Noscript blocks FireGestures with javascript bookmarklets

[sparhawk]

Hi,

I have several Javascript bookmarklets that I call using a mouse gesture, by using the FireGestures add-on. I have found that if NoScript is blocking the current page, these gestures no longer work. My Javascript bookmarklet has a keyword of "foo", and the FireGestures action is defined as

Code: Select all

loadURI(getShortcutOrURI('foo',{}));

An example bookmarklet for troubleshooting purposes follows; this renders the current page as black text on a white background.

Code: Select all

javascript:(function(){var%20newSS,%20styles='*%20{%20background:%20white%20!%20important;%20color:%20black%20!important%20}%20:link,%20:link%20*%20{%20color:%20#0000EE%20!important%20}%20:visited,%20:visited%20*%20{%20color:%20#551A8B%20!important%20}';%20if(document.createStyleSheet)%20{%20document.createStyleSheet(%22javascript:'%22+styles+%22'%22);%20}%20else%20{%20newSS=document.createElement('link');%20newSS.rel='stylesheet';%20newSS.href='data:text/css,'+escape(styles);%20document.getElementsByTagName(%22head%22)[0].appendChild(newSS);%20}%20})();

There is nothing in nothing in Tools > Error Console.

Following is a list of what will work. Each works independently.

• Temporarily/permanently allowing the current page with NoScript.
• FireGestures that call normal (non-javascript) web pages, using the above FireGestures loadURI code (e.g. give another bookmark the keyword "foo").
• Clicking on the bookmarklet instead of using a gesture.

NoScript 2.5.4
FireGestures 1.6.16
Firefox 15.0 ("Mozilla Firefox for Ubuntu canonical - 1.0)
Ubuntu 12.04

Cheers.

[Thrawn]

This sounds quite similar to the situation with Greasemonkey. It's the way that FireGestures works, inserting scripts into the page that will then run with the regular permissions attached to the page.

In other words, this behavior is by design.

[sparhawk]

Ah bummer. So presumably there's no easy way to make NoScript workaround this limitation of FireGestures?

Cheers.

[Thrawn]

So presumably there's no easy way to make NoScript workaround this limitation of FireGestures?

If it is indeed inserting scripts into the regular page, then no (I haven't confirmed this, but since it's hosted at xuldev.org, that sounds likely). Possibly what needs to happen is for FireGestures to run in the chrome: context, which would bypass NoScript, but that's for the FireGestures developer(s) to change.

[sparhawk]

Thanks. I've emailed the FireGestures developers, pointing them to this thread. Cheers.