InformAction Forums

I'm a web developer who uses noscript. I ran across a side-effect of noscript that I feel I should point out.

When you load a page with blocked items (a flash file in this case), noscript starts by not displaying them, then after the page loads, it inserts a box where that item should be, allowing you to run them.

The problem arises when using scrollHeight to get the height of the page inside the onload event. Firefox reports an incorrect height in this case, since onload runs before noscript displays the box. This is a problem when you are resizing an iframe's height to fit its content. It probably causes trouble in other circumstances also.

Would it be possible to change noscript to use visibility:hidden instead of display:none in the cases when it will be displaying a box later? I'm not really familiar with the internals of noscript, so wouldn't be surprised if this is not possible.

I won't comment on the internals of it, I will leave that to Giorgio but immediately what comes to mind as a problem with your request is that the actual content delivered is blocked by NoScript (unless its trusted) and simply hiding it doesn't achieve that as it would still load and run, just hidden. That would be a huge security issue and circumvents what NoScript is there to achieve. Have you tried to see if the site is trusted/allowed if the problem still occurs. If a person allows JUST the flash, I can see your issue but if the site is allowed, it will force a refresh (or it should unless you have unchecked that) and that will cause it all to load just fine and barring any coding issues as expected. I don't see how that would warrant a change in NoScript behavior. But then again, I will leave that part to Giorgio.

Thanks for your response. You are probably right that visibility:hidden instead of display:none will break the blocking mechanism. Obviously the ideal solution would be to insert the block box before the page is rendered, instead of after. It seems likely to me that this isn't possible, otherwise they would already be doing it.

I can confirm that if the flash file is allowed before the page is loaded, the iframe is sized properly. THis doesn't really help much though, since clicking on the block box to play the flash doesn't refresh the page. In many cases, the user won't allow the flash, resulting in the iframe being too small. This causes either a duplicate scroll bar, or for the iframe's content to be cropped (like overflow:none).