Clearing anti-XSS whitelist entries?

Ask for help about NoScript, no registration needed to post
kukla
Senior Member
Posts: 321
Joined: Mon May 04, 2009 12:08 am

Clearing anti-XSS whitelist entries?

Post by kukla »

I see a number of these. There are four from Google, Google Translate, Yahooo, and Wikipedia. Are they there by default? If so, what is their purpose? If they are not there by default, is there a simple way to delete them? I don't remember whitelisting these sites.
Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10.5; en-US; rv:1.9.1.6) Gecko/20091201 Firefox/3.5.6
Alan Baxter
Ambassador
Posts: 1586
Joined: Fri Mar 20, 2009 4:47 am
Location: Colorado, USA

Re: Clearing anti-XSS whitelist entries?

Post by Alan Baxter »

Edit: Never mind. I can type better than I can read.

google.com and yahoo.com are there by default. The other two could have been added by the NoScript top-level site or bookmark options. Any or all of them can be safely removed using this panel:
NoScript Options > Whitelist
See http://noscript.net/faq#qa1_5
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.6) Gecko/20091201 Firefox/3.5.6
User avatar
Giorgio Maone
Site Admin
Posts: 9524
Joined: Wed Mar 18, 2009 11:22 pm
Location: Palermo - Italy
Contact:

Re: Clearing anti-XSS whitelist entries?

Post by Giorgio Maone »

@Alan Baxter:
I think he refers to the XSS Exceptions in Tools|Advanced|XSS.

@kookla:
They're there because many sites you don't want to whitelist link either to Google/Yahoo search results or to Wikipedia articles, and those can contain sequence which may trigger XSS false positive warnings while being perfectly innocuous.
The same goes for Google Translate, whose implementation details may produce XSS false positives.
The exceptions are crafted to prevent the false positive while keeping those sites safe, since the matching patterns are already XSS-proof.

However you can clear the text box, but doing so you may experience XSS false positives on those sites.
Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.9.1.6) Gecko/20091201 Firefox/3.5.6 (.NET CLR 3.5.30729)
kukla
Senior Member
Posts: 321
Joined: Mon May 04, 2009 12:08 am

Re: Clearing anti-XSS whitelist entries?

Post by kukla »

OK thanks. They're default entries. I will leave them, but just in case something gets whitelisted I want to clear in the future, how do I do that? When I highlight them I don't see any delete option in NS itself, and the Firefox Menubar with Edit/Delete isn't available.
Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10.5; en-US; rv:1.9.1.6) Gecko/20091201 Firefox/3.5.6
User avatar
Giorgio Maone
Site Admin
Posts: 9524
Joined: Wed Mar 18, 2009 11:22 pm
Location: Palermo - Italy
Contact:

Re: Clearing anti-XSS whitelist entries?

Post by Giorgio Maone »

Select the relevant lines and hit the "Del" key, just like you would do in a forum post.
Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.9.1.6) Gecko/20091201 Firefox/3.5.6 (.NET CLR 3.5.30729)
kukla
Senior Member
Posts: 321
Joined: Mon May 04, 2009 12:08 am

Re: Clearing anti-XSS whitelist entries?

Post by kukla »

OMG! :oops:
Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10.5; en-US; rv:1.9.1.6) Gecko/20091201 Firefox/3.5.6
Post Reply