InformAction Forums

azcentral.com is the website for The Arizona Republic newspaper. No matter how many times I "Allow" the main URL, NS always prompts me to Accept. Here's an example article:

http://www.azcentral.com/story/news/ari ... /70494996/

I verified that azcentral.com is in my whitelist. Also, I noticed http://www.azcentral.com is in the whitelist. This page has four additional scripting domains, three of which I previously white-listed and the forth (facebook.com) is among my Untrusted sites.

Advice would be appreciated.

I cannot reproduce this with the information given.

ginahoy wrote:No matter how many times I "Allow" the main URL, NS always prompts me to Accept.

Can you be more specific please? I tried Allowing it in a clean profile with Fx 28 and NoScript 2.6.9.19rc2, and the permission stuck...

ginahoy wrote:I verified that azcentral.com is in my whitelist. Also, I noticed http://www.azcentral.com is in the whitelist.

Do you have any ABE rule with directive Sandbox for that site? Trying to go there in my main profile attempted to gave me a redirection to third party site.

When it fails, do you see anything related in the Browser Console? (Ctrl-Shift-J)
(if you don't know what's related, turn off CSS warnings and post everything else you see)

barbaz wrote:Can you be more specific please?

When I navigate to any article at azcentral.com, I get the yellow NS notice: "Scripts Partially Allowed 3/5..." and when I click on the Options button, I'm prompted to Allow or Temporarily allow http://www.azcentral.com. I click on Allow, the page refreshed and the left-hand menu expands (lock icon), asking me to subscribe. BTW, any cookies from this site are deleted at the end of the FF session. (I allow all cookies in FF, but use CookieKeeper to clear all cookies when I close FF, except those I explicitly protect.)

Do you have any ABE rule with directive Sandbox for that site?

I'm not sure what 'directive sandbox' is, but I checked the Advanced/ABE tab and Enable ABE is checked, WAN IP is checked, and ABE/System has these rules (I made no changes on this tab):
Site LOCAL
Accept from LOCAL
Deny

Trying to go there in my main profile attempted to gave me a redirection to third party site.

Hmm... I've not experienced that problem.

When it fails, do you see anything related in the Browser Console?

Here's what my console shows (only the first one appears before I click Allow):
----------------------------------------------------------------------------------------------------
- Use of getUserData() or setUserData() is deprecated. Use WeakMap or element.dataset instead. requestNotifier.js:64
- Error: http://www.gannett-cdn.com/azcentral/st ... ain.min.js is being assigned a //# sourceMappingURL, but already has one
- Use of attributes' specified attribute is deprecated. It always returns true. plusone.js:28
- Load denied by X-Frame-Options: https://apis.google.com/_/widget/render ... n=92033969 does not permit cross-origin framing.
----------------------------------------------------------------------------------------------------

Also, since I selected "Temporarily allow top-level sites by default / Base 2nd level Domains", I shouldn't need to allow this URL to begin with! I sometimes have this issue (but rarely) on google.com. But with azcentral, it happens every time.

OK the first thing to try is:
1) Export the entire NoScript settings. NoScript Options > Export (the button *on the very bottom*). Also export the Whitelist and Untrusted list: NoScript Options > Whitelist > Export (the Export button unique to the Whitelist panel).
2) Reset NoScript completely: NoScript Options > Reset (on the very bottom)
3) Re-import your whitelist/untrusted list using the Import button unique to the Whitelist panel. (Optionally try again to reproduce the problem at this stage.)
4) Manually configure other settings using only the GUI, don't do any about:config-only tweaks.

Does that stop this weirdness?
If so, maybe start by exporting the new NoScript config and doing a diff?

ginahoy wrote:

Trying to go there in my main profile attempted to gave me a redirection to third party site.

Hmm... I've not experienced that problem.

Install NoRedirect and configure it to block all redirects (Regex: .*, check only "Source") and you'll see it too.

Ok, I did the Reset and after I restored (imported) my whitelist/untrusted file, the azcentral problem persisted, even before mading changes to the GUI to restore preferences and settings.

So I did another Reset without the import. This time, when I navigated to azcentral, I "Allowed" or "Untrusted" each scripting site using my whitelist file as a guide to ensure I only allowed the domains I had previously allowed. This time the problem did not recur. That means there must be something in my whitelist/untrusted file that's causing the problem. The file is 120kB so I'm not even thinking about starting over.

Any suggestions?

You've saved your whitelist/Untrusted list separately so go ahead and import back your entire NoScript config, then remove all non-mandatory entries from the whitelist and reset about:config > noscript.untrusted .
Then (optionally backup the exported whitelist/Untrusted file and) open your exported whitelist/Untrusted list file in a text editor and see if you can spot the problem and manually remove it?
(Possible hint: 2nd-level domains should be listed as doma.in, http://doma.in, and https://doma.in, while non-2nd-level-domains don't need to be repeated 3x like that)

If you don't see anything wrong, feel free to PM it to someone on forum staff (Giorgio Maone, me, GµårÐïåñ, therube, or Thrawn) and we'll take a look at it.

barbaz wrote:remove all non-mandatory entries from the whitelist

Not sure what you mean by non-mandatory entries... The whitelist has ~3,900 entries! (after revoking temporary permissions)

I've been using NS a long time, and I do spend a lot of time browsing, but I'm surprised to see that many entries in my whitelist, especially given that I have NS set to temporarily allow TLD's by default (although I haven't always had this option set). Also, I never click "Allow all of this page".

My normal procedure when navigating to a new site is to ignore script warnings (e.g. I don't Allow, temporarily allow, or mark anything as untrusted), unless it affects functionality of whatever I'm doing at the moment, in which case I may "temporarily allow all of this page". If I decide to bookmark a site, I typically mark everything as Untrusted except items that interfere with functionality. In that case, I may do some trial-and-error to see which scripts are necessary to use the site. So in the end, I don't permanently Allow stuff very often. This is why the number of entries in my whitelist is a real shocker.

I'm seeing a LOT of familiar TLD's in the list. Those must have been added before I set NS to temporarily allow TLD's by default. But with nearly 4,000 entries, I don't have time to go through the entire list to pick out the ones I no longer need. In any case, there's no way I can remember all the 3rd party scripts I've Allowed in order to use sites I bookmarked. It would be easier to just toss my WL and start over.

I do appreciate your help, but without any obvious fix, it's so much easier to just continue accepting the azcentral TLD.

Oh, yeah.. your comment about redirection caught my attention. Perhaps this somehow relates to the problem I'm having? When I said I've never experienced that before, what I meant is that when I navigate to an article at azcentral, the URL in my address window doesn't change. That said, I now recall that redirects can be set up so the actual URL is masked. I used that feature when I changed my business TLD about six years ago. At least redirection could explain why the "Temporarily allow top-level sites by default" option doesn't work for azcentral..?

I just installed NoRedirect but can't seem to get it to work. I set RegExp to .* with only the Source box checked, which I assume is supposed to trap redirects on any website? I also navigated to my business website, which I know has redirection. But all the pages load normally. I guess I need to read up on regular expressions, or perhaps there's a conflict with another add-on.

ginahoy wrote:Not sure what you mean by non-mandatory entries...

Anything removable. Mandatory entries will be greyed out and you can't delete them.

ginahoy wrote:I just installed NoRedirect but can't seem to get it to work. I set RegExp to .* with only the Source box checked, which I assume is supposed to trap redirects on any website? I also navigated to my business website, which I know has redirection. But all the pages load normally. I guess I need to read up on regular expressions, or perhaps there's a conflict with another add-on.

Weird, it works for me, and sounds like you've done it right... try removing all the other entries in the list?

It injects a banner on the page indicating where the redirected URL is and offers you a link to there. Is your page causing the banner to be hidden or removed?

Note that it does nothing against JavaScript redirections, just HTTP/3xx & HTTP/Refresh.

I was able to get NoRedirect working. The redirect TLD turns out to be gcion.com, which was in my Untrusted list. I used about:config to manually removed all instances of gcion from the untrusted list and then added it to the whitelist. The azcentral problem went away

What was throwing me off is that gcion never showed up as untrusted @ azcentral.com (presumably because of the redirect?), so I didn't realize I needed to whitelist. I must have marked it as Untrusted from another site. Also, the "Temporarily allow top-level sites by default" setting now works for azcentral.com (e.g., azcentral no longer needs to be in my whitelist).

Thanks again for all the help!

Great! This sounds like a related issue to viewtopic.php?f=10&t=16994

barbaz wrote:This sounds like a related issue to viewtopic.php?f=10&t=16994

The last comment in that thread mentions google ("sometimes noscript forgot about google being trusted and displays [https://www.google.com]."

I've experienced this issue before, but not lately. Either because I rarely sign in to use Google, or maybe that particular issue was patched...

ginahoy wrote:

barbaz wrote:This sounds like a related issue to viewtopic.php?f=10&t=16994

The last comment in that thread mentions google ("sometimes noscript forgot about google being trusted and displays [https://www.google.com]."

I've experienced this issue before, but not lately. Either because I rarely sign in to use Google, or maybe that particular issue was patched...

The issue in that comment happens when about:config > noscript.docShellJSBlocking is set to 2. I'm not sure if it's related to my OP or not.