#23747 closed defect (fixed)

"Temporarily allow all this page" breaks JS on all other tabs

Reported by: cypherpunks Owned by: tbb-team
Priority: High Milestone:
Component: Applications/Tor Browser Version:
Severity: Major Keywords: noscript
Cc: ma1 Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

subj

Child Tickets

Change History (11)

comment:1 Changed 21 months ago by boklm

Status: newneeds_information

I don't reproduce that. Clicking on "Temporarily allow all this page" does not enable or disable JS on other tabs for me.

comment:2 Changed 21 months ago by cypherpunks

Status: needs_informationnew

Maybe, you just don't notice that?
Open http://example.com/
Press "Temporarily allow all this page"
And check that JS-dependent features stopped to function on Trac

Opened DDG Search page will show you

<meta http-equiv="refresh" content="0;URL=/html?q=noscript"><link href="/css/noscript.css" rel="stylesheet" type="text/css"><div class="msg msg--noscript"><p class="msg-title--noscript">You are being redirected to the non-JavaScript site.</p>Click <a href="/html/?q=noscript">here</a> if it doesn't happen automatically.</div>

Last edited 21 months ago by cypherpunks (previous) (diff)

comment:3 in reply to:  2 Changed 21 months ago by gk

Status: newneeds_information

Replying to cypherpunks:

Maybe, you just don't notice that?
Open http://example.com/
Press "Temporarily allow all this page"
And check that JS-dependent features stopped to function on Trac

Opened DDG Search page will show you

<meta http-equiv="refresh" content="0;URL=/html?q=noscript"><link href="/css/noscript.css" rel="stylesheet" type="text/css"><div class="msg msg--noscript"><p class="msg-title--noscript">You are being redirected to the non-JavaScript site.</p>Click <a href="/html/?q=noscript">here</a> if it doesn't happen automatically.</div>

Could you give us some steps to reproduce your issue? Where are you starting from? Are you setting the security slider to "high"? Or "medium"?

comment:4 Changed 21 months ago by cypherpunks

Status: needs_informationnew
Summary: "Temporarily allow all this page" disables JS on all other tabs"Temporarily allow all this page" breaks JS on all other tabs

You're asking as if it were a Windows-only issue. Medium/High is required, of course.
Starting with many tabs, search something in DDG, open that example.com and allow JS for it. That's all. JS on all other tabs stopped functioning (until reload).

comment:5 Changed 21 months ago by ma1

Should be fixed in 5.1.2rc7, thank you.

comment:6 Changed 21 months ago by cypherpunks

Seems it doesn't work until restart. "Forbid example.com" to revert allowed site breaks JS on all other tabs too. Subsequent allow/revert switching breaks them too.

comment:7 in reply to:  6 ; Changed 21 months ago by ma1

Replying to cypherpunks:

Seems it doesn't work until restart.

You mean installing over a "broken" version doesn't fix its behavior until restart, don't you? But a new installation or installing over rc7 itself just works as expected, correct?

Last edited 21 months ago by ma1 (previous) (diff)

comment:8 in reply to:  7 ; Changed 21 months ago by cypherpunks

Status: newneeds_revision

Replying to ma1:

Replying to cypherpunks:

Seems it doesn't work until restart.

You mean installing over a "broken" version doesn't fix its behavior until restart, don't you?

Correct.

But a new installation or installing over rc7 itself just works as expected, correct?

No. It turns out temporarily allowed page wasn't reloaded at that moment (a bug too), and this is critical for testing this issue. Reloading of the allowed page leads to JS breakage on other tabs with rc7 and after restart too.

comment:9 in reply to:  8 ; Changed 21 months ago by ma1

Replying to cypherpunks:

No. It turns out temporarily allowed page wasn't reloaded at that moment (a bug too), and this is critical for testing this issue. Reloading of the allowed page leads to JS breakage on other tabs with rc7 and after restart too.

It's not what I can see here (BTW, please switch to rc8, just released with more lifecycle-related fixes).

My test, meant to exclude "confounding factors":

  1. Install NoScript 5.1.2rc8 over a "stock" Tor Browser, set the Security Slider to "High" and restart the browser
  2. Open https://maone.net/ in a new tab
  3. Open https://noscript.net/ in a new tab, then on this tab use "Temporarily allow all this page"
  4. With this tab still active, open a Scratchpad (shift+F4) and run the following scriptlet:
     document.body.innerHTML=`<button onclick="alert('JS Active')">test</button>`
    

This will make a [Test] button appear on the noscript.net page: if you click, a "JS Active" alert should be shown as long as Javascript is enabled there

  1. Go back to the maone.net tab, and use "Temporarily allow all". Watch the page autoreload. You can also "Forbid maone.net" and repeat as many time as you want.
  2. Switch to the noscript.net tab and hit the button to verify Javascript is still enabled

comment:10 in reply to:  9 Changed 21 months ago by cypherpunks

Replying to ma1:

Replying to cypherpunks:

No. It turns out temporarily allowed page wasn't reloaded at that moment (a bug too), and this is critical for testing this issue. Reloading of the allowed page leads to JS breakage on other tabs with rc7 and after restart too.

It's not what I can see here (BTW, please switch to rc8, just released with more lifecycle-related fixes).

Another STR = another results (BTW, public repo can't be updated so quickly ;)

My test, meant to exclude "confounding factors":

Hmm...

  1. Install NoScript 5.1.2rc8 over a "stock" Tor Browser, set the Security Slider to "High" and restart the browser

"stock" Tor Browser has "bundled" NoScript. Do you mean to replace it before the first run? There are many scenarios to get rc8, but let's assume that it's enough to update any previous version with it, restart and then set the Security Slider to "Medium" (to ensure it updates rc8 settings).

  1. Open https://maone.net/ in a new tab
  2. Open https://noscript.net/ in a new tab, then on this tab use "Temporarily allow all this page"
  3. With this tab still active, open a Scratchpad (shift+F4) and run the following scriptlet:
     document.body.innerHTML=`<button onclick="alert('JS Active')">test</button>`
    

This will make a [Test] button appear on the noscript.net page: if you click, a "JS Active" alert should be shown as long as Javascript is enabled there

  1. Go back to the maone.net tab, and use "Temporarily allow all". Watch the page autoreload. You can also "Forbid maone.net" and repeat as many time as you want.

That's the reason why it works: JS breaks on non-temporarily allowed sites only.

  1. Switch to the noscript.net tab and hit the button to verify Javascript is still enabled

Confirmed.

FWIW: about:debugging#addons has a great feature "Load Temporary Add-on" for on-the-fly patching/debugging of bootstrapped extensions.

Last edited 21 months ago by cypherpunks (previous) (diff)

comment:11 Changed 20 months ago by gk

Resolution: fixed
Status: needs_revisionclosed

Actually, looking at the NoScript changelog this made it into 5.1.2, thanks.

Note: See TracTickets for help on using tickets.