I want to allow "blocked objects", including fonts, for certain sites with the NoScript FireFox plugin.

I understand why NoScript blocks fonts, but for a few trusted websites I want to allow them nonetheless.

I read how to allow script from one domain only and how to enable some particular scripts besides the ABE manual. But I cannot make it work. Here a few ABE rules I've tried for Toggl:

Site .gstatic.com .bootstrapcdn.com
Accept from .toggl.com

Site fonts.gstatic.com maxcdn.bootstrapcdn.com
Accept INCLUSION(SCRIPT, OBJ, CSS) from .toggl.com

Site fonts.gstatic.com maxcdn.bootstrapcdn.com
Accept from .toggl.com

Neither of these rule sets will allow font inclusion for Toggl, however. Do you see where I'm going wrong?

(NoScript on FireFox 34.0.5)


the noscript site states:

For example, setting the noscript.allowedMimeRegExp preference value to

  • FRAME@https?://somesite\.com
  • FONT@https?://some-other-site\.com
  • WebGL@https://www\.khronos\.org

will permanently allow any FRAME/IFRAME load from somesite.com, web fonts from some-other-site.com and WebGL 3D content from https://www.khronos.org.

I don't think the ABE can do it. One hacky way to enable the font only for a particular site/domain is to use Vimperator/Pentadactyl and change the MimeRegExp setting automatically on a LocationChange event. To revert the setting when leaving the page, you could use this simple function (got it from Anekos) in .vimperatorrc that uses an expression with a negative lookahead:

js <<EOM
function add_AutoCommand(URI, onEnter, onLeave) {
    let entered = false;
    autocommands.add('LocationChange', '(?!' + URI + ')', function () {
      if (entered) {
        entered = false;
    autocommands.add('LocationChange', URI, function () {
        entered = true;
    :set! noscript.allowedMimeRegExp="FONT@https?://some-other-site\.com", 
    :set! noscript.allowedMimeRegExp=" "

I haven't tested this but I will.

EDIT: it should be


...but noscript doesn't pick up on the preference unless the page is reloaded, so either manually reload or use tabs.reload(config.browser.mCurrentTab, false);

It seems that you should set a boolean and a timeout to prevent LocationChange to execute (thus, looping) the reload again. Perhaps another autocmd on the PageLoadPre event might be used for the boolean. This is getting quite ugly I know. Sorry.

ps. a more useful application of simple URL-based pref switching is obviously changing the download directory.

EDIT (2017): With uBlock Origin you can specifically target certain types of html objects, files or behaviors.

Both dynamic as well as static rules specify that origins are allowed for a domain/url. I've been using this for a few years now. Types include font as well as inline-script, stylesheet, image, object, script, xmlhttprequest, sub_frame, media, websocket, popunder and popup.

example rules:

* * 3p block
no-remote-fonts: * true
no-remote-fonts: allow-font-on-this-site.com false
allow-font-on-this-site.com font-cdn.org noop

which mean:

  1. block third party request from any page to anywhere
  2. block third party fonts on any page from anywhere
  3. re-enable third party fonts on a page on the domain allow-font-on-this-site.com from anywhere
  4. optionally re-enable request on our page to origins on the domain font-cdn.org

With noop ('no operation') we still apply static rule filtering (commonly defined in distributed rules known as ad-blocking or malvertising lists).

  • 1
    Thanks for your thorough answer and the time you put into it.
    – Jura
    Feb 10 '15 at 9:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.