"Temporarily allow all this page" breaks JS on all other tabs
subj
Activity
Maybe, you just don't notice that? Open http://example.com/ Press "Temporarily allow all this page" And check that JS-dependent features stopped to function on Trac
Opened DDG Search page will show you
You are being redirected to the non-JavaScript site.
Click here if it doesn't happen automatically.Trac:
Status: needs_information to new
Replying to cypherpunks:
Maybe, you just don't notice that? Open http://example.com/ Press "Temporarily allow all this page" And check that JS-dependent features stopped to function on Trac
Opened DDG Search page will show you
You are being redirected to the non-JavaScript site.
Click here if it doesn't happen automatically.Could you give us some steps to reproduce your issue? Where are you starting from? Are you setting the security slider to "high"? Or "medium"?
Trac:
Status: new to needs_informationYou're asking as if it were a Windows-only issue. Medium/High is required, of course. Starting with many tabs, search something in DDG, open that example.com and allow JS for it. That's all. JS on all other tabs stopped functioning (until reload).
Trac:
Summary: "Temporarily allow all this page" disables JS on all other tabs to "Temporarily allow all this page" breaks JS on all other tabs
Status: needs_information to new
Should be fixed in 5.1.2rc7, thank you.
-
Replying to cypherpunks:
Seems it doesn't work until restart.
You mean installing over a "broken" version doesn't fix its behavior until restart, don't you? But a new installation or installing over rc7 itself just works as expected, correct?
Replying to ma1:
Replying to cypherpunks:
Seems it doesn't work until restart.
You mean installing over a "broken" version doesn't fix its behavior until restart, don't you? Correct. But a new installation or installing over rc7 itself just works as expected, correct? No. It turns out temporarily allowed page wasn't reloaded at that moment (a bug too), and this is critical for testing this issue. Reloading of the allowed page leads to JS breakage on other tabs with rc7 and after restart too.
Trac:
Status: new to needs_revision-
Replying to cypherpunks:
No. It turns out temporarily allowed page wasn't reloaded at that moment (a bug too), and this is critical for testing this issue. Reloading of the allowed page leads to JS breakage on other tabs with rc7 and after restart too.
It's not what I can see here (BTW, please switch to rc8, just released with more lifecycle-related fixes).
My test, meant to exclude "confounding factors":
- Install NoScript 5.1.2rc8 over a "stock" Tor Browser, set the Security Slider to "High" and restart the browser
- Open https://maone.net/ in a new tab
- Open https://noscript.net/ in a new tab, then on this tab use "Temporarily allow all this page"
- With this tab still active, open a Scratchpad (shift+F4) and run the following scriptlet:
document.body.innerHTML=`<button onclick="alert('JS Active')">test</button>`This will make a [Test] button appear on the noscript.net page: if you click, a "JS Active" alert should be shown as long as Javascript is enabled there 5. Go back to the maone.net tab, and use "Temporarily allow all". Watch the page autoreload. You can also "Forbid maone.net" and repeat as many time as you want. 6. Switch to the noscript.net tab and hit the button to verify Javascript is still enabled
Replying to ma1:
Replying to cypherpunks:
No. It turns out temporarily allowed page wasn't reloaded at that moment (a bug too), and this is critical for testing this issue. Reloading of the allowed page leads to JS breakage on other tabs with rc7 and after restart too.
It's not what I can see here (BTW, please switch to rc8, just released with more lifecycle-related fixes). Another STR = another results (BTW, public repo can't be updated so quickly ;) My test, meant to exclude "confounding factors": Hmm...
- Install NoScript 5.1.2rc8 over a "stock" Tor Browser, set the Security Slider to "High" and restart the browser "stock" Tor Browser has "bundled" NoScript. Do you mean to replace it before the first run? There are many scenarios to get rc8, but let's assume that it's enough to update any previous version with it, restart and then set the Security Slider to "Medium" (to ensure it updates rc8 settings).
- Open https://maone.net/ in a new tab
- Open https://noscript.net/ in a new tab, then on this tab use "Temporarily allow all this page"
- With this tab still active, open a Scratchpad (shift+F4) and run the following scriptlet:
{{{
document.body.innerHTML=
<button onclick="alert('JS Active')">test</button>}}} This will make a [Test] button appear on the noscript.net page: if you click, a "JS Active" alert should be shown as long as Javascript is enabled there - Go back to the maone.net tab, and use "Temporarily allow all". Watch the page autoreload. You can also "Forbid maone.net" and repeat as many time as you want. That's the reason why it works: JS breaks on non-temporarily allowed sites only.
- Switch to the noscript.net tab and hit the button to verify Javascript is still enabled Confirmed.
FWIW:
about:debugging#addonshas a great feature "Load Temporary Add-on" for on-the-fly patching/debugging of bootstrapped extensions.mentioned in issue #24126 (moved)
mentioned in issue tpo/applications/tor-browser#24126 (closed)
