InformAction Forums

Hi, I noticed a strange behavior where temporarily allowing a website would create some permanent entries in the NoScript whitelist.

NoScript version 2.9.5.2rc2
Firefox version 50.0

Steps to reproduce (done using fresh Firefox profile and only NoScript installed)
- Visit http://whatismyip.network/proxy-check-t ... ansparent/
- Hover over NoScript icon and click "Temporarily allow whatismyip.network" (assuming that default jquery domain is whitelisted)
- Click the "Check Proxy" button on the website
- Open NoScript options, open the whitelist tab
- Scroll to bottom

Result:
Two PERMANENT entries for:
http://check.whatismyip.network:8888
https://check.whatismyip.network:8443
The two above entries remain in the whitelist even after revoking temporary permissions and restarting Firefox.

I would expect NoScript to only maintain temporary entries and not make any permanent entries in the whitelist.

Is this supposed to be happening?
Thanks.

Two PERMANENT entries for:
http://check.whatismyip.network:8888
https://check.whatismyip.network:8443
The two above entries remain in the whitelist even after revoking temporary permissions and restarting Firefox.

Cannot confirm.

Win XP
FF50
NoScript 2.9.5.1

New Profile.

After revoking, all the whatismyip entries are removed.

I'll note that hovering the Revoke Temporary Permissions shows both:

whatismyip.network
check.whatismyip.network:

firescript wrote: Steps to reproduce (done using fresh Firefox profile and only NoScript installed)
- Visit http://whatismyip.network/proxy-check-t ... ansparent/
- Hover over NoScript icon and click "Temporarily allow whatismyip.network" (assuming that default jquery domain is whitelisted)
- Click the "Check Proxy" button on the website
- Open NoScript options, open the whitelist tab
- Scroll to bottom

I have tested the steps above on NoScript version 2.9.5.1 and have reproduced the issue.
Did you actually click the "Check Proxy" button on the website after temporarily allowing domain as referred to in above steps?

I have found another website that reproduces this issue.
If you visit https://www.browserleaks.com/proxy and "temporarily allow browserleaks.com" from the NoScript menu.

Then the following entries will be added to the whitelist.
https://www.browserleaks.com:9050
https://www.browserleaks.com:9051
https://www.browserleaks.com:9150
https://www.browserleaks.com:9151

I can see those appearing, but they're all temporary entries, and when you've whitelisted the whole second-level domain, it doesn't seem that strange.

What seems more odd, and a bit concerning, is that whitelisting the full address, https://www.browserleaks.com, also creates those temporary entries for other ports. I was under the impression that full-address whitelisting was port-specific.

Did you actually click the "Check Proxy" button on the website after temporarily allowing domain as referred to in above steps?

Yes.

Also WFM (both sites), Win 7, SeaMonkey, 2.9.5.2rc5.


As a test, create a new, clean Profile.
Install only NoScript.
Leave all options at their defaults & test.


I'm thinking its a [NoScript] setting that you, & seemingly a bunch of others have enabled, that is causing a number of recent related issues now being seen in 2.9.x.