[RESOLVED] Some javascript not blocked?

[Peuc]

Hi,

I just noticed a behaviour of NoScript I cannot explain, so I report it there to get your though on this.
It seems some Google javascripts are still working no matter NoScript says it's blocked or not.

Steps to reproduce :
- Deactivate javascript globally, flush your white list, and so on...
- Go google.com and search anything
- On the result page, you'll notice the first time you pass you mouse cursor on a result title, the link brings to a Google redirection page.
- Move your cursor out
- When entering the title link again, the link is now direct to the website
Even if you don't move the cursor out, the link is rewritten when clicking.

Google is known to rewrite URLs when user clicks, but this is not supposed to work if NoScript blocks all javascript, so I suspect some kind of bug in NS.
Moreover this doesn't appear with javascript disabled in about:config.

I'm currently using NoScript version 2.6.8.20.

Any clue?

[barbaz]

not a "google" script
the cause is this default builtin surrogate script for google search pages

about:config -> noscript.surrogate.glinks.replacement

Code: Select all

for each(let et in ['focus','mouseover','mousedown','click'])addEventListener(et,function(e){var a=e.target,href=a.href&&a.getAttribute&&a.getAttribute('href');if(href&&/^(?:http|\/url)/.test(href)&&!a._href){a._href=a.href=a.href.replace(/.*\/url.*[?&](?:url|q)=(http[^&]+).*/,function(a,b)decodeURIComponent(b));do{if(/\brwt\(/.test(a.getAttribute('onmousedown')))a.removeAttribute('onmousedown')}while((a=a.parentElement))}},true)

.sources

Code: Select all

!@^https?://[^/]+google\..*/search

[Peuc]

Nice, I wasn't aware of this rewriting feature.

Thank you for the explanation!

[Thrawn]

If you know JavaScript, you can define your own surrogates, too. It's similar to Greasemonkey.