Page 1 of 1
data: URI & NoScript Icon Indicator
Posted: Fri Sep 07, 2012 2:27 pm
by therube
data: URI & NoScript Icon Indicator
"URL:"
http://pastebin.com/pdkzuPjJ
NoScript shows the top level domain to be wikimedia.com
Allow wikimedia.com
NoScript icon unchanged, still shows all to be blocked
Allow
http://http
NoScript icon now shows nothing blocked
Re: data: URI & NoScript Icon Indicator
Posted: Wed Sep 19, 2012 11:18 am
by Thrawn
Yeah, I can confirm the behaviour (after overriding the warning), but I'd say it's probably not worth fixing. Data uris aren't normal...
Re: data: URI & NoScript Icon Indicator
Posted: Thu Sep 20, 2012 1:55 pm
by therube
Data uris aren't normal
Precisely the reason why it is even more important.
Plus, not normal for who, you or I perhaps, but for a browser it is as normal as html.
Re: data: URI & NoScript Icon Indicator
Posted: Thu Sep 20, 2012 9:17 pm
by Thrawn
It's just cosmetic, though, isn't it? NoScript being a bit confused about what constitutes the top-level document? And NoScript blocks you from entering a data URI unless you edit about:config.
Is there an actual security hole here? If so, please elaborate.
Re: data: URI & NoScript Icon Indicator
Posted: Thu Sep 20, 2012 9:34 pm
by therube
> It's just cosmetic
Not at all.
> NoScript blocks you from entering a data URI
True (with exceptions).
But the data: URI need not be necessarily be "added" by you, it could be in a link you clicked.
And just what site are we looking at here?
Take a look. It is not wikipedia.
Re: data: URI & NoScript Icon Indicator
Posted: Thu Sep 20, 2012 10:32 pm
by Thrawn
therube wrote:
And just what site are we looking at here?
Take a look. It is not wikipedia.
No, but it tries to import a script from bits.wikimedia.org, which is why NoScript blocks & reports that. The inline scripts (of which there are several) are presumably represented by the
entry. So, that looks a bit funky, and even when you allow one or the other of the two script sources, the icon still reports that the top-level document is blocked, but NoScript is still apparently detecting and blocking everything.
Btw, I had spam filter trouble when posting this, even when I disabled automatic URL parsing and wrapped URLs in code tags, so I removed most of them. Not sure whether the angle brackets also contributed?