A couple of bugs

[azrael]

The freak, who's still using FF 3.0.19 on XP, is back!

This time I've got two issues; one recent and the other going back a few releases.

The first issue has to do with Flash on whitelisted sites. When I visit www.ppradio.dk, which is a site I've whitelisted, the logo using Flash is blocked. Until v2.3.3 I could bypass this by unchecking "Forbid Adobe Flash" on the Embeddings tab (which has always struck me as odd considering this option is for _untrusted_ sites). As of v2.3.3 (or some version between v2.3.2 and 2.3.3) this is no longer possible.

The second issue is more recent and perhaps a bit more serious. As of v2.3.6 (or some version between v2.3.5 and 2.3.6) FF will crash on me on certain sites like e.g. www.hotmail.com (usually after I've logged in and am supposed to be redirected to my inbox) and www.danskebank.dk, when I try to log in to do online banking. The browser will crash most of the time, but not on every occasion. I tried disabling NoScript, but that doesn't help. Rolling back to an earlier version like v2.3.5 does, however.

As previously stated I'm using FireFox 3.0.19 on Windows XP.

I'm using the following add-ins (besides NoScript):
Adblock Plus 1.2.2
CookieCuller 1.4
FlashGot 1.4.1
Java Quick Starter 1.0 (disabled)
Microsoft .NET Framework Assistant 1.2.1
User Agent Switcher 0.7.3

Also, I'm using Qute 3.3.9 as my FF theme.

If more info is needed, please let me know.

[Tom T.]

You do realize that compatibility and support for NS, as for most things, are assured only for supported browsers?

On Firefox 2.x, the highest possible NS is 1.10.

3.0 was abandoned ages ago, and (apparently) was such a mess that they jumped the version, not to 3.1, but to 3.5, to emphasize the degree of change.

Older browsers will have known, unpatched security flaws. NoScript cannot protect you from all of them. So it is a bit incongruous to use a strong security tool like NS on an out-of-date browser.

In any event, we can't offer support there. If you can reproduce your issues on a supported browser (you have three more weeks on Firefox 3.6.28, as do I), then please post back.

[azrael]

While I agree that FF 3.0.19 isn't exactly the latest version might I draw your attention to the blurb on the download page (http://noscript.net/getit). It clearly states: "Supported browsers: Firefox 3.0 and above". If FF3 is no longer supported, which would be totally understandable, then I'd expect NoScript _not_ to prompt me to install new versions. FF makes it possible to limit add-on versions to specific browser versions. For instance, I know that ABP exists in much newer versions than v1.2.2, but that is the last version that supports FF3. It would be great if NoScript would also adopt this feature.

As it stands, given that FF3 is supposedly (still) officially supported and I'm continuously prompted to install new builds, I'd expect them to work with the version of FF I'm using. And should I find bugs I will try to bring them to your attention, as I have done. For even though it might seem otherwise I really do appreciate all the work that is being done here by Giorgio and you guys.

As for FF 3.0 being such a mess that's the first I've ever heard of it. What I heard was that they missed several (self-imposed) deadlines and then decided to bump the version. If what you say is true, it would seem a bit rich though, considering the decline in quality that has hit the browser ever since the versionitis began last year. I've reported several bugs to Mozilla, which have been verified by others and are yet to be fixed. Seems like bumping the version has become a feature all in itself.

Firefox is still the best browser out there, in my opinion. Just in case you intend to suggest to me to switch to Chrome...

[Tom T.]

Agree completely on the versionitis, and that despite the problems, Fx is still the best.

Will attempt to reproduce on Fx 3.6.28. -- although support ends for the entire 3 branch on the 24th of this month.

[Tom T.]

....The first issue has to do with Flash on whitelisted sites. When I visit www.ppradio.dk, which is a site I've whitelisted, the logo using Flash is blocked.

Not for me. I merely TA'd ppradio, and it showed. Do you have RequestPolicy add-on? I did have to allow there also for the Flash logo to show.

.The second issue is more recent and perhaps a bit more serious. As of v2.3.6 (or some version between v2.3.5 and 2.3.6) FF will crash on me on certain sites like e.g. www.hotmail.com (usually after I've logged in and am supposed to be redirected to my inbox) and www.danskebank.dk, when I try to log in to do online banking. The browser will crash most of the time, but not on every occasion. I tried disabling NoScript, but that doesn't help. Rolling back to an earlier version like v2.3.5 does, however.

Quickest way:

Create a clean profile from scratch.
Install only NoScript, leaving the default settings.

If the problem disappears, NS is not the culprit. Add back the other add-ons, matching each one with NS, and eventually all of them one at a time, to find a possible extension conflict. If the problem is gone even with all of your add-ons re-installed, then probably the profile was corrupt. It happens more than most people realize. More on that in General Troubleshooting Instructions.

I don't use User Agent Switcher. Would it ever try to switch while you are logged in -- or trying to log in -- to a site requiring login? I can picture that messing things up -- the site thinks you're a different user from the one who logged in, etc. If not, disregard.

Let us know the results of the above, thanks.

[azrael]

Sorry for the late reply. Was away over Easter...

I tried your suggestion about creating a new profile with the profile manager (was at best dimly aware of this feature). Only thing added to this profile was the latest stable build of NoScript, v2.3.7. I then visited the mentioned sites and, sadly, all the problems remain. I then progressively downgraded to earlier stable builds with the same outcome as described in my initial report.

[Tom T.]

I tried your suggestion about creating a new profile with the profile manager (was at best dimly aware of this feature). Only thing added to this profile was the latest stable build of NoScript, v2.3.7. I then visited the mentioned sites and, sadly, all the problems remain. I then progressively downgraded to earlier stable builds with the same outcome as described in my initial report.

Could you please reproduce the problems with NS 2.3.7, then open Firefox Error Console (Ctrl+Shift+J or Firefox Tools > Error Console), click "Errors", and copy any red Error messages and paste them here? Also please click "Messages", and post here any messages relating to NoScript. Thanks.

As mentioned, I had no problem with the video at that link, and have never had the crashes you describe, so the error messages should be interesting and, let's hope, useful.

[azrael]

I'm not sure how much this helps but for ppradio.dk the error console lists the following:

Code: Select all

Error: key is null
Source File: file:///D:/Program%20Files/Firefox/components/nsUrlClassifierLib.js
Line: 1173

Code: Select all

Warning: Error in parsing value for property 'background-color'.  Declaration dropped.
Source File: http://www.ppradio.dk/includes/stylesheets/template.asp?template_id=1&nocache=02022012143448
Line: 307

For hotmail.com all I can post is the crash log:

Code: Select all

Add-ons: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}:6.0.31,{73a6fe31-595d-460b-a920-fcc0f8843232}:2.3.7,{972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.19
BuildID: 2010031422
CrashTime: 1334139273
InstallTime: 1270138628
ProductName: Firefox
SecondsSinceLastCrash: 264962
StartupTime: 1334139064
Theme: classic/1.0
URL: http://by146w.bay146.mail.live.com/mail/BrowserSupport.aspx?targetUrl=http%3a%2f%2fby146w.bay146.mail.live.com%2fmail%2fInboxLight.aspx%3fn%3d144226015&n=1861443956
Vendor: Mozilla
Version: 3.0.19

This report also contains technical information about the state of the application when it crashed.

All seems pretty useless to me. I used the CODE tags to make the URLs completely visible.

[Tom T.]

For hotmail.com all I can post is the crash log:

Code: Select all

Add-ons: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}:6.0.31

That looks like Java. The "Cafe" + "cafe (backwards)" is a dead give-away. ("Java" is en-US slang for coffee; hence the coffee-cup logo.)

Java is a plug-in, not an add-on... Does hotmail require, or use, Java? (as opposed to Javascript, a naming permission that has been regretted for more than a decade). .... If so, perhaps hotmail doesn't like the older version of Java.

I used the CODE tags to make the URLs completely visible.

Correct, thank you.

Were there no messages in the blue "Message"-icon portion of Error Console?

Just took a second look at your earlier post:

I tried disabling NoScript, but that doesn't help. Rolling back to an earlier version like v2.3.5 does, however.

That makes no sense at all. If 2.3.5 does not cause the error, how can the error occur when NS is disabled?
Does it happen if you do the clean profile *without* installing NoScript?

(For safety's sake, I'd go only to the online bank, which we hope is trustworthy, to test the no-NoScript idea.)

[dhouwn]

Java is a plug-in, not an add-on...

It also ships or at least shipped with a (AFAIK marked as hidden) add-on in the past called "Java Console" or something like that.
You should find a folder with this GUID in the name in your global extensions directory, e.g. "%programfiles%\mozilla firefox\extensions"

[azrael]

For hotmail.com all I can post is the crash log:

Code: Select all

Add-ons: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}:6.0.31

That looks like Java. The "Cafe" + "cafe (backwards)" is a dead give0away. ("Java" is en-US slang for coffee; hence the coffee-cup logo.)

Java is a plug-in, not an add-on... Does hotmail require, or use, Java? (as opposed to Javascript, a naming permission that has been regretted for more than a decade). .... If so, perhaps hotmail doesn't like the older version of Java.

I used the CODE tags to make the URLs completely visible.

Correct, thank you.

Were there no messages in the blue "Message"-icon portion of Error Console?

Just took a second look at your earlier post:

I tried disabling NoScript, but that doesn't help. Rolling back to an earlier version like v2.3.5 does, however.

That makes no sense at all. If 2.3.5 does not cause the error, how can the error occur when NS is disabled?
Does it happen if you do the clean profile *without* installing NoScript?

(For safety's sake, I'd go only to the online bank, which we hope is trustworthy, to test the no-NoScript idea.)

I just tried "barebacking" Hotmail. The reason for this and not the banking site is that visiting Hotmail with any version of NS higher than 2.3.5 results in a 100% guaranteed crash whereas visiting the banking site is a bit hit and miss. Unsurprisingly, Hotmail works perfectly without NS. Why disabling NS hasn't the same effect as uninstalling it or rolling back to an non-affected version is beyond me. Do you by any chance have a complete list of filenames for NS versions between 2.3.5 and 2.3.6 so I might be able to narrow down which beta version or release candidate first causes the issue?

Java is a plug-in, not an add-on...

It also ships or at least shipped with a (AFAIK marked as hidden) add-on in the past called "Java Console" or something like that.
You should find a folder with this GUID in the name in your global extensions directory, e.g. "%programfiles%\mozilla firefox\extensions"

That's correct. I've got Java 6 Update 31 installed (the recommended version according to Java.com), which installs the Java Console. It might very well be installed as an add-in.

[Tom T.]

Java is a plug-in, not an add-on...

It also ships or at least shipped with a (AFAIK marked as hidden) add-on in the past called "Java Console" or something like that.
You should find a folder with this GUID in the name in your global extensions directory, e.g. "%programfiles%\mozilla firefox\extensions"

Good point, but that's only a few K, whereas the installed %prog%\Java JRE is double- or triple-digit MB. Also, Java is listed in about:plugins, as a plugin, and profile\extensions has no "Java add-on". So it does seem as though MZ regards it as a plug-in.

I just tried "barebacking" Hotmail. The reason for this and not the banking site is that visiting Hotmail with any version of NS higher than 2.3.5 results in a 100% guaranteed crash whereas visiting the banking site is a bit hit and miss.

*That* is really weird. It should either be compatible with the bank or not. Have you checked for malware, with your own AV scanner, and perhaps with MalwareBytes.org Anti-Malware? IIIRC, they have a free trial version.

Were there no messages in the blue "Message"-icon portion of Error Console?

Try a fresh install of Fx. Firefox Portable gives you a free, fully self-contained one that you can run from a flash drive without messing with your computer itself -- no installation. The hit-and-miss thing sounds more like a Firefox issue or corruption, since "disabling NS" still causes the issue.

Unsurprisingly, Hotmail works perfectly without NS. Why disabling NS hasn't the same effect as uninstalling it or rolling back to an non-affected version is beyond me. Do you by any chance have a complete list of filenames for NS versions between 2.3.5 and 2.3.6 so I might be able to narrow down which beta version or release candidate first causes the issue?

NoScript version history. If you can do that, great.

That's correct. I've got Java 6 Update 31 installed (the recommended version according to Java.com), which installs the Java Console. It might very well be installed as an add-in.

Type about:plugins in the Address Bar. Is Java not listed as a plug-in?

See above reply to dhouwn. Do you have Java in your profile, in the "extensions" folder?

One last thought: Perhaps the bank is unhappy with the unsupported browser. Waay back, one online bank warned me that they would stop support for F2 a few months after official end-of-support. Just to see how astute they were (most banks aren't), I'd occasionally try to log in with F2. When they started to deny it, I changed the user agent to Firefox 3.x -- and it logged in, for the *next three years*. Finally, about a month ago, it got to where the login still worked, but the page layout was sometimes messed up.

What I'm saying is that banks are trying to be more proactive in security, sometimes, so you might check the bank's online help as to which browser versions are supported, or call their help line. Perhaps they just don't want you to log in with the unsupported one, even though you're willing to take the risk. It would not be unreasonable.

In fact, I just tried to get to your bank's login page, (with F2) and got the answer. Back shortly after I can get screenshots posted. But yes, you need to allow an <IFRAME>, Java, *and* the bank's "security software".

[Tom T.]

So, there you have it. You need their "security software". My online bank tried to push that on me, too, although they didn't require it.
I sent them a link to a tech article describing how that bank's "securiity software" could be trivially defeated. Never heard back from them, but they left me alone.
Until about three months later, when they tried to push it again.

I don't know what your bank is using, but find the name and search the Web for it.
If it's "Rapport", see the articles about how easy it is to bypass. Snake oil.

Anyway, I think that's where the real problem lies.

[azrael]

The issue with my online banking site is the same as with Hotmail. The browser simply crashes. However, as opposed to Hotmail it doesn't _always_ crash. When the banking site doesn't crash I have no issues whatsoever. There's nothing to be downloaded, by the way. The site uses NemID, which is a nationally enforced digital identification system. Every bank and governmental institution _must_ use it. NemID was created and is maintained by DanID and runs as a Java app. Both Danske Bank and DanID are completely whitelisted in NS.

I've downloaded Firefox 3.0.19 from PortableApps.com (http://portableapps.com/apps/internet/f ... n#legacy30). It exhibits the _exact_ same issues as my own local Firefox installation. I can neither see the Flash logo on ppradio.dk even though the site is completely whitelisted, nor can I log on to Hotmail without experiencing a browser crash.

I haven't had time to check through the beta versions of NS yet, so I can more precisely pinpoint when the respective problems started. Thanks for the link, though.

By the way, about:plugins lists the following related to Java.

Code: Select all

Java Deployment Toolkit 6.0.310.5

    File name: npdeployJava1.dll
    NPRuntime Script Plug-in Library for Java(TM) Deploy

MIME Type 	Description 	Suffixes 	Enabled
application/java-deployment-toolkit 			Yes

Code: Select all

Java(TM) Platform SE 6 U31

    File name: npoji610.dll
    Classic Java Plug-in 1.6.0_31 for Netscape and Mozilla

MIME Type 	Description 	Suffixes 	Enabled
application/x-java-vm 	Java 		Yes

[azrael]

Well, I just wanted to go through the release candidate versions using the link provided, but that won't work. Although it lists the number of release candidates for each version the download link always leads to Mozilla's add-in page for NoScript, which currently lists v2.3.6.

I then tried deducing the filename and download it directly from the InformAction website, e.g. https://secure.informaction.com/downloa ... 3.3rc1.xpi for the 2.3.3 RC1 version, but neither that nor any other combination I've tried worked. If someone could supply me with either the files or usable links I'd much appreciate it.