InformAction Forums

Hi folks.

I'm having an issue on Firefox with noscript and the Musician's Friend website. Basically it breaks it for me, unless I set it, every time, to 'disable restrictions for this tab'. There's no way for me to set all the sites listed when I visit it to 'trusted' because even when they're all set to trusted, the page is still broken.

Why is this the case? What's being blocked that I can't set to 'trusted' because it's not listed? Is there a workaround beside either disabling noscript or clicking 'disable restrictions for this tab' every time I visit?

Is this a problem local to my particular setup or duplicatable for other folks here? Thanks.

Following up I see there are other posts here with similar issues.

I checked 'unrestricted CSS' for trusted websites, and that fixes the breakage. Can anyone tell me more about what 'unrestricted CSS' is?

whiteletter wrote: ↑Fri Jul 02, 2021 6:52 pm I checked 'unrestricted CSS' for trusted websites, and that fixes the breakage. Can anyone tell me more about what 'unrestricted CSS' is?

"Unrestricted CSS" means that NoScript skips some additional checks on visual stylesheets which make sense where scripts are disabled and attackers may reach for additional means to work around the blocking.
Having it checked on TRUSTED sites is the recommended setting.

Thanks, I got it.

FYI I had this issue as well. As of the 11.2.9 update, 'unrestricted CSS' was un-checked for trusted sites. Checking it resolved problems loading various sites.

There's a safer solution, as there's some security issue with unrestricted CSS (not sure about CSS standard, but at least some browser (IE comes to mind) allow some level of scripting with CSS - I remember I had to use this to ensure my site showed PNG's with transculent parts correctly with IE 5 & 5.5!

Anyway, while I wonder why nobody explained it better what issues it can have, I'm even more baffled that nobody suggested using "Custom" instead of "Allowed". When you choose "Custom" for a domain, it let's you pick specific permissions for that domain, and you can check all of them if you so want; including "unrestricted CSS"

Didn't check the posts date, so not sure if this is applicable to the version used when this was posted, but it-s not a new option.

You can do that, however there is no security advantage to un-checking the "unrestricted CSS" option on script-allowed sites as discussed before in other threads. If a site wants to do that type of attack, and you allow its Javascript, it will just do it with Javascript since JS provides many easier and more accurate ways to perform the attack than trying to do it through CSS.