[Bug] 2.3.7rc2 - YouTube HTML5 video blocked

[anonymous_usr]

NoScript 2.3.7rc2.
Firefox Nightly 2012-04-02.
Relevant config: forbid <AUDIO> / <VIDEO>, Apply these restrictions to whitelisted sites too.

Problem:
Videos delivered in HTML5 (ogg) by YouTube do not play after allowing them. The video is reloaded after allowing (expected), but then blocked again. This does not apply to Flash videos.
STR:
1) Open a YouTube video delivered in HTML5 (e.g. http://www.youtube.com/watch?v=VQlRmSP8bbo).
2) Click the place holder to allow the video to load.
3) Video is reloaded and subsequently blocked.
Workaround:
From the NoScript context menu: Blocked Objects -> Temporarily allow *@youtube.com.

[therube]

NoScript and Youtube

[Giorgio Maone]

Unfortunately there's no easy fix.
If the page is not reloaded, the page-provided movie controls cannot work because when they've been wired the video object was not present.
If the page is reloaded, the video URL changes (every time two unique parameters are changed, i.e. "upn" and "signature"), therefore the permissions you just gave don't apply.

Possible partial "solutions":

1) Remove the two unique parameters from permissions match. This is obviously an ad-hoc "solution" which won't work in similar situations elsewhere, and could possibly lead to different movies being allowed together on other sites (for instance if "signature" identifies the file).
2) Don't reload but force the browser built-in movie controls to be enabled. Of course this brings another dilemma: should the content-provided UI be hidden for cosmetic reasons (with another ad-hoc solution)? And would doing that hide important UI pieces?
3) Both? (you would get the built-in control without a reload, but if you're unsatisfied you'd just reload to get the movie with Youtube-provided controls)

[Tom T.]

IDK about Fx 14, but the OP's video and STR worked fine for me on Fx 11, using the one-more-click workaround I posted in the thread linked by therube:

In Fx 11.0, one must allow or TA youtube.com and ytimg.com, but clicking the placeholder still isn't enough. I had to TA from Blocked Objects Menu also:

Code: Select all

video-ogg@http:o-o.preferred.mia05s03.v7.lscache.3.c.youtube.com

Note that this is much more specific than *@youtube.

Is there some reason that this won't work in F14? (The numbers after "preferred" will vary, of course.)

I double-checked by revoking all temp permissions, *reloading the page* to change the signature as Giorgio mentioned, and the two clicks still work: one on the placholder, one on the video-ogg as above.

All of the controls (AFAIK that are supposed to be there) work fine.

Entire Embeddings tab is checked, including Apply to Whitelisted.

[Giorgio Maone]

one on the video-ogg as above.

You just need this one. It allows all the variants, accounting for changes in the path and in the query string, and automatically reloads the page, thus allowing the controls to be wired with the video object.

[Tom T.]

one on the video-ogg as above.

You just need this one. It allows all the variants, accounting for changes in the path and in the query string, and automatically reloads the page, thus allowing the controls to be wired with the video object.

I'm so accustomed to clicking placeholders that I never even though of trying BO menu directly, without the placeholder click first.

So we have our one-click, video-specific workaround, yes?

O/T: I know you're busy, but at the other thread linked, your opinion was solicited as to the comparative safety of the new HTML5 YouTube versus traditional Flash. If you have a moment, perhaps a one- or two-line precís? If not, then some other time, thanks.