InformAction Forums

I just noticed that a page I accessed suddenly pops up a NoScript notification bar on the top and almost as quickly it disappears and is replaced with a redirect warning from NoScript which disappears just as instantly leaving no trace of what information was presented, and there is no record of it in the console either. I can ONLY see it happening and almost too briefly, so I can tell its a NS notification but not what it actually says. Anyone know what's going on? Giorgio?

Steps to hopefully reproduce:
1. Go to: http://www.opentable.com/single.aspx?ri ... &rtype=ism
2. You will immediately see the two notifications before being shown the page
3. Make the date, time, number selection and click to find
4. You will immediately see the two back to back notification before being shown the result page

I guess all fails I can "RECORD" the screen activity in a video, pause on that frame and copy down what it says but I don't have that kind of time, so I am hoping it can be easily reproduced by others and Giorgio can tell what's going on. TIA.

It's just a long standing minor bug, which would be really too much complex to fix (since Firefox doesn't display notification bars natively on the bottom), due to the "regular" notification bar being pushed on the top of the window when a META refresh notification being displayed as well.

Ok, so there is nothing worth of concern in the message being displayed? Is it possible to work around it by getting those messages inserted into the console as well in addition to the bar that Fx may not continue to display?

Notifications which you really need to see (XSS and ABE) are already logged to the console.

Well how do I know what I am seeing then? I mean if NoScript is putting the message up there unless its wasting everyone's time, it has to have a reason right? Must be telling us something or it wouldn't be necessary for it to display anything. I don't like to just accept to not know that my browser automatically does something and there is no recourse for me to know what because its not XSS or ABE to be inserted into the console? Not happy about this, sorry Giorgio but I expected a bit more on this, it makes me very uneasy. I mean I don't care if its jumping up to tell me that the sky is blue, if its going to waste my resources generating the notification, I should be able to see it, bug or not.

GµårÐïåñ wrote:. I don't like to just accept to not know that my browser automatically does something and there is no recourse for me to know what because its not XSS or ABE to be inserted into the console?

OK, I'll put it in another way: the only notification you may miss when overridden by a "blocked meta refresh" is the routine (usually bottom-side) "Scripts blocked/partially allowed" which, as anybody here knows, is redundant and mainly targeted to newbies because the statusbar icon tells everything you need to know.

@G (is that ambiguous in this case?), do you have META redirections blocked?

@G (is that ambiguous in this case?), there was that setting (?) that provided greater detail in the Error Console. Would that have logged some of @G's wanted actions?

The first X number of times, I did get the regular NoScript "script warning" bar on the bottom, & also the META redirect notice at the top. Then after messing around with settings, now I'm only getting the "script warning" bar at the top? (May have somewhat to do with cookies.)

@Giorgio, thanks for that but I don't see how it is overridden though. I mean if there is a meta refresh, it is set to be blocked by NoScript, then why is it not happening? Resulting in the notification but then poof it ignores everything and moves on anyway? Not sure that even makes mechanical sense, where is this bug and why hasn't been addressed, this seems asinine. (and before anyone decides to insult me with the obvious, read part two below)

@therube, I am not sure which G you are referring to but I will respond for myself. Yes the forbid Meta refresh is blocked for noscript element inside the untrusted, it does it anyway it seems, which suggests its not really working or a useful function if it can be bypassed. To be fair the built-in function of Fx to block the redirect is useless too and simply gets overridden too. (See Yahoo Mail Discussion) I also operate in "no history" mode which means that anything used is lost or discarded the moment the browser is closed or I dump it and move on to another site. This is not a cookie issue unless we have cookies that can redirect things suddenly. That would be one smart cookie. As for the extended error console reporting, I don't know what you are referring to honestly. As for the notifications disappearing, then its probably because you unchecked "warn me on redirect attempt" inside Fx which made the second notification go away.

The cookie would not be redirecting, obviously.
But the cookie may know if you had visited before.
And with that knowledge, it might present you with one page versus another.
(In the same way that it may present you with an ad only on every fifth page load ...)

Actually (though you wouldn't necessarily realize it) when the two notification bars overwrite one another, if you "closed" (using the X on) the NoScript notification bar, you would see the META redirect warning bar.

Pic with TWO separate notification bars:



PS: First @G = @GµårÐïåñ, second @G = @Giorgio

I would be happy to close it to see the other but the whole issue is that it won't stick around to be read, seen, or closed.