[RESOLVED] RSS feed reader broken in Nightly (49.x and 50.x)

[Internet User]

I am encountering a couple of issues where NoScript is breaking the rss feed reader and their livebookmark dropdown on toolbars

issue 1) feed reader is completely broken, it won't load the contents at all. here's an example with a fresh profile, clicking on subscribe does nothing as well.


issue 2) livebookmark dropdown on toolbars don't load unless the site is whitelisted, this wasn't the case in the past. I didn't need to whitelist a site to allow the feed to work, is this an undocumented feature (this is somewhat equivalent to blocking HTML reqs) or a bug?

[barbaz]

Probably a bug, so moving to NoScript Development

[Internet User]

any word on this?

[csalsa]

Raised in Bugzilla.
Bug 1272139 - RSS feeds don't render with any of their contents, in Nightly, if you have NoScript installed

Please vote for the bug in Bugzilla.

I am running FireFox release 48b5 and NoScript 2.9.0.12 rc1. I suspect the issue is with Firefox.

[DJ-Leith]

I think the issues in
"NoScript blocking Firefox live bookmarks"
viewtopic.php?f=7&t=21889

and

"RSS feed reader broken in Nightly (49.x and 50.x)"
viewtopic.php?f=10&t=21969

(this thread) have the same cause.
I think it may be due to changes in Firefox.

"bypass FireFox Secure Connection Failed prompt to whitelist any site (but doesn't work)"
https://bugzilla.mozilla.org/show_bug.cgi?id=1253673
which landed in Nightly on 2016-04-20. So this will now be in Fx Beta 48.

As csalsa posted, there is already a "Tech Evangelism" Bugzilla bug about how this impacted NoScript:

"RSS feeds don't render with any of their contents, in Nightly, if you have NoScript installed"
https://bugzilla.mozilla.org/show_bug.cgi?id=1272139

Another test.

https://noscript.net/feed?c=200&t=a
Should show the 200 most recent versions of NoScript (all versions including rc versions).

I tested with these 4 versions of Firefox today (2016-07-02).

Release and ESR are OK.
In Aurora and Nightly 'feeds / RSS are broken'.

Expected Result:
"NoScript Updates
Recent all builds from noscript.net"
followed by 200 versions of NoScript.

Actual Result:
In the 'broken case' you see the "Subscribe Now" button (at the top of the page)
but you do not see the
"NoScript Updates
Recent all builds from noscript.net"
You do NOT see any 'versions of NoScript' in a long list below.

In all 4 tests, using NoScript 2.9.0.12rc1 (20 May 2016), on separate Profiles.
"about:blank" is included in the 'NoScript Whitelist' for each Profile.
e10s, "Multiprocess Windows" is off on all these Profiles.

Using "about:support" to document versions of Firefox.

Code: Select all

Release 32 bit, on Windows is OK.
Name            Firefox
Version         47.0.1
Build ID        20160623154057
Update Channel  release
User Agent 	Mozilla/5.0 (Windows NT 6.1; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0

ESR 32 bit, on Windows is OK.
Name            Firefox
Version         45.2.0
Build ID        20160601155443
Update Channel  esr
User Agent      Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0

Aurora 32bit, on Windows 'feeds / RSS are broken'.
Name            Firefox
Version         49.0a2
Build ID        20160701004039
Update Channel  aurora
User Agent      Mozilla/5.0 (Windows NT 6.1; WOW64; rv:49.0) Gecko/20100101 Firefox/49.0

Nightly 64bit, on Windows 'feeds / RSS are broken'. 
Name            Firefox
Version         50.0a1
Build ID        20160701030235
Update Channel  nightly
User Agent      Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:50.0) Gecko/20100101 Firefox/50.0

DJ-Leith

[Maru]

I can confirm this, and have also been experiencing a bug where Javascript is completely disabled in Private mode regardless of whitelist settings ever since updating to v49.

Was going to make a thread about the private mode issue. Should it be standalone or will a moderator merge these into a v49 bugs megathread?

[barbaz]

@Maru: There is 2 other threads about the Private Browsing issue already, feel free to post in one or the other
viewtopic.php?f=10&t=21946
viewtopic.php?f=7&t=21952

We like to keep one issue per thread (or stick to only issues brought up by the thread's OP), and minimize the number of different threads per issue.

[Maru]

@Maru: There is 2 other threads about the Private Browsing issue already, feel free to post in one or the other
viewtopic.php?f=10&t=21946
viewtopic.php?f=7&t=21952

We like to keep one issue per thread (or stick to only issues brought up by the thread's OP), and minimize the number of different threads per issue.

Thanks for the links, I'll continue my posts there. Fingers crossed it's not terribly difficult to fix

[Giorgio Maone]

https://bugzilla.mozilla.org/show_bug.cgi?id=1272139#c5

Looks like allowing "about:feed" suffices to "fix" this issue.
I'm adding it to noscript.mandatory in next release.

[JustSomeGuy]

I just updated to v2.9.0.12, and am seeing no improvement in Live Bookmark loading in Firefox v48.0 rc.

[DJ-Leith]

Giorgio,

I don't think allowing "about:feed" is the 'whole fix'.

On Sunday 2016-07-24 I repeated my 4 tests (see above)
after manually adding "about:feed" to the NoScript Whitelist.

I had the same results (i.e. Fx 49 and Fx 50 - feed 'still broken').

As all 4 profile ALSO have RequestPolicy Continued, 1.0.beta12.2,
rpcontinued@amo.requestpolicy.org (RPC).
I did suspect RPC might be another 'block to the feed'.
So I did not investigate until today.

New test - Profile with JUST NoScript.

Steps
1. Start Firefox 49.0a2 (Build ID 20160727004019) using a New Profile.
2. Experience 'first run'.
3. visit https://noscript.net/feed?c=200&t=a
The 'feed works', there are no Extensions in this New Profile.
4. in "about:config" set "xpinstall.signatures.required" to "false".
5. in "about:preferences#general" disable e10s
(i.e. 'un-tick' "Enable multi-process Firefox Developer Edition") - you have to Restart Firefox.

6. Install NoScript 2.9.0.12rc2 (when you restart after the NoScript Install you have
the 'normal NoScript splash screen' at https://noscript.net/?ver=2.9.0.12rc2).

All of 1-6 is 'normal and expected'.
Close Firefox.

7. Start Firefox, in NoScript, Options Whitelist there is, as expected,
"about:feed" (grey because it is included in the "noscript.mandatory").

8. Now visit https://noscript.net/feed?c=200&t=a

Expected Result
Feed will work (will show 200 most recent versions of NoScript).

Actual Result
'feed is broken'.

DJ-Leith

[JustAnotherGuy]

Hi, was bothered with this problem in Firefox 48 RC. Found out the fix. Whitelist "about:feeds" plural form. Not "about:feed".

Though I encountered the "Live bookmark feed failed to load." problem too. Mentioned here viewtopic.php?f=7&t=21889 and https://bugzilla.mozilla.org/show_bug.cgi?id=1268109. Workaround is to whitelist site hosting the feed.

[DJ-Leith]

I can confirm what JustAnotherGuy said:

Found out the fix. Whitelist "about:feeds" plural form. Not "about:feed".

Another test.
An Aurora (Fx 49.0a2) Profile with NoScript 2.9.0.12rc1 (20 May 2016)
and RequestPolicy Continued 1.0.beta12.2. Also, e10s 'switched off'.

The NoScript Whitelist is 'almost empty'.
It has "addons.mozilla.org" and "about:requestpolicy".
It also has the grey items from "noscript.mandatory" (as at 12rc1).

It does not include "about:feed" or "about:feeds" or "noscript.net".

https://noscript.net/feed?c=200&t=a
is broken.

Whitelisting "about:feeds" (plural) fixes this.

As JustAnotherGuy also said, some sites might require you to

Workaround is to whitelist site hosting the feed.

Giorgio, I think Firefox 48 is due for Release on 2016-08-02 (2 August 2016). It would be good to have "about:feeds" added to the "noscript.mandatory" list.

DJ-Leith

[JustSomeGuy]

Adding "about:feeds" to the whitelist resolves Issue 1 for me; Issue 2 is extant and unaffected.

[Internet User]

yeah, adding about:feeds does fix issue #1 for me as well. thanks.

I wasn't even aware it even existed because it isn't listed on the dropdown at all.