hackademix / noscript

The popular NoScript Security Suite browser extension.
https://noscript.net/
GNU General Public License v3.0
851 stars 90 forks source link

11.4.29 does not show all sites #337

Open GaryAitken opened 10 months ago

GaryAitken commented 10 months ago

Firefox 121.0 on fbsd Visiting site https://shop.tesla.com/product/sae-j1772-charging-adapter Noscript only shows three sites:

  tesla.com (trusted)
  googletagmanager.com (temp trusted)
  maps.googleapis.com (trusted)

But the noscript icon shows 4 sites not trusted

  blocked 4 of 4 items
  script 2/2
  font 2/2

There's clearly something missing from the page, as I can't order from it and don't see a price.

hackademix commented 10 months ago

Hello,

I cannot reproduce your issues.

With your permissions, or even with just tesla.com sert to Temp. TRUSTED, I can see the price ($50), add items to the cart and go to checkout. I didn't go further because I didn't want to register an account, but I think it's enough of your case.

Now, if I use your permissions I get 1/4 scripts blocked (because googleanalytics.com is kept to DEFAULT), so your count is suspicious. Have you got any capabilities disabled in your TRUSTED preset (they should all be enabled?)

Also, does the problem persist if you either

  1. Export and Reset your configuration from the NoScript Options panel?
  2. Disable all your extensions except NoScript?

Good luck and let me know.

GaryAitken commented 10 months ago

This is pretty weird. I have 12 firefox windows open, and a lot of tabs It appears that what's going on in other windows/tabs may affect the results. After restarting firefox, it restarts on the tesla.com page I have seen (at least) two different startup situations:

  1. tesla.com and maps.googleapis.com were trusted when firefox quit: firefox opens on tesla.com page, noscript shows 2 sites blocked, and the dropdown shows:
    trusted tesla.com
    default google-analytics.com
    default googletagmanager.com
    trusted maps.googleapis.com
  2. tesla.com and maps.googleapis.com and others were default when firefox quit: firefox opens on tesla.com page, noscript shows 1 site blocked and the dropdown shows:
    default tesla.com

    The above all seems normal. However, in the #1 scenario, if I set tesla.com to default and reload the page, it shows 3 sites blocked, but dropdown only displays 3 in total, not 4:

    default       tesla.com
    default       googletagmanager.com
    trusted       maps.googleapis.com

    I have seen this "missing blocked sites" problem on a number of other sites, but have not been paying close enough attention to be able to reproduce. I suspect it is related to what permissions those blocked sites have been set to in other tabs/windows.

GaryAitken commented 10 months ago

BTW, I have no other extensions installed.

GaryAitken commented 10 months ago

Not sure what you mean by disabling capabilities in my TRUSTED presets. Oh... I guess that's the Custom button. The only ones set are frame, fetch, noscript, other "script" is hilighted in red; "font" is hilighted also, but not as much Not sure when/how that happened, maybe a long time ago. But why would it be different from the default (is the default all boxes checked?) if I've set it to default and trusted and temp-trusted? The Advanced tab for noscript shows 5 XSS blocks and allows, none related to the page in question.

iconberg commented 9 months ago

I have the same problem on windows/linux that not all sites are shown on some sites since some time. Example www.yoko.de grafik

The site www.yoko.de is not working, only menu is shown, rest is blank.

GaryAitken commented 9 months ago

Another example: https://www.wildmadagascar.org/conservation/parks/Tsimanampetsotsa.html NoScript icon shows [1] popup shows:

Temp  wildmadagascar.org
def   ampproject.net
Temp  ampproject.org
def   doubleclick.net
def   getclicky.com
def   googlesyndication.com
def   googletagmanager.com

I have a number of other windows open, so not sure what other sites may have 'temp' status and are not showing. I don't know if 'temp' status is supposed to be confined to the tab under which it was activated.