InformAction Forums

When I navigate to my AOL webmail account, noscript reports 2 of 5 scripts allowed, however, only 2 scripts are blocked, and no others are listed (5th script is missing from context menu) so there's no way to see it, allow it, or block it. So I have to X out of the notification bar every time I check my mail. See screenshot...http://bit.ly/1JLMABr

I don't use AOL myself, so I can't really verify it.

However, navigating to that page without logging in, I notice scripts from atwola.com. Is that your missing 5th domain?

Thrawn wrote:...navigating to that page without logging in, I notice scripts from atwola.com. Is that your missing 5th domain?

Thanks for your reply. Scripts are different on the main page. Anyway, I already have that domain in my blocked list.

I was hoping someone might be able to describe how they solved this issues for other websites. I don't imagine I'm the first person who's experienced this type of problem.

Try go to NoScript Options > Appearance and select to show Full Domains - this has clarified things in the past for me.

(Although I think the specific issue you're referring to in this thread has come up for me before when things are Marked as Untrusted... I had seen this & figured this out before - and learned to dismiss it - but I've since forgot what I figured the deal is. Something to do with multiple Full Domains in the same origin I think?)

barbaz wrote:Try go to NoScript Options > Appearance and select to show Full Domains

No cigar. I also tried showing Full Addresses... same result. Thanks for your suggestion.

Well if the extra domain is second subdomain of something Marked as Untrusted then it wouldn't show up anyway. The involved 2nd-level domain would have to be not Untrusted & not Allowed for you to see its two subdomains.

If you use the sticky menu you can Temporarily Allow from Untrusted & then immediately Forbid in the main menu - thus it is possible to check this while never running scripts from those sources.

barbaz wrote:...you can Temporarily Allow from Untrusted & then immediately Forbid in the main menu - thus it is possible to check this while never running scripts from those sources.

I tried your suggestion (with Appearance set to show full domains). Now I can see a couple of sub-domains in the main menu, but counting is incorrect (http://bit.ly/1PwL1oY). After I forbade the subdomains, counting is still wrong.

It's obviously easier to click the X to get rid of the nag and move on. I just thought the developer would want to know about this apparent bug.

Your second screenshot seems a different situation & would indeed seem to be a bug, as there really is nothing left to Allow there yet you're still seeing that bar.

Moving to NoScript Development.


If you click the Options button on the bar does that menu differ at all from what's shown in the toolbar icon menu?

barbaz wrote:If you click the Options button on the bar does that menu differ at all from what's shown in the toolbar icon menu?

Thanks, Barbaz. The menu is the same either way.

In case anyone tests this with an AOL account, the error only occurs on the "Today on AOL" link on the left side menu (that's the landing page whenever you check email). Also, AOL sometimes attempts to load another blocked script (scorecardresearch.com) on this page but the script count on yellow popup at bottom always indicates one more script than indicated in the menu.

Just to be clear, NoScript Options > Appearance > Blocked Objects is checked in that NS setup, right?

Yes. You can see that it is in the screenshot linked in my original post.

ginahoy wrote:You can see that it is in the screenshot linked in my original post.

Neither screenshot shows your settings for NoScript Options > Appearance nor does either shows a Blocked Objects entry in the NS menu, so it wasn't an answered question.
Anyway thanks for clarifying that.

Now, I don't have an AOL account, but if I were investigating this I'd start digging around in the page's DOM (Tools > Web Developer > Inspect) to see if I could find any <SCRIPT> tags that are sourced from sites not listed in the menu - in your screenshot2 there should be 47 of them from a single source...
I've forgotten how to use Fx 28's Inspect feature, what methods does it offer you to find DOM nodes?

If that got nowhere I'd then monitor network traffic when loading the page with all scripts listed in the menu Temp-Allowed (yet the notification is still present saying there's something else) & then with Allow Scripts Globally turned on, comparing to see if it's different (using the Browser Console (Ctrl-Shift-J) net logging feature; note that xmlhttprequest/XHR logging might need to be turned on separately). I'd also compare NS menus in each case.

Probably while doing all this I'd also want NoRedirect intercepting all redirects too, in case there's a (otherwise invisible) redirect playing a role here (Regex: .*, check only "Source").


Assuming no one on forum staff both has AOL account & sees this, are you able to do any of that investigation & report back the results?

barbaz wrote:Neither screenshot shows your settings for NoScript Options > Appearance nor does either shows a Blocked Objects entry in the NS menu, so it wasn't an answered question.

What I meant was that screenshot1 shows that I have enabled NoScript to show the Untrusted domains that it's blocking on a given web page. Based on your response, I must be confused as to what is meant by Blocked Objects on the Appearance/Show menu. Is an Object different from a Script?

I'd start digging around in the page's DOM (Tools > Web Developer > Inspect) to see if I could find any <SCRIPT> tags that are sourced from sites not listed in the menu... I'd then monitor network traffic when loading the page with all scripts listed in the menu Temp-Allowed... I'd also want redirect intercepting all redirects

Hmm... I barely know what DOM is. Don't get me wrong, I have a graduate degree in computer engineering. But this is far outside my expertise and I barely have time to respond to this thread. I appreciate the help, but this is more involved than I imagined. I'll just be content clicking past the warnings.

ginahoy wrote:Based on your response, I must be confused as to what is meant by Blocked Objects on the Appearance/Show menu. Is an Object different from a Script?

Object (in NoScript terminology) is the stuff you control under Embeddings (usually <object> or <embed> tags, but can be other things too). Script is the <script> tag.
Completely different things.

ginahoy wrote:Hmm... I barely know what DOM is. Don't get me wrong, I have a graduate degree in computer engineering. But this is far outside my expertise and I barely have time to respond to this thread. I appreciate the help, but this is more involved than I imagined. I'll just be content clicking past the warnings.

Don't worry about it, I was mostly just throwing some ideas out there for whoever is able to investigate this, regardless of whether it ends up to be you, or someone on forum staff, or another forum user who sees the same thing but has more time...