NoScript Updates

NoScript 11.4.42

Wed, 09 Oct 2024 09:35:17 +0000

x [nscl] Further SyncMessage simplification
x Mitigate race conditions on startup

NoScript 11.4.40

Sat, 28 Sep 2024 15:16:21 +0000

x [nscl] Fix patched workers failures caused by Firefox
  webRequest filters disconnect() breaking on large files
  (thanks barbaz for reporting)

NoScript 11.4.37

Tue, 10 Sep 2024 14:50:36 +0000

x [nscl] Do not patch windows with WebGLHook if webgl is
  globally disabled
x [nscl] Do not patch workers if webgl is globally disabled
x [L10n] Updated uk
x [nscl] Workers-aware WebGL Hook

NoScript 11.4.35

Wed, 28 Aug 2024 15:08:37 +0000

x Improved lazy_load capability (optimization and
  notification)
x [nscl] Slight optimization of NOSCRIPT element emulation
  loop
x Automatically add extra capabilities to policyTypesMap
x Gracefully handle new capabilities still unknown to the
  settings host (e.g. Tor/Mullvad browser), if any
x Configurable "lazy_load" capability (see
  https://github.com/whatwg/html/issues/5250)
x Prefetch all CSS subresources (1st party included) in
  private contexts where both unchecked_css and scripting
  capabilities are disabled
x Forcibly neutralize lazy loading attributes when scripting
  is disabled
x [nscl] Restored SyncMessage compatibility with Firefox 78
  and below
x Lock nscl version on stable releases
x [L10n] Updated de, fr, tr, ru, uk, zh_CN

NoScript 11.4.34

Thu, 08 Aug 2024 07:19:07 +0000

x [nscl] Work around for
  https://bugzilla.mozilla.org/show_bug.cgi?id=1899786
  (issue #372)
x [L10n] Updated de, ru, tr
x Synchronize nscl git commits as needed before tagging new
  versions

NoScript 11.4.31

Thu, 18 Jul 2024 11:54:03 +0000

x [L10n] Updated fr, is, ru, zh_CN
x Improved release tooling
x [nscl] Updated to latest NoScript Commons Library
x NoScript Options/Appearance/Show synthetic placeholders
  for invisible capability probes (issue #369)
x [nscl] Make placeholders easier to style per type
x Prevent duplicate synthetic placeholders for invisible
  capability probes (issue #369)

NoScript 11.4.30

Sat, 13 Jul 2024 05:47:42 +0000

x [nscl] Best effort WebGL placeholders for offscreen
  capability detection
x Improved blocked but required capability reporting from
  subframes (issue #367)
x [nscl] Include SVG among embedding document types (fixes
  issue #366)
x Removed obsolete "applications" manifest.json key

NoScript 11.4.29

Tue, 12 Dec 2023 10:52:09 +0000

x [nscl] Updated TLDs
x [nscl] Improved reliability of TLD updater
x Removed theme.js console noise
x Fix beta channel updates breakage due to
  browser_specific_settings override
x [nscl] Several content-side performance improvements
x Reduce synchronous policy retrieval impact on file: and
  ftp: document loading performance
x More commands for which a keyboard shortcut can be
  configured
x [L10n] Updated de, fi, mk, nl, pl, ru, sq, tr, uk,
  pt_BR, zh_CN, zh_TW
x Explicit Android compatibility declaration

NoScript 11.4.28

Tue, 10 Oct 2023 11:27:03 +0000

x Prevent URL leaks from media placeholders (thanks NDevTK
  for report)
x [nscl] Support for in-tree TLDs updates

NoScript 11.4.27

Wed, 13 Sep 2023 07:40:20 +0000

x [XSS] Better specificity of HTML elements preliminary
  checks
x [XSS] Better specificity of potential fragmented injection
  through framework syntax detection (thanks Rom623, barbaz
  et al)
x [nscl] RegExp.combo(): RegExp creation by combination for
  better readability and comments
x [nscl] Replaced lib/sha256.js with web platform native
  implementation (thanks Martin for suggested patch)
x [nscl] Fixed property/function mismatch (thanks Alex)
x Fixed operators precedence issue #312 (thanks Alex)
x [nscl] Prevent dead object access on BF cache (thanks
  jamhubub and mriehm)

NoScript 11.4.26

Tue, 25 Jul 2023 11:19:50 +0000

x [Android] Fixed regression preventing NoScript prompts
  from being shown
x [XSS] Fallback to execute most demanding regular
  expressions asynchronously
x [XSS] Removed obsolete Flash-related checks
x [XSS] Make InjectionChecker's regular expressions easier
  to debug
x [XSS] Updated OpenID regexp

NoScript 11.4.25

Wed, 12 Jul 2023 18:34:03 +0000

x Reload extension on fatal failures
x [Android] Fixed UI styling regression
x Fixed UI inconsistencies when finer-grained contextual
  policies are created/imported by other means (thanks
  barbaz for reporting)

NoScript 11.4.24

Thu, 29 Jun 2023 17:03:40 +0000

x [XSS] Fix Base64 hash checks interfering with query string
  checks (thanks barbaz for reporting)
x [TabGuard] Stop exempting domains bidirectionally by
  default
x [TabGuard] Fix destination domain being reported as the
  trigger of a warning prompt when all the other tab-tied
  domains have been exempted (thanks barbaz for report)

NoScript 11.4.22

Thu, 18 May 2023 09:11:23 +0000

x [L10n] Updated uk
x Consistently apply DEFAULT policy to top-level data: URLs

NoScript 11.4.21

Wed, 05 Apr 2023 20:00:45 +0000

x Fixed mislabeled Tor Browser settings override option
x [L10n] Updated mk

NoScript 11.4.20

Tue, 21 Mar 2023 12:07:03 +0000

x Generalized prompt safety hooks
x Better blob: URL support

NoScript 11.4.18

Fri, 03 Mar 2023 15:03:34 +0000

x [Firefox on Linux] Fixed detached window UI gets closed
  when its decoration is clicked (thanks richard for
  reporting)

NoScript 11.4.16

Mon, 13 Feb 2023 09:54:39 +0000

x [L10n] Updated de, nl, pl, ru, sq, zh_CN
x Always open the windowed standalone UI when invoked from
  the Alt+Shift+N shortcut
x Alt+Shift+Space shortcut to toggle restrictions
  enforcement for current tab (issue #129, thanks PF4Public
  for RFE)

NoScript 11.4.15

Tue, 31 Jan 2023 09:14:21 +0000

x Use the actual browser's brand name for Tor Browser
  derivatives
x Always open the windowed standalone UI when invoked from
  the contextual menu (thanks ZeroUnderscoreOu for
  reporting)

NoScript 11.4.14

Tue, 03 Jan 2023 14:54:49 +0000

x Updated HTML event attributes list
x Uniformed indexed directory Firefox UI emulation to
  prevent a script blocking bypass on file:// resources
  (thanks RyotaK for reporting)
x Fixed error being logged in the console on scriptless
  pages when hitting [Delete] or [Backspace] (thanks barbaz
  for reporting)
x Work-around for background page misteriously being
  unloaded sometimes by Firefox
x [L10n] Updated Transifex configuration

NoScript 11.4.13

Tue, 22 Nov 2022 10:17:17 +0000

x Ensure theme changes are synchronized across windows,
  including private ones (thanks barbaz for reporting)
x [UI] Ensure prompts are always centered relative to the
  parent window in multi-monitors setups
x Switch to "Modern Red Evil" icon contributed by fatboy
x Work-around for Chromium unable to load the placeholder
  icon
x Themed placeholders
x [nscl] Fixed placeholder fallback styles on Gecko
  embedding documents
x [L10n] New Romanian (ro) locale (thanks Simona Iacob and
  Inpresentia I.)

NoScript 11.4.12

Tue, 15 Nov 2022 12:04:15 +0000

x [L10n] Updated is, mk
x [L10n] New Finnish (fi) locale (thanks RJuho, olavinto and
  ricky.tigg)
x [L10n] New Ukrainian (uk) locale (thanks Kataphan, MuS and
  uniss)
x [L10n] New Persian (fa) locale (thanks voxp and magnifico)

NoScript 11.4.11

Wed, 14 Sep 2022 21:20:11 +0000

x Fix broken NoScript dialogs when
  browser.privatebrowsing.autostart = true (issue#259,
  thanks foenix for reporting)
x Avoid using fallback origins for main_frame loads

NoScript 11.4.10

Thu, 01 Sep 2022 10:47:22 +0000

x [TabTies] Cascade and merge ties in a shared pool, to
  prevent them from being cut by closing a middle tab
  (thanks NDevTK for reporting)
x Extended origin normalization to top-level documents
  (thanks NDevTK for reporting)
x [TabGuard] Fixed regression in about:blank handling
  (thanks NDevTK for reporting)
x Better origin guess for requests from sandboxed iframes
  (thanks NDevTK for reporting)
x More precise tracking of implicit origins in tab URLs
x [nscl] Stricter criteria for cutting tab relations (thanks
  NDevTK for reporting)
x Use window.origin when fetching policies for inheriting
  special URLs (thanks NDevTK for reporting)
x Better build script compatibility

NoScript 11.4.9

Mon, 15 Aug 2022 11:17:14 +0000

x [L10n] Updated pl, tr, zh_CN
x [TabGuard] Abort the load when the warning dialog is
  closed by any mean except the OK button
x [TabGuard] Stricter criteria for cutting tab relations
  (thanks fatboy for reporting)

NoScript 11.4.8

Thu, 11 Aug 2022 14:39:41 +0000

x Cross-tab identity leak protection ("TabGuard", see
  tor-browser#41071, thanks barbaz and fatboy for testing)
x [TabGuard] Better request lifecycle management
x [L10n] Updated de, it, nl, ru, sq
x [l10n] Automatic pull for 100% completed translations only

NoScript 11.4.7

Mon, 08 Aug 2022 11:04:57 +0000

x [XSS] Fixed regression in invalid characters optimization
  causing false negatives (thanks Tsubasa for reporting)
x Minor build script enhancement

NoScript 11.4.6

Mon, 30 May 2022 10:51:33 +0000

x [nscl] Copy NOSCRIPT elements' attribute in emulated
  replacements (issue #238)
x [XSS] Correct for concurrency in timeout checks
x [UI] Flatter preset appearance
x [UI] Focus visual feedback adjustments
x Inclusion-time TLD updates
x Updated HTML events
x [L10n] Updated pl
x Opaque white for vintage lock icons
x [L10n] Updated is

NoScript 11.4.5

Tue, 19 Apr 2022 14:43:49 +0000

x Improved preset sizing
x Reduce toolbar bottom shaded line tickness
x [L10n] Updated he
x Various user-driven visual tweaks
x Fixed vintage icon brightness in automatic light mode
x Minor icon tweaks

NoScript 11.4.4

Fri, 01 Apr 2022 08:34:47 +0000

x [L10n] Updated mk
x Removed "clearclick" item from default settings
x Better layout for mixed status icons

NoScript 11.4.3

Mon, 28 Mar 2022 12:21:19 +0000

x Reversed colors in Modern Red permissive icons for better
  contrast
x Fixed regression causing only signed builds to complete

NoScript 11.4.1

Wed, 23 Mar 2022 12:54:58 +0000

x Support for reverting to the "Vintage Blue" style
  (NoScript Options/Appearance)
x Various tweaks to the "Moder Red" dark and light themes

NoScript 11.4

Mon, 21 Mar 2022 14:31:53 +0000

x Visual refresh based on Simply Secure concept artwork
x Full Dark/Light color schemes support
x [l10n] Many languages updates
x Include ServiceWorker-initiated fetch requests in UI
  reporting (thanks 0_o for report)
x Remove redundant style patching
x Prompts can be closed by keyboard: Enter emulates the
  default button click, Escape the cancel action
x Ensure better visibility for in-popup message box
x Sticky toolbar and scrollable fixed-height content in
  browserAction popups
x [XSS] Automatically reload page when clearing XSS choice
  from popup
x [XSS] Enable "Clear XSS Choices" button only if some item
  is selected
x Remember last active tab when opening the option window
x Avoid useless reload if no actual change has happened in
  enforcement status
x Fix for regression: request and execution attempts not
  being reported anymore in the UI if restrictions are
  disabled (thanks Stefan Mey for report)
x Dark mode support
x Improved high contrast layout
x Fixed automatic reload not always triggered for CUSTOM
  tweakings
x More consistent cross-browser widgets
x Partial status indicator on the left of the icon, to
  accommodate Chromium's badge position
x Make focus hint less elusive for needed capability widgets
x More accurate blocking stats

NoScript 11.3.7

Wed, 02 Mar 2022 12:06:51 +0000

x Always avoid DNS resolution when a HTTP(S) proxy is used
  (thanks nojake for reporting)

NoScript 11.3.6

Mon, 28 Feb 2022 16:42:19 +0000

x Make high contrast and draggable toolbar items mutually
  exclusive
x [Chromium] Fix high contrast option not working
x Avoid flashing empty graveyard on popup opening
x More deterministic DnD placeholder creation
x [L10n] Updated fr, es, nl, zh_CN
x Make disabled buttons draggable and hidden enabled buttons
  interactive when the "graveyard" is open
x Close UI and reload immediately when enabling global/tab
  restrictions or disabling them for the tab only

NoScript 11.3.5

Mon, 28 Feb 2022 11:46:54 +0000

x [L10n] Updated de, mk, ru, sq, tr
x Fix regressions in draggable toolbar buttons
x [Android] Better styling for icon buttons in message box

NoScript 11.3.4

Fri, 25 Feb 2022 23:03:53 +0000

x Avoid closing the customizer on arrow up key context
  selection change (thanks barbaz for reporting)
x Prominently warn user whenever restrictions are disabled
x Better accessibility and styling for popup global buttons
x [L10n] Updated de
x Fix for contextual permissions display inconsistencies in
  options panel (thanks barbaz for reporting)

NoScript 11.3.3

Mon, 21 Feb 2022 15:21:20 +0000

x [Android] Improved CUSTOM panel portrait layout
x Play nice with  the Viewhance extension
x Avoid synchronous fetching for remote embedding documents
x Fixed typo in UI context dropdown initial selection
x Fixed wrong label for http: sites in contextual policy UI
  (thanks barbaz for reporting)
x Fix for first party context policy ignored on first load
  in new tabs (thanks ayi for reporting)
x Consolidate best effort policy fetching
x Use correct context for all subresources checks (thanks
  user72 for reporting)
  queries on Firefox (thanks vexity for reporting)
x [L10n] Updated de, es, he

NoScript 11.3.2

Fri, 18 Feb 2022 16:44:06 +0000

x Prevent LAN protection from breaking webRequest blocking
  on the Tor Browser (thanks TorBrowserUser for reporting)

NoScript 11.3

Wed, 16 Feb 2022 21:37:09 +0000

+ LAN capability to check for cross-zone WAN to LAN requests
  (thanks barbaz for ABE webext contributions)
+ Contextual policies (different capabilities for the same
  origin, depending on the top-level domain) configurable in
  the CUSTOM panel (thanks NLnet for financial support)

NoScript 11.2.25

Mon, 14 Feb 2022 12:23:29 +0000

x More robust policy fetching
x [Firefox] Fix regression causing file:// policy not to be
  correctly enforced sometimes

NoScript 11.2.24

Sun, 13 Feb 2022 07:22:49 +0000

x [nscl] Avoid unnecessary window patching

NoScript 11.2.23

Sun, 13 Feb 2022 07:27:47 +0000

x [nscl] Fix rare breakages due to xray cloning

NoScript 11.2.21

Thu, 10 Feb 2022 07:44:10 +0000

x Better fallback for failing syncMessage
x [XSS] Simplified preemptive name sanitization

NoScript 11.2.20

Thu, 10 Feb 2022 07:41:46 +0000

x [L10n] Updated de
x [XSS] Fix false positive warning when "name" is in the
  query string (thanks John Shield / DuckDuckGo for
  reporting)

NoScript 11.2.19

Fri, 04 Feb 2022 16:23:51 +0000

x [XSS] Faster invalidCharsRx initialization on Gecko 78 and
  above
x [XSS] More resilient name handling
x [nscl] Use HTTPS SyncMessage endpoint for Chromium too
  (works around lack of file access by default on packed
  extensions breaking NoScript)

NoScript 11.2.16

Tue, 01 Feb 2022 06:52:52 +0000

x Fallback to synchronous policy fetching if the document is
  already loaded (e.g. on updates)
x [XSS] Interactive testing made a bit easier
x [nscl] Mitigate side effects of dead objects on patched
  windows during extension updates
x [XSS] Fix false positive on Microsoft authentication
  (thanks GrK and Hanna_Payne for reporting)
x [nscl] Work-around for object element initialization
  inconsistencies on Firefox (thanks skriptimaahinen for
  reporting)
x [L10n] Updated fr
x Better support for service workers in unrestricted modes
  (thanks Mark McVeigh for reporting)

NoScript 11.2.15

Wed, 19 Jan 2022 14:24:03 +0000

x [Android] Work-around for Firefox "forgetting" tabs
x [nscl] Improved cross-frame auto-patching

NoScript 11.2.14

Thu, 30 Dec 2021 16:00:06 +0000

x [nscl] Updated SyncMessage fixes conflict with other
  content blockers (thanks gwarser, barbaz and Baraoic)
x [XSS] Tweaked risky operator check prevents false positive
  on outbound Twitter navigation (thanks @muchtypo for
  reporting)
x [XSS] Better logging for JS fragment detection
x [XSS] Fixed performance regression in invalid character
  ranges generation causing random XSS "DOS" false positives
x Fetch policy for baseURI if document.domain is empty
x [L10n] Updated ja, lt, pl, ru, zh_CN
x Always fetch policy synchronously, if missing
x Fixed undetermined status icon on BF cache page loads
x [nscl] Fix webgl blocking regression due to xray wrappers
  confusion (thanks skriptimaahinen)
x [nscl] Prevent unnecessary breakages on pages inspecting
  canvas.getContext when webgl is disabled
x [nscl] Reduce the risk to interfere with scripts messing
  with the media attribute (issue #207)

NoScript 11.2.11

Thu, 12 Aug 2021 05:31:19 +0000

x [nscl] Fixed JavaScript access to CSS rules broken on
  Chromium when unrestricted CSS is disabled - issue #204
x Prevent Chromium builds from being sent to AMO for signing
x [nscl] Fixed CPU/RAM overload on some pages with
  unrestricted CSS disabled but scripting enabled (not
  recommended setting) - issue #194, issue #199
x [nscl] Fixed CPU spikes on Chromium triggered by automatic
  file downloads (thanks ptheborg for report)