search

RequestPolicyContinued / requestpolicy

a web browser extension that gives you control over cross-site requests. Available for XUL/XPCOM-based browsers.
https://github.com/RequestPolicyContinued/requestpolicy/wiki
Other
252 stars 35 forks source link

RP blocks NoScript resources #880

Open wilkowy opened 6 years ago

wilkowy commented 6 years ago

Request Policy blocks „noscript_0.#####” resources again. This was previously mentioned and fixed here: https://github.com/RequestPolicyContinued/requestpolicy/issues/788#issuecomment-228909866

Fx 48.0.2 RP 1.0.beta13.2.1876.r489ddf49pre / default: deny

myrdd commented 6 years ago

@wilkowy how does the URI exactly look like? You get it from the request log.

wilkowy commented 6 years ago

Sorry, I got it wrong, it is not actually blocked. It started to appear in popup again, but in fact it is under „allowed connections” with „?”, not „other”. However in previous versions such entry was hidden from a view (same as „pluginproblem” I noticed as well)

In log it is recorded as resource://noscript_0.7086678826471293/flash16.png The „7086678826471293” part are random digits (they change every fx run). The log does not inform about blocking. So the issue is only partly correct.

myrdd commented 6 years ago

I see. The change has been introduced in commit https://github.com/RequestPolicyContinued/requestpolicy/commit/42208188e472d6792ed034cc9fc5e98ac1051bad#diff-1b7e0f7951478bbe351c234b42abb31bR196. Since then, resource://noscript_*/**/* (and pluginproblem) is allowed "by default": https://github.com/RequestPolicyContinued/requestpolicy/blob/061b3f9923a79502968ef0882a1d0c2e1b7df367/src/content/lib/request.js#L222-L264

I agree "allowed by default" is not fully correct here. It's "allowed by hardcoded rules".

myrdd commented 6 years ago

The WebExtension version won't have this issue anymore, because chrome and resource uris cannot be blocked by a WE. So this is a (low-prio) XPCOM-only issue.