Problem with NoScript 2.9.5.1 and Firefox Tools/Get-Add-ons

Ask for help about NoScript, no registration needed to post
anon42
Posts: 7
Joined: Wed Nov 23, 2016 12:06 pm

Problem with NoScript 2.9.5.1 and Firefox Tools/Get-Add-ons

Post by anon42 »

I just upgraded NoScript 2.9.5.1 from NoScript 2.9.0.14 and discovered that the (Mac OS X 10.6.7) Firefox (48.0.2) Addons option to "Get add-ons" hangs Firefox. It's supposed to bring up a page that starts with "Personalize your Firefox". The only way out of this is to force quit Firefox and relaunch.

After a bit of experimentation I discovered that I could get "Get add-ons" to work if I set NoScript's XSS advanced option check box for "Sanitize cross-site suspicious requests" off. Previously it was on and that still works with 2.9.0.14.

There could be a possibility that 2.9.5.1 is interacting with one of my other 38 addons since I cannot reproduce the problem with a clean profile. However, that interaction would have to have been introduced by 2.9.5.1 since using 2.9.0.14 in the same full profile does not have the Get add-ons problem when the only addon changed/updated is NoScript. So I have to blame NoScript for introducing the possible interaction.

At the moment I am getting around the problem by keeping the Sanitize option off. But I prefer to keep it on as it has always been in the past. Of course I could just elect to keep it on. It's not like I ever use that "Get add-ons" very much! But if the page Get add-ons accesses to produce this problem is similar to some other page I might happen to visit in the future that would not be good.

I hope the info I provided is sufficient to address this problem.
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:48.0) Gecko/20100101 Firefox/48.0
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:48.0) Gecko/20100101 Firefox/48.0
barbaz
Senior Member
Posts: 10841
Joined: Sat Aug 03, 2013 5:45 pm

Re: Problem with NoScript 2.9.5.1 and Firefox Tools/Get-Add-

Post by barbaz »

When this issue occurs, do you see "[NoScript XSS]" or InjectionChecker message(s) in the Browser Console (Cmd-Shift-J)?
*Always* check the changelogs BEFORE updating that important software!
-
anon42
Posts: 7
Joined: Wed Nov 23, 2016 12:06 pm

Re: Problem with NoScript 2.9.5.1 and Firefox Tools/Get-Add-

Post by anon42 »

Problem is that when this occurs FF hangs so I cannot look at the console. And if I keep the console displayed prior to clicking on get addons the hang occurs before anything is written to it.

I stumbled into this problem late last night and my memory is a bit fuzzy on what led me to XSS in the first place but as I recall, when things like this happen (i.e., clean profile works, full profile doesn't), I experiment with a copy of my full profile and start eliminating addons to check for interactions. I believe I got it to a point where I saw "XSS" in NoScript's popup menu when it didn't hang but Get Addon's did not bring up the page either. As I am typing this (next morning) I guess I will have to repeat that experiment to try to reproduce it and look at the console when/if I get to the point where I might see anything.
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:48.0) Gecko/20100101 Firefox/48.0
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:48.0) Gecko/20100101 Firefox/48.0
User avatar
Thrawn
Master Bug Buster
Posts: 3106
Joined: Mon Jan 16, 2012 3:46 am
Location: Australia
Contact:

Re: Problem with NoScript 2.9.5.1 and Firefox Tools/Get-Add-

Post by Thrawn »

The XSS filter can sometimes become very slow, if there are very large numbers of suspicious requests. How long did you wait for it?
======
Thrawn
------------
Religion is not the opium of the masses. Daily life is the opium of the masses.

True religion, which dares to acknowledge death and challenge the way we live, is an attempt to wake up.
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
barbaz
Senior Member
Posts: 10841
Joined: Sat Aug 03, 2013 5:45 pm

Re: Problem with NoScript 2.9.5.1 and Firefox Tools/Get-Add-

Post by barbaz »

I can't reproduce this problem in Firefox 48.0.2...on Linux.

Please create a clean profile from scratch. Install only NoScript latest development build, leaving all the defaults.
Does the problem still exist?
If not, what if you then import your NS settings into the clean profile using the Import and Export buttons *on the very bottom* of NS Options?
*Always* check the changelogs BEFORE updating that important software!
-
anon42
Posts: 7
Joined: Wed Nov 23, 2016 12:06 pm

Re: Problem with NoScript 2.9.5.1 and Firefox Tools/Get-Add-

Post by anon42 »

Thrawn wrote:The XSS filter can sometimes become very slow, if there are very large numbers of suspicious requests. How long did you wait for it?
I did finally reproduce the problem in a clean profile after going through the elimination process trying to find out which of my other addons might be interacting with NoScript in a copy of my full profile. It appears to be Custom Buttons (CB).

I figured that maybe one of my many custom buttons might be the culprit since I couldn't reproduce the problem in a clean profile with only NoScript and CB because in that case there are no custom buttons defined. So I took my CB data base (the custombuttons directory within my full profile) and moved it into the clean profile. Thus I had a clean profile with only NoScript 2.9.5.1 and CB installed along with my full collection of custom buttons. Thus at this point all the buttons can be seen in the customize window because none of them have been placed on tool bars in the clean profile setup.

The "hang" reproduced in the clean profile with just NoScript 2.9.5.1 and CB and my full set of custom buttons. It is strange since none of the custom buttons are actually installed on tool bars so I would think none of their code should be executed. At any rate I went on the "hunt" deleting my custom buttons in this clean profile. The "hang" continued to reproduce but eventually I saw the Get Addons appear after a long delay.

On a hunch I deleted more of the buttons (remember none of them are actually active -- you can only see them in customize) and sure enough the Get Addons page started to appear when I clicked it with a shorter and shorter delay as I deleted more and more buttons. Just to check out that the "hang" was only a long delay I put back my full set of custom buttons (simply copy the custombuttons directory again from my full profile back into the clean profile I'm testing with). With the full set of my custom buttons I clicked the Get Addons and just left it alone. I didn't time it but I think the "hang" took over an hour to come up on my 3.33 GHz machine. But the point is the Get Addons page did show up.

It looks to me that the length of the hang may be exponentially long as a function of the number of custom buttons I have defined. I really don't understand why an otherwise passive data base of button definitions (some of which are bookmarklets) should have any affect on NoScript, let alone its XSS sanitize option. Weird.
barbaz wrote:I can't reproduce this problem in Firefox 48.0.2...on Linux.

Please create a clean profile from scratch. Install only NoScript latest development build, leaving all the defaults.
Does the problem still exist?
If not, what if you then import your NS settings into the clean profile using the Import and Export buttons *on the very bottom* of NS Options?
See above for most of this. As for using the latest development build I tried it as suggested. The problem could not be reproduced. But I am confused about this. The version on that development build is 2.9.0.14 which is the same number I was using prior to updating to 2.9.5.1. So is there any difference between that 2.9.0.14 development build and the 2.9.0.14 on AMO? If not of course I would expect it to work because I said 2.9.0.14 worked prior to updating to 2.9.5.1. If that dev build is diffferent and you simply haven't updated its version number yet, then great, whatever you did fixes the problem.

Note, if you want a copy of my custombuttons directory from my profile just let me know and where to send it.
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:48.0) Gecko/20100101 Firefox/48.0
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:48.0) Gecko/20100101 Firefox/48.0
barbaz
Senior Member
Posts: 10841
Joined: Sat Aug 03, 2013 5:45 pm

Re: Problem with NoScript 2.9.5.1 and Firefox Tools/Get-Add-

Post by barbaz »

Nice troubleshooting. Image
anon42 wrote:As for using the latest development build I tried it as suggested. The problem could not be reproduced. But I am confused about this. The version on that development build is 2.9.0.14 which is the same number I was using prior to updating to 2.9.5.1. So is there any difference between that 2.9.0.14 development build and the 2.9.0.14 on AMO?
The latest dev build, 2.9.5.1rc1, is currently same as 2.9.5.1 stable. It's just standard troubleshooting to try the dev build.
anon42 wrote:Note, if you want a copy of my custombuttons directory from my profile just let me know and where to send it.
Well, you should send it to Giorgio Maone somehow. I've no idea how he'd prefer it to be sent to him. I suggest you ask him about this in PM if he doesn't reply here.
*Always* check the changelogs BEFORE updating that important software!
-
anon42
Posts: 7
Joined: Wed Nov 23, 2016 12:06 pm

Re: Problem with NoScript 2.9.5.1 and Firefox Tools/Get-Add-

Post by anon42 »

barbaz wrote:The latest dev build, 2.9.5.1rc1, is currently same as 2.9.5.1 stable. It's just standard troubleshooting to try the dev build.
Oops. Didn't read far enough down that page. If it's the same as the released 2.9.5.1 I would expect it to "hang" too and of course it does (just tried it to make it official).
Well, you should send it to Giorgio Maone somehow. I've no idea how he'd prefer it to be sent to him. I suggest you ask him about this in PM if he doesn't reply here.
I'll wait and see if he replies here first.
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:48.0) Gecko/20100101 Firefox/48.0
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:48.0) Gecko/20100101 Firefox/48.0
User avatar
Giorgio Maone
Site Admin
Posts: 9454
Joined: Wed Mar 18, 2009 11:22 pm
Location: Palermo - Italy
Contact:

Re: Problem with NoScript 2.9.5.1 and Firefox Tools/Get-Add-

Post by Giorgio Maone »

Please check latest development build 2.9.5.2rc1, then if the problem persists send me your NoScript Options>Export file by email, thank you.
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:50.0) Gecko/20100101 Firefox/50.0
anon42
Posts: 7
Joined: Wed Nov 23, 2016 12:06 pm

Re: Problem with NoScript 2.9.5.1 and Firefox Tools/Get-Add-

Post by anon42 »

Just tried it. No change. Still "hangs".
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:48.0) Gecko/20100101 Firefox/48.0
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:48.0) Gecko/20100101 Firefox/48.0
anon42
Posts: 7
Joined: Wed Nov 23, 2016 12:06 pm

Re: Problem with NoScript 2.9.5.1 and Firefox Tools/Get-Add-

Post by anon42 »

Giorgio Maone: Did you get a chance to look into my problem? I just posted in the custom buttons forum to see if they have any insight into this problem.
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:48.0) Gecko/20100101 Firefox/48.0
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:48.0) Gecko/20100101 Firefox/48.0
User avatar
Giorgio Maone
Site Admin
Posts: 9454
Joined: Wed Mar 18, 2009 11:22 pm
Location: Palermo - Italy
Contact:

Re: Problem with NoScript 2.9.5.1 and Firefox Tools/Get-Add-

Post by Giorgio Maone »

Did you already check it persists on 2.9.5.2?
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:50.0) Gecko/20100101 Firefox/50.0
anon42
Posts: 7
Joined: Wed Nov 23, 2016 12:06 pm

Re: Problem with NoScript 2.9.5.1 and Firefox Tools/Get-Add-

Post by anon42 »

Of course. Problem persists.
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:48.0) Gecko/20100101 Firefox/48.0
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:48.0) Gecko/20100101 Firefox/48.0
fandeath
Posts: 5
Joined: Tue Mar 07, 2017 10:30 am

Re: Problem with NoScript 2.9.5.1 and Firefox Tools/Get-Add-

Post by fandeath »

@anon42
hello, I had similar problem and I solved it now.
I hope this may help you.
viewtopic.php?f=7&t=22625&p=87069#p87069
Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:51.0) Gecko/20100101 Firefox/51.0
Post Reply