Such a type of attack is, to the extent of my knowledge, classified as a CSRF (Cross-Site Request Forgery) attack and can, in general, not be defended against.
I don't know of a way to configure Firefox to block those kinds of attacks, but there is (as you said) NoScript, which comes with a nice feature, ABE (Application Boundaries Enforcer) that allows you to specify which websites may access which other sites.
You can configure ABE via Settings -> Advanced -> ABE. There you can select the ruleset USER, where you can define the rules you want to be enforced.
An example for blocking all accesses that try to include (
<script> ...) resources from renren.com and all sub-sites, that didn't originate at renren.com or a sub-site:
Accept from .renren.com
One disadvantage of that way is, that, if renren.com provides means for embedding images into other websites, that would be blocked as well, but that could probably be fixed by using
Anonymize, for that purpose. On the other side, if you want to be even more restrictive, you can leave out
INCLUSION, which will result in even blocking links and redirects in links you clicked on.
The difference between the
Anonymize actions is, that the
Deny action completely blocks the request while the
Anonymize action strips the Authorization-header and the Cookie-header and turns all requests other than GET (i.e. POST, HEAD, PUT...) into data-less GET requests. The result of that is, that the website can (usually) not associate the request with a session, and /logout.do cannot terminate the session, because it doesn't know which session it would have to end, but pictures embedded into other websites that don't require a session to work will show up. A disadvantage of the
Anonymize action is, that it doesn't ever show an information bar that NoScript has anonymized the request, but it silently anonymizes it, so if you are using
Anonymize and something doesn't work as it should, try using
Deny, which will show an information bar at the top of the screen if it blocks something.
If you are using a different service for logging into renren.com such as MSN, 360.cn, 189.cn or Baidu (listed in the order of appearance on renren.com), then, with only blocking
INCLUSION it might (rather unlikely) be that you have to put an
Accept clause (example:
Accept from openapi.baidu.com) for the corresponding site too, if you block everything then you will have to put one in the ruleset.
More information about ABE is available here.