NoScript 5.1.8.1 broke website

[lakrsrool]

I thought I'd update NoScript from 5.0.6 to 5.1.8.1 and since then the Citibank log-in page give me "about:blank" in the address bar. If I disable NoScript then the log-in page works.

Should I just go back to 5.0.6?

[barbaz]

Does it require an actual login to see this problem? Or does it happen before you can enter your username/password?

[lakrsrool]

No just clicking on the log-in link causes this.

Here is the URL: https://online.citi.com/US/JPS/portal/I ... mo_ID=SPBL (I had to disable NoScript to get this otherwise I'd get the "about:blank" in the address bar and the tab is identified as a "New Tab".)

So you should get the same thing presumably (I'm using Pale Moon by the way).

Edit: I notice that a browser restart is not required when an enable/disable is done with NoScript with this new version.

[barbaz]

That link loads fine for me in Pale Moon 27.6.2, NoScript 5.1.8.1, new profile. No redirection to about:blank.

Do you see the same issue with NoScript 5.1.5?

Old NoScript @
https://addons.mozilla.org/addon/noscript/versions / https://addons.mozilla.org/addon/noscript/versions/beta
*or*
https://noscript.net/feed?c=100&t=a

[lakrsrool]

Since it worked for you I tested in fresh profile and 5.1.8.1 worked so I figured something in about:config has to be the issue. Since ABE is about the only profile settings involving Citibank that could be a possible problem ---- I've found that if I disable ABE for Citibank the log-in page works.

So I'm trying to take out an ABE ruleset that I added for a Citibank credit card page since it was the most recent change and when I either comment the lines or remove them they return after clicking on the "OK" button in the ABE interface.

I thought that all I have to do is make a change and click the OK button.

I didn't want to try the "RESET" button not knowing what it does --- what DOES the "RESET" button do in the ABE interface window? (I'm talking about the ABE interface "RESET" above the other "RESET" below which I'm figuring is a global setting reset).

Does NoScript describe or have any help on what these "RESET" buttons do, pressing the wrong "RESET" could make major (unwanted) changes.

If it makes any difference I have Citibank in its own separate ruleset, but it seems to me that before this I could make changes and click the "OK" button and whatever changes I made would hold. Is there something "new" about 5.1.8.1?

[barbaz]

ABE rules editing is hosed in 5.1.8.1 - https://forums.informaction.com/viewtop ... 10&t=23576

Please try NoScript 5.1.5.

I didn't want to try the "RESET" button not knowing what it does --- what DOES the "RESET" button do in the ABE interface window? (I'm talking about the ABE interface "RESET"

It resets all your ABE rules and rulesets to default. This includes deleting any custom ABE rulesets.

[lakrsrool]

Okay, I've got 5.1.5 and I still have the problem unless I disable ABE (btw, I am now able to modify ABE however in this version).

This is what I had in ABE of which you had helped me with in the past:

Code: Select all

Site .online.citi.com
Accept from .citi.com
Deny INC
Accept from .citi.com https://start.me/* https://palemoon.start.me/* https://rewards.thankyou.com/*
Deny

Site .citi.com
Accept from .citi.com
Deny INC
Accept from https://accountonline.com/* .citi.com
Deny

# commented for testing - if this is needed, it should be moved to the top of the ruleset
#Site https://online.citi.com/US/JRS/portal/index.do*
#Accept from https://start.me/* https://palemoon.start.me/* .citi.com
#Anon GET from https://start.me/*
#Deny

Now this causes this "about:blank" issue if enabled.

I'm sorry now I updated from my 5.0.6 and I can see why the Pale Moon add-on page is still at this version now.

Let me know if there is anything that can be done regarding ABE and if not I guess I can end up returning to 5.0.6 and explain to all the Pale Moon users why the browsers add-on page for NoScript has this version as the most recent for Pale Moon....

[barbaz]

Try changing it to this -

Code: Select all

Site .online.citi.com
Accept from .citi.com moz-nullprincipal:
Deny INC
Accept from .citi.com https://start.me/* https://palemoon.start.me/* https://rewards.thankyou.com/*
Deny

Site .citi.com
Accept from .citi.com moz-nullprincipal:
Deny INC
Accept from https://accountonline.com/* .citi.com
Deny

# commented for testing - if this is needed, it should be moved to the top of the ruleset
#Site https://online.citi.com/US/JRS/portal/index.do*
#Accept from https://start.me/* https://palemoon.start.me/* .citi.com
#Anon GET from https://start.me/*
#Deny

[lakrsrool]

Same problem

[barbaz]

Please check the Browser Console (Ctrl-Shift-J) when this issue happens and post here any messages related to NoScript.
(related messages usually start with either "[NoScript" or "[ABE]"; if you don't know what's related, turn off CSS warnings and post everything else you see)

[lakrsrool]

I cleared the web console and then clicked on the Citibank log-in link and got this result in the web console:

Code: Select all

[ABE] < .online.citi.com> Deny INCLUSION on {GET https://online.citi.com/US/JPS/portal/Index.do?Promo_ID=SPBL <<< https://palemoon.start.me/p/3g6DnO/my-start-page - undefined}
CITIBANK rule:
Site .online.citi.com
Accept from .citi.com moz-nullprincipal:
Deny INCLUSION
Accept from .citi.com https://start.me/* https://palemoon.start.me/* https://rewards.thankyou.com/*
Deny

addendum: after that all I've got what is related to this post:

Code: Select all

GET 
https://forums.informaction.com/posting.php [HTTP/1.1 200 OK 766ms]
POST 
https://forums.informaction.com/posting.php [HTTP/1.1 200 OK 1297ms]
GET 
https://forums.informaction.com/viewtopic.php [HTTP/1.1 200 OK 266ms]

[lakrsrool]

I commented the top rule-set in ABE and got this in the web console:

Code: Select all

 [ABE] < .citi.com> Deny INCLUSION on {GET https://online.citi.com/US/JPS/portal/Index.do?Promo_ID=SPBL <<< https://palemoon.start.me/p/3g6DnO/my-start-page - undefined}
CITIBANK rule:
Site .citi.com
Accept from .citi.com moz-nullprincipal:
Deny INCLUSION
Accept from https://accountonline.com/* .citi.com
Deny

Which is the next rule-set not commented out --- It appears the rule-sets are having issues in this version of NoScript....

[barbaz]

That's weird. Looks like you need to change your ABE ruleset to this -

Code: Select all

Site .online.citi.com
Accept from .citi.com moz-nullprincipal: https://start.me/* https://palemoon.start.me/* https://rewards.thankyou.com/*
Deny

Site .citi.com
Accept from .citi.com moz-nullprincipal: https://accountonline.com/*
Deny

No idea why it would consider that request a INCLUSION, nor why it's listing the request type as "undefined". I would say those are bugs.

[lakrsrool]

Okay that worked

... so is ABE not working correctly in this 5.1.5 version?

Would it be better to return to 5.0.6 (which is what is listed as the most current version on the Pale Moon add-on page for NoScript)?

Or are the other changes between 5.0.6 worth using 5.1.5?

[lakrsrool]

Decided to check other bank sites that have ABE rule-sets:

I'm having the same problem with Union Bank:

Code: Select all

 Site .sso.unionbank.com .bankingsso.unionbank.com
Accept from .unionbank.com
Deny INCLUSION
Accept from https://palemoon.start.me/* .unionbank.com
Deny

renders the "about"blank" page.

I have the following for other banks:

Code: Select all

 Site .roll.bankofamerica.com
Accept from .bankofamerica.com
Deny

Site firstnational.com
Accept from .firstnational.com
Deny

which at least the log-in page is rendered correctly... not sure about any other possible issues using either bank.