hackademix / nscl Goto Github PK

I have been running a personal fork of noscript for over a year without issue; however it was recently flagged on Mozilla's AMO with this comment:

This add-on didn't pass review because of the following problems:

1. The add-on makes remote, synchronous XMLHttpRequests which have the ability to lock-up the browser UI and are therefore not allowed in public add-ons. Please use asynchronous requests instead.

• nscl/common/SyncMessage.js line 243
• nscl/content/patchWorkers.js line 113

These files are unchanged in my fork, so the relevant lines are here and here.

Synchronous XHRs are also apparently deprecated.

If applied consistently, this policy affects noscript and any add-on using the NSCL. Has it been encountered in the past, and are there plans to remove sync XHRs from the NSCL?

Separately, how critical are sync XHRs to NSCL/noscript's functionality? I may need to remove them at least temporarily from my fork.

• nscl/common/SyncMessage.js line 243: It seems the browser.runtime.sendSyncMessage function with the offending line is only used as a fallback to an asyncFetch in StaticNS.js
• nscl/content/patchWorkers.js line 113: Could this be converted to an async XHR? Looking at the code, that seems nontrivial, though it also looks like patchWorkers isn't being used by noscript at the moment.

First, I apologize as I cannot reproduce consistently the issue and cannot share the code that leads to it (it is from a private website). If this bug report is useless, feel free to close it.

So, this happens on a fairly complex javascript application that manipulates the DOM and uses Web Workers. The browser used is Tor Browser 11.0.14, based on Mozilla Firefox 91.10.0esr, in its default configuration (so, noscript is enabled by default). Sometimes, when using the application, all DOM manipulations seem to stop working, and a page reload is required. Specifically, running:

document.createElement("div").appendChild(document.createElement("div"))

in the browser javascript console throws a DOMException. When catched with a try-catch block, the catched error is undefined. Using the browser debugger step by step shows the original exception. On line 285 of the NSCL patchWindow.js, this:

for (let j = 0; j in win; j++) {

produces this exception:

TypeError: can't access dead object

and indeed, win appears as DeadObject in the browser debugger. See MDN about dead objects:

https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Errors/Dead_object

Do you know if the issue might be coming from your software or if I'm looking in the wrong direction?

Set.prototype.size is a getter and calling it as a function will throw.

common/tld.js has not been updated at least since a3f7807 . I haven't compared the public_suffix_list.dat deleted in that commit with the then-current official version, so it might be even older.