Dojo Problems with NoScript Enabled

Ask for help about NoScript, no registration needed to post
NealWalters

Dojo Problems with NoScript Enabled

Post by NealWalters »

I finally had to "disable" No-Script to get Dojo to work in FireFox 3.5.2. Somehow, NoScript seemed to be preventing a JavaScript to download from a CDN source, even though I had "allow scripts globally".

Please see here for full details.
http://stackoverflow.com/questions/1362 ... -3-5-issue

Thanks,
Neal
Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2
User avatar
Giorgio Maone
Site Admin
Posts: 9454
Joined: Wed Mar 18, 2009 11:22 pm
Location: Palermo - Italy
Contact:

Re: Dojo Problems with NoScript Enabled

Post by Giorgio Maone »

It's working fine here.
I just needed to allow 3wcloud-com-provisioning-qa.appspot.com and ajax.googleapis.com.
Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2 (.NET CLR 3.5.30729)
User avatar
Foam Head
Senior Member
Posts: 57
Joined: Sun May 03, 2009 5:35 pm

Re: Dojo Problems with NoScript Enabled

Post by Foam Head »

I've been developing a Dojo 1.3.* web application in FireFox 3.0.* -> 3.5.2 (on Windows) and I've never had any issues like this with NoScript. It's possible that you and I have something configured differently, but once I've configured NoScript to include the necessary hosts (for the example you gave at stackoverflow.com, you'd need ajax.googleapis.com and 3wcloud-com-provisioning-qa.appspot.com to be trusted), it has never interfered with Dojo.

Looking at your example, I think the problem is your use of Dojo. It is very poorly documented, but the Dojo XD loader is an *asynchronous* loader. When using the XD loader, dojo.require returns immediately, but the module is loaded in the background. You aren't using any dojo.require's, but the concept applies to page loading as well. The only way to know when all dojo.require'd modules have been loaded is by using dojo.addOnLoad. My replies aren't visible (stupid Drupal software Dojo uses...), but you should be able to get the point from this Dojo thread.

Back to your example, you aren't using any addOnLoad's. This means you are completely relying on race conditions to define dojo.* before your inline JavaScript runs. I'm guessing that with NoScript doing some extra validations, the timing is different and you see an error. However, the root cause is the race condition. Use some addOnLoad's and you should see your problem fixed even with NoScript enabled :D.

-Foam
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2 (.NET CLR 3.5.30729)
NealWalters

Re: Dojo Problems with NoScript Enabled

Post by NealWalters »

Thanks. But let me recap:

1) I had NoScript set to the supposed dangerous 'Allow Scripts Globally'. If that is set - what more would be there be to set?

2) As to the race condition, I agree that if I need widget/dijits, etc..., that I would do a dojo.require in the onLoad. But we have a catch 22, if "dojo" itself is not available, I cannot do a dojo.require or a dojo.onLoad. So I don't believe that is the issue here.

3) Firebug and Fiddler both show that the dojo.js was never retrieved. (Unless FireFox itself thinks it has it cached somewhere.)

Google has an actual planned maintenance right now, so I can't retest everything, but I tried my local copy, and
adding ajax.googleapis.com to the "whitelist" seems also to fix it.

So my question is, if I have checked "Scripts Globally Allowed (dangerous)" why should I have to whitelist anything?


Thanks for the input.
Neal Walters
Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2
User avatar
Giorgio Maone
Site Admin
Posts: 9454
Joined: Wed Mar 18, 2009 11:22 pm
Location: Palermo - Italy
Contact:

Re: Dojo Problems with NoScript Enabled

Post by Giorgio Maone »

NealWalters wrote: 1) I had NoScript set to the supposed dangerous 'Allow Scripts Globally'. If that is set - what more would be there be to set?
Nothing else.
NealWalters wrote: 2) As to the race condition, I agree that if I need widget/dijits, etc..., that I would do a dojo.require in the onLoad. But we have a catch 22, if "dojo" itself is not available, I cannot do a dojo.require or a dojo.onLoad. So I don't believe that is the issue here.
The first inclusion (using a static SCRIPT element) is more stable and subject to timing / event loop / cross-browser issues than dojo.require and dojo.onLoad. They're definitely diffent beasts.
NealWalters wrote: 3) Firebug and Fiddler both show that the dojo.js was never retrieved. (Unless FireFox itself thinks it has it cached somewhere.)
This hints at a temporary networking issue.
NealWalters wrote: So my question is, if I have checked "Scripts Globally Allowed (dangerous)" why should I have to whitelist anything?
As I already said, no you shouldn't.
In facts, it's working fine for me "out of the box" with Scripts Globally Allowed and the default whitelist.
Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2 (.NET CLR 3.5.30729)
Post Reply