inclusionTypeChecking pref seems to have no effect

[al_9x]

Verizon wireless homepage, when flash is blocked, attempts to replace the flash navigation header with javascript but is blocked by NS.

Code: Select all

[NoScript] Blocking cross site Javascript served from https://scache.vzw.com/globalnav/globalnavmenu.txt with wrong type info text/plain and included by http://www.verizonwireless.com/b2c/index.html

1. Is this described in detail somewhere?
2. noscript.inclusionTypeChecking = false has no effect
3. what is noscript.inclusionTypeChecking.checkDynamic for
4. noscript.inclusionTypeChecking.exceptions works

[Giorgio Maone]

Is this described in detail somewhere?

http://noscript.net/changelog#1.9.6.5

noscript.inclusionTypeChecking = false has no effect

Fixed, thanks

what is noscript.inclusionTypeChecking.checkDynamic

Enables/disables check for URLs which appear to be server-side scripts (i.e. "application/unknown" or textual content type).

[al_9x]

Is this described in detail somewhere?

http://noscript.net/changelog#1.9.6.5

Yes, I saw that, but I am looking for a detailed description of the attack scenario this protects against.

[Giorgio Maone]

Yes, I saw that, but I am looking for a detailed description of the attack scenario this protects against.

Trusted site allows public uploads of some kinds of files (usually text, images, PDF documents and so on), but not JS/CSS/HTML for obvious security reasons (some Google properties do, for instance).
An attacker manages to inject a short HTML fragment in another trusted site, like

Code: Select all

<script src="http://trusted_uploads.com/some_upload.txt"></script>

where some_upload.txt is a file he previously uploaded to the public, popular and trusted by many trusted_uploads.com web site.
The upload had been allowed by the site because it was of the "innocuous" txt type (and it's served with the proper text/plain content type, which makes everybody feel safe), but in reality it contains a malicious script which now is much more likely to run than if it was sourced by an obscure and temporary Chinese domain. The inclusionType checks will prevent it from running anyway.