by Giorgio Maone
Main good news:
- Improved compatibility with Facebook Connect and Lycos Mail.
- Enhanced bookmarklet support.
- Better compatibility with Google Translate, Abine and Travelocity.
- Improved embedding reload policies.
- Revamped Embedding (previously known as "Plugins") features, including WebFont blocking and smarter reloadig policies.
- NoScript Options|Embeddings|Forbid <VIDEO> / <AUDIO> preference to control HTML 5 media blocking.
- NoScript Options|Embeddings|Forbid @font-face preference to control WebFont blocking.
- Improved Google Analytics surrogate script, handling form submissions.
- X-Frame-Options default exception for https://mail.google.com/* as a parent, to allow GreaseMonkey scripts and extensions like Integrated GMail to embed Google Calendar inside the GMail inbox.
- Improved bookmarklet emulation, supporting complex asynchronous remote imports.
- Better control over X-Frame-Options: now it can be disabled either globally or per-site, by setting the noscript.frameOptions.enabled and the noscript.frameOptions.parentWhitelist about:config preferences, e.g. for allowing seamless Google Calendar integration.
- Several XSS injection checker enhancements.
- Strict Transport Security support.
- First public Strict Transport Security implementation.
- Surrogate script for Quantserve.
- Improved XSS injection checker algorithms.
- Better compatibility with most recent Flash activation frameworks.
- Enhanced bookmarklet support.
- New: Recently blocked sites menu helps detecting active content sources which have been blocked but don't belong to the current page (e.g. those imported by extensions such as Ubiquity or Cooliris).
- Better integration with the "Private Browsing" Firefox features: when exiting private browsing, both recently blocked sites and temporary permissions are "forgotten".
- Improved protection against DOS attacks.
- Several accuracy and speed optimizations in the XSS injection checker engine.
- Complete HTML 5 media (audio and video) blocking on untrusted sites.
- New layer of inclusion protection, checks whether 3rd party script and CSS files are served with proper content type.
- Enhanced JAR abuse protection (thanks .mario for RFE).
- Improved ABE Click to view attachment rules syntax, now supporting raw IPs and subnets in address prefix/mask form.
- New option to turn off ABE notifications (in NoScript Options|Notifications).
- Click to view attachmentABE (Application Boundary Enforcer) module providing protection against CSRF attacks.
- Protection against internet to intranet attacks (e.g. router hacking from the web) thanks to the built-in SYSTEM ABE rule.
- Improved JavaScript form submission emulation.
- Enhanced and augmented Surrogate Scripts.
- New Import/Export buttons in the NoScript Options dialog, backup the whole NoScript configuration in a single JSON file, as a disconnected alternative to the Weave/XMark synchronization functionality(Fx 3 and above).
- NoScript now blocks by default also HTML 5 <video> and <audio> content from untrusted origins like it does for plugins, to prevent malicious sites from exploiting media codec vulnerabilities.
- Greatly improved bookmarklet support on untrusted pages, trying to turn setTimeout() calls into synchronous ones and to execute trusted imported scripts (e.g. in the Readability bookmarklet).
- Enhanced HTTPS enforcement engine, correctly loading redirected images no matter their caching status and displaying a meaningful error message when causing a redirect loop.
- Several speed, usability and stability improvements in the new NoScript preferences synchronization feature.
- ClearClick ClickJacking protection compatibility with Feedly, Disqus and Sharethis.
- Better Firefox 3.5 beta and Firefox 3.6 alpha support.
- Experimental Backup NoScript configuration in a bookmark for easy synchronization feature, to be enabled in NoScript Options|General.
It allows replicating NoScript preferences and permissions across multiple computers using a bookmark syncrhonization service such as Mozilla Weave or the XMarks extension. - New "partially allowed subcontent" icon Click to view attachment to indicate that the top site is blocked but some active sub-content (e.g. plugin objects or frames) is enabled.
- NoScript now reports "Scripts Forbidden" instead of "Scripts Partially Forbidden" even if 3rd party script sources are allowed, unless they can actually run because their hosting document is allowed as well.
- ClearClick ClickJacking protection compatibility with the ShareThis extension.
- Protection against exploitation of XSLT vulnerabilities like the one fixed in Firefox 3.0.8
- Better compatibility with the Google Notebook extension and with the new Flash-based GMail attachment system.
- New dedicated support forum.
- Fixed Amazon glitch with blocked IFrame placeholders.
- Improved HTTPS forcing engine, now capable of forcing HTTPS on background subrequests as well.
- Fennec 1.0b1 compatibility.
- Yieldmanager script surrogate (makes imageshack.us and other sites work with no need for whitelisting yieldmanager.com).
- Performance boost of ClearClick ClickJacking protection on very crowded documents.
- ClearClick incident reporting tool.
- Improved script blocking and scriptless pages management.
- Improved X-FRAME-OPTIONS compatibility support.
- New exclusive protection against JSON and E4X hijacking.
- Improved compatibility with some Amazon, Smugmug and Ebay features.
- Anti-XSS filters performance optimizations.
- Support for the Fennec Alpha 2 mobile browser.
- Several improvements in blacklisting mode: even if whitelisting is still the recommended safest mode, you can use Allow scripts globally and still block sites you mark as untrusted. More important, you can still enjoy full Anti-XSS protection or be protected against ClickJacking and JSON hijacking even while you're keeping JavaScript allowed everywhere.
Supported browsers: Firefox 1.5.0.6 and above, SeaMonkey 1.0.5 and above, Flock, IceWeasel, Minefield
Other browsers based on Gecko 1.8.0.6 and above might work, but are not tested.
NoScript: get it!
New! Dedicated Support Forum.