Why NoScript blocks Chrome Scripts

[Baris Derin]

Hello all,

I am developer of Readability addon. That addon tries to inject scripts to web pages to improve readability. But somehow on some websites NoScript block the extension usage. The addon tries to add chrome:// scripts into the web pages when statusbar icon is clicked. chrome:// scripts are known to be secure. So why that kind of blocking is there for chrome:// scripts? And how can we fix the problem, if possible?

Thanks.

[Baris Derin]

Hello,

Any idea about this problem? It really annoys the users.

[therube]

(One) earlier thread on Readability and Readable bookmarklets.

You'll have to wait on Giorgio to comment further.

[Baris Derin]

Thanks for the reply. How frequently does Giorgio check the topics? It is an urgent thing for me to solve.

[Alan Baxter]

Usually daily. Since you're the developer of Readability, it would be appropriate for you to email him.
http://maone.net/

[Giorgio Maone]

Hello all,

I am developer of Readability addon. That addon tries to inject scripts to web pages to improve readability. But somehow on some websites NoScript block the extension usage. The addon tries to add chrome:// scripts into the web pages when statusbar icon is clicked. chrome:// scripts are known to be secure. So why that kind of blocking is there for chrome:// scripts? And how can we fix the problem, if possible?

Thanks.

1. You cannot inject chrome:// scripts in Firefox. This is a browser built-in security feature (originally provided by NoScript, but available as a built-in for a long time now): see https://bugzilla.mozilla.org/show_bug.cgi?id=292789
2. If you mean that you insert your own SCRIPT elements in the page content, then there's absolutely no way for the browser (neither for NoScript) to tell they're more trusted than the page itself: if the page is considered untrusted, they won't run, period.
3. Most important, you don't need to insert any script into the web page content in order for an extension to work: for instance, you can wire your chrome event handlers into the content by calling addEventListener() on the proper DOM element or window. That's what NoScript does for its placeholders, and they do work properly no matter what the page's permissions are.

[Baris Derin]

Hi Giorgio,

Thanks for clarification. The add-on insert SCRIPT tags into the web page. I know adding event listeners to the page is a solution but this time you need to port an already written javascript library to Firefox Chrome. But adding the library to the page as chrome SCRIPT tags makes add-on creation lightning fast.

Is not there any possibility for NoScript to allow chrome URIs? Say my addon adds chrome://readability/content/scripts/readability.js to the page. I tried to add an exception via NoScript Options but it does not allow to pass Chrome URIs. Is there any likelihood you can allow Chrome URIs as exception in future releases of NoScript?

[Giorgio Maone]

Is not there any possibility for NoScript to allow chrome URIs?

No, they're blocked by Firefox, before than by NoScript.
And even if they were allowed, if the hosting page is not allowed to run scripts they won't work anyway.