InformAction Forums

Fx 3.6.17 & 4.0.1, NS 2.1.0.5, new profile, noscript.allowURLBarJS=true

also keyworded javascript: bookmarklets executed from about:blank don't run

(Confirmed. But then you knew that already .)
Disallow javascript: URLs entered into location bar

Edit: This have anything to do with it, Bug 656815 - javascript: URIs refuse to load when channel owner is null (& Gavin's comment #c8)?

you need noscript.allowURLBarImports = true too.

Giorgio Maone wrote:you need noscript.allowURLBarImports = true too.

Ok, but can you clarify? "javascript:alert('')" doesn't import any scripts and it seems like a good idea to not allow non-trusted imports, why can't javascript: work on about:blank without allowURLBarImports=true

al_9x wrote:

Giorgio Maone wrote:you need noscript.allowURLBarImports = true too.

Ok, but can you clarify? "javascript:alert('')" doesn't import any scripts and it seems like a good idea to not allow non-trusted imports, why can't javascript: work on about:blank without allowURLBarImports=true

Because for a long while now the only way to execute javascript on about:blank has been allowing scripts globally (which is the same as allowing imports), don't ask me why because I couldn't figure it out.

Giorgio Maone wrote:

al_9x wrote:

Giorgio Maone wrote:you need noscript.allowURLBarImports = true too.

Ok, but can you clarify? "javascript:alert('')" doesn't import any scripts and it seems like a good idea to not allow non-trusted imports, why can't javascript: work on about:blank without allowURLBarImports=true

Because for a long while now the only way to execute javascript on about:blank has been allowing scripts globally (which is the same as allowing imports), don't ask me why because I couldn't figure it out.

So in 2.1.0.6rc8 scripts are still globally allowed on about:blank but without needing to set allowURLBarImports?

al_9x wrote:So in 2.1.0.6rc8 scripts are still globally allowed on about:blank but without needing to set allowURLBarImports?

Exactly.