NoScript causes a 5 second delay on drop-down box population

[ahardy42]

Hello,

to use my bank's internet banking website with Firefox, I have to disable NoScript otherwise the website takes 5 seconds to populate the drop-down boxes!

Admittedly it is a badly programmed website and I really really hope the bank replaces it, but I've seen this issue for 2 years now.

Normally it is easier for me to launch Chrome and do my banking there than to disable NoScript.

I have of course enabled all the scripts that NoScript says are needed.

This is with FF 55.0 and NoScript 5.1.1

If you think it might be worth pursuing, then I'm happy to try to help but I realise it will be difficult since it is highly unlikely that you have an account with this bank that you would be able to use to test the issue.

[barbaz]

Please check the Browser Console (Ctrl-Shift-J) when this issue happens and post here any messages related to NoScript.
(related messages usually start with either "[NoScript" or "[ABE]"; if you don't know what's related, turn off CSS warnings and post everything else you see)

[ahardy42]

It's a bit difficult getting the logs, or rather, working out which logs are relevant - it doesn't just freeze up the drop-down, it freezes the whole FF instance.

There are about a dozen of these:

16:59:20.124 TypeError: can't access dead object 1 tab.js:1620:1

Does that help?

[barbaz]

So no obviously related console messages then.

As a test, does disabling the XSS filter get it working? NoScript Options > Advanced > XSS, un-check both boxes.

[ahardy42]

Hit the nail on the head!

Works fine now.

The whole site is now a lot quicker.

It's a bit user-unfriendly that it was doing this without any warning - or has NoScript got warnings for this that I just turned off at some point ages ago?

Thanks

[barbaz]

NoScript would show a notification bar and log messages to the console if it actually filters anything. Since neither one is your case, your bank site is merely doing something NoScript needs to check in more detail, but turns out to be harmless.

Therefore, the solution here is to come up with a safe XSS exception for your bank. See the sticky for how to make XSS exceptions.

[barbaz]

Moving to NoScript Support.

[ahardy42]

Sadly for its customers like me, the bank's website is poorly coded and desperately needs completely replacing.

I can see HTML comments in amongst the HTMl when I am trying to expand a view or something, which give the impression that they are outsourcing the maintenance work. It also gives the impression that it may have vulnerabilities.

Thanks for the help.

[barbaz]

You're welcome.