NoScript 5.1.8.1 broke website

[barbaz]

... so is ABE not working correctly in this 5.1.5 version?

Apparently not in Pale Moon. Quick testing suggests that the last 'good' version maybe 5.0.8rc1.

I might try to look into this more.

Would it be better to return to 5.0.6 (which is what is listed as the most current version on the Pale Moon add-on page for NoScript)?

Or are the other changes between 5.0.6 worth using 5.1.5?

5.0.6 is behind several surrogate script updates and XSS filter improvements. See changelog for full details.

I'm having the same problem with Union Bank:

Code: Select all

 Site .sso.unionbank.com .bankingsso.unionbank.com
Accept from .unionbank.com
Deny INCLUSION
Accept from https://palemoon.start.me/* .unionbank.com
Deny

renders the "about"blank" page.

This change should get that one back working -

Code: Select all

 Site .sso.unionbank.com .bankingsso.unionbank.com
Accept from .unionbank.com https://palemoon.start.me/*
Deny

[lakrsrool]

Okay I changed UNION Bank from:

Code: Select all

Site .sso.unionbank.com .bankingsso.unionbank.com
Accept from .unionbank.com
Deny INCLUSION
Accept from https://palemoon.start.me/* .unionbank.com
Deny

which renders the about:blank page

To:

Code: Select all

Site .sso.unionbank.com .bankingsso.unionbank.com
Accept from .unionbank.com moz-nullprincipal: https://palemoon.start.me/*
Deny

And the log-in page is working...

I have NO IDEA what I'm doing other than copying what you've changed --- thanks for all the great help as always.

Let me know if you think I'm okay staying with this 5.1.5 version under the circumstances or whether it would be advisable to return to 5.0.6?

[lakrsrool]

I hadn't seen your post on what to do with UNION bank yet, but just sort of formulated what it should be from what you did before....

Since ABE is working for these websites presumably maybe it would be okay to stay with this version for the sake of whatever other improvement there were.... What do you think?

[lakrsrool]

Or is it better (more safe) to be able to include the "Deny INCLUSION" line in the ABE rule-sets that worked in 5.0.6 but apparently does not in 5.1.5?

Also the only way I can update NoScript in Pale Moon is to use this AMO website: https://addons.mozilla.org/en-US/firefo ... on-5.0.7.1
which would appear that I am only able to update to 5.0.7.1 so perhaps returning to 5.0.6 that would allow the inclusion (no pun intended) of the "Deny INCLUSION" part of the rule-set....

If so this was a lot of time spent just to find out that the 5.0.6 version in the Pale Moon add-ons page is the correct NoScript for the optimum compatibility with Pale Moon, but if that's the case it is what it is....

[barbaz]

You should be OK to stay with 5.1.5 for now. The ABE rules are still tight enough to do their job.

Also the only way I can update NoScript in Pale Moon is to use this AMO website: https://addons.mozilla.org/en-US/firefo ... on-5.0.7.1
which would appear that I am only able to update to 5.0.7.1 so perhaps returning to 5.0.6 that would allow the inclusion (no pun intended) of the "Deny INCLUSION" part of the rule-set....

If so this was a lot of time spent just to find out that the 5.0.6 version in the Pale Moon add-ons page is the correct NoScript for the optimum compatibility with Pale Moon, but if that's the case it is what it is....

NoScript Classic is supposed to still work in Pale Moon, although support for Pale Moon is unofficial.

[lakrsrool]

I've decided to go back down to the most recent version that will work with the ABE rule-sets I had before (presumably more secure than the current rule-sets that only work in more recent NS builds).

So what I found out is all the way from 5.1.5 down to 5.0.8.1 the former ABE rule-sets that I had for v5.0.6 that allow the "Deny INCLUSIONS" line in the ABE rule-set all fail to work so the most recent NS build that still works with the ABE rule-sets I had before turns out to be NS 5.0.7.1 (one up from v5.0.6).

So I've returned to the former ABE rule-sets using NS 5.0.7.1 FWIW (not much of a difference from v5.0.6 but that's the way it turns out if I want to keep the former ABE rule-sets I had before and still have the bank sites work).

[barbaz]

The following patch, applied to NoScript 5.1.8.2rc4, fixes the undefined request type problem in Pale Moon. And I think also fixes the problem with INCLUSION in Pale Moon.

Code: Select all

diff --git a/chrome/content/noscript/ABE.js b/chrome/content/noscript/ABE.js
--- a/chrome/content/noscript/ABE.js
+++ b/chrome/content/noscript/ABE.js
@@ -1160,7 +1160,7 @@
 
   type: function() {
     try {
-      return this.early ? this.channel.type : this.channel.loadInfo.externalContentPolicyType;
+      return this.early ? this.channel.type : this.channel.loadInfo.externalContentPolicyType || PolicyState.extract(this.channel).contentType;
     } catch(e) {
       ABE.log("Error retrieving type of " + this.destination + ": " + e); // should happen for favicons only
     }

I also checked it in Firefox 56.0.2 and SeaMonkey 2.49.1, and I didn't notice any issue.

Can anyone confirm?

[Giorgio Maone]

Merging, thanks!

[barbaz]

Thanks Giorgio!

@lakrsrool: Can you please try NoScript 5.1.8.2 and let us know if it works for you? Thanks!

[lakrsrool]

Thanks Giorgio!

@lakrsrool: Can you please try NoScript 5.1.8.2 and let us know if it works for you? Thanks!

Sorry for the late reply --- just now revisited the forum because a Pale Moon user is having "Paste" issues in Pale Moon 27.8.3 and we do not know yet whether NoScript 5.1.8.5 is involved but this NoScript version was a recent update at the same time as the Pale Moon update at which time subsequent to this the issue arose.

So to answer your question -- I'm currently using NoScript 5.1.8.2 and do not have any issues that I'm aware of....

[lakrsrool]

Is NoScript 5.1.8.2 the highest version we should consider to be compatible with Pale Moon?

[barbaz]

I use NoScript 5.1.8.5rc3 in Pale Moon and haven't noticed any problems. But that isn't my daily use browser.

[lakrsrool]

I use NoScript 5.1.8.5rc3 in Pale Moon and haven't noticed any problems. But that isn't my daily use browser.

Is there a place to go to find the most recent "official" release for NS that is compatible with Pale Moon? (presumably "Classic" release that is "official" should work in Pale Moon).

As it turned out the issue was not NSv5.1.8.5 like I thought it might be -- but a firewall "sandbox" setting as far as the issue with the he was having --- and that user is using v5.1.8.5.

I'm using 5.1.8.2 based on the last forum comments involving an ABE fix to the previous 5.1.8.1 version.

It would be nice to know where to go to acquire the most recent stable "Classic" release (presumably PM compatible) since the PM Add-on installer does not tell me anything is available past my current 5.1.8.2 version.

This NS change log regarding "Classic" says: for "Automatic updates test" = "Updates for NoScript Classic are now served directly from secure.informaction.com due to beta channel deprecation and other problems with dual branches on AMO".

But I must be missing something because https://secure.informaction.com/ renders a blank page for me.

I'm not so comfortable with "automatic updates", but would like to know the source of where to find the "official" release for the "Classic" versions of NS....

.... That said, it doesn't look like anything in the v5.1.8.5 versus my v5.1.8.2 impacts anything about me anyway.

---- Thanks as always for your invaluable help.

[lakrsrool]

Damn -- following up -- got that security issue posting this saying: Ooops, something in your posting triggered my antispam filter...
Please use the "Back" button to modify your content and retry.

.... WHICH WIPES EVERYTHING OUT AS USUAL --- very frustrating board!!

I'll PM you with the message.

[lakrsrool]

Update (no pun intended): Checked out this link: https://www.dslreports.com/forum/r31886265 -- but still same results (never got a reference to "Classic" update. Tried other combinations since I'm was using v5.1.8.2 i.e. https://noscript.net/?ver=5.1.8.4&prev=5.1.8.2 and https://noscript.net/?ver=5.1.8.5&prev=5.1.8.2 -- but still same result.

I had to go to https://noscript.net/getit and scroll down to the "Classic" download to get the update to v5.1.8.5 --- would have probably preferred v5.1.8.4 since it had critical updates that my have applied to me but that never worked since PM clocked it as an invalid or unsecured source or something like that.... So I've got the "official" v5.1.8.5 release now -- hope it works OKAY for what I've got in the way of "Rule-sets" especially... looks to me like the updates to Classic will be ending at some point -- makes me wonder about the viability of NS in Pale Moon eventually.