InformAction Forums

Hi,

I have had a few bugs with NoScript since v2.9.5.*, which is something I expected given the important changes. I've seen two of them being fixed in 2.9.5.2, namely XSS POST to GET on Startpage and the delay in menu updates due to asynchronous permission update.

There may be more, but there is one that frankly is horrible. Sometimes, I don't know what triggers it, when I temp allow a domain like example.com, NoScript starts displaying http://www.example.com as forbidden, and I can't allow it. The website can't run JS. If I remove temp permissions the website reloads, http://www.example.com disappears and is replaced by (according to my appearance settings) "example.com", and I'm back to square one.

I'm not sure if from this point on, it happens on ALL sites or if it's constrained to example.com.
Either way, to get the normal behaviour back I have to restart Firefox multiple times, it's possible that disabling completely NoScript and reenabling it may be necessary. (The bug hasn't happened often enough for me to describe how it works and how it can be worked around properly, sorry)

My NoScript settings are quite customized. Even if you have exactly my profile, I have no idea how to reproduce the bug. It happens once or twice a day seemingly at random.

[removed per request]


Hope that limited amount of information can help pin down the cause.

Also, would you mind removing my NoScript preferences from my post once you don't need them anymore ? I'd rather not have fingerprinting information tied to the way I write become accessible to crawlers. (Yes that's overly prudent, but better be safe than sorry )

Also having Noscript not allowing a temporary or permanent allow on some sites.
Not recommended but Mozilla has an older versions list and i went back to 2.9.5.1 and disabled update for now.
Looking forward to seeing this resolved to get back on the most current version

It happens on 2.9.5.1 too, for me

Admin/Mods see viewtopic.php?t=22347

Are there square brackets around the "http://www.example.com"?

EDIT
Kami, you have a non-default value of noscript.docShellJSBlocking. If you reset that pref, do you still get the issue?

No square brackets no. I've seen those in the past (before 2.9.5, so unrelated to the current issue). What does it mean ?

Also "example.com" does appear in NoScript's options under the whitelist tab.

When I reset docShellJSBlocking to the default value, the problem doesn't get fixed if it is already present. (It is right now on slashdot.org)
I don't know if a default docShellJSBlocking prevents the bug from occurring in the first place though, so I'll try browsing with it for a few days.

Thank you for removing the prefs

I closed and reopened Firefox like 5 times without Slashdot getting fixed. I tried disabling and reenabling NoScript completely, to no avail.

This time (I can't make it a generality yet), what made it work again was to close Firefox on a slashdot page and reopen it that way.

Note: I am offline each time I start Firefox so that no ad or tracker can get through due to asynchronous loading of adblockers. So what happened was that I closed Firefox on a slashdot page, disconnected, reopened to a network error page (as expected), reconnected, refreshed, and then temp allow worked again on slashdot.

It hasn't occurred to me since then. I set noscript.docShellJSBlocking to my custom value and the bug still doesn't occur anymore, so far.

I think the only thing that changed is that I uninstalled Firefox 50.0 (keeping profile intact) and installed 50.0.2. Maybe NoScript's update got some bug when it occurred on Firefox 50.0, and somehow 50.0.2 tidied up the profile on fist run ?

Have you seen similar messed up updates in the past ? Other possibility is that the bug will occur again, but even though I don't often allow JS, it should have occurred by now.

Kami wrote:Have you seen similar messed up updates in the past ?

Yes, but in all the time I've been here, I could count the number of similar messed up Firefox updates on one hand.

Were you visiting sites you've Marked as Untrusted? If so, see viewtopic.php?f=7&t=22355

The issues do look alike. Very similar symptoms. But no, I never visit untrusted sites. It's an almost certitude because I have disabled redirects and I only mark tracking third-parties as untrusted, e.g. Google Analytics, a site I would never go to directly. I do that mostly to remove clutter from NoScript's UI.

So I could hardly visit one of my untrusted websites, whether by accident or not. It's not 100% impossible that I MARKED one 3rd party site as untrusted some time during a browsing session in which the bug occurred, but it's far from certain. I didn't mark anything untrusted since Firefox 50.0.2 is the only certitude.

Note that it's also certain that I did NOT mark a 3rd party as untrusted on the website affected by the bug. (At least not the same day, but perhaps in the past; i.e. it's possible that all sites on which the bug occurred had an untrusted third party, but I did not untrust it on the same session/day or from the same 1st party site.)

It just occurred on a site at the beginning of a session. I have not modified my untrusted list for a number of days now. However there are some untrusted third parties on the affected website.

I had docShellJSBlocking set to my custom value though. Resetting it to default to test further I guess

Kami wrote:It just occurred on a site at the beginning of a session.

Someone else just reported similar behavior - viewtopic.php?p=85526#p85526