web bug only blocked if scripting allowed on the page itself

al_9x · Post by **al_9x** » Sun Nov 07, 2010 12:27 pm

https://sourceforge.net/account/login.php has a scorecardresearch.com script followed by a web bug. If sourceforge.net is allowed and scorecardresearch.com is not, the bug is blocked, but if sourceforge.net is not allowed, the bug loads.

I am guessing this is because the web bug machinery only kicks in when an external script is explicitly blocked, but when the page itself is not allowed, the explicit external blocking never takes place. But it's still a web bug (an image request that contacts an external site, in lieu of a disabled script) and should be blocked.

Post by **Giorgio Maone** » Sun Nov 07, 2010 5:57 pm

Cannot reproduce.
Both sourceforge.net and scorecard.com not whitelisted.
No scorecard image loads.
NoScript logs says:

[NoScript] Content BLOCKED Tracking Image -- type: 3, location: http://b.scorecardresearch.com/p?c1=2&c ... &c15=&cj=1, origin: https://sourceforge.net/account/login.php, ctx: <HTML Element>, mime: , null

al_9x · Post by **al_9x** » Sun Nov 07, 2010 9:49 pm

Sorry, web bug blocking was off in this test profile. The reason I didn't notice is that it was being apparently blocked when sf.net was allowed, but that was because scorecardresearch.com was untrusted and <noscript> is not shown for untrusted, hence no web bug to block. When sf.net is not allowed, <noscript> is shown and the bug loads. It is kind of a curious scenario where there is more tracking with less scripting.

InformAction Forums

web bug only blocked if scripting allowed on the page itself

web bug only blocked if scripting allowed on the page itself

Re: web bug only blocked if scripting allowed on the page it

Re: web bug only blocked if scripting allowed on the page it