Wow, something is wrong with uMatrix. I have uMatrix with 1st party javascript disabled by default. Yet this site says "Please disable JavaScript to view this site." To be sure, I curled the source and hosted it elsewhere, and my browser (firefox 84.0b4 on linux with uMatrix) still runs the JavaScript.
The JS is inline. Neither uM nor uBO static rules block that. The only way to block it is a uBO dynamic rule `no-scripting: $hostname true`, which you'll also need to be able to render the `<noscript>` content anyway.
BTW, you probably want to move off of uM given gorhill has abandoned it in favor of uBO. (I converted all my rules to a mix of uBO dynamic rules for JS and static rules for everything else, except for cookies which I still use uM for because uBO can't manage them.)
Is there a guide for moving from uMatrix to uBO? uMatrix works exactly how I want/expect...
BTW, the site works as expected with my Linux/Firefox/uMatrix setup... the inline scripts are disabled by default and I see the page content. I'm not sure why GP had issues.
2. Block images by replacing them with the built-in 1x1 GIF instead of canceling the request.
3. Disable web workers by setting the CSP worker-src.
4. Override the previous rules by allowing first-party CSS, frames and images. (The @@ means it's an override rule.)
(The fact that my default is to block everything is why the first example I gave above starts with @@ too.)
Web workers can be allowed on a per-site basis by overriding the csp directive with a reset:
@@||foo.com^$csp
Lastly, I have a dynamic rule to allow `<noscript>` tags to be rendered:
no-scripting: * true
Then, for every static rule where I enable JS for a domain, I add a corresponding `no-scripting: $domain false` in the dynamic rules.
It's annoying to have to move between static and dynamic rules when deciding to enable JS on a site, but I'm not sure there's a better way. Neither static nor dynamic rules individually support everything that uM could do - static rules can't block inline JS nor render `<noscript>` content, and dynamic rules can't block every kind of request.
Static rules are also nice in that you can have empty lines and comments and arbitrary ordering of your rules, so it's easier to group rules in sections based on the domain names, add comments, etc. Dynamic rules however are like uM's rules and are forced to be sorted by domain name with no empty lines or comments.