BUG: NS10 interferes with accessibility.blockautorefresh

Bug reports and enhancement requests
Post Reply
tom1
Posts: 2
Joined: Fri Feb 09, 2018 8:02 pm

BUG: NS10 interferes with accessibility.blockautorefresh

Post by tom1 »

NoScript 10.1.6.4
Firefox 58.0.1

Steps to reproduce:
1. Set in about:config "accessibility.blockautorefresh" to "true"
2. Go to a website that redirects e.g. https://duckduckgo.com/?q=firefox

With NoScript disabled Firefox displays a warning, but with NoScript enabled the page redirects.
Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:52.0) Gecko/20100101 Firefox/52.0
geek99
Junior Member
Posts: 20
Joined: Wed Dec 13, 2017 12:36 am

Re: BUG: NS10 interferes with accessibility.blockautorefresh

Post by geek99 »

I followed the steps provided by tom1, and got a slightly different result ...

NoScript 10.1.6.5
Firefox 58.0.2

First, I verified that "accessibility.blockautorefresh" was set to "true".

Then, with NoScript enabled, I navigated to: https://duckduckgo.com/?q=firefox

I saw a page briefly appear on the screen, then I saw the DuckDuckGo search results page.

I followed the same steps, and pressed the "Print Screen" key while the first page briefly appeared. The captured page said this:

Ignore this box please.
DuckDuckGo
firefox X S

You are being redirected to the non-JavaScript site.

Click here if it doesn't happen automatically.


I then disabled NoScript (using Firefox's add-on manager), and again navigated to: https://duckduckgo.com/?q=firefox


The only difference was that (with NoScript disabled) I did not see the first page briefly appear ... I immediately saw the DuckDuckGo search results page.

Hope this helps diagnose this issue.
Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:58.0) Gecko/20100101 Firefox/58.0
tom1
Posts: 2
Joined: Fri Feb 09, 2018 8:02 pm

Re: BUG: NS10 interferes with accessibility.blockautorefresh

Post by tom1 »

I checked again (on a new Firefox profile) and I think it's because I originally had uMatrix disable JavaScript on duckduckgo.com.
With JavaScript enabled I got the results that geek99 got, but with
1) either uMatrix or setting javascript.enabled to false in about:config; and
2) NoScript disabled
Firefox displays "Firefox prevented this page from automatically redirecting to another page" and the page doesn't redirect to the HTML site, whereas with NoScript enabled the page does redirect.
Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:52.0) Gecko/20100101 Firefox/52.0
skriptimaahinen
Master Bug Buster
Posts: 244
Joined: Wed Jan 10, 2018 7:37 am

Re: BUG: NS10 interferes with accessibility.blockautorefresh

Post by skriptimaahinen »

Can confirm. The redirect seems to be due to meta refresh inside noscript-tag.

For the Firefox's redirect blocking to work (shows redirect warning), you need to have:

1) javascript.enabled; false
2) accessibility.blockautorefresh; true
3) NoScript disabled or has the "script" allowed for the page

Regardless of the state of "javascript.enabled", if NoScript has "script" disabled for the page, no redirect warning is shown and the redirect happens automatically.
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:58.0) Gecko/20100101 Firefox/58.0
skriptimaahinen
Master Bug Buster
Posts: 244
Joined: Wed Jan 10, 2018 7:37 am

Re: BUG: NS10 interferes with accessibility.blockautorefresh

Post by skriptimaahinen »

Well, looks like this is another case of intended behaviour.

Code: Select all

  if (!canScript) {
    for (let noscript of document.querySelectorAll("noscript")) {
      // force show NOSCRIPT elements content
      let replacement = document.createElement("div");
      replacement.innerHTML = noscript.innerHTML;
      noscript.parentNode.replaceChild(replacement, noscript);
      // emulate meta-refresh
      let meta = replacement.querySelector('meta[http-equiv="refresh"]');
      if (meta) {
        let content = meta.getAttribute("content");
        if (content) {
          let [secs, url] = content.split(/\s*;\s*url\s*=\s*/i);
          if (url) {
            try {
              let urlObj = new URL(url);
              if (!/^https?:/.test(urlObj.protocol)) {
                continue;
              }
            } catch (e) {
            }
            window.setTimeout(() => location.href = url, (parseInt(secs) || 0) * 1000);
          }
        }
      }
    }
  }
However, quick testing shows that the meta redirect works even without the timer. Is this block of code even needed?

In any case, I hope there is a way to bring back the redirect warning.
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:58.0) Gecko/20100101 Firefox/58.0
User avatar
Giorgio Maone
Site Admin
Posts: 9454
Joined: Wed Mar 18, 2009 11:22 pm
Location: Palermo - Italy
Contact:

Re: BUG: NS10 interferes with accessibility.blockautorefresh

Post by Giorgio Maone »

skriptimaahinen wrote:Well, looks like this is another case of intended behaviour.

In any case, I hope there is a way to bring back the redirect warning.
I've tried some approaches in the last few hours and I concluded there's no way for a WebExtension to "organically" emulate a meta refresh in a way that could be intercepted by Firefox's optional blocking.
Therefore I'm afraid the only thing I can do is emulating the blocking notification myself (in content, ouch!) and put it behind a separate NoScript options, since I cannot access the built-in Firefox one :(
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:64.0) Gecko/20100101 Firefox/64.0
skriptimaahinen
Master Bug Buster
Posts: 244
Joined: Wed Jan 10, 2018 7:37 am

Re: BUG: NS10 interferes with accessibility.blockautorefresh

Post by skriptimaahinen »

Did you consider the possibility of sending the redirect info to the background, reloading the page and then writing the info to the header in onHeadersReceived? Though I'm somewhat conflicted if this is any better than the alternatives.
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:63.0) Gecko/20100101 Firefox/63.0
User avatar
Giorgio Maone
Site Admin
Posts: 9454
Joined: Wed Mar 18, 2009 11:22 pm
Location: Palermo - Italy
Contact:

Re: BUG: NS10 interferes with accessibility.blockautorefresh

Post by Giorgio Maone »

skriptimaahinen wrote:Did you consider the possibility of sending the redirect info to the background, reloading the page and then writing the info to the header in onHeadersReceived? Though I'm somewhat conflicted if this is any better than the alternatives.
You've just gave me inspiration for a pretty clever and simple trick I did not think about, and taking advantage of the fact the page is scriptless by definition (so it shouldn't have any side effects other than perhaps loading some subresource twice):

Code: Select all

// in onScriptDisabled.js
window.addEventListener("DOMContentLoaded", e => {
  if (moveAnyMetaRefreshOutsideNoScriptElements()) {
     let html = document.documentElement.outerHTML;
     document.open();
     document.write(html);
     document.close();
  }
}
Very quick preliminary testing says it does work :D
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:64.0) Gecko/20100101 Firefox/64.0
User avatar
Giorgio Maone
Site Admin
Posts: 9454
Joined: Wed Mar 18, 2009 11:22 pm
Location: Palermo - Italy
Contact:

Re: BUG: NS10 interferes with accessibility.blockautorefresh

Post by Giorgio Maone »

Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:64.0) Gecko/20100101 Firefox/64.0
skriptimaahinen
Master Bug Buster
Posts: 244
Joined: Wed Jan 10, 2018 7:37 am

Re: BUG: NS10 interferes with accessibility.blockautorefresh

Post by skriptimaahinen »

Very nice trick indeed. Definitely better than the alternatives. And seems to work well.
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:63.0) Gecko/20100101 Firefox/63.0
Post Reply