Describe the issue

I've enabled Block CSP reports so I got an entry no-csp-reports: * true in my rules. Today the NoScript WebExtension for Firefox 57+ came out and I noticed several CSP reports from the domain fake-domain.noscript.net appearing in uBO's logger, e.g.:

Then I found this interview with NoScript's main developer Giorgio Maone in which he says he would be using CSP reports in a "creative" way to rebuild certain of the old extension's features in the WebExtension:

Dynamic permissions for embedded JavaScript are not natively supported by WebExtensions. Rather than requesting a new API, I am using Content Security Policies (CSP), a Web Application Security standard, to control scripting execution and other security properties of the webpage.

Therefore I tried to set the explicit allow rule no-csp-reports: fake-domain.noscript.net false analogous to what's described in uBO's Wiki to allow CSP's for the domain fake-domain.noscript.net only. Now obviously this didn't work because the CSP reports still get blocked by the no-csp-reports: * true rule (at least that's what uBO's logger shows, the same as in the screenshot above).

I don't have enough understanding of the technical details involved to say what's going on/wrong here. As far as I can tell this hasn't caused any practical issue/limitation on my side. But on the other hand I'm still becoming accustomed to NoScript's new – let's say "in need of getting used to" – interface and can't really tell if it works completely as it should (i.e. provides all the protection it should).

Update:
When I allow steemit.com in NoScript, the NoScript CSP reports don't show up but ones from steemit.com instead:

So I guess uBO's logger "wrongly" allocates the Steemit's CSP reports to the NoScript domain/can't allocate them to the actual domain they're originating from?

Besides that, I've noticed that when a site like Steemit is blocked in NoScript, noscript.net appears as a blocked third-party domain in uBO's panel (and allowing it doesn't do nothing, i.e. still red/blocked).

Update 2:

NoScript's CSP reports only fire when the first party domain is not whitelisted in NoScript. This might result in fake-domain.noscript.net being able to reconstruct the browsing history as gorhill warns in this comment.

Update 3:

According to a statement from Giorgio Maone there's no privacy issue (browser history leakage):

"fake-domain.noscript.net", as the name implies, is a domain which does not resolve to anything, and since noscript.net is under my control I can make sure nobody makes it real domain. It's used as the report URI for the script-blocking CSP, in order to catch LOCALLY whatever has been blocked by NoScript and show it in the UI. As soon as the request is initiated, is processed LOCALLY by NoScript and blocked, so the information never leaves the browser. If, by accident (e.g. because you disable NoScript while a page with the CSP loaded is still active) the CSP report is fired and not caught, as I said the domain doesn't resolve and the request just times out.

One or more specific URLs where the issue occurs

E.g. this site: https://steemit.com/spanish/@vieira/el-materialismo-el-mayor-problema-de-la-sociedad

Your settings

• OS/version: Ubuntu 16.04 LTS x64
• Browser/version: Firefox 57.0
• uBlock Origin version: 1.14.18

Your filter lists

Enabled all built-in filter lists, minus:

• Adguard Mobile Filters​​​​​​​​​
• Fanboy’s Social Blocking List​​​​​​​​
• the country specific filters (except DEU)

Your custom filters (if any)

Disabled them all, issue still occurs.

Besides I'm using "AAK-Cont Filter For uBlock Origin​" with Greasemonkey (the new WebExtension).