[issues?] Suddenly all google search result contain prefix

[Giorgio Maone]

On Tuesday 21st Feb, I noticed that the problem had returned and upgraded again to NoScript 2.3.1.rc4 Unfortunately, the problem is still there.

Could you please describe in details your problem?

[Mc]

All search links end here now in a "302 Moved" message.

[Giorgio Maone]

All search links end here now in a "302 Moved" message.

1) Are you using google.com or a local domain (e.g. google.co.uk)?
2) Are google.com and gstatic.com allowed or forbidden?
3) Could you share a search URL and one of these results URL leading to "302 Moved"?
4) Does it happe on a clean profile with just NoScript installed?

[Mc]

All search links end here now in a "302 Moved" message.

1) Are you using google.com or a local domain (e.g. google.co.uk)?
2) Are google.com and gstatic.com allowed or forbidden?
3) Could you share a search URL and one of these results URL leading to "302 Moved"?
4) Does it happe on a clean profile with just NoScript installed?

1. Both.
2. google is not allowed, gstatic is blocked by RequestPolicy.
Seems RequestPolicy blocks all search results, because google makes request to the results now (again?). The resulting redirect site looks different from the further one, though.
So your bypass doesn't work any longer here, and I wouldn't even know, if RequestPolicy would not block the redirect.
3. You can take any, with my settings.
4. I can try it, if it's still needed

[obiwan]

I can confirm what a previous poster said. My Google results links look like

Code: Select all

http://www.google.co.uk/url?q=http://...

at the moment, so you may need to match /url?q= as well as /url?url= in the regex. I've seen both variations.

If I change it from

Code: Select all

for each(let et in ['focus','mouseover','mousedown','click'])addEventListener(et,function(e){var a=e.target;if(a.href&&!a._href){a._href=a.href=a.href.replace(/.*\/url.*[\?|&]url=(http[^&]+).*/,function(a,b)decodeURIComponent(b));if(/\brwt\(/.test(a.getAttribute('onmousedown')))a.removeAttribute('onmousedown')}},true)

to

Code: Select all

for each(let et in ['focus','mouseover','mousedown','click'])addEventListener(et,function(e){var a=e.target;if(a.href&&!a._href){a._href=a.href=a.href.replace(/.*\/url.*[\?|&](?:url|q)=(http[^&]+).*/,function(a,b)decodeURIComponent(b));if(/\brwt\(/.test(a.getAttribute('onmousedown')))a.removeAttribute('onmousedown')}},true)

then it works.

[DJ-Leith]

All search links end here now in a "302 Moved" message.

1) Are you using google.com or a local domain (e.g. google.co.uk)?
2) Are google.com and gstatic.com allowed or forbidden?
3) Could you share a search URL and one of these results URL leading to "302 Moved"?
4) Does it happe on a clean profile with just NoScript
installed?

1. Both.
2. google is not allowed, gstatic is blocked by RequestPolicy.
Seems RequestPolicy blocks all search results, because google makes request to the results now (again?).
The resulting redirect site looks different from the further one, though.
So your bypass doesn't work any longer here, and I wouldn't even know, if RequestPolicy would not block
the redirect.
3. You can take any, with my settings.
4. I can try it, if it's still needed

I see similar to Mc,

All search links end here now in a "302 Moved" message.

I have seen this on Fx 3.6.27, Aurora (12.0a2) and 10.0.2 (on several profiles, on two PCs, all with NoScript 2.3.1rc4).
However, this may be due to RequestPolicy (all Profiles just mentioned have RequestPolicy).
It might be because I have been testing on google.co.uk

Using a profile with NoScript as the ONLY Add-On Extension, on Fx 3.6.27, I get the following.
1. Using google.co.uk
2. No google domains in the whitelist (of any kind including no gstatic).
3. Search for anything, e.g.

Code: Select all

"Windows 7" mouse hard to see

Right click the top 'result URL' and choose "Open Link in New Tab" ==> opens in a New Tab (as one would expect).

However,
IF the Profile has NoScript and RequestPolicy I get
Right click a 'result URL' and choose "Open Link in New Tab" ==> opens a "302 Moved" page.
This "302 Moved" page has a single link to

Code: Select all

http://www.microsoft.com/athome/setup/magnify.aspx

if you choose the first result from the example search (above).
At this point RequestPolicy is 'asking',

Temporarily allow requests from google.co.uk to microsoft.com

I'm no expert, but I think the Referer (as shown by RefControl 0.8.16), will now have the 'trailing suffix' [presumably identifying your search, and possibly disclosing more] when you 'get to your destination'.
In this example, clicking on the link on the "302 Moved" page,
and going to microsoft (as in the code box above) the Referer has a lot of 'code type stuff' in the suffix.
I speculate that, in this example, Google still 'captured my search' AND Microsoft (by looking at the
Referer 'page where I was coming from') - the "302 Moved" page - can also 'see how I arrived' / 'found their page'.

So, I conclude that RequestPolicy 0.5.22 and NoScript 2.3.1rc4
are not working as well as they were before Google started
making changes.

DJ-Leith

[sigmax2]

I see the same as DJ-Leith above.

Doing the same search, this is my request policy log from clicking that first link:

Code: Select all

Origin
http://www.google.co.uk/search?q=%22Windows+7%22+mouse+hard+to+see&btnG=Search&hl=en&safe=off&site=&btnK=
Destination
http://www.google.co.uk/url?q=http://www.microsoft.com/athome/setup/magnify.aspx&sa=U&ei=n1BFT4eRFs6p8QO045nlBA&ved=0CBIQFjAA&usg=AFQjCNFc3zFjoCbbrLB99qpt12o7G7_kHQ


Origin
http://www.google.co.uk/search?q=%22Windows+7%22+mouse+hard+to+see&btnG=Search&hl=en&safe=off&site=&btnK=
Destination
http://www.google.co.uk/url?q=http://www.microsoft.com/athome/setup/magnify.aspx&sa=U&ei=n1BFT4eRFs6p8QO045nlBA&ved=0CBIQFjAA&usg=AFQjCNFc3zFjoCbbrLB99qpt12o7G7_kHQ


Origin
http://www.google.co.uk/url?q=http://www.microsoft.com/athome/setup/magnify.aspx&sa=U&ei=n1BFT4eRFs6p8QO045nlBA&ved=0CBIQFjAA&usg=AFQjCNFc3zFjoCbbrLB99qpt12o7G7_kHQ
Destination
http://www.microsoft.com/athome/setup/magnify.aspx

[Giorgio Maone]

Please check latest development build 2.3.2rc1, thanks.

[Mc]

Works here, thank you Giorgio

[sigmax2]

Yes that seems fine again. (NoScript and Request Policy)

Many thanks,

sigma

I'm surprised not to have read anything about this tracking issue with respect to Google's new Privacy Policy that comes into force in a few days.

[therube]

(Just to note, from Page 2 of this thread: "Or are you running RequestPolicy, Yahoo search ALWAYS lead to a blocked redirect!?")

[GµårÐïåñ]

Yes I briefly experienced a weird and messed up way before old-school style image search today as well but didn't think it was NoScript related, just Google being stupid when you don't allow it. But will investigate to be sure. Thanks.

[Bachstelze]

Please check latest development build 2.3.2rc1, thanks.

Better, but not entirely.
Search for „empire me“ -> 3 Video results
All result titles are direct links to youtube, but the result images are links to the google tracking page, as seen in the infobox at the bottom of ff. But if you click them the revert instandly to plain youtube links and there is no request to the google tracking page in the noscript net panel.

The image search does not work for me. Google and gstatic are allowed but the redirect is endless there.

[Giorgio Maone]

All result titles are direct links to youtube, but the result images are links to the google tracking page, as seen in the infobox at the bottom of ff. But if you click them the revert instandly to plain youtube links and there is no request to the google tracking page in the noscript net panel.

This is already functionally OK, but I've tried to make the behavior more uniform in latest development build 2.3.2rc2.

The image search does not work for me. Google and gstatic are allowed but the redirect is endless there.

[/quote]
This sounds like a different issue. Could you provide more details? Does disabling NoScript actually help?

[Bachstelze]

All result titles are direct links to youtube, but the result images are links to the google tracking page, as seen in the infobox at the bottom of ff. But if you click them the revert instantly to plain youtube links and there is no request to the google tracking page in the noscript net panel.

This is already functionally OK, but I've tried to make the behavior more uniform in latest development build 2.3.2rc2.

Nearly. The result has to be hovered one time to change the link text in the ff bottom box.

The image search does not work for me. Google and gstatic are allowed but the redirect is endless there.

This sounds like a different issue. Could you provide more details? Does disabling NoScript actually help?

I found it, i set in the force https field *.google.com which actually breaks the image results. The https link is redirect from google to http, and from noscript back to https which causes an endless loop.

Other Question
Is there a way to circumvent the google image landing page entirely and go direct to the result page?