uBlock Origin doesn’t honor noscript tags when blocking JS

[linkmauve]

In advanced mode, when blocking some or all of the JS scripts on a page, the noscript tag following the script tag is never used.

Here is a simple testcase for this issue, the page should display either “Using <script/>” when using JS, or “Using <noscript/>” when blocking it, but it currently displays nothing when using uBlock Origin.

http://linkmauve.fr/files/ublock.xhtml

[gorhill]

There is no good solution for this.

uBlock does not disable javascript in the browser, it prevents it from running using a Content-Security-Policy header, and in such case it appears the browser does not fall back on noscript tags. Forcing the noscript tags to render using some trickery leads to other issues.

So there is no good solution. Maybe file an issue with the browser devs to ask them if the noscript tags can become active whenever the browser can't execute script tags, for whatever reasons, not just just because javascript is disabled in the browser.

[luxoflux]

So those annoying <noscript><meta http-equiv="refresh" content="0" url=...></noscript> redirects don't function now? I hadn't noticed when that changed, but I'm glad.

[gitarra]

Just for the record, e.g. NoScript honours noscript tags. NoScript also has options whether to allow META redirections inside them or to hide them completely.

[vn971]

Can we maybe use this technique?: http://kb.mozillazine.org/Allowing_only_certain_sites_to_use_JavaScript

That is, if all javascript is disabled for a site, can we set
user_pref("capability.policy.nojs.sites", "http://www.example.com http://www.example.net");
?

This probably has to be carefully thought of as uMatrix can both function as a blacklist and as a whitelist, but still, even supporting the simplest most popular scenario would be awesome.

[chiraag-nataraj]

I just ran into this when trying to ensure my site was accessible to users who don't have javascript. Do we know how NoScript manages to deal with the <noscript> tag and can we do something similar?

[bzbarsky]

Gecko bug https://bugzilla.mozilla.org/show_bug.cgi?id=1392090 will make this work for "script-src 'none'" once fixed. For cases when some but not all scripts are blocked, the desired behavior of noscript tags is ... unclear at best.

[gorhill]

will make this work for script-src 'none' once fixed

Ok thanks. Well, a master javascript switch was an alternative solution, however it could not be implemented in Firefox due to browser.contentSettings not being present.

Between both solutions, I like the script-src 'none' far better, because this matches exactly uBO's way of deciding on the fly as to whether something is blocked or not, while this is not possible with the essentially declarative chrome.contentSettings API.

[gorhill]

A new per-site switch has been added to wholly disable/enable javascript. noscript tags will be honoured if and only if javascript is wholly disabled through that new per-site switch.