[RESOLVED] having difficulties logging in...

[questionx]

Ever since the last version of NoScript, I'm having difficulties logging in to an account. When I input my username and pass I'm directed to a page stating: "NoScript filtered a potential cross-site scripting (XSS) attempt from (site).

What's going on? Never had this issue before.

[therube]

Open the Error Console, & post the associated XSS warning.

[questionx]

It reads something like this:

[No Script XSS] Sanitized suspicious upload to [https:online............(long string of numbers and characters) from [https://(my site)]: transformed into a download-only GET request.

(my site): server does not support RFC (a number), see (another number)

[therube]

> Ever since the last version of NoScript

If you revert to an earlier version, http://noscript.net/feed, does the problem go away?


server does not support RFC is unrelated. That is something that your bank has to take care of on their end, & it's only their to let you know that the situation exists (if you happened to have looked in your Error Console).


The other is what is needed & you are showing the general layout of the message, though you're providing no details to work with.

What bank (or other entity) as a start?

If you don't feel comfortable posting the data, email it to Giorgio.
(He's going to be the one <most likely> to provide you the help you're looking for anyhow.)

[questionx]

YES!, downgrading to version 2.1.0.5 DOES make the problem go away! , so you guys need to fix that...

Please tell Giorgio to fix it. It was https://online.wellsfargo.com , I like to keep my NoScript up to date, but for now I'll make an exception. Please tell me when it's OK to upgrade again

[questionx]

actually it was: https://www.wellsfargo.com/ , the login located at the left, now it takes me right away instead of even another login page.

[Alan Baxter]

Logging in from https://www.wellsfargo.com/
NoScript 2.1.1.1rc1 with default settings except wellsfargo.com allowed.
XSS error message is

Code: Select all

[NoScript XSS] Sanitized suspicious upload to [https://online.wellsfargo.com/signon###DATA###TF1%3B015%3B%3B%3B%3B%3B%3B%3B%3B%3B%3B%3B%3B%3B%3B%3B%3B%3B%3B%3B%3B%3B%3BMozilla%3BNetscape%3B5.0%2520%2528Windows%2529%3B20100101%3Bundefined%3Btrue%3BWindows%2520NT%25205.1%3Btrue%3BWin32%3Bundefined%3BMozilla%2F5.0%2520%2528Windows%2520NT%25205.1%253B%2520rv%253A2.0.1%2529%2520Gecko%2F20100101%2520Firefox%2F4.0.1%3Ben-US%3Bundefined%3Bwww.wellsfargo.com%3Bundefined%3Bundefined%3Bundefined%3Bundefined%3Btrue%3Btrue%3B1307226398072%3B-7%3BTuesday%252C%2520June%252007%252C%25202005%25209%253A33%253A44%2520PM%3B1280%3B1024%3B%3B10.3%3B7.6.9%3B1.6.0_25%3B%3B%3B8%3B420%3B360%3BSaturday%252C%2520June%252004%252C%25202011%25204%253A26%253A38%2520PM%3B24%3B1280%3B994%3B0%3B0%3BAdobe%2520Acrobat%257CAdobe%2520PDF%2520Plug-In%2520For%2520Firefox%2520and%2520Netscape%252010.0.1%3B%3B%3B%3B%3BShockwave%2520Flash%257CShockwave%2520Flash%252010.3%2520r181%3B%3B%3B%3BQuickTime%2520Plug-in%25207.6.9%257CThe%2520QuickTime%2520Plugin%2520allows%2520you%2520to%2520view%2520a%2520wide%2520variety%2520of%2520multimedia%2520content%2520in%2520Web%2520pages.%2520For%2520more%2520information%252C%2520visit%2520the%2520%253CA%2520HREF%253Dhttp%253A%2F%2Fwww.apple.com%2Fquicktime%2F%253EQuickTime%253C%2FA%253E%2520Web%2520site.%3B%3B%3B%3B%3B%3BMicrosoft%25AE%2520Windows%2520Media%2520Player%2520Firefox%2520Plugin%257Cnp-mswmp%3B%3B%3B15%3B] from [https://www.wellsfargo.com/]: transformed into a download-only GET request.

[Giorgio Maone]

Please check latest development build, thanks.

[questionx]

By downgrading I'm able to login to https://www.wellsfargo.com/ WITH wellsfargo.com enabled. Before I could only login with wellsfargo.com disabled. But this would disable JavaScript needed to properly use the page...

[Giorgio Maone]

@questionx:
Did you read my message above?

[questionx]

Yes, latest development build works too! Thanks very much Giorgio! I'll update this thread if anything else comes up...