InformAction Forums

NoScripters and WebSec nerds of all lands, unite!
https://forums.informaction.com/

Whitelisted site still blocked

https://forums.informaction.com/viewtopic.php?t=21546

Page 1 of 1

Whitelisted site still blocked

Posted: Tue Jan 12, 2016 9:51 pm
by Stinkehund
Alright, i'm a bit stumped here. Since the last update, noscript blocks .. something that interferes with, for example, deviantart-menus. I completely whitelisted that site, but with noscript active it just won't work anymore. When i deactivate the addon entirely, everything goes back to normal. That is hardly a good solution, though. And i have no idea what's happening here.. Any help?

Re: Whitelisted site still blocked

Posted: Tue Jan 12, 2016 10:56 pm
by barbaz
Please provide a link to an example page and describe the problems in more detail (with specifics).

Re: Whitelisted site still blocked

Posted: Wed Jan 13, 2016 12:53 am
by Stinkehund
Alright..
http://www.deviantart.com/notifications/ does not work for me, neither does any subpage of it, like
http://www.deviantart.com/notifications/#view=feedback
http://www.deviantart.com/notifications/#view=watch
http://www.deviantart.com/notifications ... deviations

As i said, all of those are completely whitelisted and by now i also manually allowed every single thing noscript showed as blocked. The only option left is to allow scripts globally.
I'm using Windows 10, in case it matters and i tried both 32bit and 64bit Firefox. It worked just fine before the latest noscript update and it continues to work fine in other browsers and with noscript completely deactivated in Firefox.

Re: Whitelisted site still blocked

Posted: Wed Jan 13, 2016 1:33 am
by barbaz
When this issue occurs, do you see anything related in the Browser Console? (Ctrl-Shift-J)
(if you don't know what's related, turn off CSS warnings and post everything else you see)

Your link requires login, it redirects me to

Code: Select all

https://www.deviantart.com/users/login?ref=http://www.deviantart.com/notifications/
so I can't investigate there for myself, sorry. Do you have a deviantart link that shows the problem but does *not* require login to see the issue?

Re: Whitelisted site still blocked

Posted: Wed Jan 13, 2016 9:03 am
by Stinkehund
No, sorry. I haven't seen that kind of thing on any other page on dA so far.

The browser console gives me this:

Code: Select all

too much recursion
en()
 deviantart-network_jc.js:9
tn()
 deviantart-network_jc.js:9
.css()
 deviantart-network_jc.js:10
At()
 deviantart-network_jc.js:9
A()
 deviantart-network_jc.js:8
.hide()
 deviantart-network_jc.js:10
it.fn[t]()
 deviantart-network_jc.js:10
window.Popup2<.hide()
 deviantart-network_jc.js:30
window.NotesRecipients()
 deviant3_jc.js:14
<anonymous>
 deviant3_jc.js:14
DWait.fire()
 notifications:106
DWait.run()
 notifications:106
<anonymous>
 v6core_jc.js:42
DWait.fire()
 notifications:106
DWait.run()
 notifications:106
<anonymous>
 v6core_jc.js:39
DWait.fire()
 notifications:106
DWait.run()
 notifications:106
<anonymous>
 v6core_jc.js:38
DWait.fire()
 notifications:106
DWait.run()
 notifications:106
<anonymous>
 v6core_jc.js:36
DWait.fire()
 notifications:106
DWait.run()
 notifications:106
<anonymous>
 v6core_jc.js:37
DWait.fire()
 notifications:106
DWait.run()
 notifications:106
<anonymous>
 v6core_jc.js:34
DWait.fire()
 notifications:106
DWait.run()
 notifications:106
<anonymous>
 v6core_jc.js:33
DWait.fire()
 notifications:106
DWait.run()
 notifications:106
<anonymous>
 v6core_jc.js:29
DWait.fire()
 notifications:106
DWait.run()
 notifications:106
<anonymous>
 v6core_jc.js:27
DWait.fire()
 notifications:106
DWait.run()
 notifications:106
<anonymous>
 v6core_jc.js:26
DWait.fire()
 notifications:106
DWait.run()
 notifications:106
<anonymous>
 v6core_jc.js:25
DWait.fire()
 notifications:106
DWait.ready()
 notifications:106
<anonymous>
 v6core_jc.js:20
DWait.fire()
 notifications:106
DWait.run()
 notifications:106
<anonymous>
 deviantart-network_jc.js:98
DWait.fire()
 notifications:106
DWait.run()
 notifications:106
<anonymous>
 deviantart-network_jc.js:97
DWait.fire()
 notifications:106
DWait.run()
 notifications:106
<anonymous>
 deviantart-network_jc.js:96
DWait.fire()
 notifications:106
DWait.run()
 notifications:106
<anonymous>
 v6core_jc.js:23
DWait.fire()
 notifications:106
DWait.run()
 notifications:106
<anonymous>
 v6core_jc.js:21
DWait.fire()
 notifications:106
DWait.run()
 notifications:106
<anonymous>
 v6core_jc.js:13
DWait.fire()
 notifications:106
DWait.run()
 notifications:106
<anonymous>
 v6core_jc.js:12
DWait.fire()
 notifications:106
DWait.run()
 notifications:106
<anonymous>
 v6core_jc.js:11
DWait.fire()
 notifications:106
DWait.run()
 notifications:106
<anonymous>
 v6core_jc.js:8
DWait.fire()
 notifications:106
DWait.run()
 notifications:106
<anonymous>
 v6core_jc.js:7
DWait.fire()
 notifications:106
DWait.run()
 notifications:106
<anonymous>
 v6core_jc.js:5
DWait.fire()
 notifications:106
DWait.run()
 notifications:106
<anonymous>
 chat_jc.js:4
DWait.fire()
 notifications:106
DWait.run()
 notifications:106
<anonymous>
 deviantart-network_jc.js:99
DWait.fire()
 notifications:106
DWait.run()
 notifications:106
<anonymous>
 deviantart-network_jc.js:95
DWait.fire()
 notifications:106
DWait.run()
 notifications:106
<anonymous>
 deviantart-network_jc.js:70
DWait.fire()
 notifications:106
DWait.run()
 notifications:106
<anonymous>
 v6loggedin_jc.js:9
DWait.fire()
 notifications:106
DWait.run()
 notifications:106
<anonymous>
 chat_jc.js:7
DWait.fire()
 notifications:106
DWait.run()
 notifications:106
<anonymous>
 deviantart-network_jc.js:86
DWait.fire()
 notifications:106
DWait.run()
 notifications:106
<anonymous>
 deviantart-network-loggedin_jc.js:7
DWait.fire()
 notifications:106
DWait.run()
 notifications:106
<anonymous>
 menusys_jc.js:7
DWait.fire()
 notifications:106
DWait.run()
 notifications:106
<anonymous>
 deviantart-network_jc.js:94
DWait.fire()
 notifications:106
DWait.run()
 notifications:106
<anonymous>
 deviantart-network_jc.js:92
DWait.fire()
 notifications:106
DWait.run()
 notifications:106
<anonymous>
 stashwriter_jc.js:11
DWait.fire()
 notifications:106
DWait.run()
 notifications:106
<anonymous>
 stashwriter_jc.js:15
DWait.fire()
 notifications:106
DWait.run()
 notifications:106
<anonymous>
 stashwriter_jc.js:14
DWait.fire()
 notifications:106
DWait.run()
 notifications:106
<anonymous>
 stashwriter_jc.js:13
DWait.fire()
 notifications:106
DWait.run()
 notifications:106
<anonymous>
 stashwriter_jc.js:12
DWait.fire()
 notifications:106
 deviantart-network_jc.js:9:31540

Re: Whitelisted site still blocked

Posted: Wed Jan 13, 2016 2:50 pm
by barbaz
Ok that looks like all one massive message, and too unclear if that's related...

Please try disabling these NS features one at a time, in this order, and let us know when (if) it works:
  1. XSS filter (part 1): NoScript Options > Advanced > XSS, un-check both boxes
  2. XSS filter (part 2): about:config > set noscript.xss.checkInclusions to false
  3. ABE: NoScript Options > Advanced > ABE, un-check "Enable ABE"
  4. Inclusion type checking: about:config > set noscript.inclusionTypeChecking to false
Oh, and what is the value of about:config > noscript.filterXExceptions.deviantart ?

Re: Whitelisted site still blocked

Posted: Wed Jan 13, 2016 5:25 pm
by Guest
the noscript.filterXExceptions.deviantart value is 'true'

1. didn't do anything
2. worked, but only after checking the boxes in 1. again.

I didn't try 3. and 4., since the pages seem to work again now.

Re: Whitelisted site still blocked

Posted: Wed Jan 13, 2016 10:00 pm
by Thrawn
That was just for troubleshooting; you really shouldn't leave those features completely switched off.

Was there anything else in the browser console (with everything enabled)?

Re: Whitelisted site still blocked

Posted: Sat Jan 16, 2016 4:08 pm
by therube
> interferes with, for example, deviantart-menus

Such as?
Shop? More? Submit? The dropdowns from those items?

In what way does it interfere?


> http://www.deviantart.com/notifications/ does not work for me

Are you saying from the menu item on the site?
Or when you type the URL in directly?

What does happen when you try?
Are you logged in to deviantart?


> worked just fine before the latest noscript update

And just what update was that?
So if you revert to an earlier version of NoScript, functionality returns?
https://noscript.net/feed?t=a (You may need to get from AMO if these are unsigned, don't know?, & you are affected by "signing".)


AFAICT, all is working as expected.
Only deviantart.com & deviantart.net are allowed.
All times are UTC
Page 1 of 1

Powered by phpBB® Forum Software © phpBB Limited