NoScript prevents change.org from loading correctly

[bege]

Hi,

this https://www.change.org/de/Petitionen/al ... syriot-aus page does not load correctly (information part of the page remains white)

Temporarily allowing all, even allowing all scripts doesn't help.
After deactivating NoScript the page loads correctly. Activating NoScript again and the problem is back.

Regards

Firefox 14.0.1
NoScript 2.5

[Giorgio Maone]

As far as I can see you just need to allow the following 4 script sources:

1. change.org
2. googleapis.com
3. google.com
4. cloudfront.net

[bege]

They are (see screenshot), but as I wrote, even allowing all scripts doesn't help, only deactivating NoScript.


In the white space under the tabs there should be text.

[Giorgio Maone]

Please check on a clean profile with just NoScript installed, thanks.

[therube]

5. gstatic.com

Which is not shown on bege's screenshot, so maybe he has it blacklisted?

[bege]

Yes, gstatic.com was the problem.
maps.gstatic.com was in the button menu and allowed, but gstatic.com did not show up.
It was not blacklisted but part of an ABE rule. I deleted this URL in the rule.
If an URL is not allowed by ABE rule, does it not show up in the button menu?

[Thrawn]

If an URL is not allowed by ABE rule, does it not show up in the button menu?

Quite possibly. ABE blocks the request that would download the script, so the regular script-blocking may never see it.

[GµårÐïåñ]

Actually all scripting decisions are made by NS before ABE even comes in. SO if anything is blocked or allowed script wise, it would be decided by NS before it even gets to ABE to decide to apply the rule against. That's why you need to allow the sites that you have in your ABE filter in order for them to bypass NS so ABE can decide.

[bege]

Actually all scripting decisions are made by NS before ABE even comes in. SO if anything is blocked or allowed script wise, it would be decided by NS before it even gets to ABE to decide to apply the rule against. That's why you need to allow the sites that you have in your ABE filter in order for them to bypass NS so ABE can decide.

But then the site url should be seen in the button menu, shouldn't it? That was not the case so I didn't know that gstatic.com had to be allowed.
And I expected allowing all scripts generally to disable the ABE rules. That wasn't the case either. So the ABE rule was still active and the site not correctly loaded.

[GµårÐïåñ]

But then the site url should be seen in the button menu, shouldn't it? That was not the case so I didn't know that gstatic.com had to be allowed.
And I expected allowing all scripts generally to disable the ABE rules. That wasn't the case either. So the ABE rule was still active and the site not correctly loaded.

Yes it should, you are right - that would be the logical thing. However, with gstatic.com there is an unfortunate decision by Google to not invoke the site unless a resource is ACTUALLY being pulled from it so until such time as that invoke happens, it won't show up as an item because it hasn't been called yet. I have come across this with Google services all over the place and many times people have asked in the past, it wasn't there and then I did something suddenly it was there, why? The simple answer is that it is not loaded all the time, just when something off it is needed. Which means often time until you actually do something that involves it, you won't see it. Hope that helps explain it.

I got the site working with the following scripts and objects allowed:

change.org
googleapis.com
mixpanel.com
cloudfront.net
gstatic.com
amazonaws.com

There was an object needed to get 3 of the above items to show up. Under the blocked objects menu, there is a themes.googleusercontent.com that you need to allow and once you do that, you get the following items show up:

mixpanel.com
gstatic.com
amazonaws.com

and voila the site works fine and here is the screenshot to show it. Its too large to put inline, so you can see it by clicking on the link:
Alt-Kanzler Schröder & Doris Schröder-Köpf: Sprechen Sie sich für #PussyRiot aus!
(Its a full frame capture, so its as long as the page and as wide as the page)

If you have any other questions let me know. Its not NoScript that is preventing it, its just really really piss poor site design and just hodgepodge cross domain linking that complicates things.

[Thrawn]

And I expected allowing all scripts generally to disable the ABE rules. That wasn't the case either. So the ABE rule was still active and the site not correctly loaded.

Yes, ABE is completely independent of script blocking, by design. After all, if there is a rule there, then either a) it's the default SYSTEM rule, protecting against cross-zone attacks, which is still relevant, or b) you put the rule there yourself, so presumably you still want it to apply. Note that any sites that you 'Mark as Untrusted' will still be blocked in Scripts Globally Allowed mode, too.

[bege]

And I expected allowing all scripts generally to disable the ABE rules. That wasn't the case either. So the ABE rule was still active and the site not correctly loaded.

Yes, ABE is completely independent of script blocking, by design. After all, if there is a rule there, then either a) it's the default SYSTEM rule, protecting against cross-zone attacks, which is still relevant, or b) you put the rule there yourself, so presumably you still want it to apply. Note that any sites that you 'Mark as Untrusted' will still be blocked in Scripts Globally Allowed mode, too.

Thank you for your explanation.
I usually use Scripts Globally Allowed mode only if i cannot get a trusted site working correctly. So I need to deactivate NoScript to find out, whether my own ABE rules or Marks as Untrusted are the reason for an incorrectly loaded page. That's a bit inconvenient by I can live with it as I know it now.
Thanks to you all who were answering and explaining this issue.