InformAction Forums

dhouwn wrote:Wait, so NoScript is toggling the global Java setting? Aren't all plugin instances aborted when a plugin gets deactivated?

Giorgio Maone wrote:However, this is moot because I've just found a wonderful hack which allows me to intercept the java properties without triggering the JVM and without disabling the plugin.

al_9x wrote:

Giorgio Maone wrote:However, this is moot because I've just found a wonderful hack which allows me to intercept the java properties without triggering the JVM and without disabling the plugin.

What is it?

(function() {
      const w = window;
      const k = function() {};
      w.watch('java', k); // wonderful trick reducing w.java resolution by a 100 factor,
      w.watch('Packages', k); // by skipping InitJavaProperties() and undeffing Packages and java
      const g = function() {
        const d = w.document;
        const o = d.createElement("object");
        o.type = "application/x-java-vm";
        o.data = "data:" + o.type + ",";
        d.body.appendChild(o);
        d.body.removeChild(o);
        w.__defineGetter__("java", k);
        w.__defineGetter__("Packages", k);
      }
      w.__defineGetter__("java", g);
      w.__defineGetter__("Packages", g);
    })()

Giorgio Maone wrote:It works fully on Fx 3.6 (speedup + JVM prevention)

<script>
watch('java', function() {});
</script>

al_9x wrote:

Giorgio Maone wrote:It works fully on Fx 3.6 (speedup + JVM prevention)

Code: Select all

<script>
watch('java', function() {});
</script>

this starts the vm on 3.6 for me

Giorgio Maone wrote:Please check latest development build (2.0.6rc5).

al_9x wrote:If you change the code, please bump the version. Why did you remove the logging in the new rc5 (final)?

Giorgio Maone wrote:

al_9x wrote:If you change the code, please bump the version. Why did you remove the logging in the new rc5 (final)?

It slipped in the very early rc5 on my site (lasted 5 minutes or so) and was removed before going in AMO's update channel, because it was on a performance-critical code path and didn't belong in a final RC.

al_9x wrote:In 2.0.8rc1, it looks like the plugins toggling and liveconnect injection take place even when the Java plugin is disabled. Is that right? Would it not make sense to check before calling interceptLiveConnect? Is it an expensive operation? Perhaps it's possible to be notified and cache the Java state?

al_9x wrote: Also, I noticed that after clicking the liveconnect link in http://samy.pl/natpin/ , the page navigates to # (expected), and "about:blank" is shown in the NS menu. It has something to do with the empty iframe on the page.

Code: Select all

<iframe name="A" style="display:none"></iframe>

Normally, about:blank is excluded, but somehow the liveconnect blocking is changing this.

Giorgio Maone wrote:

al_9x wrote:In 2.0.8rc1, it looks like the plugins toggling and liveconnect injection take place even when the Java plugin is disabled. Is that right? Would it not make sense to check before calling interceptLiveConnect? Is it an expensive operation? Perhaps it's possible to be notified and cache the Java state?

It's relatively expensive and in some circumstances (which I coudln't reproduce reliably) it fires a JVM.

Giorgio Maone wrote:

al_9x wrote: Also, I noticed that after clicking the liveconnect link in http://samy.pl/natpin/ , the page navigates to # (expected), and "about:blank" is shown in the NS menu. It has something to do with the empty iframe on the page.

Code: Select all

<iframe name="A" style="display:none"></iframe>

Normally, about:blank is excluded, but somehow the liveconnect blocking is changing this.

No idea, investigating. Does it happen also on a reduced test case (the iframe only)? Does disabling liveconnect interception change anything?

<a href="#" onclick="alert(java.lang.Math.PI);">PI</a>
<iframe></iframe>

al_9x wrote: Is it possible to be notfified and cache the enabled state?

al_9x wrote: Also, I noticed that after clicking the liveconnect link in http://samy.pl/natpin/ , the page navigates to # (expected), and "about:blank" is shown in the NS menu. It has something to do with the empty iframe on the page.

Code: Select all

<iframe name="A" style="display:none"></iframe>

Normally, about:blank is excluded, but somehow the liveconnect blocking is changing this.
Here's a simple page:

Code: Select all

<a href="#" onclick="alert(java.lang.Math.PI);">PI</a>
<iframe></iframe>

If you disable interception or disable Java, it does not happen.