InformAction Forums

The addon-sdk now has an api to add a browser toolbar:

https://developer.mozilla.org/en-US/Add ... ui_toolbar

HTML content can be added to the toolbar, which is inserted as an iframe -- this last bit of functionality did not work until Firefox 30.

NoScript prevents scripts from executing in this iframe, and prevents communication from this iframe using postMessage. I have a sample extension here:

http://mashing.org/noscript-firefox30-toolbar/test.xpi

To test:

* Start Firefox 30+ with a new profile.
* Install the test extension.

You will see a new toolbar. It should be yellow. There is a button that will generate postMessage requests. This should be working, and you can verify this by looking for console.log messages in the browser console.

* Install NoScript and restart

With the default configuration, NoScript prevents the javascript in the iframe from running at all, so the Toolbar will be grey and the test button will not be enlivened.

* Configure NoScript to "Allow Scripts Globally" and restart

The iframe javascript should now execute, so the Toolbar will be yellow again. However, clicking the test button will not result in any console.log messages. This is because the postMessage never made it through to the main extension code.

NoScript does not appear to log anything to explain why this content is being blocked. I tried turning off every configuration option I could find, nothing short of disabling NoScript works.

Finally, the in the logs you will also see a giant stack dump from the sdk loader. I won't paste the whole stack. This only happens once NoScript is installed. I have not looked into this, but it makes me wonder if something in the loader is getting monkey-patched.

TypeError: from is not an object
Stack trace:
[object Object] core.js:90
TypeError: from is not an object
Stack trace:
[object Object]

Can anyone help me figure out what is happening?

Reminds me of viewtopic.php?f=7&t=19820

Thanks for the reply. Yes, this does cover the script blocking part of this, but the thread was never resolved.

* This is privileged code, so I'm not sure why noscript is involved. resource:// urls are supposed to be white-listed, but that isn't working.
* There isn't a message about the blocked content, and no way to whitelist it as far as I can tell.
* The addon-sdk has built up these components with module isolation and security in mind, which is why we have to use the components in this way. The implementation is from their documentation.

The postMessage blocking is worse:

* postMessage is about safe cross-boundary communication. Again, not sure why noscript is involved here.
* Even "Allow Scripts Globally" doesn't fix it.
* Again, no messaging.

So it seems like something needs to be done to make noscript and addon-sdk addons cooperate. Right now it seems I'm stuck trying to work around the sdk if I want to use noscript. This is a problem because Australis doesn't have a first-class way to create a browser toolbar except for this new addon-sdk api.

I confirmed that 2.6.8.34 fixes the problem with scripts running in the toolbar (thanks!). However, postMessage still appears to be getting blocked.

amoore wrote:I confirmed that 2.6.8.34 fixes the problem with scripts running in the toolbar (thanks!). However, postMessage still appears to be getting blocked.

Not what I can see, actually.
The postMessage issue happens erratically, both on stable and Nightly Firefox, no matter whether NoScript is installed or not.

It appears to depend on some start-up event which I could not identify, but I manage to see the test add-on work once correctly (logging "Main.js received a message from the frame") and the other time incorrectly (the "from is not an object" exception) both on a clean profile and a profile with NoScript installed across multiple browser restarts.