload the page, http://www.zeit.de/index, Firefox crashes?

Is it an actual crash rather then just a (perhaps, prolonged) hang?
about:crashes, the last few crash report URLs?


What version of NoScript?
Do you have E10s enabled in FF?

[Franzi]

Thanks for the fast response.

I tried the procedure you suggested above, the websites in questions will not cause Firefox to stop responding when javascript is getting disabled/enabled in about:config.

FF will also stop responding if NoScript is enabled and scripts are allowed globally. Perhaps anything else is causing this, like XSS protection?

E10s is enabled by default, the version of NoScript I have installed is 5.0.4.

[Franzi]

Ok I just tested it and as I suspected, XSS protection is causing Firefox to stop responding. If I disable "Sanitise cross-site suspicious requests" and "Turn cross-site POST requests into data-less GET requests" it works just fine.

[barbaz]

Ok I just tested it and as I suspected, XSS protection is causing Firefox to stop responding. If I disable "Sanitise cross-site suspicious requests" and "Turn cross-site POST requests into data-less GET requests" it works just fine.

Huh? How could µMatrix, which has no XSS filter, cause the hanging in such case?

[Franzi]

Yes I probably should have clarified that. I enabled scripts globally with NoScript and left it running for XSS and other protections while uMatrix was handling scripts. Having the NoScript extension disabled I can't reproduce it with uMatrix. Like said above, its the XSS filter. The websites in question must have changed something on their side, I had no problems 3 days ago. I guess adding an exception rule is the best workaround for now.

[yooooooloooooo]

yeah, like the dude above says, it seems its noscript and its the xss thingy (not a programmer, just a user here). Ill try to explain: so im using latest firefox 32bits, from the website, the regular standard one
ive got installed noscript, adblock plus, and nothing else, no flash or anything. So this is how i was having the problem (probably still have it on other sites)

some sites were getting stuck begining like some days ago, but its always the same sites, i manage to identify one in which it crashed every single time (as.com, a spanish sport newspaper), so i started testing there, first i tried loading firefox in safe mode, the site loaded fine, then reinstalled firefox but i did not do the refresh thingy so noscript and abp are untouched theoretically, still broken, then i started messing with noscript and the other pluggin, so with noscrip completely disabled and ad block plus enabled it was loading fine too, so i went here and found this thread, tried disabling those 2 xss settings inside noscript and it loaded fine even with noscript and adblockplus enabled, so it seems related to those 2 xss settings in some way

and then the weirdest thing happened, since i did not want to use firefox without those 2 nosctipt xss settings (i dont even know what they do, but they seem important, again im just a user here lol), i started messing with the subdomains individually while it was working fine, like, blocking this one, allowing that one, and NOW i can load the site with the 2 xss settings enabled and it seems to work perfectly fine but the subdomains that i have allowed and blocked in noscript inside that site are different than what i had before when the site was hanging firefox inmediately after loading

so im on the same site, with the 2 xss thingys enabled like i was before, but now its not geting stuck

weeeeird

[barbaz]

@Franzi Thanks for the clarification.

In order to figure out the needed XSS exception, you'll need the NoScript messages from the Browser Console (Ctrl-Shift-J). This is to determine A) which sites are involved, and B) whether allowing this is safe.

Are you able to see the console messages, or does Firefox hang before they appear? If you can see them, please post them here.

[barbaz]

If you guys still experience the problem with NoScript latest development build, and you get no console messages from NoScript, this might be related - viewtopic.php?f=10&t=22828