207807 - disable javascript per site & no foreign (third party) javascript

Status: RESOLVED DUPLICATE of bug 38966

(SeaMonkey :: UI Design, enhancement)

Description

[Kevin B]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.4b) Gecko/20030504 Mozilla Firebird/0.6
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.4b) Gecko/20030504 Mozilla Firebird/0.6

Javascript should have some of the same options as images currently have. 
Namely, you should be able to black or white list sites for javascript, and
there should be an option like 'run scripts from the originating site only'
which would disable loading <script> tags that where the src is absolute and not
from the same host as the page.

Reproducible: Always

Steps to Reproduce:
1.
2.
3.

Comment 1

[Kai Lahmann (is there, where MNG is)]

you nead, add a Javascript-Manager?

Comment 2

[Greg K.]

Some of this is already implemented in CAPS, Configurable Security Policies
(<http://www.mozilla.org/projects/security/components/ConfigPolicy.html>).

That document does mention that the value "sameOrigin" isn't presently
implemented for controlling JavaScript, though.

Comment 3

[Daniel Wang]

*** Bug 208508 has been marked as a duplicate of this bug. ***

Comment 4

[Daniel Wang]

I'll hack an .xpi Javascript Manager. should be done very soon.

Comment 5

[Daniel Wang]

Attachment: jsManager.xpi

install instruction: download the file and drag the file icon to the browser.
Tested in mozilla 1.4 on win98se only. The package adds a "Javascript Manager"
menu to the Tools menu. Currently only "manage scripte sites" work.

This extension allows you to create a whitelist for script sites. If you check
"Disable JavaScript except for the following sites", then only sites listed can
execute Javascript. Note: "www." is dropped from site name, so if you try to
add "www.cnn.com", "cnn.com" will be added instead and all *.cnn.com sites can
run js.

This extension is for testing purpose only. I do not provide user support and
do not guarentee that it will be compatible w/ any future version.

Comment 6

[Jon Henry]

Confirming and sending to XP Apps. This seems like a reasonable request,
especially now that Daniel has done much of the work already.

Comment 7

[Daniel Wang]

Comment on attachment 129210 [details]
jsManager.xpi

the package had a serious bug. use the one from page bottom of
http://bannerblind.mozdev.org/installation.html

Comment 8

[Daniel Wang]

-> me

Comment 9

[Bogdan Stroe]

*** Bug 247578 has been marked as a duplicate of this bug. ***

Comment 10

[Bogdan Stroe]

*** Bug 239585 has been marked as a duplicate of this bug. ***

Comment 11

[mmortal03]

*** Bug 251688 has been marked as a duplicate of this bug. ***

Comment 12

[mmortal03]

May I request that the bug and fix also include per-site Java Exception options?

Comment 13

[Bogdan Stroe]

(In reply to comment #12)
> May I request that the bug and fix also include per-site Java Exception options?
Blocking Java is covered in bug 94035 (see also bug 238388). Probably a
whitelist mechanism will be implemented for each type of plugin.

Comment 14

[Jo Hermans]

*** Bug 257717 has been marked as a duplicate of this bug. ***

Comment 15

[Matthew Flaschen]

We need a blacklist too, not just a whitelist, like Daniel made.  It should have
Firefox 1.0 PR support as well.

Comment 16

[Daniel Veditz [:dveditz]]

*** Bug 273105 has been marked as a duplicate of this bug. ***

Comment 17

[Jackie Liu]

This seems to have been neglected for quite a time now.  It seems to be from when Firefox was just starting out.  I would really like to see this enhancement implemented on all platforms.  A extension, Noscript (www.noscript.net) which offers whitelist functionality for Java and Javascript, has been extremely popular.  I think this should come standard in Firefox.

Comment 18

[Jackie Liu]

I think the Product: field should be changed to Firefox or Seamonkey and the Version: field to unspecified.

Comment 19

[Daniel Veditz [:dveditz]]

*** This bug has been marked as a duplicate of 38966 ***