Issue with 12.0.5 and 12.0.6 (breaking sites)

[l-404-l]

When loading NoScript for example watching on twitch.tv my notifications will stop loading. The only fix is to uninstall the extention.

[hackademix]

Thank you for your report.

• Which notifications?
• Which sites have you set as TRUSTED?
• Could you provide me with your NoScript Options>Export file?

[l-404-l]

Like the go live notifications or the channel point things don't work.

With or without temp trust / trusting everything on twitch's site

[hackademix]

Is that still broken on 12.0.8?

If so, which browser (and Chromium version) are you using exactly?

[l-404-l]

Yes, just makes the notifications like load forever

[nc-Brandon]

I can confirm this as well. You can't even log in to Twitch with the extension enabled. It doesn't matter what scripts you allow, or even if you disable for the entire tab; it's still doing some kind of checks causing errors with GraphQL and other javascript on the page. Twitch is far from the only site I've seen these same errors in the console for even after white listing.

Almost every one of these errors contains: Content Security Policy directive: "script-src-elem 'none'".

These errors disappear only after completely disabling the extension in the browser.

[hackademix]

@l-404-l & @nc-Brandon again, area you using Chrome (which version?) or another browser?

It's quite important to know, since it seems there are implementation differences and bugs in the Manifest V3 APIs across different browsers, even if Chromium-based.

[nc-Brandon]

@hackademix I am using the latest version of Brave.

I have the same problems on a Windows machine and a Linux machine (flatpak), if any of that is relevant.

[Uj947nXmRqV2nRaWshKtHzTvckUUpD]

12.08 breaking most websites on latest brave Version 1.73.97 Chromium: 131.0.6778.108 (Official Build) (64-bit)

[mcmurtryz1]

I have also been experiencing this. I am on version 7.0.3495.26 (latest) of vivaldi. I manually rolled back to 12.04, and at least for right now, it appears to be working. I exported my sites and imported them into the rolled back version with no changes, so in my case the trusted sites also do not seem to be the culprit here.

[hackademix]

Everybody, does NoScript 12.0.901 help?

Thank you!

[mcmurtryz1]

I did some more experimenting and realized I was actually incorrect. 12.0 and up do not work. I tried every version including 12.0.901.
Testing methodology:
Close any open private windows
Enable extension version to test and allow incognito
Open twitch in new private window and try to login
Repeat

Something interesting though is that if I first open twitch with either 11.X noscript or no noscript at all then switch to 12.X noscript, it keeps working. Even if I clear all site data, it keeps working. It only stops working once I clear all site data and third-party cookies at the same time.

Also interestingly, the reverse way does not seem to be true at least instantly. If I start with 12.X then remove it and refresh, it doesn't suddenly work even if I clear all site data and 3rd party cookies. I really have no idea why that might be the case. I thought it might have been some sort of integrity check, but even intercepting and replacing the integrity token value with a 100% working one did not seem to make the /protected_login call work. Genuinely stumped on why this might be occurring.

Edit
I tested the latest Vivaldi, Edge, Chrome, and Opera versions. They all exhibited this issue with version 12.X.