InformAction Forums

Hello everybody,
I should like to verify whether NoScript can be installed on Vista, as Firefox displays a message telling it has blocked it.

Oh, it was more serious than I thought ? Going to see that ... My point was about the content of the message. There is room on the screen to display where the script comes from. with some experience it could help determine more quickly whether the XSS is OK. Although I have to admit my reaction was ...

Oh, you are really reactive :) I filtered the console on "trip" and found this : [NoScript InjectionChecker] JavaScript Injection in coalesced:///site/17576ret=html&phint=__bk_l=https://www.tripadvisor.fr/VacationRentalReview-g196586-d1870201-Stylish_Paris_Houseboat-Puteaux_La_Defense_...

Hello everybody, NoScript displayed me something very, very strange indeed, in Firefox 56 on Windows 10. Allegedly, a script of tripadvisor.fr called by tripadvisor.fr is a cross site scripting, blocked as such. http://www.cjoint.com/doc/17_11/GKswm4H20Wu_xss.jpg http://www.cjoint.com/doc/17_11/GKsw...

Hello everybody, After a few months using Firefox with NoScript to connect to a bank, the user told me the password was not seized any more by the screen keyboard (normally, by clicking on buttons, that adds a star in a field, meaning that a character has been added in the password). I searched a mo...

barbaz wrote:???
What does this have to do with the NoScript team? You mean the bank's IT/webmaster team?

For sure that would be best

Oh ... I am afraid the only thing I can do is to wait for the NoScript team to find a more secure protocol ...

I saw a white list in the options of NoScript, but no black list. It's not available via the NoScript Options. You either need to Mark it as Untrusted in the GUI (make sure you have 'NoScript Options > Appearance > Full Domains' checked) while visiting the site, or edit about:config > noscript.untr...

therube wrote:

I authorized par.societegenerale.fr, and it freezed

Well you'd want to do the opposite.
You'd want to Forbid par.societegenerale.fr.

I saw a white list in the options of NoScript, but no black list.
Do you propose something in the hosts file ?

Oh, I added that in the XSS parameters (I spent some time as I was looking for an add button). The page does not freeze. But that is *not* safe! The only way it could be even slightly safe is if this exception is added in a NoScript install in a profile used exclusively with/for that bank site. See...

Thrawn wrote:To begin with, you must escape the dots:

Code: Select all

^@https://particuliers\.societegenerale\.fr/

Oh, I added that in the XSS parameters (I spent some time as I was looking for an add button).
The page does not freeze.

And now the connection is tested with the password.

therube wrote:It looks to be

> par.societegenerale.fr

that is causing the issue.
So if you blacklist that...

Well, I authorized par.societegenerale.fr, and it freezed as well with white veil on the page.

Hello, Well, about societegenerale.fr this promises not to be too easy : the only external address in the page source is xiti, and this is for a picture. I imagine if xiti had scripts with problems you would already know it ? In fact, there are 2 subdomains, and so this gives the three following scr...

Hello everybody, I have at home a customer of the Societe Generale bank, so she must regularly connect to https://particuliers.societegenerale.fr That often runs quite well. This afternoon, a problem appeared. The user once forgot to disconnect from the site but I fail to imagine this could be the p...