"# is not whitelisted" error

[Guest]

Since the latest version of NS, 1.9.9.63, was released I keep getting this error message popping up:

"262397977194136785 [or some other number that I can find no rhyme or reason for] is not whitelisted"

This shows up along with the "Noscript filtered a potential XSS attempt" message bar, and the message in the error console reads:

[NoScript XSS] Sanitized suspicious request. Original URL [http://superpokepets.com/platform_test/ ... vep==false] requested from [https://platform.slide.com/platformui/p ... ng_number=]. Sanitized URL: [http://superpokepets.com/platform_test/ ... 6966709476].

I've whitelisted both superpokepets.com and slide.com (yes I got sucked into an online game, please ignore that fact) and I don't fully understand the whole problem with XSS, so I am very confused.

But my main question is, is the error message containing the strange number a result of NS or is it the site that I'm browsing? Should I be reporting this problem to NS or that website? Whom should I be bugging to get answers?

Thanks for your help,
KK

[Guest]

I noticed there was a newer version of NS available on the site so I installed 1.9.9.69. I still get the error message but the XSS messages don't appear anymore. So is the error message not caused by NS, or...?

-KK

[Giorgio Maone]

NS doesn't give any "Is not whitelisted" message, so that's probably something else.
Could you post a screenshot and/or perform Standard Diagnostic?

[Guest]

Here's a screenshot: http://img.photobucket.com/albums/v683/ ... rormsg.gif

As for the diagnostic, the problem goes away when I turn off NS only and leave other extensions on, and reappears when I turn on NS only and turn everything else off.

I also take back what I said in my second post, the XSS messages still show up.

[Giorgio Maone]

The message is from the web site, and probably a side effect of the XSS sanitization.
Can I see the [NoScript XSS] lines you should get in Tools|Error Console when this happens?

[Guest]

Is it this?

[NoScript XSS] Sanitized suspicious request. Original URL [http://superpokepets.com/platform_test/ ... vep==false] requested from [https://platform.slide.com/platformui/p ... ng_number=]. Sanitized URL: [http://superpokepets.com/platform_test/ ... 7210726795].

[Giorgio Maone]

Yes it is.

There's not much NoScript can do about that, since that URL actually contains executable (albeit apparently safe) code.
You can work-around by adding the following line to your NoScript Options|Advanced|XSS exceptions box;

Code: Select all

^http://superpokepets\.com/[\.\w\-\/]+#

Good luck and let me know.

[Guest]

That seems to work, thanks a lot!

-KK

[Guest]

Hi!

I'm a "different guest" than the previous one. But I'm having the same problem, so I found my way here. I have tried your solution and it works for me too - in parts, that is.

The thing is, that aside from the regular "superpokepets.com"-URLs, there's also personalized URLs like "http://karline.superpokepets.com/". These are giving the same "is not whitelisted"- message.

I guess your solution would work on them, too, if the URL would be adjusted. I'm sure there's some kind of wildcards, as there's a few other samples already there, for Google or Wikipedia, but I don't know enough about this, to make them up myself.

What I need is the code line above, with a wildcard for that name before "superpokepets", like "http://*.superpokepets.com/" (but THAT does not seem to work)...

Thanks in advance...

[dhouwn]

What I need is the code line above, with a wildcard for that name before "superpokepets", like "http://*.superpokepets.com/" (but THAT does not seem to work)

Regular Expressions, not globbing.

Here you go:

Code: Select all

^http://([a-z]+\.)?superpokepets\.com/[\.\w\-\/]+#

[Guest]

Thank you, it works - partly. I'm still getting the error message from URLs like this:

http://jessijex088.spp.com

I guess it's because of the numbers, a-z does include those, I guess?

[Giorgio Maone]

Code: Select all

^http://(?:[^/\?#]+\.)?superpokepets\.com/[\.\w\-\/]+#

[Guest]

Great, absolutely perfect, no "whitelist" messages anymore.

Thanks a lot, this is how support should work everywhere!