[RESOLVED] NoScript and Tomahawklet

[Pluto]

When I try using the Tomahawklet (a bookmarklet that searches for songs on the current page and gives you a player to listen to them from sources like Youtube/Soundcloud in a sidebar to the left) while NoScript is on, Tomahawklet doesn't load right. Even if scripts are allowed globally, it doesn't load properly. I don't get any XSS warnings, ClearClick warnings, or anything pop up on my screen from NoScript. If I disable NoScript from Firefox's Add-on's page, the bookmarklet works again. If I open Firefox's Web Console, there don't appear to be any warnings or errors, just messages.

Can you help me configure NoScript for the bookmarklet? I've tried a bunch of settings in NoScript, but nothing worked... Here's the page for the bookmarklet: http://toma.hk/tools/tomahklet.php (it's the red "Play Now" button).

[Tom T.]

Please post any "messages" related to NoScript, typically starting with NOSCRIPT, ABE, XSS, etc.

Another possibility is an extension conflict. Please create a clean profile from scratch, install *only* NoScript in its latest version, and try the test again.
Please report results of this, including relevant errors or messages, thanks.

[Pluto]

Yeah I don't see anything related to NoScript that looks like it could be the cause of the problem... No messages at all.

I started a clean profile as you said, installed NoScript, added the bookmarklet, and tested it. The sidebar appears on the left, but it just says "Loading". I get the same result with scripts allowed globally while NoScript is running. From the web console, this is what happens after I click the bookmarklet:

On http://www.last.fm/music/Mika:
https://pacific.rsmart.com/access/conte ... unes1/Code (On a new page because of antispam filter from these forums)

All the "false: domain @ ..." messages (and one true message) are logged to the console every time as a result of this bookmarklet being run. It's part of the playgrab.js code to log those messages. You can also see the last message is unrelated...

Anyways, I can post a video to show you what I see on my side; screen recording is easy for me. I'll edit that in soon. In the meantime I'll try some of my own extra testing, though I doubt I'll figure anything new out.

[Pluto]

Looks like I was looking at the wrong console. Here's what I see from the Error Console (as opposed to the Web Console):

Code: Select all

[NoScript] Blocking nosniff Javascript served from https://raw.github.com/sydlawrence/tomahawklet/master/scrapers/rdf.js?_=1346736031675 with wrong type info text/plain, inline and included by http://www.last.fm/music/Blink-182

4 other JS files, removed bc of the spam filter.

How do I manage with getting NoScript to stop blocking that?


EDIT: Found my solution. http://forums.informaction.com/viewtopi ... 543#p33541

I'll email the main contributor to the Tomahawklet to see what he can do so that I won't have to have extra filters...

[Tom T.]

Looks like I was looking at the wrong console. Here's what I see from the Error Console (as opposed to the Web Console):

Code: Select all

[NoScript] Blocking nosniff Javascript served from https://raw.github.com/sydlawrence/tomahawklet/master/scrapers/rdf.js?_=1346736031675 with wrong type info text/plain, inline and included by http://www.last.fm/music/Blink-182

EDIT: Found my solution. http://forums.informaction.com/viewtopi ... 543#p33541

I'll email the main contributor to the Tomahawklet to see what he can do so that I won't have to have extra filters...

Thanks for searching the Forum. (We wish all would.)

The best thing that the sitemaster could do would be to do what Giorgio said in the linked thread:

Solution for the webmaster: copy the script in your own domain.

rather than serving it from the risky Github. Let's hope the advice is taken.