Page 1 of 1
Adblock Plus feature causes NoScript to trigger false CC
Posted: Fri Jul 29, 2011 9:12 pm
by GµårÐïåñ
Giorgio,
I have noticed that there are alot of false positive notices from ClearClick and I investigated the image differences to notice a common thread among them. If the user has Adblock Plus installed and has chosen the [Show tabs on Flash and Java - extensions.adblockplus.frameobjects;true - default setting] then it will 100% of the time cause a ClearClick error (I can generate a report for you if you like). But I resolved it by unchecking that option basically resulting in [extensions.adblockplus.frameobjects;false] and the error never occurs.
I was wondering, can you add this circumstance, since its default and probably will cause A LOT of false positives, as a logic inside the ClearClick to account for it? This way if you notice the difference is simply the presence of that tab, then just let it go and move on, don't issue a ClearClick warning. Just thinking this could be a good feature enhancements towards usability. The tab is a simple CSS with the caption "Block ...", you can probably parse it from the ABP code and just validate for it.
Re: Adblock Plus feature causes NoScript to trigger false CC
Posted: Fri Jul 29, 2011 9:34 pm
by Giorgio Maone
Could you please give me some report ID?
Re: Adblock Plus feature causes NoScript to trigger false CC
Posted: Fri Jul 29, 2011 9:42 pm
by GµårÐïåñ
Giorgio Maone wrote:Could you please give me some report ID?
Certainly, here is one coming right up: 1849150
Do you need more or is that enough? While we are at it, I am getting false positive XSS warning as well, will put it in its own topic. I was on my way to do that when I saw your reply.
Re: Adblock Plus feature causes NoScript to trigger false CC
Posted: Fri Jul 29, 2011 9:49 pm
by Giorgio Maone
Thank you, I'll try to have a work-around in next release.
Re: Adblock Plus feature causes NoScript to trigger false CC
Posted: Fri Jul 29, 2011 10:20 pm
by GµårÐïåñ
Giorgio Maone wrote:Thank you, I'll try to have a work-around in next release.
No, thank YOU, I am but a humble messenger. I will look forward to it and I can test it and verify. Thanks again.
Re: Adblock Plus feature causes NoScript to trigger false CC
Posted: Wed Aug 03, 2011 11:25 pm
by GµårÐïåñ
Can you please let me know which version you fix this in, so I can check and make sure it works. I checked the changelog to see and confirm but didn't find anything, so assuming not done yet? No rush, just a heads up when you have it fixed and which version so I can confirm would be great, thanks.
Re: Adblock Plus feature causes NoScript to trigger false CC
Posted: Thu Aug 04, 2011 1:41 pm
by Giorgio Maone
Sorry, a tentative fix was added in one of the most recent builds but slipped out of the changelog (just added it on rc3's line).
Please
check it, thanks.
Re: Adblock Plus feature causes NoScript to trigger false CC
Posted: Thu Aug 04, 2011 7:38 pm
by GµårÐïåñ
You are the master and a gentleman. Thank you very much sir, confirmed it works but one slight problem that might inflame the ABP crowd, the fix actually REMOVES the tab on those items and that might have their panties in a bunch if they want it there, so just a heads up. But hey its a temporary work around and such side effects are expected, so no biggie. Just as long as you know in case you can tweak it, it all seems good. The problem I reported is fixed and that's the good news. I don't use the tab myself, so I could care less that its missing, but can't speak for others. Thanks again.
Re: Adblock Plus feature causes NoScript to trigger false CC
Posted: Thu Aug 04, 2011 10:31 pm
by Giorgio Maone
The work-around (which was already present in previous NoScript version but was broken by changes in ABP's tab implementation) is meant to work transparently, i.e. the tab should be removed just before the check and added back just after, and since all this happens with no repaint in between you should notice nothing.
If, as you say, the tab is removed but never restored there's a bug which must be fixed.
Re: Adblock Plus feature causes NoScript to trigger false CC
Posted: Thu Aug 04, 2011 11:02 pm
by GµårÐïåñ
Well sir then something went wrong and you might want to take a look. I didn't know there was a change in ABP code and its good that we caught this then, just for sake of completeness. However, the work around is resulting in a situation where the tab NEVER shows up when you hover the item and then you click it, issues no warning on CC, expected and good so far, then you still don't see the tab return. Even after moving your mouse away (mouseout and/or blur) and then come back to hover again on it (focus and/or mousein) it won't show the tab either. So something is suppressing the tabs altogether. An uncaught logic/case exception maybe? Not sure, that's your call.
Re: Adblock Plus feature causes NoScript to trigger false CC
Posted: Thu Aug 04, 2011 11:12 pm
by Giorgio Maone
GµårÐïåñ wrote:Even after moving your mouse away (mouseout and/or blur) and then come back to hover again on it (focus and/or mousein) it won't show the tab either.
Is there a page where I could reproduce this without registering to a Facebook game?
Re: Adblock Plus feature causes NoScript to trigger false CC
Posted: Thu Aug 04, 2011 11:17 pm
by GµårÐïåñ
Giorgio Maone wrote:Is there a page where I could reproduce this without registering to a Facebook game?
Not off the top of my head, because I see it and have access to it because I develop, test and design for them, but I am sure if it happened there error wise, then I should be able to reproduce it somewhere now too, so give me a few minutes to hunt down something for you. Thanks.
Re: Adblock Plus feature causes NoScript to trigger false CC
Posted: Fri Aug 05, 2011 12:06 am
by GµårÐïåñ
UPDATE: We have two conditions existing now, static vs. dynamic.
If you have a static content flash (animation, no clickable interface, no raise/lower effect, FLAT) then the tab will show up, there click obviously doesn't generate error as it is has no event trigger, and we are fine. No interference with the ABP tab. We co-exist happily.
If you have a dynamic content flash (such as a button, that you click to have something happen and have raise/lower effects causing any kind of depth, NOT FLAT) then the tab will NOT show up before, during, or after. But on the plus side, no CC error either.
Hope that helps you narrow down where to look maybe?
Re: Adblock Plus feature causes NoScript to trigger false CC
Posted: Fri Aug 05, 2011 12:08 am
by GµårÐïåñ
UPDATE AGAIN: We have two conditions within the dynamic interface too
If you have a flash button generated using SWF_BTN a sort of a wrapper I guess you can call it using code like this:
Code: Select all
<div id="swf_btn" class="swf"><embed type="application/x-shockwave-flash" src="http://data.com/swf/uc.swf?v=18" style="" id="btn" name="btn" bgcolor="#ECAD71" quality="high" menu="false" allowscriptaccess="always" flashvars="__file=http://data.com/swf/btn.swf?v=0&__key=http://data_fr/swf_key&lang=en&u=/fight/&d=comeofrr&b=http://data.com/img/en/teasing_submit.gif&o=http://data.com/img/en/teasing_submit_over.gif&a=ltcmike&k=1215" scale="noscale" height="66" width="212"></div>
If you have however a flash button generated using the traditional embed method using code like this:
Code: Select all
<div style="right: 10px; display: block; position: absolute; top: 178px; background: none repeat scroll 0pt 0pt transparent; z-index: 1;" title="Toggle Music">
<object width="30" height="30" style="visibility: visible;" id="bg_music" data="http://static.com/flash/bg_music.swf" type="application/x-shockwave-flash">
<param value="menu" name="menu"/>
<param value="high" name="quality"/>
<param value="noborder" name="scale"/>
<param value="transparent" name="wmode"/>
<param value="false" name="oop"/>
<param name="movie" value="http://static.com/flash/bg_music.swf" />
<param name="allowscriptaccess" value="always" />
<param name="FlashVars" value="bg_color=_000000" />
</object>
</div>
I hope this somehow helps.