How to really blacklist mediasource?

[Guest]

Hi,

I don't know if this is a result of updating to Firefox 42, but now the "mediasource:" pseudo-protocol seems permanently whitelisted. This is quite a surprise, since the old behavior is that I can explicitly grant permission to mediasource from the "Blocked Objects" context menu entry. Now the entry for mediasource: is grayed out in the whitelist and cannot be removed.

I even tried removing mediasource: in the about:config entry "noscript.mandatory". After restarting Firefox, this made it possible to remove "mediasource:" from the whitelist menu. But this seems to do nothing.

Example:
Expected behavior: Go to youtube.com -> open a video page -> should see blank in place of the video player -> grant temporary permission to mediasource: in "Blocked Objects" -> page reloads, video player plays video.
Current behavior: Go to youtube.com -> open a video page -> video plays as if NoScript is not there

[barbaz]

What makes you think it's using mediasource when it just plays?

Also, please note that when you've got mediasource: in your Noscript menu you are already trusting the thing generating it, as it's from a script you already have allowed. You get no security benefit from allowing it explicitly.
That's why it's on the "mandatory" whitelist.

You also have not provided enough details about your NoScript configuration for us to be clear what's happening here. Please post here the domain(s) Allowed on youtube, what Embeddings you selected to forbid, whether you have "Apply these restrictions to whitelisted sites too" checked, and any information I didn't mention that could help us assess if you maybe getting the Flash video player or non-mediasource html5 video.

[therube]

(Also note that there are various media.mediasource.* about:config items.)