InformAction Forums

Hi, with the latest noscript development build and nightlies if google.com is removed from the whitelist about:addons, about:support and about:config are impossible to get to. With due respect to google and Mozilla google.com is the last page I want to permanently give permissions to so I hope this is just temporary otherwise I'll be forced to never update noscript again.

While bugs in Nightlies are totally expected these days, since they completely removed CAPS which was the mechanism which NoScript has always relied upon in order to block inline scripts, I cannot reproduce the issue you're reporting.
If I remove google.com from the whitelist, about:config and about:addons keep working as usual.
about:support needs to be whitelisted explicitly, since it's not in the default whitelist, but after that works just fine.
Could you please provide step-by-step instructions to reproduce on a clean profile with just NoScript installed?

After creating a new profile and installing just noscript it appears to work fine with google.com deleted from the whitelist, even following a reboot of firefox. So what I did was go back to my usual profile and temporarily disable every addon but noscript to see if there was a conflict. Take away google.com and those support pages are still impossible to get to, put it back and it's fine although sometimes you have to reboot firefox for them to return. I can't figure out what setting in prefs.js is causing the issue.

Wish I could help but for now I'm back to 2.6.8.7, which works without google.com however there's still a problem with Inline javascript. Toggle noscript.docShellJSBlocking to 2 and those pages won't load since I don't whitelist google.com.

To the developer: it turns out that reproducing the bug is real easy. First create a fresh profile and install only the latest noscript. Next remove google.com from the whitelist and then restart Firefox. Go to https://www.google.com/ from a bookmark. While still on google try to go to about:addons or about: config, neither page will load at that point.

maybe i am mucking up the thread by commenting, but i am not seeing a problem with accessing "about:config" or "about:addons" when using Firefox 26 and the "released" version of noscript, build 2.6.8.8..

redwolfe_98 wrote:maybe i am mucking up the thread by commenting, but i am not seeing a problem with accessing "about:config" or "about:addons" when using Firefox 26 and the "released" version of noscript, build 2.6.8.8..

It's fine on earlier versions of Firefox for me also; this new bug is the result of Inline javascript with the latest v29 nightlies only.

Guest wrote: While still on google try to go to about:addons or about: config, neither page will load at that point.

OK, now it's clearer, but has nothing to do with google.com per se.
It seems that if you manually navigate to a non-http website (e.g. about:config or about:addons) from a non-whitelisted sites (google.com, in your case) in the same window (e.g. by typing the address in the URL bar or left-clicking a bookmark) the permissions of the landing page are reported as "forbidden", even though the site is actually whitelisted.
And yes, it affects just latest builds of both Firefox and NoScript.
Investigating, thanks.

The latest development build resets "noscript.docShellJSBlocking" back to 1 so that support pages load again in the nightlies but the inline javascript problem is back where some pages won't load completely. Was this intentional? Or maybe I'm missing a change in settings that resolves the issue?

Guest wrote:but the inline javascript problem is back where some pages won't load completely.

Could you specify what's exactly the problem with inline JavaScript which is back again? Thanks!

Giorgio Maone wrote:

Guest wrote:but the inline javascript problem is back where some pages won't load completely.

Could you specify what's exactly the problem with inline JavaScript which is back again? Thanks!

This problem I had assumed was due to inline javascript because when "noscript.docShellJSBlocking" is set to 2 pages load properly. An example is any addon Mozilla
site:

https://addons.mozilla.org/en-US/firefo ... src=search

With "noscript.docShellJSBlocking" on 2 and javascript off look on the bottom of the page and there's a link to the right that says "See complete version history". When "noscript.docShellJSBlocking" is on 1 and javascript is off the link won't load and there's a throbber. I noticed this with other pages as well not loading.

24ESR works properly, regardless of the noscript version. This problem started with the latest nightlies.

Guest wrote:An example is any addon Mozilla
site:

https://addons.mozilla.org/en-US/firefo ... src=search

With "noscript.docShellJSBlocking" on 2 and javascript off look on the bottom of the page and there's a link to the right that says "See complete version history". When "noscript.docShellJSBlocking" is on 1 and javascript is off the link won't load and there's a throbber. I noticed this with other pages as well not loading.

24ESR works properly, regardless of the noscript version. This problem started with the latest nightlies.

I can see it. The problem is that the new (recommended by Mozilla) method to turn off JavaScript per-window seems not to cause <noscript> elements to be rendered, and therefore fallbacks provided by the web page are useless.
Looking for a work-around, thank you.

To the developer: thanks for the quick fix with the latest build. The two issues appear resolved.