InformAction Forums

steps to reproduce:
Firefox 38.0.5 with fresh profile
NoScript 2.6.9.26 with default settings
check "Scripts Globally Allowed (dangerous)"
check "Apply these restrictions to whitelisted sites too"
uncheck "Forbid <AUDIO> / <VIDEO>"
go to https://www.youtube.com/watch?v=muLfJWOfqGQ

With the settings indicated above, the audio plays, but the video is blocked. In my own profile, the audio is also blocked, but I haven't isolated settings to reproduce that part of the issue.

EDIT:
Same result regardless of whether "Block every object coming from a site marked as untrusted" is checked

HTML5 player or Flash player?

HTML5 player.

I notice that this issue does not exist if "Forbid other plugins" is unchecked. I don't have any plugins installed. Does this option block codecs provided by the system such as via gstreamer?

Ah.. firefox provides one or two "plugins" by default, both related to decoding video. see what happens if you go to about:addons > plugins and disable everything that's there, restart the browser, and try again.

The only plugin that comes with my build is OpenH264, but it comes disabled ("Never Activate"), and I leave it that way.

What's in your blocked objects submenu when this issue occurs? Screenshot please?

1) Have you got Media Source Extensions (MSE) enabled? (about:config > media.mediasource.* prefs. i think media.mediasource.enabled controls it, but there may also be a media.mediasource.youtubeonly - no idea what that does.)
2) If MSE disabled... YouTube's video player is fairly complex, can you reproduce this on any non-YouTube site that has HTML5 video? e.g. http://www.montanalinux.org/video-systemd-as-core.html
If MSE enabled, what happens if you disable it?


With this information I'll try to reproduce it myself (since you're on Linux and not Win7 64-bit).

YouTube doesn't seem to be the best way to test this, since it serves different content to different users under different circumstances ...

Try this:
Firefox 38.0.5 with fresh profile
NoScript 2.6.9.26 with default settings
check "Scripts Globally Allowed (dangerous)"
check "Apply these restrictions to whitelisted sites too"
uncheck "Forbid <AUDIO> / <VIDEO>"
go to https://thimble.webmaker.org/
select the markup in the left pane and delete it; paste the following: At this point, the right pane should have a placeholder for the video. Don't click it or anything ...

now, select the text in the left side again and delete; paste the same text from above again ...

Now the right pane has the video rather than a placeholder. What accounts for this inconsistency?

Thanks, I can confirm the behavior....

Some more information, now that I've also tried to reproduce on my main profile.

ABP sees the content type as "audio/video" (in both cases) - but there are two requests logged in ABP even on just the first try: one originates from "thimble.webmaker.org" and the other originates from "mozillathimblelivepreview.net".
ABP logs nothing else on the second try, but I think it's to be expected because ABP doesn't log duplicate requests.

HTTPFox logs: Only unusual request header is this:

If you save the HTML from my previous post to test.html and close Firefox, then open test.html in Firefox, you'll get the placeholder. If you then press refresh, you will get the video.

This should eliminate the multiple request issue you describe for testing purposes.

^ I can confirm that too.


Couple other notes:
- Downloading the movie and setting it to open by relative path, I can't reproduce the problem.
- I also can't reproduce the problem if I host the same movie on my local server (which I access by IP address and is not trusted in any special way in that profile AFAIK). Nothing jumped out at me as different in the headers sent to/from my server vs the quirksmode server.

Unfortunately that just makes this bug weirder

EDIT Oh, and I should add that SeaMonkey is affected the same as Firefox.

Yes, there seems to be a pattern with this affecting cross sub/domain requests.

I want to reiterate an earlier comment that I think is relevant and has gotten a bit lost: this issue does not exist if "Forbid other plugins" is unchecked.

Investigating, thanks.