ClearClick error on gmx.net ?

[Zanzi]

Hello,

I'm repeatedly getting ClearClick warnings when logged in at gmx.net (German e-mail provider, see http://en.wikipedia.org/wiki/GMX_Mail ) with Firefox 25.0.1 and NoScript 2.6.8.5 enabled. (Note: I reported this with Report-ID: 1001049).

How to reproduce

• Log in to gmx.net. (You can register a free e-mail address to do this.)
• Make sure some JS is allowed to see the default web site: gmx.net, gmxpro.net, ui-portal.de
• Go to E-Mail Tab (on upper menu bar)
• Hit Tab until FF shows "https://home.navigator.gmx.net/home/show?sid=[sidValue]#" in the lower left corner - it's usually three times of hitting TAB for me
• Try to open a new tab with Strg+T

-> ClearClick warning appears! See screenshot: http://s1.directupload.net/file/d/3452/5ayhpb9g_jpg.htm
The url it names is: https://home.navigator.gmx.net/home/show?sid=[sidValue]#[random letters]

The random letters change every time you reload the whole page, in my screenshots they are "jnjpesnu". Those letters can also be found at some places in the site's html, for instance:

[...]
<iframe id="r200095621.86228347" class="application home display_enabled" frameborder="0" src="https://home.navigator.gmx.net/home/sho ... ]#jnjpesnu" name="home" allowfullscreen="true" mozallowfullscreen="" webkitallowfullscreen="" allowtransparency="true">
[...]

I'm guessing that those letters are something similar in function to a session id, as they are the same for every time I reload the page.

In this screenshot, you can see that some icon has been cut off. This icon does not appear on the visible site, but it's part of an iframe that is activated and becomes visible when the "Start" tab (on upper menu bar) is clicked.

As you can see from the screenshots, the blocked and unblocked version looks exactly the same. I've also had this warning occurring with the blocked/blocked version field seemingly empty or containing words like "Neue E-Mail" (meaning "new e-mail" in German). I suppose that the content of the blocked/blocked version field depends on which element was focused by the tabbing.

I've followed the steps outlined above when using FF with NoScript disabled, and when I Strg+T-tabbed, a new FF tab opened with the gmx.net tab looking unchanged. Therefore, it seems like gmx.net did not use my keyboard input to do anything.

I don't understand why the ClearClick warning is triggered in the first place. Also, is there anything suspicious in gmx.net's behaviour, or is this just a problem with gmx.net apparently focusing invisible iframes when tabbing...? Would this be considered a false positive by NoScript, or unfortunate coding by gmx.net?

Thanks for any explanations, hints etc.!
Zanzi

[Zanzi]

Hey,

a little update with some more information:

I've now discovered the browser console and with it, some NoScript log messages

When I trigger the ClearClick warnings as describes above, I can find several NoScript messages in the browser console of the following type:

Code: Select all

[NoScript ClearClick] Swallowed event keypress on A/0 at https://home.navigator.gmx.net/home/show?sid=[sidValue]#[randomLetters]

[NoScript ClearClick] Swallowed event keyup on A/0 at https://home.navigator.gmx.net/home/show?sid=[sidValue]#[randomLetters]

On the other hand, I just discovered similar messages for this site here:

Code: Select all

[23:39:37.017] [NoScript ClearClick] Swallowed event mousedown on http://forums.informaction.com/posting.php?mode=reply&f=7&t=18207 (rapid fire from http://api.recaptcha.net in 400ms)

Can anyone give me a hint if this warning is something to worry about or not? I'm guessing it is harmless and happens due to some unfortunate coding (iframes in iframes in iframes...) on gmx.net's part, but I'd love to hear the thoughts of someone with more knowledge and experience with NoScript!

[Thrawn]

I agree that it's probably harmless; I've noticed a similar thing before on a blogspot blog (but not consistently).

Does this tend to happen immediately after you switch tabs?

[Zanzi]

Hi Thrawn,

thanks for your answer.

Huh, it's hard to say actually. I don't think it usually happens when I'm Strg+TABbing through several open tabs, but then I guess I'm not actually focusing anything on the webseite. I tend to notice it when I have had the gmx.net tab open for a while (in the background or after closing another tab) and then try to open a new tab with Strg+T.

As the url that triggers the ClearClick warning is an url inside gmx.net (that can actually be found in the site's source code in several iframes), as opposed to some other url leading me off-site or something, I suppose it really appears to be harmless, right? I was just a little confused/irritated because I haven't been using FF and NoScript for very long and this was the first ClearClick warning I encountered.

Thanks again and in advance :]

[Thrawn]

Well, the message for this forum indicated that a 'rapid-fire' click was the issue. So it's related to how quickly you click on things.

Is the error occurring consistently? If so, please try to provide steps to reproduce. If not - it's probably nothing to worry about.

[Zanzi]

Hi Thrawn,

the steps to reproduce this error are mentioned in the first posting of this thread! You have to be able to log in to gmx.net, so you may have to register a free e-mail address that you can delete afterwards.

How to reproduce

• Log in to gmx.net. (You can register a free e-mail address to do this.)
• Make sure some JS is allowed so you go to the default web site: gmx.net, gmxpro.net, ui-portal.de
• Go to E-Mail Tab (on upper menu bar)
• Hit Tab until FF shows "https://home.navigator.gmx.net/home/show?sid=[sidValue]#" in the lower left corner - it's usually three times of hitting TAB for me
• Try to open a new tab with Strg+T

-> ClearClick warning appears!