InformAction Forums

Currently NoScript (5.0.2) is acting like Allow and Forbid are switched. It was working fine with uBlock Origin until this weekend when I wanted to try uBO for blocking 1st party scripts instead and set NS to Allow Scripts Globally. I switched back today and that's when this started. I've tried removing and reinstalling both NS and uBO and resetting all of NS's preferences in about:config. It's like NS is allowing 3rd party scripts and even bypassing uBO 3rd party script block when I haven't allowed 1st and 3rd party scripts. If I Allow Scripts Globally, uBO seems to work normally, so I'm guessing NS is the problem.

For example, if I go to say arkhamcity.wikia.com:
If I forbid wikia.com in NS
NS asks to allow wikia and nocookie yet all the images (which come from nocookie) are showing
uBO shows wikia, nocookie, quantserve, scorecardresearch and wikia-beacon

If I allow wikia.com in NS
NS asks to allow nocookie, quantserve, scorecardresearch and wikia-beacon and all the images are gone
uBO shows wikia.com and nocookie.net

I appreciate any help.

All seems fine to me.

That page creates many script tags dynamically. If javascript is globally disabled for that page, these script tags are not going to be created, and hence won't be reported in NoScript menu. uBO reports more than just script resources, it reports the domain/hostname of whatever the page tried to load.

When javascript is globally disabled, there are images from wikia-beacon.com, scorecardresearch.com, etc. from withing noscript tags, so uBO reports these.

When javascript is not globally disabled, but only 1st-party javascript is allowed, these noscript tags won't render, and now a new set of domains/hostnames are reported in uBO. If NoScript block script resources from loading, uBO won't be notified of what was blocked, and hence can't report it (this will be different with WebExtensions).

In short, all is working as expected given how legacy extensions work. If you were to install uBO before NoScript, you will probably get a different set of domains/hostnames in uBO and NoScript for the second scenario.

The only part that still seems puzzling is the fact that images appear when scripts are blocked, and vanish when scripts are allowed. However, NS doesn't try to block images.

Perhaps the images have a scriptless fallback, but allowing some sites results in a failed attempt to load them dynamically?

Thrawn wrote:Perhaps the images have a scriptless fallback, but allowing some sites results in a failed attempt to load them dynamically?

Yep. The images are lazy loaded with a scriptless fallback. And the site's lazy load implementation requires scripts from wikia.nocookie.net.