InformAction Forums

Hi,

my config : WinXp SP3, Firefox 3.6.24, NoScript 2.4.1 (a few other add-ons, the biggest TabMixPlus)

the requested feature :

new context menu items on each tab :
1. 'stop all scripts in this tab (without reload)' (my most wanted option...)
2. 'stop all scripts in this tab (with reload)' (for completeness maybe)
and/or ...
3. 'suspend all scripts in this tab (no reload of course)'
4. 'resume all scripts in this tab (no reload of course)'

This would NOT affect scripting permissions, NOR other tabs, but ONLY the chosen tab.
* option 1. : the tab would not be reloaded , all scripts running 'inside' this tab would just be killed,
so the tab would get kind of script-frozen (no more changes/reloads/redirects/popups initiated by scripts).
* option 2. : the tab would be reloaded, but the scripts running 'inside' this tab
would not be started at all during the reload.

Why?

for example this page http:// www .rue89.com/ (only this base page, not the sub-pages like http:// www .rue89.com/contact)
forces a script-initiated page refresh (not a meta-refresh) on the tab every 180 seconds or so.
For some reason this completely locks down my firefox for 5-10 seconds, which is painful.
The lock down occurs even if another tab is active during the http:// www .rue89.com/ reload.

I have to allow this site to scripting (otherwise I can not see the comments after the press articles)
What's more, if I load http:// www .rue89.com/ without scripts I don't even get the images on this page! (stupid site...)

Related :

Could scripts running on inactive tabs have lower time-sharing priority than those running on the active tab?
> the time-sharing would need to be lower not towards other Apps (this is the OS business), but towards the active tab.
> this would make the active tab scripts, and so the active tab itself, more reponsive.
> unhappily this looks very difficult (since related to firefox inner-code I guess).

my config : WinXp SP3, Firefox 3.6.24,

The entire 3.x branch is now unsupported, but the last one was Fx 3.6.28. So you're a bit behind even on the unsupported browser.
Also, your useragent shows as:

AppleWebKit/125.2 (KHTML, like Gecko) Safari/125.8

So, on which browser does this occur?

Try with current Firefox 12.0?

I did try to reproduce on Fx 3.6.28, and didn't see anything after a few minutes, but there is no reason to investigate further until you try on a supported browser.

> unhappily this looks very difficult (since related to firefox inner-code I guess).

I believe you're correct on that part.

The first part looks rather impractical, because more than 100 scripts from *one* domain can be running at one time (e. g., Yahoo Mail).
The menu would have to change each time one of your options was exercised.

Wouldn't it be easier just to leave this site in default-deny zone, then "Temporarily Allow" as needed? Then "Revoke Temporary Permissions" if this strange issue occurs again?

Go to NoScript Options > General and uncheck "Automatically reload affected pages when permissions change" > OK.
That solves your reload issue.

@OP If there's a specific script file causing the refresh, then you can block it with ABE. The JSView addon might help you to check. If you need any help writing the ABE rule, just ask here.

Thrawn wrote:@OP If there's a specific script file causing the refresh, then you can block it with ABE. The JSView addon might help you to check. If you need any help writing the ABE rule, just ask here.

Funny, I was going to say that, too -- GMTA -- but it seemed moot since I couldn't reproduce, even on Fx 3.6, and that even OP's version of 3.6 was not the most recent. I actually did look at the site with JSView, but didn't immediately recognize a script URL that would correlate to that. And not about to read through hundreds of K of scripting.

In the site source code itself, there were some with names including the word "revamp", but didn't investigate further whether that corresponded to "refresh". Might be a fruitful avenue, once it's clear which browser, and whether reproducible on current or even a more recently-deprecated one.

Updated firefox 3.6.24 > 3.6.28
Updated noscript 2.4.2 > 2.4.3
Still same problems.

To TomT :

Also, your useragent shows as:
AppleWebKit/125.2 (KHTML, like Gecko) Safari/125.8

This is only a user-agent 'joke' from the firefox.js config file...

Go to NoScript Options > General and uncheck "Automatically reload affected pages when permissions change" > OK.

This option is already unchecked for me.

To Thrawn :
What JSView shows me for this page : http:// www. rue89 .com/, is dozen of scripts either embedded or from http:// www. rue89 .com/
Which script is reponsible for the reload, no one will ever know...
And this site by itself is not worth spending hours to find which one is the refreshing script.

Since you cannot reproduce the problem you may have some difficulties to understand what happens.

Problem 1 :
> If http:// www. rue89 .com/ is NOT ALLOWED for scripting then loading this exact page http:// www. rue89 .com/
will load a page MOSTLY WITHOUT images (this page shows a lot of sources for scripts, none is allowed)
> Symetrically, if http:// www. rue89 .com/ is ALLOWED for scripting then loading this page http:// www. rue89 .com/
will load the page WITH images (I only allow scripts from http:// www. rue89 .com/, not the other sources)
* Do you get the images when scripts from http:// www. rue89 .com/ are disabled, with the same firefox 3.6.28 ?

Problem 2 : if I allow http:// www. rue89 .com/ for scripting and load the page http:// www. rue89 .com/,
every 180 seconds this tab reloads and locks firefox for 5-10 seconds (100% cpu usage)
* don't you get this auto-refresh every 3 minutes with the same firefox 3.6.28 ?
* the blockage might be slightly shorter with my updated firefox/noscript.
* the reload and blockage only occurs on the exact page http:// www. rue89 .com/, but this page is needed
to browse the articles of the site.

So I have the choice between a "http:// www. rue89 .com/" tab without image or blocking me every 180 seconds...
I don't really care for this specific site, my post had a more general intend (see next post).

Something like this:
Suppose you could set one of those surrogate things to nix it?

OK, I've been able to reproduce this. The page doesn't exactly lock the browser, but it did reload after about 3 minutes, and since it's a very heavyweight page, that took some time.

Maybe we can at least isolate which function call is doing it and use Configurable Security Policy to block it on that site?

ETA dhouwn beat me to it. So, you could add to user.js: Haven't yet tested this myself, but will soon.

therube wrote:Something like this:

Code: Select all

<script type="text/javascript">
<!--//--><![CDATA[//><!--
jQuery(document).ready( function() { setInterval(function() { if (!$("#cboxOverlay").is(":visible") && !$(".app-box").is(":visible")) { window.location.reload(); } }, 180000); } );
//--><!]]>
</script>

Suppose you could set one of those surrogate things to nix it?

Or use Greasemonkey or Scriptish to change that "180000" to "999000"? At least it delays the reload for 16+ minutes instead of three.

(unless that "180000" is entirely coincidental to the "180-second reload time. Which would be highly coincidental.)

Or use those tools to undo/rewrite/neuter that script altogether?

ETA: Just saw Thrawn's ETA. Yes, that looks like a good way to go.

To Thrawn :
for 'Configurable Security Policies' you need to know the 'object names' or 'class names' of the objects that can trigger a page auto-refresh
I don't know these names...

therube and TomT : are you looking for a way to block the (script-activated) refresh action of this specific site?
I hope you don't spend too much time to try to 'cure' the scripts of this site, because this site by itself is not so important.

My initial post had a more general intend than solving an auto-refresh problem with this specific site.
My solution was not rule-based (via surrogate scripts, or ABE, or 'Configurable Security Policies'), but user action-based (see under).

From TomT :

The first part looks rather impractical, because more than 100 scripts from *one* domain can be running at one time (e. g., Yahoo Mail).
The menu would have to change each time one of your options was exercised.

I don't understand (?), maybe I should have used the term 'function' and not 'option'

What I meant : right-click ON A GIVEN TAB > 'stop all scripts in this tab' (stop means 'kill' or 'suspend')
> all scripts running WITHIN THIS tab (and ONLY THIS tab) would be stopped (killed or suspended, like a process is killed/suspended)
> this action would not take into account current NoScript permissions, nor change these permissions
> the chosen tab would get 'frozen' (with all its scripts stopped)
> this would not affect scripts running within other tabs

This requires
1. that NoScript can enumerate all scripts started by the chosen tab (the tab right-cliked by user)
2. that NoScript can kill and/or suspend these scripts

This would be more a usability than a security feature.
It would not be possible if running scripts were not 'attached' to a specific tab.

What I meant : right-click ON A GIVEN TAB > 'stop all scripts in this tab' (stop means 'kill' or 'suspend')
> all scripts running WITHIN THIS tab (and ONLY THIS tab) would be stopped (killed or suspended, like a process is killed/suspended)
> this action would not take into account current NoScript permissions, nor change these permissions
> the chosen tab would get 'frozen' (with all its scripts stopped)
> this would not affect scripts running within other tabs

If it's only this one site that causes an issue, why is the new feature needed?
What are some other sites or cases where this would be useful?

This requires
1. that NoScript can enumerate all scripts started by the chosen tab (the tab right-cliked by user)
2. that NoScript can kill and/or suspend these scripts

This would be more a usability than a security feature.
It would not be possible if running scripts were not 'attached' to a specific tab.

IIUC, the script permissions are across all tabs in an open browser.
For example, I just forbade script from informaction.com, then opened a new tab in the same site. It had the same prohibition.
Temp-allowing the site applied to the unfocused tab as well as to the active tab.

Then I tested this cross-site, by temp-allowing google-syndication.com at one site. (It's default-blocked.)
Then I went to another site that also tries to run google-syndication, and it already had allowed it.
So I forbade g-s.com at Site #2, and when I clicked the tab on Site #1, g-s was forbidden there, too.

So I believe that by your own last statement, this is not feasible by simple NoScript changes.
Hence the other approaches would have to be used, but as an NS feature, it seems infeasible.

You can always run a second browser, on its own profile, by starting it with the -no-remote command line switch.
This is especially easy if you have two separate installs, such as 3.6.24 and 3.6.28.
Or put a portable version on a flash drive, which is fully self-contained, with its own profile. See Firefox Portable.