Allow 3rd party scripts from a domain only with NoScript

Question

Github is now hosting its scripts in akamai. But NoScript only allows me to allow akamai.net but not github_account.akamai.net.

Is there a way to tell NoScript to allow akamai.net only when I visit GitHub?

I'm looking at ABE settings, but I'm not sure if that's the right way to go. I'm having difficulties testing as I can't find other sites that use akamai.net scripts at the moment.

Answer 1

The NoScript FAQ answers this very question, using ABE (Application Boundaries Enforcer):

Site .akamai.net
Accept INCLUSION from SELF++
Accept INCLUSION from .trusted-site1.com .trusted-site2.com trusted-site3.com
Deny

So:

Site .akamai.net
Accept INCLUSION from SELF++
Accept INCLUSION from *.github.com github.com
Deny

...should work?

More info on ABE here, including a PDF of the how to write the rules.

See also from Informaction.com forums:

Notice that since ABE's rule work independently from NoScript's permissions, you need to "Allow google-analytics.com" in NoScript's menu for the above to work. Notice also that, independently from ABE, even if a certain script source is whitelisted in NoScript it won't run as a 3rd party script on pages whose origin is not whitelisted itself.