problem finding cause of new windows

[scripteze]

I sometimes have problems determining the exact cause of whole new windows or popups.
That's question # 1 - using Firefox, what's the easiest way to determine the type ? element ? causing the pop ups, whether in a complete new browser window or not?

One recent site has a separate (full) browser window that pops up (a full window, w/ all controls of normal browser). The windows sometimes pop in foreground, or in background (just adds another Fx icon in task bar). But it's an entire new window.

I looked in Fx inspector to find the URL displayed in address bar of the popup new window: hXXp://www.torntv-downloader-dl.info. It appeared to be in an "iframe." Though I never found (in source for original page) what was responsible for causing the new windows. Don't have much experience w/ blocking iframes or "full windows."

FIRST: I listed the the "bad" URL (shown in new windows), in Kaspersky IS - "block list." Didn't help.
Then I disabled iframes in NoScript. That seemed to keep the new, full windows from opening over the top of existing "good" window. Instead, new task bar icons for these windows kept opening in background (minimized) - every time I viewed a new page on the site. Eventually 5, 10, 15 "browser window icons" opened - all grouped under the main browser icon in task bar. Content of every new window was identical.

By now, I'm just playing. Next, checked "Collapse blocked objects." I think that helped.
It wasn't clear from NoScript's pop up window, if I'd already marked the "problem" domain as untrusted.

Eventually, after several more new "bad" windows or page icons opened, I marked that domain as Untrusted. Seemed to stick this time, but still can't see a list.
For now, no more pop up windows. But, trying to see which action actually stopped the problem, by reversing all changes I'd made didn't make it reappear.
Maybe because the domain is now marked untrusted (which I can't see)?

What if I didn't want to block that entire domain (in this case, it's OK to block)?

In the future, what's best way to find the cause of an undesired new window opening, so you know what settings to change - if any (vs. flagging entire domain as untrusted)?

Once a domain is marked Untrusted (maybe by mistake), how can that flag be removed? The FAQ:

3.10
Q: I added good-site.com to the black list ...

doesn't work in this case. Since the "bad" site no longer pops up, NoScript won't show it as an untrusted site.

If the site I thought was marked untrusted didn't "stick," then I'm confused. After reversing all recent setting changes in NoScript (to find which recent change was stopping the new windows), and if the "bad" site isn't flagged as untrusted, then I don't know why the pop ups stopped.
EDIT: I found the URL of "badsite" that I flagged untrusted & browsed there. NoScript now shows it marked untrusted.
For situations like this, seems we should be able to view all blacklisted sites? Without having to open the blacklisted sites in a browser. Even if have to open the list in separate editor.

Thanks.

[barbaz]

Not quite sure what you're asking regarding determining cause of popups...
If you don't want to script-block the site, just use a surrogate like this to block the site from calling window.open.

Code: Select all

noscript.surrogate.disable_popups.replacement : Object.defineProperty(window, "open", {set:function(){}});
noscript.surrogate.disable_popups.sources : @.badsite1.com .sub.badsite2.com

Where badsite1.com and sub.badsite2.com are the domains of the pages (not scripts) that are spawning annoying popups.

seems we should be able to view all blacklisted sites? Without having to open the blacklisted sites in a browser.

about:config -> edit noscript.untrusted (but watch for multiple instances of the same domain, would be listed also under http://domain and https://domain)

[scripteze]

Thanks - for answers & the code.
I assume because I first blocked scripts globally (as a test) & it didn't prevent the new "ad" window, that a script wasn't causing it.
Right or wrong, that's what happened. In fact, it went on after I changed to block scripts globally, after closing & reopening the main site, etc.

Until ??? I clicked ON the pop up window & marked the URL (listed in the window address bar) as untrusted. That's what I'm saying, it seemed that "blocking all scripts on all sites" didn't solve it. But marking the pop up URL as untrusted... did solve it? Shouldn't those 2 actions have done the same thing?

In this case, it was trickier to see how to block the window (not being an expert). On a (full) browser window pop up ... NoScript won't show the URL of that window - to mark untrusted, unless you click ON the window - AFAIK. Normally, you don't "click on crap" that pops up, because of risks - yes? Not knowing what's really there.

Seems like some risk, having to do that (for this case) before NoScript can / will show the domain to allow marking untrusted?
Don't know if there'd be a way to change NoScript behavior so you wouldn't have to click the new window, to be shown a domain? I'm sure that's part of why they made a separate pop up window - to make harder to avoid.

But here, (seems) even if I'd wanted to leave scripts blocked globally, it didn't seem to affect this one. Unless there was a "glitch" in NoScript recognizing the setting.
I'm positive I first blocked scripts globally & it didn't stop the pop up. After the global blocking, a couple other "good" sites complained about javascript being off, so apparently it was.

I'm just guessing as to why blocking scripts globally didn't stop the problem. I've made lots of setting changes in Fx, other apps - where it was "set to do xyz," but didn't. At times, toggling a setting AGAIN will make it start working. I must be missing something.

I understand the code you wrote (mostly). What is it actually telling NoScript to / not to do (the 1st entry)?
Does inserting those 2 entries add * new * function to NoScript, or modify existing ones?

[barbaz]

scan your system for malware

I understand the code you wrote (mostly). What is it actually telling NoScript to / not to do

those prefs telling noscript to run that "userscript" which effectively removing window.open from the content DOM on the listed pages, when those pages are script-allowed

[scripteze]

OK, thanks.

Why do you say scan my system? I certainly can, but you're not saying that just because NoScript had a hiccup? Even if it was my fault.
I'm not seeing any of the many, typical signs of malware.

[barbaz]

Because AFAIK new windows don't just open like that without user interaction or active content, and the only way a NoScript "hiccup" could have occured is if you didn't reload some page after the forbid scripts globally, or something in your whitelist was still running active content, but it didn't sound like either was the case.

Unless you've got some plugin that you aren't forbidding at all with NS?