(2.9.5rc35)Site serving only embedded video vanish from menu

Post by **barbaz** » Tue Nov 15, 2016 11:09 pm

NoScript 2.9.5rc31
SeaMonkey 2.46pre (like Firefox 49.0.2). Also reproducible on Firefox Nightly 20161116030212

STR (from a fresh browser session):
1) put this page up on a server

Code: Select all

<!doctype html>
Testing.
<video src="http://<THE_SERVER_IP>/big_buck_bunny.webm" controls="yes"></video>

2) Temp-Allow the server, but not its IP

Expected results: video placeholder and entry for the server's IP address in the NoScript menu
Actual results: no placeholder and no way to allow the video. The server's IP is gone from the menu. Reloading the page by clicking the toolbar button, toggles between this behavior and the expected behavior.

Also, once the video is Temp-Allowed, NoScript will not block it even after revoking temporary permissions, despite reloading the page with Ctrl-R and Ctrl-Shift-R. And in this situation, the video does not show up in the NoScript menu at all, nor does the server's IP address.

GH113 · Post by **GH113** » Wed Nov 16, 2016 11:11 am

barbaz wrote:NoScript 2.9.5rc31
SeaMonkey 2.46pre (like Firefox 49.0.2)
STR (from a fresh browser session):

I received your PM, thank you very much!

Did you try to reproduce this bug in Nightly or Firefox 50+? I am asking because I think I could reproduce the same bug a couple of times in Nightly as well.

Post by **barbaz** » Wed Nov 16, 2016 5:12 pm

GH113 wrote:I received your PM, thank you very much!

You're welcome.

GH113 wrote:Did you try to reproduce this bug in Nightly or Firefox 50+? I am asking because I think I could reproduce the same bug a couple of times in Nightly as well.

No, I didn't tried anything other than SeaMonkey 2.46pre. If you have a specific version of Nightly where this can be reproduced, I'll add it to the OP.

GH113 · Post by **GH113** » Wed Nov 16, 2016 6:51 pm

barbaz wrote:No, I didn't tried anything other than SeaMonkey 2.46pre. If you have a specific version of Nightly where this can be reproduced, I'll add it to the OP.

Let me quote my post from the other thread:

I've just come across a new bug, I don't create a new thread because I don't have STR but the idea is the following:
Open webpage example1.com with embedded video loading from example2.com
Allow both example1.com and example2.com, reload the page
Once the video starts playing, wait until the video buffering stops (that's important)
Hover the mouse over the NoScript icon - example2 is missing from the dropdown menu

As you can see, I've reproduced a similar bug a couple of times in Nightly 15-11-16 but I am not 100% sure that's the same bug you reported. The only way to find out is to try out your STR in Nightly and I can't do that because I am not a programmer and I don't know how to put a page on a server

Post by **barbaz** » Wed Nov 16, 2016 7:38 pm

Yes it is reproducible in today's Nightly. Updated the report.

In Nightly, closing the tab, then opening the test page again in a new tab, seems to straighten things out.

GH113 · Post by **GH113** » Fri Nov 18, 2016 6:13 pm

barbaz wrote:Yes it is reproducible in today's Nightly. Updated the report.
In Nightly, closing the tab, then opening the test page again in a new tab, seems to straighten things out.

Thank you very much!

GH113 · Post by **GH113** » Sun Nov 20, 2016 7:34 pm

I can still reproduce this (?) bug in Nightly and NoScript 2.9.5rc35. STR (just an example):
Go to example1.com, embedded video starts playing/loading from example2.com
Wait until video stops buffering
Go to example3.com with the same embedded video - that video starts playing again
Hover the mouse over NoScript icon - there is no example2.com among domains even though the page has embedded video from example2.com. As far as I understand, NoScript doesn't detect example2.com because the embedded video from example2.com is loading from cache and not from example2. If I clear the cache, NoScript starts detecting example2.com

The question is: is NoScript supposed to list the domain with video when video is loading from cache and not from that domain? English is not my 1st language but I hope you understand what I am talking about.

I've just checked: 2.9.0.14 has the same bug (?).

Post by **barbaz** » Sun Nov 20, 2016 7:49 pm

Indeed, NoScript should *not* care whether the video is in cache or not.

GH113 wrote:I've just checked: 2.9.0.14 has the same bug (?).

Well, 2.9.0.14 wouldn't really be expected to work with Nightly at this point, especially if you've got e10s enabled. We'd need to try it with a browser based on Gecko 45esr or 49.*

GH113 · Post by **GH113** » Sun Nov 20, 2016 7:58 pm

barbaz wrote:Indeed, NoScript should *not* care whether the video is in cache or not.

OK, I've already found STR but it NSFW so I am currently trying to find an alternative safe for work STR

If I don't find one, I'll send you a PM with NSFW STR tomorrow!

Post by **barbaz** » Sun Nov 20, 2016 8:07 pm

Er, that's fine to PM me but it'd be a problem for me to access pron sites in this environment. (I'm not the network sysadmin.)

What I will do is try the STR out with my local server, tweaking the content until I hit the bug following your exact steps-to-reproduce.

Post by **Giorgio Maone** » Sun Nov 20, 2016 11:17 pm

GH113 wrote:
barbaz wrote:Indeed, NoScript should *not* care whether the video is in cache or not.
OK, I've already found STR but it NSFW so I am currently trying to find an alternative safe for work STR If I don't find one, I'll send you a PM with NSFW STR tomorrow!

Please share your STR with me as well, I'd like to release 2.9.5 stable ASAP and I want to be sure thi either can be fixed quickly or is not a showstopper. Thank you!

GH113 · Post by **GH113** » Mon Nov 21, 2016 1:13 pm

Well, I guess I'll just post STR right here then. NSFW! I've also recorded a video: https://www.youtube.com/watch?v=nNiKhCYdBk4
STR:
Create new profile, launch it, install NoScript 2.9.5rc35
Go to https://vk.com/club65001334
(from wiki: VK is the largest European online social networking service, based in Russia)
Enable vk.com, go to https://vk.com/club65001334 again
Scroll the page down until you see the video from "23 Oct at 4:48 am" post
Hover the mouse over NoScript icon - enable vk-cdn.net (if there is no vk-cdn.net then enable vk.me)
Page will reload, make sure video quality is set to 480, wait until video starts playing and the buffering stops (the grey line at the bottom of the video stops moving)
Reload the page, grey line shouldn't move
Ctrl-click on "23 Oct at 4:48 am" link
Wait until that tab loads, switch to it, hover the mouse over NoScript icon - no vk-cdn.net!
Clear cache and hover the mouse over NoScript icon again - vk-cdn.net (or vk.me if you enabled vk.me instead of vk-cdn.net) is now listed!

GH113 · Post by **GH113** » Mon Nov 21, 2016 2:07 pm

Update: it looks like vk changed something on their side and video is now loading from vk.me, not vk-cdn.net. Bug is still reproduced, you just have to work with vk.me instead of vk-cdn.net!

Post by **barbaz** » Mon Nov 21, 2016 2:57 pm

@GH113: I've made the links in your post require copy+paste. Please don't post live, clickable links to NSFW content in these forums, thanks.

Post by **barbaz** » Mon Nov 21, 2016 4:23 pm

^^^ Following those STR, but using my local server, I saw the bug once in SeaMonkey 2.46pre. Once. But I could not replicate it again in SeaMonkey nor Nightly.

What I did see, about half the time, was the video placeholder gone and no Blocked Objects menu entry. But the "domain" hosting the video did always show up.

InformAction Forums

(2.9.5rc35)Site serving only embedded video vanish from menu

(2.9.5rc35)Site serving only embedded video vanish from menu

Re: (2.9.5rc31)Site serving only embedded video vanish from

Re: (2.9.5rc31)Site serving only embedded video vanish from

Re: (2.9.5rc31)Site serving only embedded video vanish from

Re: (2.9.5rc31)Site serving only embedded video vanish from

Re: (2.9.5rc31)Site serving only embedded video vanish from

Re: (2.9.5rc31)Site serving only embedded video vanish from

Re: (2.9.5rc31)Site serving only embedded video vanish from

Re: (2.9.5rc31)Site serving only embedded video vanish from

Re: (2.9.5rc31)Site serving only embedded video vanish from

Re: (2.9.5rc31)Site serving only embedded video vanish from

Re: (2.9.5rc35)Site serving only embedded video vanish from

Re: (2.9.5rc35)Site serving only embedded video vanish from

Re: (2.9.5rc35)Site serving only embedded video vanish from

Re: (2.9.5rc35)Site serving only embedded video vanish from