Page 3 of 3

Re: [RESOLVED] samy.pl bypasses NS content blocking (Java)

Posted: Sat Dec 04, 2010 2:00 pm
by al_9x
My profile wasn't totally clean, I narrowed it down to specific settings.

Starting with a new profile:

1) Apply to trusted
2) remove about:blank from whitelist
3) noscript.consoleDump=4
4) load the test page
5) allow it
6) click PI
8) you should get the partial icon with about:blank in the menu, also, the following error, which is probably the cause:

Code: Select all

[NoScript] Error enumerating sites: [Exception... "Component is not available"  nsresult: "0x80040111 (NS_ERROR_NOT_AVAILABLE)"  location: "JS frame :: chrome://noscript/content/Main.js :: anonymous :: line 3784"  data: no],undefined

Re: [RESOLVED] samy.pl bypasses NS content blocking (Java)

Posted: Sat Dec 04, 2010 3:14 pm
by Giorgio Maone
al_9x wrote:My profile wasn't totally clean, I narrowed it down to specific settings.
[...]
3) noscript.consoleDump=4
[...]

Code: Select all

[NoScript] Error enumerating sites: [Exception... "Component is not available"  nsresult: "0x80040111 (NS_ERROR_NOT_AVAILABLE)"  location: "JS frame :: chrome://noscript/content/Main.js :: anonymous :: line 3784"  data: no],undefined
It's a side effect of logging itself.
The LiveConnect interception adds a dummy applet to the page and removes its immediately, in order to trigger the content policy and cause the "Blocked Sites" menu to be populated.
Since the applet has already been disconnected from the document by the time the site enumeration code is hit, when its cached reference gets logged its toSource() method fails because of some property (don't ask me which) not being available anymore.

I'm working around this by simply enclosing the logging code in a try {} cacth {} block, since this is quite an edge case.

Re: [RESOLVED] samy.pl bypasses NS content blocking (Java)

Posted: Mon Dec 06, 2010 3:37 pm
by Giorgio Maone
Giorgio Maone wrote: It's a side effect of logging itself.
[...]
I'm working around this by simply enclosing the logging code in a try {} cacth {} block, since this is quite an edge case.
Fixed in latest development build.