NoScript Reset Bugs

[ddigas]

Hello,

I would like to report the following bugs:

1. When using the reset button to reset all the preferences & site permissions to the default values the default whitelist is different to the one initially installed (eg. I noticed that in recent versions the top level domain wlxrs.com has been added to the default whitelist. When you use the reset button the default whitelist does not contain the top level domain wlxrs.com but the sub domains js.wlxrs.com & msc.wlxrs.com).

2. When using the reset button to reset all the preferences & site permissions to the default values the UNTRUSTED sites are not reset. I verified this by using the reset button and then immediately exporting the whitelist. All UNTRUSTED entries I had before the reset were still there.

I am currently running NoScript v2.1.9 on Firefox v8.0. Please verify my findings and fix this as soon as possible.

Feel free to ask for any additional information if required

Best regards,

Dimitris

[therube]

1. actually it is js.wlxrs.com & msc.wlxrs.com. assume it had been the other way around, but was changed to lessen its scope.

if an older version of NoScript had been installed, & if wlxrs.com was the default at that time, a later NoScript version would not change those defaulted settings. though once you click the Reset button, it resets the defaults anew to those found in the xpi.

Code: Select all

\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi\defaults\preferences\noscript.js

2. that looks like a bug in the Export process, where it is still listing the now removed domains. though in fact the domains are removed. after a browser restart, the Export list is correct. if you open about:config & filter it on, noscript.untrusted, you will see your untrusted list. keep that window open, then do a Reset. you will see that preference revert to default, all domains removed. (though as you say, an export at that point will still list them.)

[therube]

Well something doesn't jive.
http://noscript.net/changelog

Code: Select all

v 2.1.1.2rc6
==========================================================================
x Removed msc.wlxrs.com and js.wlxrs.com, adding just wlxrs.com to the
  default whitelist and to the whitelists of Hotmail users, after Microsoft
  explained that this is the future-proof permission needed to ensure
  compatibility with the Live webmail

Code: Select all

v 2.1.1.2rc4
==========================================================================
+ Added msc.wlxrs.com to the default whitelist as requested by the Hotmail
  team (new domain required for Hotmail to work)

+ One-time merge of the default whitelist to integrate services already
  whitelisted as needed (e.g. hotmail.com to imply msc.wlxrs.com)

Code: Select all

v 1.9.9.57
==========================================================================
x Included js.wlxrs.com in default whitelist in order to make Hotmail
  login work out-of-the-box for new users

[GµårÐïåñ]

AFAIK, deprecated items between versions don't always get removed on a profile. Untrusted not being removed I believe is due to the preservation of security and saving you trouble of having to re-unstrust them but I could be wrong. The reset has always to me been to ensure that any conflict between previous vs. current package settings are resolved by being set to the current package. Doesn't mean that it will just discard things that are not changed or user set. Now this is my take on it, you have to see what Giorgio says on that, as his motives and thought process are just that, his and we can only guess, assume or make education observations. To know for sure, you need to get it from the developer's mouth as to why.

[Giorgio Maone]

1. When using the reset button to reset all the preferences & site permissions to the default values the default whitelist is different to the one initially installed (eg. I noticed that in recent versions the top level domain wlxrs.com has been added to the default whitelist. When you use the reset button the default whitelist does not contain the top level domain wlxrs.com but the sub domains js.wlxrs.com & msc.wlxrs.com).

It has actually been a glitch in the build process which made the wlxrs.com domain be removed from the default whitelist and the two subdomain be restored instead, even though the changelog said the opposite.
Will be fixed (wlxrs.com being left as the only default entry) in next dev build.

2. When using the reset button to reset all the preferences & site permissions to the default values the UNTRUSTED sites are not reset. I verified this by using the reset button and then immediately exporting the whitelist. All UNTRUSTED entries I had before the reset were still there.

As therube said, it's a bug in the Export button which doesn't take in account the just happened reset. You need to restart the browser it to behave correctly.
I'll try to fix this in next dev build as well. Thank you for reporting.