Inside a web page I have the following snippet:
<html>
<head>
<META http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<base href="https://XXXXX /">
<title>Example</title>
<link href="Layout/standard.css" type="text/css" title="Example" rel="stylesheet">
</head>
<body>
The referenced page standard.css looks like this:
@import url( "standard2.css" );
@import url( "standard3.css" );
After upgrading the noscript plugin (version 2.4.3) within Firfefox ESR 10.0.4 the css pages standard2.css and standard3.css are not loaded anymore. With an earlier version of noscript everything worked as expected.
Why is noscript blocking this? Is there a known security problem importing a css from within another css? Or is it simply a bug in noscript?
Update: The problem is not the cascaded import. The problem is that I used a short URL (https://hostname/...). If I use a fully qualified URL (https://hostname.mynet.com/...) everything is working.
So it really looks like a bug in noscript 2.4.3.
The NoScript changelog doesn't mention any changes to this, so it's probably a bug.