NoScript Error on Specific Web Page

[Unregistered]

Hi all,

I'm getting a very strange error in NoScript 10.1.8.2 on a specific page. The message "In order to operate on this tab, NoScript needs to reload it. Proceed?" shows in the NoScript pop-out panel when I try to access the following page on the Dropbox website:

https://www.dropbox.com/help/security/e ... rification

I have "OK" and "Cancel" options and neither fix the issue. "OK" does reload the page but this doesn't remove the message.

When first accessing, the page was completely blank but I've manually added a range of Dropbox domains and subdomains to my whitelist and the page now displays correctly but the error persists.

Oddly, when I go to the main Dropbox website (https://www.dropbox.com), NoScript works normally, and I can access the pop-out panel to change settings. I'm therefore not sure if this is an issue with this one specific page for some coincidental coding reason, or if there's an issue with NoScript itself.

My set-up is Firefox 61.0 (64 bit) on Windows 10 with NoScript 10.1.8.2. The error persists with all Add-Ons other than NoScript disabled.

Grateful if someone could test this and let me know if there's a setting or something that I'm missing? Should I report this as a bug with NoScript, or is it just my computer that's haunted*?

Thanks very much for any guidance.

*https://xkcd.com/1316/

[therube]

That is a weird page.
(Using NoScript 5.)

Initially I see

-dropboxstatic.com
-dropbox.com

Allow dropbox.com

icon does not change, still shows not allowed
other domains turn up at this point

-googletagmanager.com
-storage.googleapis.com
-dropboxstatic.com
+dropbox.com
+https://www.dropbox.com

Allow dropboxstatic.com

icon does not change, still shows not allowed

-googletagmanager.com
-storage.googleapis.com
+dropboxstatic.com
+dropbox.com
+https://www.dropbox.com

Using base 2nd level, only

dropbox & dropboxstatic show as such (base 2nd level)
https://www.dropbox.com shows up as not allowed - from the icon, but per the listing above, it shows that it is?
Why it even shows at all?

It I "Allow" https://www.dropbox.com, nothing changes
https://www.dropbox.com still shows as not allowed, still shows up with a + if I copy a list of the domains, still shows up when it is not a base 2nd level?


(As far as the page working as expected, I did not look into that.
I saw nothing similar to "NoScript needs to reload"...)

[Giorgio Maone]

It looks like a Firefox bug. For some reason, content scripts (WebExtensions' components which are meant to run in the content process and interact with web pages) are unable to run on it, just as it happens on browser-privileged pages, AMO pages and, more recently, the internal PDF viewer.
Investigating and possibly filing a bugzilla report, thanks.
[EDIT]
It's https://bugzilla.mozilla.org/show_bug.cgi?id=1411641 -- been around for a long time now, but seemingly undetected so far by NoScript users because not many pages use this CSP feature YET

[Unregistered]

Really interesting insight on this - thanks both therube and Giorgio for your time investigating and replying.

I see that you (Giorgio) have responded on the Bugzilla thread - I'll keep watching this (hopefully) for a solution.

Thanks again.

[fenix]

Hello.

I'm seeing exactly the same message on all websites where PDF.js viewer is in use etc. (However, I didn't notice such a popup window on a - let say - "normall" sites, without .PDF file). I've created a thread about this issue, please see: https://forums.informaction.com/viewtop ... =7&t=24745. NoScript version is 10.1.8.2 and latest Firefox release.

Best regards.