[RESOLVED] Zynga Poker and NoScript

[TanOwer]

Hi ever since yesterday I have not been able to play unless I disable NoScript altogether in firefox.
I have checked that both facebook and Zynga Poker have full access and no scripts are blocked. If I leave NoScript enabled all I get is the buddy bar loading at the top of the page. This happens even if I enable scripts globally:(
Thanks for and help in advance.
Tan

[therube]

URL ?

[centaurius]

The same thing happens to me also since 20t of May also!

[Peter]

I have the very same problem, and it appeared on the very same day.

[Giorgio Maone]

Does the problem persist with 1.9.9.79?

[centaurius]

Does the problem persist with 1.9.9.79?

Yes... just tested it... i've uploaded a screenshot of the XSS warning: http://i50.tinypic.com/syqg6b.jpg After that warning it just blocks practily evertything of that APP. I've tried to add to whitelist in XSS the http://apps.facebook.com with no sucess.

[Giorgio Maone]

Can I see the [NoScript XSS] lines you should get in Tools|Error Console when it happens?

[centaurius]

Can I see the [NoScript XSS] lines you should get in Tools|Error Console when it happens?

Well it gives this warning, and a bunch of unexpected lines, I only posted the NoScript XSS line:

[NoScript XSS] Sanitised suspicious request. Original URL [http://facebook.poker.zynga.com/poker/l ... .php?path=(edited out for OP's privacy)] requested from [http://apps.facebook.com/texas_holdem/i ... ecent&fa=1]. Sanitised URL: [http://facebook.poker.zynga.com/poker/l ... .php?path=(edited out for OP's privacy)#1126653147501698389].

[centaurius]

Do you recommend any XSS expection code i could write?
^http://apps.facebook.com only doesn't work.

[Giorgio Maone]

Remove the exception you put there, and replace it with

Code: Select all

^http://facebook\.poker\.zynga\.com/poker/

[centaurius]

Remove the exception you put there, and replace it with

Code: Select all

^http://facebook\.poker\.zynga\.com/poker/

It worked, thanks
However this wasn't needed prior to 20th of May. Why is that?

[Giorgio Maone]

However this wasn't needed prior to 20th of May. Why is that?

A change in Zynga code, most likely.
Notice that they're even nesting a full-featured JavaScript URL (

Code: Select all

inviteURL=javascript:ZY.openInvitePopup()

) in that requests, therefore NoScript has all rights to scream XSS danger.

[TanOwer]

Thank you for your help Giorgio Maone and centaurius.

[centaurius]

Well the problem returned.... even ysng that code u said to add to excpetion.

This is what appears on error log:

[NoScript XSS] Sanitised suspicious request. Original URL [http://facebook2.poker.zynga.com/poker/ ... 0a1d1f27a1] requested from [http://apps.facebook.com/texas_holdem/i ... ecent&fa=1]. Sanitised URL: [http://facebook2.poker.zynga.com/poker/ ... 6376058146].

What exception line should I (we) add now? :>

[Giorgio Maone]

Hell, they seem to try hard at triggering XSS warnings (is their real aim making you disable the XSS filter outright)?
However, please change the above into:

Code: Select all

^http://facebook\w*\.poker\.zynga\.com/poker/