InformAction Forums

I write presentations in Remark.js. It's nice and for local development I just open the file from disk. With NoScript I can allow scripts for that given file (nice!) and it works fine. However there is one issue.

Being at:
file:///home/foo/Documents/presentation5/pres.html#17 (page 17 of that presentation)

NoScript doesn't recognized it as file:///home/foo/Documents/presentation5/pres.html anylonger and F5 results in:
> Content Security Policy: The page’s settings blocked the loading of a resource at inline (“script-src”).

I need to change url to file:///home/foo/Documents/presentation5/pres.html , reload and then type #17 at the end. It's very tedious. I tried to define rules with * at the end, but NoScript ignores it. It works fine for regular URLs, e.g. https://remarkjs.com/#17 works fine for https://remarkjs.com/ exception and can be used as a workaround, but anyway.

To recap. It would good to be able treat file:///tmp/pres.html#17 (for local files) as allowed, if file:///tmp/pres.html has been on the trusted list (the same as with URL).

Marcin

Can confirm.

Problem is in Policy.js: Sites.parse() Since origin is null for file:, the fragment (hash) ends up in the siteKey and the url is not matched.

It looks like browsers have some differences here. For example Chromium gives "file://" as origin instead of Firefox's "null".

Please check latest development build:
v 11.0.39rc2
============================================================
x Let temporary permissions survive NoScript updates
(shameless hack)
x Fixed some traps around Messages abstraction
x Ignore search / hash on policy matching of domain-less
URLs (e.g. file:///...)
x Removed useless CSS property
x Updated TLDs

With 11.0.39rc5 it works fine, thanks!