464237 - NoScript plus IE Tab - NoScript fails when return from ie engine

Status: RESOLVED WORKSFORME

(Firefox :: Security, defect)

Description

[tomas.kirkegaard]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.0; nb-NO; rv:1.9.0.3) Gecko/2008092417 Firefox/3.0.3
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 6.0; nb-NO; rv:1.9.0.3) Gecko/2008092417 Firefox/3.0.3

If you have both IE Tab & the NoScript extension, if you have been on a site using ie tab, then return to using firefox engine, then the block javascript content with NoScript fails. It doesn't do anything. It says the page's script has been blocked, but it hasn't.

Reproducible: Always

Steps to Reproduce:
1.Open a page you know is with javascript. I testet with a page with javascripted clock
2.Show the page with IE engine
3.Return to firefox engine
4.Try blocking the script in the page with NoScript
Actual Results:  
NoScript doesn't block script-content

Comment 1

[Daniel Veditz [:dveditz]]

This is unlikely to be a Firefox bug, but rather a bug or bad interaction in one or the other of the addons. I'm clearing the "sensitive" flag because it doesn't seem particularly exploitable by a remote attacker and addon authors generally don't have access to security-sensitive Firefox bugs.

On the page you tested is the script on the same domain as the page, or does the <script src=""> tag point at some other site? If you test a simple page with only inline script
  <script>alert("JavaScript live!")</script>
do you see the same symptoms? I'm guessing that case will still get correctly blocked, although if not it might well be a Firefox problem apply "capability" policies.

I'm not sure what IETab does when you switch engines. Since many security checks are performed when content is loaded if it doesn't reload the content that could cause some problems.

I'm a little confused about your steps -- you return to firefox on the page in step 3, before you try blocking that site in step 4? What happens if you block that site in NoScript (and save that setting) before you switch to the IE engine and back?

Comment 2

[Giorgio Maone [:ma1]]

Just tested following the steps in the original report, and cannot reproduce.
Since the bug is rather old and seemingly not reproducible with latest versions of both extensions (NoScript 1.9.8.6 and IE Tab 1.5.20090525) on either Fx 3.0.13 or 3.5.2, resolving as WORKSFORME.