NoScripters and WebSec nerds of all lands, unite!
https://forums.informaction.com/
I'm investigating, but it's not necessarily a NoScript bug: the page may be checking whether a resource loads successfully in a certain timeframe and attempt a new load if it doesn't.al_9x wrote:If blocking a particular resource prevents a page from reaching loaded state, that's probably bug, Giorgio?
In fact, the same problem happen if you disable/uninstall NoScript and install ABP with Easylist.Giorgio Maone wrote:it's not necessarily a NoScript bug: the page may be checking whether a resource loads successfully in a certain timeframe and attempt a new load if it doesn't.
Code: Select all
<script>
var iframe_id = 'iframe1';
document.write('<iframe id="' + iframe_id + '"></iframe>');
(function()
{
var iframe, iframe_doc;
if ((iframe = document.getElementById(iframe_id)) && (iframe_doc = iframe.contentDocument))
iframe_doc.write('<script src="http://untrusted.invalid/"><\/script>');
else
setTimeout(arguments.callee, 100);
})();
</script>
There's not much I can do about it, aside surrogating a "contentDocument"property on NoScript's placeholder (and contentWindow? and contentWindow.document? and what about contentDocument.write()?) .al_9x wrote: Loading the above with NS results in perpetual loading state. This technique is utilized by http://www.adriver.ru/ and is in both sites.
It's not clear from your response, can you repro this with the small test page from my previous post?Giorgio Maone wrote:There's not much I can do about it, aside surrogating a "contentDocument"property on NoScript's placeholder (and contentWindow? and contentWindow.document? and what about contentDocument.write()?) .al_9x wrote: Loading the above with NS results in perpetual loading state. This technique is utilized by http://www.adriver.ru/ and is in both sites.
I'm not sure whether an iframe blocked by content policies has an accessible contentDocument either: does it work if you block the frame with ABP?
I really don't understand what you're saying here. What placeholder? Anyway, I did identify the precise cause. In order for the the loading state to go to completion the document has to be closed. One of the doc.written external ad scripts does just that, but since it's blocked, the doc remains open.Giorgio Maone wrote:There's not much I can do about it, aside surrogating a "contentDocument"property on NoScript's placeholder (and contentWindow? and contentWindow.document? and what about contentDocument.write()?) .
Sorry, I was assuming you were blocking the frame and the perpetual loading was due to a setTimeout() loop.al_9x wrote:I really don't understand what you're saying here.
Code: Select all
untrusted.invalidCode: Select all
if (top != self && top.location.href == location.href) setTimeout("try{document.close()}catch(e){}", 100)Even if setTimeout were looping it would not keep the doc in the loading state.Giorgio Maone wrote:Sorry, I was assuming you were blocking the frame and the perpetual loading was due to a setTimeout() loop.al_9x wrote:I really don't understand what you're saying here.
How is it a site bug? It only manifests when NS blocks the ad script that closes the document.Giorgio Maone wrote:In your case, even though this is clearly a site bug and wouldn't deserve "fixing"
Code: Select all
user_pref("noscript.surrogate.adriver.sources", "ad.adriver.ru/cgi-bin/erle.cgi");
user_pref("noscript.surrogate.adriver.replacement", "if (top !== self && top.location.href === location.href) setTimeout('try{document.close();}catch(e){}', 100);");