Page 1 of 1

NoScript bug affecting page cursor

Posted: Mon May 27, 2013 7:01 pm
by obiwan
Steps to Reproduce:

1. Run Firefox with NoScript enabled
2. Copy and paste the following into the URL bar and press Enter (may need to set noscript.allowURLBarJS to true):

Code: Select all

data:text/html,<body style="height:2000px;cursor:pointer"></body>
3. Move the mouse over the page. As expected, the cursor is a hand cursor (pointer)
4. Click on the NoScript toolbar button to open the menu, then click again to close the menu
5. Now move the mouse back over the page

Expected result:
The cursor is still a pointer

Actual result:
The cursor has changed to an arrow

According to DOM Inspector, this CSS is added to the page, which is causing the problem by forcing the body cursor to auto:

Code: Select all

body:not([id]) { cursor: auto !important } .__noscriptOpaqued__ { opacity: 1 !important; visibility: visible; filter: none !important } iframe.__noscriptOpaqued__ { display: block !important; } object.__noscriptOpaqued__, embed.__noscriptOpaqued__ { display: inline !important } .__noscriptJustOpaqued__ { opacity: 1 !important } .__noscriptScrolling__ { overflow: auto !important; min-width: 52px !important; min-height: 52px !important } .__noscriptNoScrolling__ { overflow: hidden !important } .__noscriptHidden__ { visibility: hidden !important } .__noscriptBlank__ { background-color: white !important; color: white !important; border-color: white !important; background-image: none !important }
The bug can also be triggered in other ways, for example by opening a new page in another tab and then switching back to the first tab.

Re: NoScript bug affecting page cursor

Posted: Mon May 27, 2013 7:08 pm
by obiwan
Also, you might see the arrow cursor at step 3, in which case you can ignore steps 4 and 5 because you've hit the bug already...

Re: NoScript bug affecting page cursor

Posted: Tue May 28, 2013 9:15 am
by Giorgio Maone
It's part of the protection against cursorjacking, I'm not sure there's a easy fix. Do you think this is something users can live with?

Re: NoScript bug affecting page cursor

Posted: Tue May 28, 2013 6:49 pm
by therube
Why am I not able to see the "hand" when following STR 1+2+3, with NoScript installed?
(I do get the hand when NoScript is not installed.)

Re: NoScript bug affecting page cursor

Posted: Wed May 29, 2013 12:10 am
by obiwan
therube wrote:Why am I not able to see the "hand" when following STR 1+2+3, with NoScript installed?
(I do get the hand when NoScript is not installed.)
It should be the hand, but NoScript forces it to be the arrow instead. In my experience that doesn't happen straight away though. If I run the STR as soon as I open the browser, I get the hand/pointer at step 3 and the arrow at step 5. But if I run the STR at any other time, I get the arrow at step 3.

To answer Giorgio: it seems (at least to me) a surprising thing for NoScript to be affecting, but I guess if it's required for a security feature then it has to be done...

Re: NoScript bug affecting page cursor

Posted: Wed May 29, 2013 11:21 am
by therube
> It should be the hand, but NoScript forces it to be the arrow instead.

Oh, OK then. I see the arrow instead of the hand.