InformAction Forums

I've allowed scripts globally but I forbid audio / video tags and I applied these restrictions to whitelisted sites too. With these settings I was expecting Youtube's HTML5 player to be blocked but somehow it is being allowed.

Firefox 42.0
NoScript 2.6.9.39
Windows 7

Not enough details.
Please list all Allowed sites on youtube, as well as whether you have MSE enabled (if you don't know, type about:config in the address bar and post here the values of all media.mediasource.* prefs).

media.mediasource.

enabled = true
format-reader = true
format-reader.webm = false
mp4.enabled = true
webm.enabled = false

Any site is allowed to run JS because I've enabled the Scripts Globally Allowed option.

OK. YouTube is serving you the video with MSE enabled, which (I think) is dependent on XHR allowed to googlevideo.com rather than an <audio> or <video> enabled. Please double check this by script-blocking googlevideo.com (mark it as Untrusted, when done testing just Temporarily allow it).


offtopic: Did you pick that username for Guest posting because you previously registered here but can't remember your account name?

If you block googlevideo.com, you will rollover to Flash.
(Though for some odd reason, I was getting Flash [on XP] today?)

(With HTML5) does Embeddings | Apply these settings to whitelisted sites too need to be enabled?

No, my previous username was unregistered too.

When I mark googlevideo.com as untrusted and reload the page, I get the message "An error occured. Please try again later."

So I guess NoScript can't block all HTML5 video when using my preferred settings. I don't really care (as long as iframes are blocked, that's more important for security) but I thought it was a bug. Thanks for the quick replies.

Apply these restrictions to whitelisted sites too

Do not forbid <I|FRAME>

about:config -> media.mediasource.enabled;false

URL: https://www.youtube.com/watch?v=rGvtg3q7CUU

You should get a placeholder.
That placeholder is for an ogg object.

If you left-click the placeholder, a Flash player will load & play.
If you center-click the placeholder, the HTML5 player will load in a new tab & play.

So in a round-about way, you can block things.

Maybe playing around with some of the other *mediasource* Prefs will accomplish something different?

If MSE is disabled then as therube said you should get a placeholder for a <video> element (but its URL will change with every page reload, so clicking the placeholder is moot - you need to go to Blocked Objects and choose an option below the separator).

therube wrote:Apply these restrictions to whitelisted sites too

Do not forbid <I|FRAME>

about:config -> media.mediasource.enabled;false

URL: https://www.youtube.com/watch?v=rGvtg3q7CUU

You should get a placeholder.
That placeholder is for an ogg object.

If you left-click the placeholder, a Flash player will load & play.
If you center-click the placeholder, the HTML5 player will load in a new tab & play.

So in a round-about way, you can block things.

Maybe playing around with some of the other *mediasource* Prefs will accomplish something different?

@therube, the place holder for Flash only appears on some videos for me (like this one: https://www.youtube.com/watch?v=_kna46Ok2kA). For other videos (like the one you linked) another placeholder shows up (it has the VLC icon in my PC) and the behavior is exactly like barbaz described. Even if you click it, the URL will change and placeholder returns (still with the VLC icon).

Here's the difference between the two: http://imgur.com/a/ypfaZ

So is there a way to have MSE enabled but still have NoScript block the video?

To block all YT videos, just Forbid googlevideo.com and only Temporarily allow it when you want to watch video. (Assuming you didn't alter noscript.forbidXHR to be 0)

Thanks barbaz, I did block googlevideo and I get the placeholder on the first video.

But as you can see here

when I get the ogg video, I only have the option to unblock the whole domain, not the single video.

Because of that, many other videos are automatically unblocked too. Sometimes I open a lot of tabs at the same time and will unblock one by one.
But now if I unblock the domain and open the tabs, many videos will start playing simultaneously.

Oh... what you want cannot be done at youtube using NoScript.