InformAction Forums

Hi There,

You can see full details reported to TorProject:

https://gitlab.torproject.org/tpo/appli ... sues/40596

ThX!

(I'll just note that in FF [not Tor] 78ESR & 91, I can get high CPU [that does subside after a bit], but I don't see XSS nor do I crash.
Win7 x64.)

I can see what's happening there: the page has 152 <noscript> elements, 56 of which contain distinct Youtube iframes which get therefore scanned for XSS attempts all together, DOSing the browser.

If you either disable the noscript capability for 3mdeb.com or the frame capability for youtube.com the page should load almost instantaneously with no warning.

I should probably look into some form of rate limiting or serialization of the injection checker for edge case like this.

Any news on this issue? I can see it still happening until this day.

Could you please check latest development build? Thanks.
v 11.4.6rc1
============================================================
x [XSS] Correct for concurrency in timeout checks
x [UI] Flatter preset appearance
x [UI] Focus visual feedback adjustments
x Inclusion-time TLD updates
x Updated HTML events
x [L10n] Updated pl
x Opaque white for vintage lock icons
x [L10n] Updated is

Could you please check latest development build? Thanks.
v 11.4.6rc1

Yes works great!, Thank You

Btw forums doesnt send notifications not through email nor internally (within the forum), Also reset password doesnt work (no reply).. So i just wanted to let you know so hopefully can be fixed or so.

security-alert wrote: ↑Thu May 26, 2022 9:51 pm Btw forums doesnt send notifications not through email nor internally (within the forum), Also reset password doesnt work (no reply).. So i just wanted to let you know so hopefully can be fixed or so.

???
Ok, I'm testing subscribing to this topic, let's see if I get notified of this reply...

Email notification came instantly for me. EDIT Board-internal notification is also there. /EDIT

Check your settings in ucp.php?i=ucp_notifications&mode=notification_options and that you are indeed subscribed to this topic?

> and that you are indeed subscribed to this topic?

Ah i should subscribe manually to the topics? i didnt know this thought its automatic as long as the topic created by me. (which is my first account which is sadly i dont know why i cant login to it anymore..)

My notifications for internal and email are enabled, But yeah about topic subscription that didnt check.

You can mark this ticket as fixed.

Worked for me as well. Thanks. And yes you have to be subscribed to the topic in order to receive notifications. I did not know it either.