Back navigation problem w/ NYTimes.com site

[wclark2048]

I recently began to notice a problem with "back navigation" within the NYTImes.com website. At first it seemed my [Back] button was not working, but on closer examination, I found that the browse history (dropdown menu from Back button) had the pages I'd traversed in duplicate. I'm going to try to post an image:


I have whitelisted everything on the site (everything showing in the 'blocked' bar at the bottom.)

If I disable NoScript, the problem goes away.

I have not found this problem with any other site.

[Grumpy Old Lady]

I can confirm this duplication behaviour - using a clean test profile with NS current development version default install.
It's annoying but not dangerous as far as I can work out.

Your disabling NS still allows scripts to run, NS can only prevent scripts if it is enabled.
You will find that the problem is with a script that nytimes.com is running, not with NS.

For proof, if you forbid nytimes.com, using the NS menu, the duplication of back history ceases.
Of course, you should post again if this test doesn't behave the same for you.

nytimes.com has a history of fiddling around with scripting quite a bit.

[Grumpy Old Lady]

Just to clarify:

When I wrote "Your disabling NS still allows scripts to run, NS can only prevent scripts if it is enabled."
I wanted you to make it clear whether you mean disabling NS from the addons console, or whether you mean using the "forbid nytimes.com" item or the "forbid all" in the NS menu. Until then, I assumed there may be some mis-communication and that the steps I took would help you track things down also.

[Grumpy Old Lady]

Ah, back again.
With another report in here:
http://forums.informaction.com/viewtopic.php?f=7&t=1860
I've done a more comprehensive lot of testing and found the following:

With this second report of duplication of back button history (which I think markspace will find is because the page they are on is duplicated in the back button history, hence a single click of the back button will land them on the duplicate of the current page - and a second click will land them back at the starting page) I had a play with the options, since I wasn't getting the behaviour with my very tied-down configuration.

It appears that a scripting interaction with the google ads active content is somehow interrupting NY times scripting and the page is loading twice.

If I forbid iframes on trusted sites as well as untrusted, I can get rid of the duplication of the back button history.
The console gives a few scripting grahics exceptions and then many messages as follows

Code: Select all

Security Error: Content at http://pagead2.googlesyndication.com/ may not load data from http://www.nytimes.com/pages/sports/index.html.

If iframes are allowed (when nytimes.com active content is also allowed) then the security error is still flagged, but only appears to interrupt the rest of the page's active content. Page reload and thus duplication of back button history.
Proof that scripting is involved: If iframes are forbidden or allowed when nytimes.com is forbidden, there is no duplication of back button history.
.
Somebody may want to bring it to Giorgio's attention because disabling NS does indeed remove the page reloading problem.


As an interim workaround, if your preferred way to navigate is sequencing through history in a single tab, you may like to check the NoScript Option|Plugins|Forbid <IFRAME> along with apply these restrictions to trusted sites too. That configuration shouldn't prevent any journalist's content from displaying, only ads and some NY Times promotions.

[Alan Baxter]

I'm able to reproduce this problem in both topics, but only in Fx 3.0.11, not Fx 3.5. Looks like a Firefox update might be a more straightforward workaround.

[Charles Plager]

I'm able to reproduce this problem in both topics, but only in Fx 3.0.11, not Fx 3.5. Looks like a Firefox update might be a more straightforward workaround.

I find that this still happens with Firefox 3.6.3

[VQ444]

This same duplicate page instance behavior occurs when navigating backward and forward through Google search results on a single tab. So clearly the Google search page rendering structure utilizes the scripting particulars that interact with NoScript's current code to produce this effect.

I've found that rolling back my NoScript version to release 1.9.9.81 from release 1.9.9.87 entirely resolves this duplicate page instance issue. Perhaps this may serve as a hint to the devolper on how to resolve said issue in future releases of NoScript.

While I acknowledge that the duplicate behavior likely poses no security risk, it's nonetheless an annoying experience. My suspicion is that the mozilla support threads listed below may have been spawned by this very issue (since NoScript continues to be such a popular extension for Firefox):

http://support.mozilla.com/en-US/forum/1/600145
http://support.mozilla.com/en-US/forum/1/571089
http://support.mozilla.com/en-US/forum/1/589785
http://support.mozilla.com/en-US/forum/1/579822
http://support.mozilla.com/en-US/forum/1/502413
http://support.mozilla.com/en-US/forum/1/589785
http://support.mozilla.com/en-US/forum/1/555834
http://support.mozilla.com/en-US/forum/1/530173
http://support.mozilla.com/en-US/forum/1/576284
http://support.mozilla.com/en-US/forum/1/570699
http://support.mozilla.com/en-US/forum/1/584271
http://support.mozilla.com/en-US/forum/1/605762

In fact, this behavior is personally irritating enough to me that I'm not going to upgrade NoScript again (from release 1.9.9.81) until I'm confident a fix has been implemented.

(Note: The content of this post is purely based upon my observations and personal opinions.)

[Giorgio Maone]

@VQ444:
Albeit I couldn't reproduce it (and therefore suspect an interaction with another extension), I've been told by email that latest versions (1.9.9.95rc and above) don't exhibit this issue.
Can you confirm?
If not, could you try on a clean profile with just NoScript installed and, if the problem goes away, Standard Diagnostic keeping NS enabled to find the conflicting extension?

[VQ444]

@VQ444:
Albeit I couldn't reproduce it (and therefore suspect an interaction with another extension), I've been told by email that latest versions (1.9.9.95rc and above) don't exhibit this issue.
Can you confirm?
If not, could you try on a clean profile with just NoScript installed and, if the problem goes away, Standard Diagnostic keeping NS enabled to find the conflicting extension?

Hello Giorgio,

I've just downloaded, installed, and tested release 1.9.9.96. When using release 1.9.9.96, the duplicate instance problem appears to be gone. I tested it with precisely the same parameters that had produced the effect when using release 1.9.9.87.

Thank you for your prompt attention to this matter, as well as for your persistent diligence in the development of NoScript.