InformAction Forums

[quote="Giorgio Maone"]Everybody please remove the work-around above and check [url=http://noscript.net/getit#devel]latest development build[/url] 2.3.3rc1, thanks.[/quote]
Works fine here, let's just see if others can verify it as well and we'll mark it as RESOLVED.

Everybody please remove the work-around above and check [url=http://noscript.net/getit#devel]latest development build[/url] 2.3.3rc1, thanks.

Thank you Giorgio for taking a look, I had asked him through PM to help everyone along to take a second look. So we'll find out what's up pretty soon.

[quote="rdk"]I have been having similar problem when I log into ebay. [/quote]
Could you please open your [url=https://developer.mozilla.org/en/Error_Console]Error Console (Ctrl+Shift+J)[/url] when this happens and look for any line starting with "[NoScript XSS]", which may help understanding what's going on in your case?

Regarding the Yahoo one I'm investigating, but it's very likely a false positive due to recent changes in the XSS filter. For the time being the suggested work-around is [url=http://forums.informaction.com/viewtopic.php?p=35923#p35923]the one found by olorin[/url], i.e. [b]adding the following line to your [i]NoScript Options|Advanced|XSS[/i] exceptions box[/b]:
[code]
^http://us\.lrd\.yahoo\.com/_
[/code]
(this shortened regular expression may perform slightly better than the original).

A more permanent, generalized and restrictive work-around will be included in next version.

[quote="guest"]Where can I find an earlier version to rollback to[/quote]
http://noscript.net/feed=a or on AMO.

I have been having similar problem when I log into ebay. I get an xss error message. I have the site whitelisted but it doesn't seem to matter. This started with the last update. If anyone knows how to fix it I would appreciate it. Thanks - Ruth

[quote="olorin"]whitelisted in options>XSS>anti-XSS protection exceptions
^http://us\.lrd\.yahoo\.com/_.+$
works now.

jan[/quote]
Thank you Jan... that seems to work so far... I'll report back here if anything negative happens.
[quote="guest"]Where can I find an earlier version to rollback to[/quote]

Guest... copy/paste what Jan posted into Options/Advanced and the XSS tab... paste it at the end
of the other items listed.

Where can I find an earlier version to rollback to

whitelisted in options>XSS>anti-XSS protection exceptions
^http://us\.lrd\.yahoo\.com/_.+$
works now.

jan

Same problem here since today:
Happens when I follow in RSS link from my.yahoo.com.
Results in a 404.
Problem since upgrade to 2.3.2 yesterday.

jan

[NoScript XSS] Sanitized suspicious request. Original URL [http://us.lrd.yahoo.com/_ylt=As8.n6pF2Rh4m42eHteyUkFG2vAI;_ylu=X3oDMTI2bjdhNWhuBGlpZAM0ZjYyMDI1MTExNjk4ZjNhY2E2NDgxYjFhZTUyM2Q0NWRlMjcwYjQ4BG5vaAM1BHBvcwM1BHJpZANfMzgxMTAwMTM-/RV=1/RE=1330772650/RH=dXMubHJkLnlhaG9vLmNvbQ--/RO=2/RU=aHR0cDovL2dvLnRoZXJlZ2lzdGVyLmNvbS9mZWVkL3d3dy50aGVyZWdpc3Rlci5jby51ay8yMDEyLzAzLzAyL29jZWFuX2FjaWRpZmljYXRpb24v/RS=%5EADA3TV3ANuWPSCNLPCSzL07fpEkpl0-] requested from [http://my.yahoo.com/]. Sanitized URL: [http://us.lrd.yahoo.com/_ylt%20As8.n6pF2Rh4m42eHteyUkFG2vAI;_ylu%20X3oDMTI2bjdhNWhuBGlpZAM0ZjYyMDI1MTExNjk4ZjNhY2E2NDgxYjFhZTUyM2Q0NWRlMjcwYjQ20G5vaAM1BHBvcwM1BHJpZANfMzgxMTAwMTM-/RV%201/RE%201330772650/RH%20dXMubHJkLnlhaG9vLmNvbQ-/RO%202/RU%20aHR0cDovL2dvLnRoZXJlZ2lzdGVyLmNvbS9mZWVkL3d3dy50aGVyZWdpc3Rlci5jby51ay8yMDEyLzAzLzAyL29jZWFuX2FjaWRpZmljYXRpb24v/RS%20%5EADA3TV3ANuWPSCNLPCSzL07fpEkpl0-#5713747081608086172].

Did you try rolling back to prove your theory?

Seems to me that the problem lies with the latest versions of NoScript...didn't have the problem until the most recent update. Since it is happening with the developmental build as well, it seems that something was introduced in the last "official" release that is messing things up.

Just tried the development build...problem remains.

[quote="therube"][quote]What version of NoScript are you running?[/quote]

The latest (#dev's ?) have changes related to XSS.
Try it, [url=http://noscript.net/getit#devel]development build[/url].


(Not sure what #dev version corresponds to #release? Hint, hint, @G.)[/quote]

Sorry... :oops: lost my mind for a second... I should have posted that... Is that what you need?

[b]version 2.3.2[/b]

EDIT...
OK... installed the dev. build into my Test profile and still received some 404 errors. But, then I went back to my default profile (with ver. 2.3.2) and some of the links now worked... so, I did some perusing of other news and click on one... same error BUT about 1 minute after I had clicked on that link it worked!! It's almost as if Yahoo was changing stuff second by second.

So, in order to get a clean link to post (by the time it gets to the error page the link is all messed up with stuff...) I opened up IE for one of the bad ones that I got in Firefox... visited the page and got a clean link... came back to FF and pasted it into the loc. bar and the site opened up OK... went back to the line/link presented within my MyYahoo news... clicked on it and got the error.... I suppose that it may have grabbed it from cache somewhere with that test.

I'm going to continue playing with this stuff.
BTW... one link that is still messing up is...
http://video.nytimes.com/video/2012/02/ ... -2012.html

So, I wouldn't[u] stop the train[/u] for this ... I'll keep testing for a pattern.

[quote]What version of NoScript are you running?[/quote]

The latest (#dev's ?) have changes related to XSS.
Try it, [url=http://noscript.net/getit#devel]development build[/url].


(Not sure what #dev version corresponds to #release? Hint, hint, @G.)