<FRAME> & "NoScript aborted redirection to" error

[therube]

<I/FRAME> & "NoScript aborted redirection to" error

http://mail.yahoo.com/

NoScript Options:
Reset
then, Forbid <IFRAME> & <FRAME>


Open an email containing an attachment
Click attachment
(attachment is virus scanned)


Nothing happens, but a 'Download File' link does appear.
Clicking the 'Download File' link & nothing further happens.


Normally, once virus scanned, a download prompt pops up.
If <FRAMES> are blocked, instead you get nothing (other then an Error Console error).

Code: Select all

Error: 'NoScript aborted redirection to http://bf1.attach.mail.ymail.com/us.f1614.mail.yahoo.com/ya/securedownload?clean=0&fid=Inbox&mid=2_0_0_1_89406_APXTi2IAACCdUFOFrwrb6j20q1E&pid=2&tnef=&prefFilename=Attachment+Here.xls&redirectURL=http%3A%2F%2Fus.mc1614.mail.yahoo.com%2Fmc%2FshowMessage%3Fcmd%3Ddownload.failure%26fid%3DInbox%26mid%3D2_0_0_1_89406_APXTi2IAACCdUFOFrw...%26pid%3D2%26tnef%3D%26prefFilename%3DAttachment+Here.xls&view=none&cb=parent.attachmentFail&cred=KoibG2WBIA0JQQbZBgY5PbCekz53CdcjG6H0CAJH.0NHwsVhO8AwqSYsBLQK3t735he896CtJxpU15GXTzQ6wz.r8wrHQNERp...--&ts=134...&partner=ymail&sig=HlAzppB7bOrnq...--' when calling method: [nsIChannelEventSink::asyncOnChannelRedirect] = NS_ERROR_XPC_JS_THREW_STRING

If you were to center-click the 'Download File' link, then the download dialog does appear.


Earlier topic, "NoScript aborted redirection to" error.

[Tom T.]

That explains why I've suddenly been unable to d/l Yahoo Mail attachments for the past few days. Never had time to look into it.
I have *everything* checked on Embeddings page.

However, the workaround seems to be to temporarily unblock IFRAME, not FRAME. Which makes sense, because the Blocked Object that should appear in the window is an IFRAME to some "secure download" sub-domain of ymail.com, IIRC.

You might have noticed that Yahoo has continually changed their methods of d/l (and u/l) over the years -- usually for the worse, and more complicated.
In the days of Fx 2, you just clicked d/l or u/l, and they worked, even with NS blocking all embeddings.

Perhaps Giorgio can make an update that will work with embeddings blocked. I'll ask.

[Giorgio Maone]

Do you get any blocked objects entry?
Is ymail.com allowed?

[Thrawn]

I get the same, but yes, there's a Blocked Objects entry.

Allowing

Code: Select all

unknown@http://bf1.attach.mail.ymail.com

fixed it! Thanks for the heads-up, Giorgio .

[Tom T.]

Yahoo must have changed d/l methods yet again. My whitelist, for the past several years, in both Fx 3.6 and Fx 4+, has been:

mail.yahoo.com
mail.yimg.com
ymail.com

Period. And that was enough to bring the Blocked Object menu; TA <IFRAME>@ etc. completed the d/l.

After a lot of trial and error, I found that one must apparently whitelist the entire yimg.com. This was not the case a week ago.

Sometimes, after trying to d/l with the above allowed, another page refresh is required, but in any case, when
Recently Blocked Sites includes
TA all from http://mud.attach.mail.ymail.com, then TA that completes the d/l, without an actual "Blocked Object" menu item required.
Sometimes it asks to TA All from https://s.yimg.com.

Verified on Fx 16.0.1 and Fx 3.6.28.

@ Giorgio:

I added http://mud.attach.mail.ymail.com to the whitelist, but it still requires a TA as described above.
I realize that is because I have w/l only script from there, and the "all" implies a separate code object. (I block *all* embeddings, at "all" sites, in NS Embeddings.)
Since I don't know what Mime type this object is, is it possible to whitelist it in
noscript.allowedMimeRegExp
or elsewhere? Same with https://s.yimg.com.

[Thrawn]

Since I don't know what Mime type this object is, is it possible to whitelist it in noscript.allowedMimeRegExp or elsewhere?

For me, it's 'application/x-unknown'. However, the following doesn't work for me:

Code: Select all

application/x-unknown@http://bf1\.attach\.mail\.ymail\.com

[Tom T.]

Care to try

Code: Select all

application/x-unknown@http://mud\.attach\.mail\.ymail\.com/*

since that was where I had to TA?
I've never seen the URI you cited. Or adding the /* may help. But it may be merely a geographical difference.
I've been playing with Yahoo for -- hours -- and that's about enough for now, thanks.

[Thrawn]

Care to try

Code: Select all

application/x-unknown@http://mud\.attach\.mail\.ymail\.com/*

since that was where I had to TA?
I've never seen the URI you cited. Or adding the /* may help. But it may be merely a geographical difference.
I've been playing with Yahoo for -- hours -- and that's about enough for now, thanks.

Probably is geographical, but I already tried:

Code: Select all

application/x-unknown@http://.*\.attach\.mail\.ymail\.com/*

which covers both of our cases. No joy. Maybe this MIME type can't be whitelisted?

[Tom T.]

Care to try

Code: Select all

application/x-unknown@http://mud\.attach\.mail\.ymail\.com/*

since that was where I had to TA?
I've never seen the URI you cited. Or adding the /* may help. But it may be merely a geographical difference.
I've been playing with Yahoo for -- hours -- and that's about enough for now, thanks.

Probably is geographical, but I already tried:

Code: Select all

application/x-unknown@http://.*\.attach\.mail\.ymail\.com/*

which covers both of our cases. No joy.

Shouldn't that be

Code: Select all

application/x-unknown@http://*\.attach\.mail\.ymail\.com/*

?

Maybe this MIME type can't be whitelisted?

My hunch was that it was not a registered MIME type at all, which is why I asked Giorgio.
It might be easier to wait for his reply.

[therube]

I have never knew ymail.com existed until you mentioned it.
It does not show up until after you have already attempted the download.
(And once I had done that, I never bothered to look to see if any other domains showed up.)

(So once you mentioned, I look & saw, & not really paying attention, allowed, & everything was fine. So then I denied again, & still was fine? Then I tried again on a different computer & I'm not sure what results I got, but different yet again, but mostly ending in failure. Wasn't really paying attention, just banging keys, so it could have been me?)

[Tom T.]

@ therube, I too have experienced very inconsistent results, which means that Yahoo is doing something screwy. Why couldn't they have just left it alone back when it just *worked*, without further user action? (sigh)