NSA++ not working with Firefox Mobile Beta 34?

[randomusername67]

As the title says, it doesn't seems to work for me. After the installation every page just show a white page.

I've already tried to install/reinstall Firefox and to clear data, but it doesn't seems to make any difference.

[Guest]

Second that.

All recent FF mobile 34 betas with NSA++ enabled result in a blank screen; Sony Z2tab w/ 4.4.2. Disabling NSA++ and all's (not so) fine.

In case it matters: NSA++ 3.5a6rc201407162251

Would be really great and appreciated if this could be fixed. I could not imagine to run FF mobile w/o NSA++ - I need to prevent FF mobile stable to upgrade to 34 ...

[Lekensteyn]

Confirmed, the page stays blank with NSA enabled in Firefox 34.0 (Firefox Beta). With NSA disabled (both via about:addons and via a new profile in Guest Session), pages do load.

The logs do not reveal interesting details, this was acquires after opening https://lekensteyn.nl/ via the location bar:

Code: Select all

D/Telemetry(10718): StopUISession: awesomescreen.1, reason=commit
D/Telemetry(10718): StopUISession: frecency.1, reason=null
D/Telemetry(10718): StopUISession: homepanel.1:4becc86b-41eb-429a-a042-88fe8b5a094e, reason=null
D/Telemetry(10718): SendUIEvent: event = loadurl.1 method = actionbar timestamp = 30366957 extras = user
D/GeckoTabs(10718): handleMessage: Content:StateChange
D/GeckoLayerClient(10718): Window-size changed to (720,786)
E/GeckoConsole(10718): [NSA] false
I/Gecko   (10718): [NSA] false
D/GeckoToolbar(10718): onTabChanged: MENU_UPDATED
D/GeckoBrowserApp(10718): BrowserApp.onTabChanged: 5: MENU_UPDATED
D/GeckoToolbar(10718): onTabChanged: START
I/GeckoToolbarDisplayLayout(10718): zerdatime 6768903 - Throbber start
D/GeckoBrowserApp(10718): BrowserApp.onTabChanged: 5: START
D/GeckoTabs(10718): handleMessage: SessionHistory:New
D/GeckoTabs(10718): handleMessage: Content:LocationChange
D/GeckoTabs(10718): handleMessage: Content:SecurityChange
D/GeckoTabs(10718): handleMessage: DOMTitleChanged
D/GeckoTabs(10718): handleMessage: DOMContentLoaded
E/GeckoConsole(10718): [NSA] false
I/Gecko   (10718): [NSA] false
D/GeckoTabs(10718): handleMessage: Content:PageShow
D/GeckoTabs(10718): handleMessage: Tab:ViewportMetadata
D/GeckoTabs(10718): handleMessage: Tab:ViewportMetadata
D/GeckoTabs(10718): handleMessage: Content:StateChange
D/GeckoLayerClient(10718): Window-size changed to (720,1230)
D/GeckoToolbar(10718): onTabChanged: TITLE
D/GeckoBrowserApp(10718): BrowserApp.onTabChanged: 5: TITLE
D/GeckoToolbar(10718): onTabChanged: MENU_UPDATED
D/GeckoBrowserApp(10718): BrowserApp.onTabChanged: 5: MENU_UPDATED
D/GeckoToolbar(10718): onTabChanged: LOCATION_CHANGE
D/GeckoToolbarDisplayLayout(10718): updateFavicon(null)
I/GeckoToolbarDisplayLayout(10718): zerdatime 6769338 - Throbber stop

[Lekensteyn]

After two hours fruitless setting breakpoints, I employed the ol' good "log && return" trick. It turns out that something in FF34 broke the usage of -moz-binding in a user stylesheet (content/user.css -> content/ns.xml).

Whenever a page has the "noscript-ui" class attribute for its HTML root element, it will display properly. Possible alternatives to injecting the NS icon is adding a menu item and/or investigate whether the icon can be added to the chrome.

[barbaz]

It turns out that something in FF34 broke the usage of -moz-binding in a user stylesheet

Oh.. you need to set bindToUntrustedContent="true" on the binding

[Lekensteyn]

It turns out that something in FF34 broke the usage of -moz-binding in a user stylesheet

Oh.. you need to set bindToUntrustedContent="true" on the binding

I have just tried it and although the page now displays properly, the icon is still disfunct. Clicking it results in:

Code: Select all

[JavaScript Error: "NS_ERROR_XPC_BAD_CONVERT_JS: Could not convert JavaScript argument arg 0 [nsISupports.QueryInterface]" {file: "resource://noscript_3_5a6rc201407162251/modules/ContentUI.jsm" line: 72}]

Since NoScript is a security product and the Mozilla devs probably have good reasons to apply this restriction, I went ahead and implemented the whitelist via a menu instead. While doing so I also fixed some bugs. See https://github.com/Lekensteyn/noscript- ... f34-fix-ui (in case I rebase, https://github.com/Lekensteyn/noscript- ... ...d69dce1).

What do you think of this alternative approach?

[hempeter]

What do you think of this alternative approach?

I think the menu interface idea is much cleaner and better. The overlay icon sometimes didn't appear for me, and the overlay window sometimes didn't respond well to resizing.
Hats off I say. Thanks for the hours you put into this!

[Meteron]

I would like the menu method- the noscript icon is tiny on larger mobile screens.

[Lekensteyn]

I would like the menu method- the noscript icon is tiny on larger mobile screens.

For those who would like to try this, I have uploaded the XPI generated from my repo to https://lekensteyn.nl/files/noscript-nsa/. Auto-updating is disabled, so be sure to check this forum once in a while. (there does not seem to be much activity though).

Btw, I recently got a false XSS positive from moz-nullprincipal, not sure if it is related to this.

[kevin551]

I prefer the new menu ui.
The default ui which I don't like - On my tablet the noscript icon is about 2mm square in the bottom left. It overlays as a layer the the ghostery icon which is a more usable 1cm square.

[Meteron]

Tried downloading the addon (uninstalling the normal noscript first, since it didn't seem to work with it) and it didn't give me a menu option on firefox regular or beta.

[Lekensteyn]

Tried downloading the addon (uninstalling the normal noscript first, since it didn't seem to work with it) and it didn't give me a menu option on firefox regular or beta.

You are supposed to get a menu option in the same place where you see Back/Forward/Favorite/Settings, etc. What phone do you have? This was tested on a Samsung Galaxy S III i9300 with Android 4.4.4 (CM 11).

[Meteron]

Tried downloading the addon (uninstalling the normal noscript first, since it didn't seem to work with it) and it didn't give me a menu option on firefox regular or beta.

You are supposed to get a menu option in the same place where you see Back/Forward/Favorite/Settings, etc. What phone do you have? This was tested on a Samsung Galaxy S III i9300 with Android 4.4.4 (CM 11).

I checked and it was there- I thought by menu you meant it would go in the address bar mini-menu like HTTPS everywhere or refresh, but having it in the side menu is probably better anyhow.

[Spash]

Since NoScript is a security product and the Mozilla devs probably have good reasons to apply this restriction, I went ahead and implemented the whitelist via a menu instead. While doing so I also fixed some bugs. See https://github.com/Lekensteyn/noscript- ... f34-fix-ui (in case I rebase, https://github.com/Lekensteyn/noscript- ... ...d69dce1).

What do you think of this alternative approach?

Allow me to thank you so much for this, now that FF 34 has been pushed into the Google Play store, <finding> your update is literally the highlight of my day. Without your fix, I'd have had to completely stop browsing the web on a tablet for the time being (wouldn't let vanilla Firefox access the web on its own and JavaScript security/control in other Android browsers is beyond tragic, so there are no options).

Additionally to making NoScript work again, your menu approach also works around the problem present on many web sites, when either the NoScript icon or the subsequent popup don't react to touch presses at all, previously leaving you with the only option to edit json manually. That said, have you considered an option of adding the NoScript icon to the URL bar, i.e. similarly to what this addon does?

https://addons.mozilla.org/EN-us/androi ... n-android/

Having a plainly visible notification that there were scripts blocked (as with the old approach) on a particular site would be mightily useful. Also accessing NoScript would be slightly faster that way (e.g. my current Firefox menu lists 19 items at the moment, with the nasty habit of shuffling them around every other moment, so it gets a little crowded in there).

Edit: URL.

[js_blocker]

@Lekensteyn: Thank you very, very much. I even registered to this forum to write down my kudos. Installed your version a few weeks ago and it's working - imo flawless \o/. So, thanks again!

Let me second what 'Spash' wrote. I'm more than happy you took over (at least for the time being) to make NSA work for FFM 34. The current menu approach is a good solution. Better might be to add a notification icon, too - as mentioned from Spash. But hey, it's working.

btw, I'm still reluctant to update FFM v33 stable to v34. This is jut to the fact that I'm not sure how/what the future of nsa will look like.