NoScript v10: Blocked Objects - Allow <object> popup window.

[aleister]

Hello.

Today, I've tried to use a google translate service. So, I allowed, for example, google.com website in uBlock Origin addon and google.com website* in NoScript v10 (but as (Temp. TRUSTED)). And something strange happened. I'm not pretty sure what is the cause of "Blocked Objects" popup window. Probably, I've tried to revert an "old" settings in both addons: deny google.com website in uBlock Origin and change (Temp. TRUSTED) to (DEFAULT) for both websites mentioned above, in NoScript.

Suddenly, a popup window appeared: "Blocked Objects". Here is an example of how it looked:

Code: Select all

Blocked Objects

                                         Allow <OBJECT> 




                       (o) Allow https://ssl.gstatic.com/translate/sound_player2.swf
                       ( ) Allow https://ssl.gstatic.com 



               [  OK  ]                                                          [  Cancel  ]

As we can see, there are very large intervals between options. The first option (https://ssl.gstatic.com/translate/sound_player2.swf) was checked by default. (However, nothing related with .swf appeared - I mean sound_player2.swf etc.) I decided not to use [OK] or [Cancel] buttons/options and just close this window. There is also one more important thing: when "Blocked Objects" window showed up, NoScript "Options..." window was also opened - without any reaction from my side.

I apologize for that, I can not write and provide an exactly circumstances in which this "Blocked Objects" window appeared. Some more informations:

✗ NoScript: v10.1.6.5
✗ Firefox: v58.0.2
✗ Platform: Linux; x86_32

Thanks.
_______
* I don't remember if allowing 'googletranslate' website is also needed in NoScript.

[sodead]

Hi. Should it be treated as a bug?

[Giorgio Maone]

That dialog should be shown only if you click on an <OBJECT> placeholder (which should be rather cospicuous, yellow background and NoScript logo).
Anyway the file name suggests the trigger was a Flash-based sound player from the Google Translator service, so it might be the actual replaced object was very tiny and the placeholder, almost invisible, has been clicked accidentally.
Difficult to tell without precise reproducible steps.