View source for NoScript

{{Short description|Extension for Mozilla- and Chromium-based web browsers}}
{{For|the <noscript> HTML element|HTML element#Other block elements}}
{{Infobox software
| name = NoScript
| logo = File:NoScript.svg
| logo size = 80px
| logo alt = NoScript icon
| logo caption = Logo used since November 2022
| screenshot =
| screenshot size = 252px
| screenshot alt = NoScript screenshot
| caption = NoScript extension icon and main menu
| author = Giorgio Maone
| released = {{Start date and age|2005|05|13}}<ref name="a.m.o_initial_release">{{Cite web |title=Version 1.0 |work=NoScript |publisher=Mozilla Addons |date=2005-05-13 |url=https://addons.mozilla.org/en-US/firefox/addon/noscript/versions/?page=15#version-1.0.1 |url-status=dead |archive-url= https://web.archive.org/web/20181002111532/https://addons.mozilla.org/en-US/firefox/addon/noscript/versions/?page=15#version-1.0.1 |archive-date=2018-10-02}}<!--
• The #version-1.0.1 anchor takes to the bottom of the page, where version 1.0 is then also visible on the Internet Archive. • If the #version-1.0 anchor is used, then Version 1.0 information stays behind the Internet Archive Wayback Machine UI. • Please do not change the archiveurl to a newer one, because the new and current version of the Mozilla Addons layout depends on JavaScript and fails to render properly.--></ref>
| latest release version = {{wikidata|property|reference|P348}}
| latest release date = {{start date and age|{{wikidata|qualifier|P348|P577}}}}
| latest preview version = 11.5.3rc1
| latest preview date = {{Start date and age|2024|11|11|df=yes}}
| developer = [https://maone.net/ Giorgio Maone]
| programming language = [[JavaScript]], [[XUL]], [[Cascading Style Sheets|CSS]]
| genre = [[Browser extension]]
| license = [[GNU General Public License|GPLv2+]]
| website = {{URL|https://noscript.net/|NoScript.net}}
| language count = 45<ref>[https://noscript.net/features#lang Supported language] on noscript.net.</ref>
| repo = https://github.com/hackademix/noscript
}}
'''NoScript''' (or '''NoScript Security Suite''') is a [[Free and open-source software|free and open-source]] [[Browser extension|extension]] for  [[Firefox]]- and [[Chromium (web browser)|Chromium]]-based web browsers,<ref name="chrome-announcement">{{cite web |url= https://www.zdnet.com/article/noscript-extension-officially-released-for-google-chrome/ |title=NoScript Extension Officially Released for Google Chrome|publisher=[[ZDNet]]|access-date=2019-04-12}}</ref> written and maintained by Giorgio Maone,<ref name="noscript-developer">{{cite web |url= https://addons.mozilla.org/en-US/firefox/addon/noscript/developers |title=Meet the NoScript Developer |publisher=Mozilla |access-date=2011-09-27 |url-status=dead |archive-url= https://web.archive.org/web/20111009040345/https://addons.mozilla.org/en-US/firefox/addon/noscript/developers |archive-date=2011-10-09}}</ref> a software developer and member of the Mozilla Security Group.<ref name="mozilla-sec-group">{{cite web |url=https://www.mozilla.org/projects/security/secgrouplist.html |title=Mozilla Security Group |publisher=[[Mozilla]] |access-date=2011-06-29 |url-status=dead |archive-url= https://web.archive.org/web/20110629162354/http://www.mozilla.org/projects/security/secgrouplist.html |archive-date=June 29, 2011}}</ref>
==Features==
[[File:NoScript screenshot.png|thumb|right|The classic NoScript menu in Firefox]]
===Active content blocking===
By default, NoScript blocks active (executable) web content, which can be wholly or partially unblocked by allowlisting a site or domain from the extension's toolbar menu or by clicking a placeholder icon.
In the default configuration, active content is globally denied, although the user may turn this around and use NoScript to block specific unwanted content. The allowlist may be permanent or temporary (until the browser closes or the user revokes permissions). Active content may consist of [[JavaScript]], web fonts, media [[codec]]s, [[WebGL]], and [[Adobe Flash|Flash]]. The add-on also offers specific countermeasures against security exploits.<ref name="about.com">{{cite web |url=http://browsers.about.com/od/48/gr/noscript.htm |title=NoScript |author=Scott Orgera |publisher=About.com |access-date=2010-11-27 |archive-date=2010-12-20 |archive-url=https://web.archive.org/web/20101220060900/http://browsers.about.com/od/48/gr/noscript.htm |url-status=dead }}</ref>
Because many web browser attacks require active content that the browser normally runs without question, disabling such content by default and using it only to the degree that it is necessary reduces the chances of vulnerability exploitation. In addition, not loading this content saves significant bandwidth<ref>{{Cite web|title=The effect of Firefox addons on bandwidth consumption :: IANIX|url=https://ianix.com/pub/firefox-addons-and-bandwidth-consumption.html|access-date=2020-07-14|website=ianix.com}}</ref> and defeats some forms of web tracking.
NoScript is useful for developers to see how well their site works with JavaScript turned off. It also can remove many irritating web elements, such as in-page pop-up messages and certain [[paywall]]s, which require JavaScript in order to function.
NoScript takes the form of a [[toolbar]] icon or [[status bar]] icon in Firefox. It displays on every website to denote whether NoScript has either blocked, allowed, or partially allowed scripts to run on the web page being viewed. Clicking or hovering (since version 2.0.3rc1<ref>{{cite web |title=NoScript Changelog 2.0.3rc1 |url=https://noscript.net/changelog#2.0.3rc1 |publisher=noscript.net |access-date=16 March 2011}}</ref>) the mouse cursor on the NoScript icon gives the user the option to allow or forbid the script's processing.
NoScript's interface, whether accessed by right-clicking on the web page or the distinctive NoScript box at the bottom of the page (by default), shows the URL of the script(s) that are blocked, but does not provide any sort of reference to look up whether or not a given script is safe to run.<ref>{{cite news |last1=Brinkman |first1=Martin |title=The Firefox NoScript guide you have all been waiting for |url= http://www.ghacks.net/2014/02/10/firefox-noscript-guide-waiting/ |website=GHacks.net |access-date=14 January 2017 |date=February 10, 2014}}</ref> With complex webpages, users may be faced with well over a dozen different cryptic URLs and a non-functioning webpage, with only the choice to allow the script, block the script or to allow it temporarily.
On November 14, 2017, Giorgio Maone announced NoScript 10, which will be "very different" from 5.x versions, and will use WebExtension technology, making it compatible with [[Firefox 57|Firefox Quantum]].<ref>{{cite web |url=https://hackademix.net/2017/11/14/double-noscript/ |title=Double NoScript|author=Giorgio Maone |date=2017-11-14 |publisher=Hackademix.net |access-date=2017-11-15}}</ref> On November 20, 2017, Maone released version 10.1.1 for Firefox 57 and above. NoScript is available for Firefox for Android.<ref>{{Cite web|url=https://github.com/hackademix/noscript/pull/28|title=Cosmetic Changes by Issa1553 · Pull Request #28 · hackademix/noscript|website=GitHub|language=en|access-date=2019-01-04}}</ref>
===Anti-XSS protection===
On April 11, 2007, NoScript 1.1.4.7 was publicly released,<ref>[https://addons.mozilla.org/en-US/firefox/addon/noscript/versions/1.1.4.7 NoScript's first Anti-XSS release ''Mozilla Add-ons'']</ref> introducing the first client-side protection against Type 0 and Type 1 [[cross-site scripting]] (XSS) ever delivered in a web browser.
Whenever a website tries to inject HTML or JavaScript code inside a different site (a violation of the [[same-origin policy]]), NoScript filters the malicious request and neutralizes its dangerous payload.<ref>[https://noscript.net/features#xss NoScript Features-Anti-XSS protection] ''NoScript.net''. Retrieved April 22, 2008.</ref>
Similar features have been adopted years later by [[Internet Explorer 8|Microsoft Internet&nbsp;Explorer&nbsp;8]]<ref>{{cite web|url=http://zdnet.com/blog/security/noscript-vs-internet-explorer-8-filters/1421|archive-url=https://web.archive.org/web/20100511182201/http://www.zdnet.com/blog/security/noscript-vs-internet-explorer-8-filters/1421|url-status=dead|archive-date=May 11, 2010|title=NoScript vs Internet Explorer 8 Filters|author=Nathan Mc Fethers|date=2008-07-03|publisher=ZDNet|access-date=2010-11-27}}</ref> and by [[Google Chrome]].<ref>{{cite web|url=https://blog.chromium.org/2010/01/security-in-depth-new-security-features.html|title=Security in Depth: New Security Features|author=Adam Barth|date=2010-01-26| publisher=Google|access-date=2010-11-27}}</ref>
===Application Boundaries Enforcer (ABE)===
The Application Boundaries Enforcer (ABE) is a built-in NoScript module meant to harden the [[web application]]-oriented protections already provided by NoScript, by delivering a firewall-like component running inside the browser.
This "firewall" is specialized in defining and guarding the boundaries of each sensitive web application relevant to the user (e.g., plug-ins, webmail, online banking, and so on), according to policies defined directly by the user, the web developer/administrator, or a trusted third party.<ref>{{cite web |url=https://noscript.net/abe |title=Application Boundaries Enforcer (ABE) |author=Giorgio Maone |publisher=NoScript.net |access-date=2010-08-02}}</ref> In its default configuration, NoScript's ABE provides protection against [[Cross-site request forgery|CSRF]] and [[DNS rebinding]] attacks aimed at intranet resources, such as routers and sensitive web applications.<ref>{{cite web |url=https://hackademix.net/2010/07/28/abe-patrols-the-routes-to-your-routers/ |title=ABE Patrols Routes to Your Routers |author=Giorgio Maone |date=2010-07-28 |publisher=Hackademix.net |access-date=2010-08-02}}</ref>
===ClearClick (anti-clickjacking)===
NoScript's ClearClick feature,<ref>{{Cite web|url=https://noscript.net/faq#clearclick|title = NoScript - JavaScript/Java/Flash blocker for a safer Firefox experience! - faq - InformAction}}</ref> released on October 8, 2008, prevents users from clicking on invisible or "redressed" page elements of embedded documents or applets, defeating all types of [[clickjacking]] (i.e., from frames and plug-ins).<ref>{{cite web|url=https://hackademix.net/2008/10/08/hello-clearclick-goodbye-clickjacking/|title=Hello ClearClick, Goodbye Clickjacking|author=Giorgio Maone|date=2008-10-08|publisher=Hackademix.net|access-date=2008-10-27}}</ref>
This makes NoScript "the only freely available product which offers a reasonable degree of protection against clickjacking attacks."<ref name="Zalewski">{{cite web|url=https://code.google.com/p/browsersec/wiki/Part2#Arbitrary_page_mashups_(UI_redressing)|title=Browser Security Handbook, Part 2, UI Redressing|author=Michal Zalewski|date=2008-12-10|publisher=Google Inc.|access-date=2008-10-27}}</ref>
===HTTPS enhancements===
NoScript can force the browser to always use [[HTTP Secure|HTTPS]] when establishing connections to some sensitive sites, in order to prevent man-in-the-middle attacks. This behavior can be triggered either by the websites themselves, by sending the [[HTTP Strict Transport Security|Strict Transport Security]] header, or configured by users for those websites that don't support Strict Transport Security yet.<ref>[https://noscript.net/faq#https NoScript FAQ: HTTPS] ''NoScript.net''. Retrieved August 2, 2010.</ref>
NoScript's HTTPS enhancement features have been used by the [[Electronic Frontier Foundation]] as the basis of its [[HTTPS Everywhere]] add-on.<ref>[https://eff.org/https-everywhere/ HTTPS Everywhere]</ref>
==Awards==
* [[PC World (magazine)|PC World]] chose NoScript as one of the 100 Best Products of 2006.<ref>[http://pcworld.com/article/125706-14/the_100_best_products_of_2006.html PC World Award] {{Webarchive|url=https://web.archive.org/web/20110828015914/http://www.pcworld.com/article/125706-14/the_100_best_products_of_2006.html |date=2011-08-28 }} ''pcworld.com''. Retrieved April 22, 2008.</ref>
* In 2008, NoScript won [[About.com]]'s "Best Security Add-On" editorial award.<ref>[http://browsers.about.com/od/allaboutwebbrowsers/a/bestsecurityff.htm About.com 2008 Best Security Add-On Award] {{Webarchive|url=https://web.archive.org/web/20110323055756/http://browsers.about.com/od/allaboutwebbrowsers/a/bestsecurityff.htm |date=2011-03-23 }} ''about.com''. Retrieved August 2, 2010.</ref>
* In 2010, NoScript was "The Reader's Choice Awards" winner in the "Best Privacy/Security Add-On" category at [[About.com]].<ref>[http://browsers.about.com/od/allaboutwebbrowsers/ss/2010-readers-choice-awards-web-browsers-winners_5.htm Best Privacy/Security Add-On 2010] {{Webarchive|url=https://web.archive.org/web/20100304054954/http://browsers.about.com/od/allaboutwebbrowsers/ss/2010-readers-choice-awards-web-browsers-winners_5.htm |date=2010-03-04 }} ''about.com''. Retrieved August 2, 2010.</ref>
* In 2011, for the second year in a row, NoScript was "The Reader's Choice Awards" winner in the "Best Privacy/Security Add-On" category at [[About.com]].<ref>[http://browsers.about.com/od/allaboutwebbrowsers/ss/2011-Readers-Choice-Awards-Winners-Web-Browsers_6.htm Best Privacy/Security Add-On 2011] {{Webarchive|url=https://web.archive.org/web/20110317064904/http://browsers.about.com/od/allaboutwebbrowsers/ss/2011-Readers-Choice-Awards-Winners-Web-Browsers_6.htm |date=2011-03-17 }} ''about.com''. Retrieved March 20, 2011.</ref>
* NoScript was the 2011 (first edition) winner of the Dragon Research Group's "Security Innovation Grant". This award is given to the most innovative project in the area of information security, as judged by an independent committee.<ref>[http://dragonresearchgroup.org/2011/07/18/ Security Innovation Grant Winner Announcement] {{Webarchive|url=https://web.archive.org/web/20150212211829/http://dragonresearchgroup.org/2011/07/18/ |date=2015-02-12 }} ''Dragon Research Group''. Retrieved July 17, 2011.</ref>
== Conflicts ==
===Conflict with Adblock Plus===
In May 2009, it was reported that an "extension war" had broken out between NoScript's developer, Giorgio Maone, and the developers of the Firefox ad-blocking extension [[Adblock Plus]] after Maone released a version of NoScript that circumvented a block enabled by an AdBlock Plus filter.<ref name=register_extension_wars>{{cite web|last=Goodin|first=Dan|title=Firefox users caught in crossfire of warring add-ons|url=http://theregister.co.uk/2009/05/04/firefox_extension_wars/|work=The Register|access-date=19 May 2013}}</ref><ref name=ajaxian_extension_wars>{{cite web|title=Extension wars – NoScript vs. AdblockPlus|url=http://ajaxian.com/archives/extension-wars-noscript-vs-adblockplus|work=Ajaxian|access-date=19 May 2013}}</ref> The code implementing this workaround was "camouflaged"<ref name="register_extension_wars" /> to avoid detection. Maone stated that he had implemented it in response to a filter that blocked his own website. After mounting criticism and a declaration by the administrators of the [[Mozilla Add-ons]] site that the site would change its guidelines regarding add-on modifications,<ref>{{cite web|title = No Surprises|url = https://blog.mozilla.com/addons/2009/05/01/no-surprises/|date = 2009-05-01}}</ref> Maone removed the code and issued a full apology.<ref name="register_extension_wars" /><ref>[https://hackademix.net/2009/05/04/dear-adblock-plus-and-noscript-users-dear-mozilla-community/ Dear Adblock Plus and NoScript Users, Dear Mozilla Community]</ref>
=== Conflict with Ghostery ===
In the immediate aftermath of the Adblock Plus incident,<ref name=purplebox>[https://archive.today/20130629095300/http://purplebox.ghostery.com/?p=103180001 Attention all NoScript users]</ref> a spat arose between Maone and the developers of the [[Ghostery]] add-on after Maone implemented a change on his website that disabled the notification Ghostery used to report [[web bug|web tracking software]].<ref>{{Cite web|url=http://yardley.ca/2009/05/04/when-blockers-block-the-blockers/|title=When blockers block the blockers|archive-url=https://web.archive.org/web/20090508023124/http://yardley.ca/2009/05/04/when-blockers-block-the-blockers/ |archive-date=2009-05-08|work=yardlay.ca|author=Greg Yardley|date=2009-05-04}}</ref> This was interpreted as an attempt to "prevent Ghostery from reporting on trackers and ad networks on NoScript's websites".<ref name=purplebox /> In response, Maone stated that the change was made because Ghostery's notification obscured the donation button on the NoScript site.<ref>[https://forums.informaction.com/viewtopic.php?p=3704#p3704 NoScript support forum] "Re: Latest NoScript version (1.9.2) breaks Adblock Plus", comment #3704, Giorgio Maone (2009-05-04)</ref> This conflict was resolved when Maone changed his site's CSS to move—rather than disable—the Ghostery notification.<ref name="comment3935">[https://forums.informaction.com/viewtopic.php?p=3935#p3935 NoScript support forum] "Re: Additional steps to regain and retain user trust", comment #3935, Giorgio Maone (2009-05-06)</ref>
==See also==
{{Portal|Free and open-source software|Internet
}}
<!-- Please keep entries in alphabetical order & add a short description [[WP:SEEALSO]] -->
{{div col|colwidth=20em}}
* [[Content Security Policy]]
* [[Flashblock]]
* [[Framekiller]]
* [[GNU LibreJS]]
* [[HTTP Switchboard]]
* [[uBlock Origin]]
{{div col end}}
<!-- please keep entries in alphabetical order -->
== References ==
{{Reflist|30em}}
==External links==
* {{Official website|https://noscript.net/}}
* [https://addons.mozilla.org/en-US/firefox/addon/noscript/ NoScript at addons.mozilla.org]
* [https://noscript.net/nsa NoScript Anywhere] (3.5<abbr title="alpha">a</abbr>15) for [[Firefox for Mobile|Firefox for Android]]
* [https://web.archive.org/web/20160923062558/http://en.flossmanuals.net/bypassing-censorship/ch017_noscript/ NoScript presentation] in [http://howtobypassinternetcensorship.org/ ''How to Bypass Internet Censorship''], a [[Free and open source software|FLOSS]] Manual, 10 March 2011, 240 pp.
{{DEFAULTSORT:Noscript}}
[[Category:Free security software]]
[[Category:Free Firefox WebExtensions]]