Temporary Permissions' Persistence

[PristineVisitor]

So, I'm not sure if this is related to jumping to Firefox 37 (Aurora channel) or whether it was related to getting a NoScript update (I don't reset browsers very often) however I noticed that some time in between today and yesterday afternoon the behavior for Temporary Permissions' persistence seems to have changed.

Normally once all tabs with a website where temporary permissions were given have been closed the temporary permissions goes away. This is great because
a) I don't close my browser down ever
b) Sites like Google Search which do annoying things with Javascript enabled. Unfortunately if you need to use Google Maps you have to enable javascript for Google domain and thus all of Google now has access to do a bunch of annoying stuff.

Now I find that this is no longer the behavior. I have to actually explicitly revoke all of the temporary permissions or exit the browser.

Even odder, I was killing/crashing the browser a lot last night and it seems that temporary permissions now become permanent when the browser closes down ungracefully?

I've looked for options pertaining to this and could not find anything.

Thoughts?

Thanks,

[barbaz]

I have to actually explicitly revoke all of the temporary permissions or exit the browser.

That (just the quoted part) is how it's supposed to be and how it's always been...

[PristineVisitor]

I have to actually explicitly revoke all of the temporary permissions or exit the browser.

That (just the quoted part) is how it's supposed to be and how it's always been...

On one hand, I've read the FAQ and so yes that's how it's supposed to work.

On the other hand, I've been using NoScript for probably 2-3 years on every machine that I have. And I remove all whitelists and almost never put a permanent whitelist on most machines. And In that time I have probably used "Revoke Temporary Permissions" maybe 20 times. I Enable Javascript and Close out Web pages out probably 200-300 times a day and then go back to a lot of them (especially Google Search) across all of the machines that I use NoScript on. And I pay very close attention to ensuring that websites that. And just recently has Google constantly been having Javascript enabled despite me closing out the website(s) where I had to enable Google (usually for captcha or their map BS).

So a part of me is WTF

[therube]

Normally once all tabs with a website where temporary permissions were given have been closed the temporary permissions goes away.

That has never been the case.

[Thrawn]

Normally once all tabs with a website where temporary permissions were given have been closed the temporary permissions goes away.

That has never been the case.

It would be a useful behavior, actually, but mostly for privacy reasons; there's not much security benefit in revoking permissions after you've already visited.

And I'm guessing that to implement it, NoScript would have to poll every few seconds, like the Self-Destructing Cookies addon...

[PristineVisitor]

Normally once all tabs with a website where temporary permissions were given have been closed the temporary permissions goes away.

That has never been the case.

It would be a useful behavior, actually, but mostly for privacy reasons; there's not much security benefit in revoking permissions after you've already visited.

And I'm guessing that to implement it, NoScript would have to poll every few seconds, like the Self-Destructing Cookies addon...

(For my scenario) It's more for shared Javascript websites (CDN etc).
E.g. 20 websites load jQuery from jQuery's CDN (As some people may not know jQuery was "silently" hacked a while back and delivered malware to millions of people).

I only allow it for "one" website and when I'm done with that website I expect that "temporary permission" to go die. And nobody else to pick it up.

It shouldn't require repolling. The act is triggered upon closing a tab and seeing whether that website is complete (e.g. if you were visiting www.microsoft.com and had to enable a bunch of javascript just to make their website work (Thanks Microsoft for tagging all of your websites with random display:hidden crap) and now you were done closing 2 tabs out). When the last tab closes out any temporary permissions that were granted through that website should be gone.

The only complex thing is tracking when a single website (say jQuery's CDN) crosses multiple websites. You would have to make sure that even though the jQuery CDN is a temporary permission it was not actually granted on the 2nd website (because it already existed) and so is not revoked when 2nd website is closed out if first website is still open.

[barbaz]

e.g. if you were visiting www.microsoft.com and had to enable a bunch of javascript just to make their website work (Thanks Microsoft for tagging all of your websites with random display:hidden crap)

Heh. viewtopic.php?f=26&t=20455

[MSUser]

Heh. viewtopic.php?f=26&t=20455

Yes! It's a real winner here. I hated having to stuff around with View>No Style etc etc for the past couple of update days.

On the revoke Temp Permissions per tab rfe, if it's not too off topic, I'd never trusted those popular 3rd party scripts much. In the absence of this enhancement for NS I've been a single-Fx-instance-per-domain habitue since they became so popular. Exceptions of course do come up, but only for those domains I know don't use 3rd party off-the-shelf active stuff.
Initially I felt hard done-by with the lack of multiple tabs, but somehow it's turned productivity up a couple of notches. Instead of opening links out to other domains in new tabs I bookmark in a self-authored script that mirrors workflow within the Fx session. Remarkably, at least for my own browsing style, when I return to the flow I mostly decide to ignore half the links out. Sorry for the slight hijack.

[Thrawn]

The act is triggered upon closing a tab

Is that an event that is advertised to addons? If so, then I would think that Self-Destructing cookies would use it. If not, then polling is needed.

The only complex thing is tracking when a single website (say jQuery's CDN) crosses multiple websites. You would have to make sure that even though the jQuery CDN is a temporary permission it was not actually granted on the 2nd website (because it already existed) and so is not revoked when 2nd website is closed out if first website is still open.

That's basically what SDC does.

You might be better off writing an ABE rule, so that you don't need to keep temporarily allowing each time. Or better still, put JQuery in a surrogate. Feel free to ask for assistance with either one.

[PristineVisitor]

From a quick look at the Plugins SDK for Firefox seems pretty do-able.

Track tabs

You can register event listeners to be notified when tabs open, close, finish loading DOM content, or are made active or inactive:

var tabs = require("sdk/tabs");

// Listen for tab openings.
tabs.on('open', function onOpen(tab) {
myOpenTabs.push(tab);
});

// Listen for tab content loads.
tabs.on('ready', function(tab) {
console.log('tab is loaded', tab.title, tab.url);
});

[barbaz]

The act is triggered upon closing a tab

Is that an event that is advertised to addons?

Sure it is, https://developer.mozilla.org/docs/Web/Events/TabClose