noscript blocking Load the YouTube Video Player On-Demand

[Reva]

http://www.labnol.org/internet/light-yo ... eds/27941/
https://labnol.googlecode.com/files/youtube.js

example site where noscript blocks it.. relevant scripts is allowed for the site... but nothing shows...

http://www.ggmania.com/?smsid=far-cry-4 ... iler-38195

noscript disabled completely it works.

what option is missing to get this working?

[therube]

All it took for me were:

+youtube.com
+labnol.org

Nothing allowed, black placeholder.
labnol allowed, placeholder with screenshot.
Allow youtube & the clip plays.

[Reva]

Well that is odd because I don't see any placeholder... the space is just empty, inspecting the area even shows that

youtube and ytimg are already allowed scripts

labnol is allowed

nothing at all.. what other option?

I managed to once temporary allow all and the image place holder showed and was able to playvideo.. but after resetting noscript and restarting and doing it again it didn't work.

also with noscript disabled when you move the mouse over the image there is a call to https://fbstatic-a.akamaihd.net/rsrc.ph ... MekyHM1.js which is never shown in the noscript menu.


test on newer fx with latest noscript

[therube]

As a test, try a new, clean Profile.
Install NoScript, restart FF, then try your page.

[Reva]

nope still not.. empty profile.. install noscript restart.. goto site.. temp allow ggmania, labnol.. nothing.. temp allow all.. nothing ..allow scripts globally ..nothing


so something else in noscripts default options is causing it to not work.. what I dunno.. i've checked many settings off/on and tested

[Reva]

maybe someone else can check

[Giorgio Maone]

--
[08:38:24.867] [NoScript] Blocking cross-site Javascript served from https://labnol.googlecode.com/files/youtube.js with wrong type info text/plain, attachment; filename="youtube.js" and included by http://www.ggmania.com/?smsid=far-cry-4 ... iler-38195

More in general, never include JavaScript files from a code repository: anybody can put any file there, so if NoScript allowed wholesale JavaScript files with the wrong content-type (which usually the repository set to a generic one in order to advise that the file is meant for download, rather than inclusion) it would put user in great danger.

On a side note, is there any reason why you're using Firefox 27, BTW?

@therube: the script working for you worries me a bit: did you turn the noscript.inclusionTypeChecking about:config preference to false, or add googlecode.com as an exception?

[barbaz]

More in general, never include JavaScript files from a code repository: anybody can put any file there, so if NoScript allowed wholesale JavaScript files with the wrong content-type (which usually the repository set to a generic one in order to advise that the file is meant for download, rather than inclusion) it would put user in great danger.

If that sounds scary (it is), a good alternative to running JS straight off a code repository could be to get a revision of the file that you trust, vet it, then set it up as a surrogate for the real thing using a file URL pointing to the downloaded script as the replacement. Then you know when it's changed and how, because you're the one who would have changed it...

[Reva]

On a side note, is there any reason why you're using Firefox 27, BTW?

I haven't yet migrated over to anything beyond that pile of fucking shit gui chrome copy that was introduced in v30 or whatever

to many custom userstyles to port over and I just haven't seen much of anything in the later versions to make me want do update yet maybe by version 60 they might have done something worthwhile

though I have started redoing addons trying to get things back to how I like in v35, but its really ass to look at.. and now those mozilla clowns are tearing up the options and putting that in a fucking tab instead of gui window.

Anyway I'll forward that info about the youtube script to the ggmania dev he can sort it out, I shoudl have checked the error console.. no idea it was saying that.

[Reva]

If that sounds scary (it is), a good alternative to running JS straight off a code repository could be to get a revision of the file that you trust, vet it, then set it up as a for the real thing using a file URL pointing to the downloaded script as the replacement. Then you know when it's changed and how, because you're the one who would have changed it...

i have actually put this external youtube script into greasemonkey script now, it works and I don't need labnol allowed, not sure if the site dev will fix it, so many web developers just dump external scripts... tbh i don't mind its often one less **** javascript that I don't need to allow in most cases.. the noscript menu list of external scripts gets **** crazy big on some sites. Feel dirty going on such sites without noscript

Otherwise they start embedding javascripts into the main domain, and then you allow the main domain all these **** rat scripts start running.

Need a per tab firewall next just to vet javascript connections, ooh you want to send some analytic data **** to google.. **** denied.

[barbaz]

On a side note, is there any reason why you're using Firefox 27, BTW?

I haven't yet migrated over to anything beyond that pile of f***ing s*** gui chrome copy that was introduced in

That was introduced in Firefox 29. If that's the main reason why you don't upgrade your Fx to the latest version then you have no reason not to use Firefox 28 or latest Firefox 24 ESR.

i have actually put this external youtube script into greasemonkey script now, it works and I don't need labnol allowed

Yes, that will *sometimes* work, but the timing of when a Greasemonkey script runs isn't controlled by when the "actual" script "should" have run, so if it runs too early or too late things could be messed up. Apparently it's not an issue in this case, but it could be on other sites.

tbh i don't mind its often one less s****ing javascript that I don't need to allow in most cases.. the noscript menu list of external scripts gets f***ing crazy big on some sites. Feel dirty going on such sites without noscript

Otherwise they start embedding javascripts into the main domain, and then you allow the main domain all these f***ing rat scripts start running.

Need a per tab firewall next just to vet javascript connections, ooh you want to send some analytic data crap to google.. f**king denied.

+1, and you've already got a tool that can be used as such a firewall: ABE

[therube]

@therube: the script working for you worries me a bit: did you turn the noscript.inclusionTypeChecking about:config preference to false, or add googlecode.com as an exception?

I'm doing nothing out of the ordinary.
New Profile. Install NoScript.
I load the page & have black placeholders.
I allow labnol.org & the placeholders load & the clip will play.
(Prior to allowing labnol.org, youtube, ytimg, & google did not exist, but after they did.)

[therube]

LOL. It just dawned on me, LOL.
OK, the "clip" in Gameguru will not load & does generate the cross-stie Javascript warning.

viewtopic.php?f=19&t=20117

[hejyhej]

LOL. It just dawned on me, LOL.
OK, the "clip" in Gameguru will not load & does generate the cross-stie Javascript warning.

viewtopic.php?f=19&t=20117

Did you happen to dawn upon a solution to this problem, by chance?

[mpapad]

LOL. It just dawned on me, LOL.
OK, the "clip" in Gameguru will not load & does generate the cross-stie Javascript warning.

viewtopic.php?f=19&t=20117

Did you happen to dawn upon a solution to this problem, by chance?

First you need to download the script (https://labnol.googlecode.com/files/youtube.js) to your hard drive.
I've placed it in the folder C:\Youtubejs_surrogate

Then you need to go to about:config page and add two keys
1st key is
noscript.surrogate.ytjs.sources
with the value
https://labnol.googlecode.com/files/youtube.js

2nd key is
noscript.surrogate.ytjs.replacement
with the value
file:///C:/Youtubejs_surrogate/youtube.js

Thats it!