STR: 1. Install NoScript. 2. Visit some RSS feed, e.g.: one of these: http://leoville.tv/podcasts/sn.xml http://www.feedforall.com/sample.xml ACTUAL RESULTS: The page just loads a blank RSS feed view, with some buttons and checkboxes at the top. It doesn't help if I tell NoScript to whitelist the domain, either. There is no way to make it do anything useful unless I tell NoScript to "Allow Scripts Globally (dangerous)". EXPECTED RESULTS: The page should load the full RSS feed view, as it did before. There are no scripts involved here; just the browser running some of its own scripts for presentation, I think. Regression range: https://hg.mozilla.org/integration/fx-team/pushloghtml?fromchange=9a8ff2f4978493c3fd9982652a09ffcdf2333a75&tochange=d4b74afcc60b937f25d54f365be46a8133980209 --> Regression from bug 1253673. I'm tentatively assuming that this is a case where NoScript needs to whitelist some "about:" page, though I'm not sure. (Hence: starting this out as a Tech Evang bug.) This might be a bug in the csets that landed too -- if so, we can reclassify.

I'm hitting this in today's Nightly, btw -- Nightly 49.0a1 (2016-05-11) -- back to the regression range in comment 0. I'm using NoScript 2.9.0.11rc1 (from the "development build" link on https://noscript.net/getit ). I assume this affects earlier NoScript versions as well, though.

There don't seem to be any errors in the console when this happens, which is odd because there are normally some. Looking in the noscript source code as listed on AMO, I don't see any about: pages except the one defined in https://mxr.mozilla.org/addons/source/722/3.5a13/modules/NSA.jsm which doesn't seem to be safe for content anyway (so wouldn't (shouldn't?) have been affected by bug 1253673). Giorgio, can you take a look? The summary of the changes in bug 1253673 basically boils down to "even URI_SAFE_FOR_UNTRUSTED_CONTENT about: pages are now going to not be linkable from content"...

Another test. https://noscript.net/feed?c=200&t=a Should show the 200 most recent versions of NoScript (all versions including rc versions). I tested with these 4 versions of Firefox today (2016-07-02). Release and ESR are OK. In Aurora and Nightly 'feeds / RSS are broken'. Expected Result: "NoScript Updates Recent all builds from noscript.net" followed by 200 versions of NoScript. Actual Result: In the 'broken case' you see the "Subscribe Now" button (at the top of the page) but you do not see the "NoScript Updates Recent all builds from noscript.net" You do NOT see any 'versions of NoScript' in a long list below. In all 4 tests, using NoScript 2.9.0.12rc1 (20 May 2016), on separate Profiles. "about:blank" is included in the 'NoScript Whitelist' for each Profile. e10s, "Multiprocess Windows" is off on all these Profiles. Using "about:support" to document versions of Firefox. Release 32 bit, on Windows is OK. Name Firefox Version 47.0.1 Build ID 20160623154057 Update Channel release User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0 ESR 32 bit, on Windows is OK. Name Firefox Version 45.2.0 Build ID 20160601155443 Update Channel esr User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0 Aurora 32bit, on Windows 'feeds / RSS are broken'. Name Firefox Version 49.0a2 Build ID 20160701004039 Update Channel aurora User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; rv:49.0) Gecko/20100101 Firefox/49.0 Nightly 64bit, on Windows 'feeds / RSS are broken'. Name Firefox Version 50.0a1 Build ID 20160701030235 Update Channel nightly User Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:50.0) Gecko/20100101 Firefox/50.0 DJ-Leith

This issue raised in NoScript forum at RSS feed reader broken in Nightly (49.x and 50.x) https://forums.informaction.com/viewtopic.php?f=10&t=21969 No smoking gun in NoScript forum thread as yet.

Looks like allowing "about:feed" suffices to "fix" this issue. I'm adding it to noscript.mandatory in next release.

Fixed in NoScript 2.9.0.12rc2, thank you. https://noscript.net/getit#devel