NoScript XSS Error for "Google Groups" iGoogle gadget

[madscijr]

NoScript is blocking something at iGoogle.com for "cross-site scripting".

The problem appears to be in the Google Groups Reader gadget, as that is the only one not displaying correctly.
It just shows the error "Missing or malformed url parameter".

Browser & plugin: Fx 3.6.10 and NS 2.0.3.3.

URL: http://www.google.com/ig?refresh=1

Steps to reproduce: add the gadget Google Groups Reader by Matt Kruse, at
http://www.google.com/ig/directory?url= ... roups2.xml

Errors in FF console:

[NoScript XSS] Sanitized suspicious request. Original URL [http://www.ig.gmodules.com/gadgets/ifr? ... 1920098821] requested from [http://www.google.com/ig?refresh=1]. Sanitized URL: [http://www.ig.gmodules.com/gadgets/ifr? ... 6081136164].

Error: Permission denied for <http://talkgadget.google.com> to call method Location.toString on <http://www.google.com>.

I am also seeing lots of warnings such as:
Warning: Error in parsing value for 'filter'. Declaration dropped.
Warning: Unknown property 'zoom'. Declaration dropped.
Warning: Expected declaration but found '*'. Skipped to next declaration.
Warning: Expected color but found 'sold'. Expected end of value but found 'sold'. Error in parsing value for 'border-right'. Declaration dropped.

[Giorgio Maone]

There's nothing much NoScript can do about it, since that URL actually contains HTML and JavaScript code.

However you can work-around by adding the following line to your NoScript Options|Advanced|XSS exceptions box:

Code: Select all

^@http://www.google.com/ig(?:[?/#]|$)