How to allow a script to run on a single domain with NoScript?

Question

Some forums allow direct embedding of YouTube videos, and this is slowing down my browsing a lot when a user posts several videos in a single post. I want to allow scripts from YouTube only on youtube.com, not anywhere else.

I also want to disable social network tracking so that scripts from sites like Facebook are only allowed on their home domain. How do I set up a blacklist with exceptions or a whitelist with conditions?

Solution

You'll have to use a feature the noscript author calls 'ABE', accessible through noscript options->advanced->ABE

the syntax looks something like this:

# comment
# .example.com includes example.com and subdomains of example.com
# example.com includes example.com but excludes its subdomains

#Allow akamaihd scripts and objects to be included only from select hosts
Site .akamaihd.net
Accept from .twitter.com
Deny INCLUSION(SCRIPT, OBJ, SUBDOC)

Site .akamai.net
Accept from github.com
Deny INCLUSION(SCRIPT, OBJ, SUBDOC)

Site .googleusercontent.com
Accept from .picasaweb.google.com .translate.google.com
Deny INCLUSION(SCRIPT, OBJ, SUBDOC)

In your case, you might need something like:

Site .youtube.com .ytimg.com
Accept from .youtube.com
Deny INCLUSION(SCRIPT, OBJ, SUBDOC)

If you also want to enable Youtube's comments and other social features, you will need:

Site .google.com .googleapis.com .youtube.com .ytimg.com
Accept from .youtube.com
Deny INCLUSION(SCRIPT, OBJ, SUBDOC)

For more information, see the Noscript:ABE documentation at:

• http://noscript.net/abe/
• http://noscript.net/abe/abe_rules.pdf

Comments

[user]

You can also switch to uMatrix, it's more flexible: you'll be able to do what you want here and also other things, like managing cookies in the same way as scripts or allowing JavaScript but not XHR (dynamic requests after page load).