[RESOLVED] script is not blocked

[rayhkk]

on the following link:
http://news.sina.com.hk/cgi-bin/nw/show ... 129/1.html

this is a combo box on the page to switch news detail.
Javascript is disabled on Firefox but the combo box is also working.

[Tom T.]

Javascript is disabled on Firefox

JavaScript must be enabled in Firefox for NoScript to work correctly, as per the FAQ here.
When I visited the site, all scripting was blocked (which is good if this was a spam post -- no offense if not).

[GµårÐïåñ]

I can verify that with the NS blocking the site, the drop list does indeed execute the JS location change code. I didn't have time to dig too hard into the code to see if there is an alternate method but a cursory evaluation shows that you are right, the menu still works despite the JS being blocked. Any ideas Giorgio?

[therube]

Does the code use JavaScript?

Code: Select all

<a href="/cgi-bin/nw/main.cgi?cat=2">港聞</a> > <a href="/cgi-bin/nw/main.cgi?cat=3">明報</a></span>     <select name="related_prog" onchange="Go(this.value, 'no')"><option value="0">   請選擇  2009年 04月 28日  港聞   </option>
<optgroup label=" -- 明報 -- ">
<option value="/cgi-bin/nw/show.cgi/3/1/1/1116129/1.html" selected="selected">世衛研疫情警告升級</option>
<option value="/cgi-bin/nw/show.cgi/3/1/1/1116128/1.html">口罩藥房賣斷市 來貨貴五成</option>
<option value="/cgi-bin/nw/show.cgi/3/1/1/1116127/1.html">袁國勇﹕獲最新樣本研快速測試</option>
<option value="/cgi-bin/nw/show.cgi/3/1/1/1116126/1.html">歐洲首確診 籲避往美墨</option>
<option value="/cgi-bin/nw/show.cgi/3/1/1/1116125/1.html">凌晨消息：英國2人確診</option>
<option value="/cgi-bin/nw/show.cgi/3/1/1/1116124/1.html">夏天利阻遏病毒 需防第二波</option>
<option value="/cgi-bin/nw/show.cgi/3/1/1/1116123/1.html">墨西哥病人投訴醫院拒收</option>
<option value="/cgi-bin/nw/show.cgi/3/1/1/1116122/1.html">製流感疫苗小資料</option>
<option value="/cgi-bin/nw/show.cgi/3/1/1/1116121/1.html">環球股市受壓 藥業股做好</option>
<option value="/cgi-bin/nw/show.cgi/3/1/1/1116120/1.html">權威組織﹕應叫「北美流感」</option>
<option value="/cgi-bin/nw/show.cgi/3/1/1/1116119/1.html">中泰禁美墨豬肉入口</option>
<option value="/cgi-bin/nw/show.cgi/3/1/1/1116118/1.html">港鐵巴士商場SARS規格戒備</option>

In Gecko 1.8.x, with sina.com.hk blocked, the drop down does not function.
With it sina.com.hk Allowed, it does. (Which does then kind of point to the use of JavaScript?)

In Gecko 1.9.+ the drop down functions regardless of NoScript settings (JavaScript being allowed or not).

main.cgi uses JavaScript (http://news.sina.com.hk/cgi-bin/nw/main.cgi/) but if JavaScript is disabled, does it skip main.cgi & then attempt to use a non-JavaScript method?

(No clue, only guess on my end.)

[dhouwn]

I can't see any combo box on this page, only a drop-down box which is a drop-down box even when JS is allowed.

[GµårÐïåñ]

I can't see any combo box on this page, only a drop-down box which is a drop-down box even when JS is allowed.

Combo box = drop-down box

[dhouwn]

Combo box = drop-down box

Nope.

[Giorgio Maone]

No script gets executed there.
It's just "Attempt to fix JavaScript links", which has been recently enhanced to work with other improper navigational tools like <SELECT> element with an onchange handler.
In other words, it's a feature, not a bug.

[GµårÐïåñ]

Combo box = drop-down box

Nope.

Nope what? It is in fact the same thing, a developer would know.
Read up: http://en.wikipedia.org/wiki/Combo_box and http://en.wikipedia.org/wiki/Drop-down_list, these are terms interchangeably used since they achieve the same thing, although not 100% identical.

[dhouwn]

although not 100% identical.

In a drop-down-list a user chooses from a predefined set of items and a combo-box is basically a text box which gives the user suggestions.
They are not freely interchangeable (just think of your Fx address bar being replaced by a drop-down list) and thus there is a huge difference and the terms shouldn't be mixed up .

[therube]

Is the fact that this enhanced "Attempt to fix JavaScript links" functions differently in Gecko 1.8.1 vs 1.9.x on sina.com an issue?

[therube]

Is the fact that this enhanced "Attempt to fix JavaScript links" functions differently in Gecko 1.8.1 vs 1.9.x on sina.com an issue?

Yes.
Now fixed in NoScript 1.9.2.5.