Skip to content

Commit da25e07

Browse files
hackademixhackademix
committed
Update 11.4.38.
1 parent 7deed1a commit da25e07

5 files changed

Lines changed: 269 additions & 47 deletions

File tree

‎content/_data/ver.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
11
{
2-
"stable": "11.4.29",
3-
"dev": "11.4.30rc1"
2+
"stable": "11.4.37",
3+
"dev": "11.4.39rc2"
44
}

‎content/changelog.md‎

Lines changed: 187 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,194 @@
11
---
22
title: Changelog
33
---
4-
[+] new feature, [x] bug fix, [-] removed feature, [=] repackaging or cosmetic change
4+
[+] new feature, [x] bug fix/maintenance, [-] removed feature, [=] repackaging or cosmetic change
55
```{.changelog}
6+
v 11.4.38
7+
============================================================
8+
x [nscl] Reuse uuid() in SyncMessage
9+
x [nscl] Simpler and safer SyncMessage logic on
10+
Chromium-based browsers (thanks NDevTK for reporting)
11+
x Fixed missing frameId on interception reporting
12+
x Updated file exclusions on packaging
13+
14+
v 11.4.38rc2
15+
============================================================
16+
x [nscl] Reuse uuid() in SyncMessage
17+
18+
v 11.4.38rc1
19+
============================================================
20+
x Updated file exclusions on packaging
21+
x [nscl] Simpler and safer SyncMessage logic on
22+
Chromium-based browsers (thanks NDevTK for reporting)
23+
x Fixed missing frameId on interception reporting
24+
25+
v 11.4.37
26+
============================================================
27+
x [nscl] Do not patch windows with WebGLHook if webgl is
28+
globally disabled
29+
x [nscl] Do not patch workers if webgl is globally disabled
30+
x [L10n] Updated uk
31+
x [nscl] Workers-aware WebGL Hook
32+
33+
v 11.4.37rc3
34+
============================================================
35+
x [nscl] Do not patch windows with WebGLHook if webgl is
36+
globally disabled
37+
38+
v 11.4.37rc2
39+
============================================================
40+
x [nscl] Do not patch workers if webgl is globally disabled
41+
42+
v 11.4.37rc1
43+
============================================================
44+
x [L10n] Updated uk
45+
x [nscl] Workers-aware WebGL Hook
46+
47+
v 11.4.36
48+
============================================================
49+
x [nscl] Merged MV3-compatible branch
50+
x [XSS] Take in account the whole redirection chain (thanks
51+
NDevTK for reporting)
52+
53+
v 11.4.35
54+
============================================================
55+
x Improved lazy_load capability (optimization and
56+
notification)
57+
x [nscl] Slight optimization of NOSCRIPT element emulation
58+
loop
59+
x Automatically add extra capabilities to policyTypesMap
60+
x Gracefully handle new capabilities still unknown to the
61+
settings host (e.g. Tor/Mullvad browser), if any
62+
x Configurable "lazy_load" capability (see
63+
https://github.com/whatwg/html/issues/5250)
64+
x Prefetch all CSS subresources (1st party included) in
65+
private contexts where both unchecked_css and scripting
66+
capabilities are disabled
67+
x Forcibly neutralize lazy loading attributes when scripting
68+
is disabled
69+
x [nscl] Restored SyncMessage compatibility with Firefox 78
70+
and below
71+
x Lock nscl version on stable releases
72+
x [L10n] Updated de, fr, tr, ru, uk, zh_CN
73+
74+
v 11.4.35rc4
75+
============================================================
76+
x Improved lazy_load capability (optimization and
77+
notification)
78+
x [nscl] Slight optimization of NOSCRIPT element emulation
79+
loop
80+
x Automatically add extra capabilities to policyTypesMap
81+
x [L10n] Updated de, fr, tr, ru, zh_CN
82+
83+
v 11.4.35rc3
84+
============================================================
85+
x Gracefully handle new capabilities still unknown to the
86+
settings host (e.g. Tor/Mullvad browser), if any
87+
x Configurable "lazy_load" capability (see
88+
https://github.com/whatwg/html/issues/5250)
89+
x [L10n] Updated fr
90+
91+
v 11.4.35rc2
92+
============================================================
93+
x Prefetch all CSS subresources (1st party included) in
94+
private contexts where both unchecked_css and scripting
95+
capabilities are disabled
96+
x Forcibly neutralize lazy loading attributes when scripting
97+
is disabled
98+
99+
v 11.4.35rc1
100+
============================================================
101+
x [nscl] Restored SyncMessage compatibility with Firefox 78
102+
and below
103+
x [L10n] Updated uk
104+
x Lock nscl version on stable releases
105+
106+
v 11.4.34
107+
============================================================
108+
x [nscl] Work around for
109+
https://bugzilla.mozilla.org/show_bug.cgi?id=1899786
110+
(issue #372)
111+
x [L10n] Updated de, ru, tr
112+
x Synchronize nscl git commits as needed before tagging new
113+
versions
114+
115+
v 11.4.34rc2
116+
============================================================
117+
x [L10n] Updated ru, tr
118+
x [nscl] Work around for
119+
https://bugzilla.mozilla.org/show_bug.cgi?id=1899786
120+
(issue #372)
121+
122+
v 11.4.34rc1
123+
============================================================
124+
x Fix fallback noscript meta-refresh broken by sandbox CSP
125+
directive
126+
127+
v 11.4.33
128+
============================================================
129+
= (placeholder Chrome Store version for 11.4.31 rollback)
130+
131+
v 11.4.32
132+
============================================================
133+
x [L10n] Updated de
134+
x [nscl] Use the sandbox directive in addition to script-src
135+
for CSP-based script blocking
136+
x Syncrhonize nscl git commits as needed before tagging new
137+
versions
138+
139+
v 11.4.31
140+
============================================================
141+
x [L10n] Updated fr, is, ru, zh_CN
142+
x Improved release tooling
143+
x [nscl] Updated to latest NoScript Commons Library
144+
x NoScript Options/Appearance/Show synthetic placeholders
145+
for invisible capability probes (issue #369)
146+
x [nscl] Make placeholders easier to style per type
147+
x Prevent duplicate synthetic placeholders for invisible
148+
capability probes (issue #369)
149+
150+
v 11.4.31rc3
151+
============================================================
152+
x [L10n] Updated zh_CN
153+
x Improved release tooling
154+
x [nscl] Updated to latest NoScript Commons Library
155+
x [L10n] Updated ru
156+
x [L10n] Updated fr, is
157+
158+
v 11.4.31rc2
159+
============================================================
160+
x NoScript Options/Appearance/Show synthetic placeholders
161+
for invisible capability probes (issue #369)
162+
x [nscl] Make placeholders easier to style per type
163+
164+
v 11.4.31rc1
165+
============================================================
166+
x Prevent duplicate synthetic placeholders for invisible
167+
capability probes (issue #369)
168+
169+
v 11.4.30
170+
============================================================
171+
x [nscl] Best effort WebGL placeholders for offscreen
172+
capability detection
173+
x Improved blocked but required capability reporting from
174+
subframes (issue #367)
175+
x [nscl] Include SVG among embedding document types (fixes
176+
issue #366)
177+
x Removed obsolete "applications" manifest.json key
178+
179+
v 11.4.30rc2
180+
============================================================
181+
x [nscl] Best effort WebGL placeholders for offscreen
182+
capability detection
183+
x Improved blocked but required capability reporting from
184+
subframes (issue #367)
185+
x [nscl] Include SVG among embedding document types (fixes
186+
issue #366)
187+
188+
v 11.4.30rc1
189+
============================================================
190+
x Removed obsolete "applications" manifest.json key
191+
6192
v 11.4.29
7193
============================================================
8194
x [nscl] Updated TLDs

‎content/community.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,4 +54,4 @@ Specific NoScript development efforts have been generously supported by the [__
5454

5555
#### Donations
5656
Nevertheless NoScript couldn't keep up with its continuous and strenuous fight against emerging web threats with no help from you, dear user. So, if you find NoScript useful, __please consider a donation__, either via __Paypal__ ([USD]({{links.donate}}?c=USD) / [EUR]({{links.donate}}?c=EUR)) or [by other means]({{ "/faq#faq-donate" | url }}).
57-
You will feel proud of your contribution to a safer web, and prouder your gorgeous [dark NoScript wallpaper](/img/noscript-wallpaper-dark.png).
57+
You will feel proud of your contribution to a safer web, and even prouder of your gorgeous [dark NoScript wallpaper](/img/noscript-wallpaper-dark.png).

‎content/getit.md‎

Lines changed: 78 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -25,21 +25,19 @@ nav: 2
2525
You can get the latest stable version __for Firefox desktop only__ also using this [__direct NoScript {{ ver.stable }} download link__](https://noscript.net/download/releases/noscript-{{ ver.stable }}.xpi).
2626
To install, just drag and drop it onto your address bar.
2727
````{.changelog}
28-
v 11.4.29
28+
v 11.4.37
2929
============================================================
30-
x [nscl] Updated TLDs
31-
x [nscl] Improved reliability of TLD updater
32-
x Removed theme.js console noise
33-
x Fix beta channel updates breakage due to
34-
browser_specific_settings override
35-
x [nscl] Several content-side performance improvements
36-
x Reduce synchronous policy retrieval impact on file: and
37-
ftp: document loading performance
38-
x More commands for which a keyboard shortcut can be
39-
configured
40-
x [L10n] Updated de, fi, mk, nl, pl, ru, sq, tr, uk,
41-
pt_BR, zh_CN, zh_TW
42-
x Explicit Android compatibility declaration
30+
x [nscl] Do not patch windows with WebGLHook if webgl is
31+
globally disabled
32+
x [nscl] Do not patch workers if webgl is globally disabled
33+
x [L10n] Updated uk
34+
x [nscl] Workers-aware WebGL Hook
35+
36+
v 11.4.36
37+
============================================================
38+
x [nscl] Merged MV3-compatible branch
39+
x [XSS] Take in account the whole redirection chain (thanks
40+
NDevTK for reporting)
4341
````
4442
### __Development build__{#devel}
4543

@@ -72,57 +70,95 @@ You're done. Happy testing!
7270

7371
#### Recent development history
7472
````{.changelog}
75-
v 11.4.30rc1
73+
v 11.4.39rc2
74+
============================================================
75+
x [nscl] Prevent patchWindow from throwing on SOP violations
76+
77+
v 11.4.39rc1
78+
============================================================
79+
x [nscl] Correctly propagate extra arguments to shadowed
80+
worker constructors
81+
82+
v 11.4.38rc2
83+
============================================================
84+
x [nscl] Reuse uuid() in SyncMessage
85+
86+
v 11.4.38rc1
87+
============================================================
88+
x Updated file exclusions on packaging
89+
x [nscl] Simpler and safer SyncMessage logic on
90+
Chromium-based browsers (thanks NDevTK for reporting)
91+
x Fixed missing frameId on interception reporting
92+
93+
v 11.4.37rc3
7694
============================================================
77-
x Removed obsolete "applications" manifest.json key
95+
x [nscl] Do not patch windows with WebGLHook if webgl is
96+
globally disabled
7897
79-
v 11.4.29rc5
98+
v 11.4.37rc2
8099
============================================================
81-
x [nscl] Improved reliability of TLD updater
100+
x [nscl] Do not patch workers if webgl is globally disabled
82101
83-
v 11.4.29rc4
102+
v 11.4.37rc1
84103
============================================================
85-
x [nscl] Updated TLDs
86-
x Removed theme.js console noise
104+
x [L10n] Updated uk
105+
x [nscl] Workers-aware WebGL Hook
87106
88-
v 11.4.29rc3
107+
v 11.4.36rc1
89108
============================================================
90-
x Fix beta channel updates breakage due to
91-
browser_specific_settings override
109+
x [nscl] Merged MV3-compatible branch
110+
x [XSS] Take in account the whole redirection chain (thanks
111+
NDevTK for reporting)
92112
93-
v 11.4.29rc2
113+
v 11.4.35rc4
114+
============================================================
115+
x Improved lazy_load capability (optimization and
116+
notification)
117+
x [nscl] Slight optimization of NOSCRIPT element emulation
118+
loop
119+
x Automatically add extra capabilities to policyTypesMap
120+
x [L10n] Updated de, fr, tr, ru, zh_CN
121+
122+
v 11.4.35rc3
94123
============================================================
95-
x [L10n] Updated fi, pt_BR
96-
x [nscl] Several content-side performance improvements
97-
x Reduce synchronous policy retrieval impact on file: and
98-
ftp: document loading performance
99-
x More commands for which a keyboard shortcut can be
100-
configured
101-
102-
v 11.4.29rc1
124+
x Gracefully handle new capabilities still unknown to the
125+
settings host (e.g. Tor/Mullvad browser), if any
126+
x Configurable "lazy_load" capability (see
127+
https://github.com/whatwg/html/issues/5250)
128+
x [L10n] Updated fr
129+
130+
v 11.4.35rc2
131+
============================================================
132+
x Prefetch all CSS subresources (1st party included) in
133+
private contexts where both unchecked_css and scripting
134+
capabilities are disabled
135+
x Forcibly neutralize lazy loading attributes when scripting
136+
is disabled
137+
138+
v 11.4.35rc1
103139
============================================================
104-
x [nscl] Updated TLDs
105-
x [L10n] Updated de, mk, nl, pl, ru, sq, tr, uk, zh_CN,
106-
zh_TW
107-
x Explicit Android compatibility declaration
140+
x [nscl] Restored SyncMessage compatibility with Firefox 78
141+
and below
142+
x [L10n] Updated uk
143+
x Lock nscl version on stable releases
108144
````
109145

110146
### Deprecated, obsolete and unsupported "Classic" versions
111147

112148
[![NoScript Classic Logo](https://classic.noscript.net/noscript/logo.png){.left}](https://classic.noscript.net/)
113149

114-
You can still download [**NoScript "Classic"** (5.1.9)](https://noscript.net/download/releases/noscript-5.1.9.xpi) ([SHA256](releases/noscript-5.1.9.xpi.sha256)) for Seamonkey, Palemoon, Waterfox Classic and possibly other "vintage" (pre-Gecko 57) Firefox forks [here](https://noscript.net/download/releases/noscript-5.1.9.xpi).
150+
You can still download [**NoScript "Classic"** (5.1.9)](https://noscript.net/download/releases/noscript-5.1.9.xpi) ([SHA256](https://noscript.net/download/releases/noscript-5.1.9.xpi.sha256)) for Seamonkey, Palemoon, Waterfox Classic and possibly other "vintage" (pre-Gecko 57) Firefox forks [here](https://noscript.net/download/releases/noscript-5.1.9.xpi).
115151

116152
**Notice:** _you may need to open about:config and set your **xpinstall.signatures.required** preference to **false** in order to install NoScript 5.x, since Mozilla doesn't support signatures for legacy add-ons anymore. If you're [using a non ESR Firefox, you may also need this hack](https://forums.informaction.com/viewtopic.php?p=98662#p98662)._
117153

118154

119155
Users of Firefox 58 and below are urged to upgrade their very unsafe browser. For those few who can't,
120156

121157
* [latest NoScript version compatible with Gecko 57 - Gecko 58 is 10.1.7.3](https://noscript.net/download/releases/noscript-10.1.7.3.xpi);
122-
* [latest NoScript version compatible with Gecko 46 - Gecko 56 is 5.1.9](https://noscript.net/download/releases/noscript-5.1.9.xpi) ([SHA256](releases/noscript-5.1.9.xpi.sha256));
123-
* [latest NoScript version compatible with Gecko 13 - Gecko 45 is 2.9.0.14](https://noscript.net/download/releases/noscript-2.9.0.14.xpi) ([SHA256](releases/noscript-2.9.0.14.xpi.sha256));
124-
* [latest NoScript version compatible with Gecko 1.9 - Gecko 12 is 2.9.0.1rc1](https://noscript.net/download/betas/noscript-2.9.0.1rc1.xpi) ([SHA256](betas/noscript-2.9.0.1rc1.xpi.sha256));
125-
* [latest NoScript version compatible with Gecko < 1.9 is 1.10](https://noscript.net/download/releases/noscript-1.10.xpi) ([SHA256](releases/noscript-1.10.xpi.sha256)).
158+
* [latest NoScript version compatible with Gecko 46 - Gecko 56 is 5.1.9](https://noscript.net/download/releases/noscript-5.1.9.xpi) ([SHA256](https://noscript.net/download/releases/noscript-5.1.9.xpi.sha256));
159+
* [latest NoScript version compatible with Gecko 13 - Gecko 45 is 2.9.0.14](https://noscript.net/download/releases/noscript-2.9.0.14.xpi) ([SHA256](https://noscript.net/download/releases/noscript-2.9.0.14.xpi.sha256));
160+
* [latest NoScript version compatible with Gecko 1.9 - Gecko 12 is 2.9.0.1rc1](https://noscript.net/download/betas/noscript-2.9.0.1rc1.xpi) ([SHA256](https://noscript.net/download/betas/noscript-2.9.0.1rc1.xpi.sha256));
161+
* [latest NoScript version compatible with Gecko < 1.9 is 1.10](https://noscript.net/download/releases/noscript-1.10.xpi) ([SHA256](https://noscript.net/download/releases/noscript-1.10.xpi.sha256)).
126162

127163
#### Disclaimer
128164
We cannot update nor support NoScript 5.x and below anymore, because it was based on a completely different and now obsolete technology. However you can still find usage information and a FAQ section for those ancient versions in the [NoScript Classic archived website](https://classic.noscript.net/).

‎content/usage.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ Even though this is not recommended, power users may customize also the built-in
6060
#### LAN Protection{.subh}
6161

6262
Simply put, the LAN capability lets documents coming from the public Internet (AKA World Area Network / WAN) to link / send requests to hosts inside your Local Area Network (LAN), which is pretty much what they can do now, allowing so called cross-zone CSRF/XSS attacks.
63-
By keeping it disabled (the factory setting in the DEFAULT and UNTRUSTED presets), you're replicating this feature from "Classic" NoScript, without the hassle of going through ABE's firewall-like rules when you need to set an exception, which now is just a matter of checking the LAN capability box.
63+
By keeping it disabled (the factory setting in the DEFAULT and UNTRUSTED presets), you're replicating [the Application Boundaries Enforcer feature](https://classic.noscript.net/abe/index.html) from "Classic" NoScript, without the hassle of going through ABE's firewall-like rules when you need to set an exception, which now is just a matter of checking the LAN capability box.
6464

6565
### Per-site preferences editor
6666
{% screenshot "per-site-prefs", "Configuring per-site permissions (light scheme)" %}

0 commit comments

Comments
 (0)