InformAction Forums

BUGs in Noscript.

NoScript v10.1.5.9 (these bugs have also appeared in earlier versions)
Firefox v 57.0.2
Windows 7

The bugs show themselves in two ways, but I think both ways
are timing related.

The FIRST way the bug shows itself is when I navigate to a site
that only has a few scripts (such as hackademix.net).
Before the site is completely loaded,
if I quickly single click the NoScript icon in the Firefox bookmarks bar,
instead of the expected dropdown appearing with permissions for various URLs,
I get a dropdown with the message "In order to operate on this tab,
NoScript needs to reload it. Proceed?" There are OK and Cancel buttons.

The bug does not occur every time, but I can usually make it happen
once out of 10 tries. Navigate to page, click Firefox reload icon, then
quickly single click the NoScript icon (before the page loads and dropdown appears).



The SECOND way the bug shows itself is when I navigate to a site
that has many scripts and takes many seconds to load.
While the site is loading, if I quickly click
the NoScript icon in the Firefox bookmarks bar MULTIPLE TIMES,
then instead of getting a dropdown (showing URLs),
I will get the contents of the dropdown in a separate window
(with re-sizable frame, title bar, and min/max/close icons
on the right side of the title bar).

This window is independent of the Firefox window,
and it can be moved, re-sized, covered by other windows,
shows up in the Windows taskbar, and will remain open when
the Firefox window is closed). The title bar says:
mox-extension://d05b5c18-27f3 ... ef30 - NoScript Settings - Mozilla Firefox

Sometimes client part of this window shows the list of permissions (URLs), and sometimes
that part is blank. The client portion of the window has the usual
NoScript close, reload, and options icons in the upper left,
and the Revoke Temporary and Temporarily Allow icons
in the upper right.

The bug does not occur every time, but I can usually make it happen once
out of 10 tries. While navigated to a desired page (with many scripts that takes
several seconds to load) ... first click the Firefox reload icon, then click
the NoScript icon multiple times while Firefox shows that the page is
being loaded (reload icon has changed to X). Note that sometimes the separate
window will appear "on top" and be quickly visible, and sometimes the separate window
is "under" the Firefox window. You may have to check the Windows taskbar,
or minimize Firefox, to see if the separate window exists.



Again, my guess is that these two bugs are caused by a timing issue that occurs when
the user clicks the NoScript icon before the page is fully loaded.

Suggested solution: disable (grey out) the NoScript icon while
the page is being loaded, and re-enable the icon once the page
has been fully loaded. In that way, if a user mistakenly clicks the
NoScript icon while the page is being loaded, it will have no effect.

If it is not possible to disable the NoScript icon while page is being loaded,
then perhaps you can disable mouse/keyboard input while page is being loaded?


Can anyone else reproduce these bugs?

geek99 wrote:when I navigate to a site
that only has a few scripts (such as hackademix.net).
Before the site is completely loaded,
if I quickly single click the NoScript icon in the Firefox bookmarks bar,
instead of the expected dropdown appearing with permissions for various URLs,
I get a dropdown with the message "In order to operate on this tab,
NoScript needs to reload it. Proceed?" There are OK and Cancel buttons.

I can confirm this one. These steps seem to consistently reproduce it, starting from a clean profile -

1) go to https://noscript.net/getit, install NoScript

2) open the NoScript popup

3) close the NoScript popup by clicking outside it

4) click the "what is it?" link on the open noscript.net/getit page

5) Before it finishes loading, open the NoScript popup.

Closing and re-opening the NoScript popup brings it back to normal.

geek99 wrote:if I quickly click
the NoScript icon in the Firefox bookmarks bar MULTIPLE TIMES,
then instead of getting a dropdown (showing URLs),
I will get the contents of the dropdown in a separate window
(with re-sizable frame, title bar, and min/max/close icons
on the right side of the title bar).

This window is independent of the Firefox window,
and it can be moved, re-sized, covered by other windows,
shows up in the Windows taskbar, and will remain open when
the Firefox window is closed). The title bar says:
mox-extension://d05b5c18-27f3 ... ef30 - NoScript Settings - Mozilla Firefox

Can confirm this as well. Page doesn't have to be loading to reproduce this. If you rapid-fire click the NoScript icon quickly enough, for long enough, it'll open that window.

When the window is blank, re-sizing it makes it fill with the contents of the NoScript popup.

barbaz wrote:

geek99 wrote: I get a dropdown with the message "In order to operate on this tab,
NoScript needs to reload it. Proceed?" There are OK and Cancel buttons.

I can confirm this one. These steps seem to consistently reproduce it, starting from a clean profile -

1) go to https://noscript.net/getit, install NoScript

2) open the NoScript popup

3) close the NoScript popup by clicking outside it

4) click the "what is it?" link on the open noscript.net/getit page

5) Before it finishes loading, open the NoScript popup.

Closing and re-opening the NoScript popup brings it back to normal.

Couldn't try on noscript.net, loading was too fast. Could reproduce on https://www.amazon.com/
I don't really see a bug here. Doesn't this message simply indicate, that loading hasn't finished/failed?

Tomatix wrote:In don't really see a bug here. Doesn't this message simply indicate, that loading hasn't finished/failed?

No. That message is supposed to be shown for existing tabs when NoScript is first installed. NoScript wasn't installed when those tabs were loaded, so it could not operate on those tabs. So it shows the message.

Now, surely NoScript *is* operating on a partially-loaded page, isn't it? Because if it wasn't, bypassing NoScript would only require loading a script quickly enough. Clearly that would be absurd for a security tool. So NoScript shouldn't be showing that message.

That is the bug here.

barbaz wrote: No. That message is supposed to be shown for existing tabs when NoScript is first installed. NoScript wasn't installed when those tabs were loaded, so it could not operate on those tabs. So it shows the message.

Yes, I think so too.

barbaz wrote: Now, surely NoScript *is* operating on a partially-loaded page, isn't it? Because if it wasn't, bypassing NoScript would only require loading a script quickly enough. Clearly that would be absurd for a security tool. So NoScript shouldn't be showing that message.

Misunderstanding: I never meant that NS is not operating on a partially-loaded page = meaning letting scripts execute unfiltered.
I thought the dialog was some sort of warning, when NS thinks that screening of the page code shows faults f.i. code missing (= clicking in the middle of page loading) or no content at all (= old tabs before install).

In order to operate on this tab, NoScript needs to reload it. Proceed?

But reading it again closely makes me think as well, that it means operate it the first time instead of operate+show it correctly. Thanks.


It seems, that it occurs, when
* everything is on DEFAULT for the page (as you said: fresh install)
and
* the script counter shows nothing (0) for the page
Could be that's how NS determines/d, if the tab was already processed.

Actually in my test with 10.1.6 this dialog isn't shown anymore after NS install or reactivation on already open tabs.
Automatically just screens the "unoperated" tabs htmls?

EDIT: highlighted some words

Tomatix:

Both of the bugs that I reported still occur in v10.1.6

To reproduce the first one:
Navigate to a site that only has a few scripts (such as hackademix.net).
Before the site is completely loaded, quickly single click the NoScript icon in the Firefox bookmarks bar.

You may have to try this a few times, but eventually the dropdown will contain this message:

"In order to operate on this tab, NoScript needs to reload it. Proceed?"

The second bug can also be easily reproduced ... follow instructions in my original post for this thread.

I think the solution might require that the NoScript icon be disabled until the page is fully loaded and fully processed by NoScript. In that way, the user cannot click the icon while the page is opening (and being processed by NoScript).

I've also seen both of these bugs happen, but I've also seen something else:
Sometimes when I rapidly click the NS10 icon while the page is loading (due to me being frustrated about long loading times) instead of showing the menu it will open up the Noscript options page.

@geek99

Tomatix wrote: Actually in my test with 10.1.6 this dialog isn't shown anymore after NS install or reactivation on already open tabs.
Automatically just screens the "unoperated" tabs htmls?

I am talking about the real purpose of this dialog that barbaz described.. when old tabs are not yet processed by Noscript.
Can you reproduce this?

geek99 wrote:Both of the bugs that I reported still occur in v10.1.6

Yes, your bugs I can still reproduce as you describe in 10.1.6 as well.