[RESOLVED] SelfClickJacking???

[MadameIlsa]

Hi there,

I want to view a site at say --- http://www.toplevel.com

This site has some scripts on it I think are ok to run, and others that are not. If I enable a script to run on this page, then toplevel.com is added to the whitelist

Now, I want to click on a link on this page. The link will redirect me to --- http://www.toplevel.com/subdirectory --- which is wonderful and where I want to be.

However, not only am I redirected to where I want to be, the click also opens a new window. The URL at the top of the page goes something like: -- http://www.toplevel.com/ads/adserver.js ... &isPopup=1

is there a way to configure Noscript to allow the redirect and not allow the new window to open??

Thank you!

[Giorgio Maone]

Could you please PM me the real page where this happens?

[Giorgio Maone]

OK, please open about:config and replace the value of the noscript.surrogate.popunder.replacement preference with

Code: Select all

(function(){var cookie=document.__proto__.__lookupGetter__('cookie');document.__proto__.__defineGetter__('cookie',function() {var c='; popunder=yes; popundr=yes; setover18=1';return (cookie.apply(this).replace(c,'')+c).replace(/^; /, '')});var fid='_FID_'+(Date.now().toString(16));var open=window.__proto__.open;window.__proto__.open=function(url,target,features){try{if(!(/^_(?:top|parent|self)$/i.test(target)||target in frames)){var suspSrc,suspCall,fr,ff=[];for(var f,ev,aa=arguments;aa.callee&&(f=aa.callee.caller)&&ff.indexOf(f)<0;ff.push(f)){aa=f.arguments;if(!aa)break;ev=aa[0];suspCall=f.name=="doPopUnder";if(!suspSrc)suspSrc=suspCall||/(?:\bpopunde?r|\bfocus\b.*\bblur|\bblur\b.*\bfocus|[pP]uShown)\b/.test(f.toSource());if(suspCall||ev&&typeof ev=='object'&&('type' in ev)&&ev.type=='click'&&ev.button===0&&(ev.currentTarget===document||('tagName' in ev.currentTarget)&&'body'==ev.currentTarget.tagName.toLowerCase())&&!(('href' in ev.target)&&ev.target.href&&(ev.target.href.indexOf(url)===0||url.indexOf(ev.target.href)===0))){if(suspSrc){fr=document.getElementById(fid)||document.body.appendChild(document.createElement('iframe'));fr.id=fid;fr.src='data:text/html,';fr.style.display='none';var w=fr.contentWindow;w.blur=function(){};return w;}}}}}catch(e){}return open.apply(null, arguments)}})()

If it works, this will be made the default in next NoScript version.

[MadameIlsa]

that does seem to do the trick --nice to have a response so quick!
that is cool that it is a generic situation and users will not have to set this (even thru GUI) for each site.
Cheers!

[Giorgio Maone]

Just, please change it again to

Code: Select all

(function(){var cookie=document.__proto__.__lookupGetter__('cookie');document.__proto__.__defineGetter__('cookie',function() {var c='; popunder=yes; popundr=yes; setover18=1';return (cookie.apply(this).replace(c,'')+c).replace(/^; /, '')});var fid='_FID_'+(Date.now().toString(16));var open=window.__proto__.open;window.__proto__.open=function(url,target,features){try{if(!(/^_(?:top|parent|self)$/i.test(target)||target in frames)){var suspSrc,suspCall,fr,ff=[];for(var f,ev,aa=arguments;aa.callee&&(f=aa.callee.caller)&&ff.indexOf(f)<0;ff.push(f)){aa=f.arguments;if(!aa)break;ev=aa[0];suspCall=f.name=='doPopUnder';if(!suspSrc)suspSrc=suspCall||/(?:\bpopunde?r|\bfocus\b.*\bblur|\bblur\b.*\bfocus|[pP]uShown)\b/.test(f.toSource());if(suspCall||ev&&typeof ev=='object'&&('type' in ev)&&ev.type=='click'&&ev.button===0&&(ev.currentTarget===document||('tagName' in ev.currentTarget)&&'body'==ev.currentTarget.tagName.toLowerCase())&&!(('href' in ev.target)&&ev.target.href&&(ev.target.href.indexOf(url)===0||url.indexOf(ev.target.href)===0))){if(suspSrc){fr=document.getElementById(fid)||document.body.appendChild(document.createElement('iframe'));fr.id=fid;fr.src='data:text/html,';fr.style.display='none';var w=fr.contentWindow;w.blur=function(){};return w;}}}}}catch(e){}return open.apply(null, arguments)}})()

No semantic difference, but it won't prevent future updates to this script, because it's the new default verbatim as I'm putting it in NoScript.