Information on ES6 attacks thwarted by NoScript 2.6.9.13

[bgmnt]

Hi,

In the changelog there is:

x [XSS] Better protection against some ES6 attacks (thanks Masato Kinugawa for reporting)

I'm curious, which attacks did ES6 enabled that NoScript had to be tweaked to protect against ?

Thanks

[Giorgio Maone]

One using a funny combo of string interpolation (a new, very tricky ES6 feature) and nested comments.
I'll leave to Masato publishing the gory details.

[bgmnt]

Ok thanks, I'll see if he publishes something in English

For anyone interested in new threats posed by ES6, I found this. A vulnerability with NoScript XSS protection was even found and quickly fixed. It's interesting to see that ES6 features can take even NoScript off guard, but of course there needs to be a whitelisted site involved for attackers to have a chance to run anything ES6.