Help documentation for Noscript

General discussion about the NoScript extension for Firefox
access2godzilla
Senior Member
Posts: 109
Joined: Sun May 20, 2012 5:09 pm

Help documentation for Noscript

Post by access2godzilla » Mon Sep 30, 2013 10:24 am

Noscript is a great security extension; but help documentation for this gem is nearly nonexistent.

Some of the help documentation resides under the "features" page; but doesn't have much details (apart from the fact that help documentation shouldn't be in "features"). As for other features of Noscript, such as about:config preferences, surrogate script references and internal details of Noscript : they lie scattered across the forum, noscript.net and hackademix.net.

Couldn't all this information be organised into a single resource? This makes everyone's job easier - and might draw in a few more people to use Noscript!
Mozilla/5.0 (Windows NT 6.1; rv:21.0) Gecko/20130401 Firefox/21.0

User avatar
Thrawn
Senior Member
Posts: 3106
Joined: Mon Jan 16, 2012 3:46 am
Location: Australia
Contact:

Re: Help documentation for Noscript

Post by Thrawn » Mon Sep 30, 2013 10:29 pm

access2godzilla wrote:about:config preferences

I'd do this one myself, except that in many cases I'd be making educated guesses about what each preference does.
surrogate script references

Er...what would you like to document about them, exactly? Not saying this is a bad idea, I'm just not sure what "references" means in this context.
and internal details of Noscript

Again not sure, unless you're referring to the various behind-the-scenes countermeasures like inclusion type checking etc?
======
Thrawn
------------
Religion is not the opium of the masses. Daily life is the opium of the masses.

True religion, which dares to acknowledge death and challenge the way we live, is an attempt to wake up.
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:24.0) Gecko/20100101 Firefox/24.0

access2godzilla
Senior Member
Posts: 109
Joined: Sun May 20, 2012 5:09 pm

Re: Help documentation for Noscript

Post by access2godzilla » Tue Oct 01, 2013 12:17 pm

Making educated guesses about what some feature/about:config preferences etc. isn't really an option for most users -- many are confused by them. Hence the request for it.

And some documentation as to what NS is doing behind the scenes would be great. Information regarding this is very sparse (and it is unfortunate that I have not managed to understand it by looking at NS code).
Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)

barbaz
Senior Member
Posts: 9145
Joined: Sat Aug 03, 2013 5:45 pm

Re: Help documentation for Noscript

Post by barbaz » Tue Oct 01, 2013 1:57 pm

Any ideas how to handle the completely undocumented quirks (unexpected behaviors if you don't know about them), such as ABE treating INCLUSION(OBJ) as "inclusion that is either an object or object subrequest" and the behavior when entering schemes containing capital letters in the whitelist, where, say, "File:" or "fILe:" would become "file://"? AFAIK this is the first time these two have been documented, and I don't know how many more there are...

Thrawn wrote:
surrogate script references

Er...what would you like to document about them, exactly? Not saying this is a bad idea, I'm just not sure what "references" means in this context.

http://hackademix.net/2011/09/29/script-surrogates-quick-reference/?
*Always* check the changelogs BEFORE updating that important software!
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:24.0) Gecko/20100101 SeaMonkey/2.21

barbaz
Senior Member
Posts: 9145
Joined: Sat Aug 03, 2013 5:45 pm

Re: Help documentation for Noscript

Post by barbaz » Sun Jan 18, 2015 1:32 am

Bump

Please add NoScript's DNT feature to the list of things that need more obvious documentation. For it to help users most, they really should be aware of it, but it seems with the current documentation many don't know it exists.

I'd be happy to help write some of the help docs for NS if I'm told what sort of docs to do..
*Always* check the changelogs BEFORE updating that important software!
Mozilla/5.0 (Windows NT 5.2; rv:33.0) Gecko/20100101 SeaMonkey/2.30

barbaz
Senior Member
Posts: 9145
Joined: Sat Aug 03, 2013 5:45 pm

Re: Help documentation for Noscript

Post by barbaz » Wed Oct 21, 2015 9:46 pm

FWIW I just noticed that user fatboy has written quite extensive documentation of NoScript's about:config prefs (in Russian), and linked it as their personal website: https://chico-gordo.github.io/
Last edited by barbaz on Mon Dec 14, 2015 1:15 am, edited 1 time in total.
Reason: update link
*Always* check the changelogs BEFORE updating that important software!
-

User avatar
Thrawn
Senior Member
Posts: 3106
Joined: Mon Jan 16, 2012 3:46 am
Location: Australia
Contact:

Re: Help documentation for Noscript

Post by Thrawn » Thu Oct 22, 2015 12:07 am

That's an impressive effort :). Google Translate isn't perfect, but gets the gist of it quite well.
======
Thrawn
------------
Religion is not the opium of the masses. Daily life is the opium of the masses.

True religion, which dares to acknowledge death and challenge the way we live, is an attempt to wake up.
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:41.0) Gecko/20100101 Firefox/41.0

fatboy
Senior Member
Posts: 50
Joined: Fri Jul 25, 2014 6:56 am
Contact:

Re: Help documentation for Noscript

Post by fatboy » Thu Oct 22, 2015 4:34 pm

Unfortunately, did not find the explanation to some items:
noscript.ABE.allowRulesetRedir
noscript.audioApiInterception
noscript.badInstall
noscript.forbidExtProtSubdocs
noscript.hideOnUnloadRegExp
noscript.injectionCheckHTML
noscript.nselNoMeta
noscript.oldStylePartial
noscript.secureCookies.recycle
noscript.visibleUIChecked
noscript.xss.checkCharset.exceptions
noscript.xss.trustData

Found, but did not understand the meaning:
noscript.asyncNetworking
https://noscript.net/changelog#1.9.4RC1
https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest/Synchronous_and_Asynchronous_Requests
http://bbs.kafan.cn/thread-1668724-1-1.html
noscript.clearClick.threshold
https://noscript.net/changelog#2.3.9
http://bbs.kafan.cn/thread-1668724-1-1.html
noscript.filterXGetRx
https://noscript.net/changelog#1.1.4.6.070318
noscript.forbidData
https://noscript.net/faq#qa3_14
noscript.policynames
https://forums.informaction.com/viewtopic.php?f=7&t=1986
noscript.safeJSRx
( https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox-3.5/#firefox3.5.2 )
https://noscript.net/changelog#1.1.6.18
http://forums.mozillazine.org/viewtopic.php?p=3034091&sid=71218cc119ebc263784163f742ebef79#p3034091
Last edited by barbaz on Thu Oct 22, 2015 5:08 pm, edited 1 time in total.
Reason: oops, I misunderstood what fatboy wanted posted
-

barbaz
Senior Member
Posts: 9145
Joined: Sat Aug 03, 2013 5:45 pm

Re: Help documentation for Noscript

Post by barbaz » Thu Oct 22, 2015 5:01 pm

Of the ones you found but couldn't understand, I can understand two:

> noscript.filterXGetRx

Code: Select all

  1. GET requests with a query string get all the matches for the
     noscript.filterXGetRx regular expression replaced with space

NoScript's XSS filter works in part by replacing "unsafe" portions of a URL with "safe" "equivalents". This pref seems to control at least somewhat what NS considers "unsafe" (although I don't understand all of the regex syntaxes used in it...)

> noscript.safeJSRx
Giorgio Maone wrote:NoScript prevents javascript: URLs from being loaded in top-level chrome window, in order to avoid chrome privilege escalations like the ones shown recently during the "URI handlers war".


So the browser window isn't "just a browser window", but a basically empty window containing a loaded chrome: document, which you know as all the browser UI and stuff. The NoScript feature in question here, prevents most javascript: URIs from being loaded in the same way as the chrome: document of the browser itself, defining in full which javascript: URIs are allowed.



Do those explanations help?
*Always* check the changelogs BEFORE updating that important software!
-

fatboy
Senior Member
Posts: 50
Joined: Fri Jul 25, 2014 6:56 am
Contact:

Re: Help documentation for Noscript

Post by fatboy » Fri Oct 23, 2015 7:51 pm

Certainly helped, thanks.
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Firefox/24.0 SeaMonkey/2.21

fatboy
Senior Member
Posts: 50
Joined: Fri Jul 25, 2014 6:56 am
Contact:

Re: Help documentation for Noscript

Post by fatboy » Fri Oct 30, 2015 9:06 pm

noscript.forbidData — is meaning "Data URI" (data: URL)?
https://en.wikipedia.org/wiki/Data_URI_scheme
https://ru.wikipedia.org/wiki/Data:_URL
http://sirdarckcat.blogspot.ru/2008/06/hacking-noscript.html

noscript.xss.trustData — bypass anti-XSS filter for "Data URI", if noscript.forbidData;false?
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Firefox/24.0 SeaMonkey/2.21

barbaz
Senior Member
Posts: 9145
Joined: Sat Aug 03, 2013 5:45 pm

Re: Help documentation for Noscript

Post by barbaz » Sun Nov 01, 2015 12:35 am

fatboy wrote:noscript.forbidData — is meaning "Data URI" (data: URL)?

I can't figure this out. I grep'd the code and it appears this pref is only referred to in code obtaining it for use, seems nothing is done with it?

fatboy wrote:noscript.xss.trustData — bypass anti-XSS filter for "Data URI",

Seems to be that, regardless of forbidData value - this code is placed just after the built-in XSS exceptions (and is the only reference to the pref):

Code: Select all

if (/^(?:javascript|data):/i.test(origin) && ns.getPref("xss.trustData", true)) {
*Always* check the changelogs BEFORE updating that important software!
-

fatboy
Senior Member
Posts: 50
Joined: Fri Jul 25, 2014 6:56 am
Contact:

Re: Help documentation for Noscript

Post by fatboy » Sun Nov 01, 2015 11:18 am

@barbaz
1. noscript.forbidData is related to ХMLНttpRеquеst.
( https://noscript.net/faq#qa3_14 )
2. ХMLНttpRequеst is related to data: url
( https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest/HTML_in_XMLHttpRequest#Method_2
https://dvcs.w3.org/hg/xhr/raw-file/tip/Overview.html#data:-urls-and-http
https://github.com/w3c/web-platform-tests/blob/master/XMLHttpRequest/data-uri.htm )
3. noscript.forbidData forbids data: url?
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Firefox/24.0 SeaMonkey/2.21

barbaz
Senior Member
Posts: 9145
Joined: Sat Aug 03, 2013 5:45 pm

Re: Help documentation for Noscript

Post by barbaz » Sun Nov 01, 2015 3:30 pm

I don't know what it's "supposed" to do but it seems to me from looking at the code like it currently does nothing.
*Always* check the changelogs BEFORE updating that important software!
-

fatboy
Senior Member
Posts: 50
Joined: Fri Jul 25, 2014 6:56 am
Contact:

Re: Help documentation for Noscript

Post by fatboy » Sun Nov 01, 2015 8:43 pm

Thanks.
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Firefox/24.0 SeaMonkey/2.21

Post Reply