Facebook Google Gadget

Ask for help about NoScript, no registration needed to post
Dateline 4:20

Facebook Google Gadget

Post by Dateline 4:20 »

NoScript "broke" my Facebook Google Gadget, or iGoogle, or whatever it's called.
Every time I try to load the page, it blocks what it thinks is a "suspicious" XSS attempt and I can't see my Facebook information. I tried "unsafe reload" but that didn't help. I tried adding a string "^http://*facebook.com" to the XSS area of the NoScript options, but that didn't help either.
I'd like to attach my screenshot, but I can't figure out how. I'm going to try photobucket:
Image
OK, good, that worked.

NoScript Version is 1.9.5 on Firefox For U3 version 2.0.0.4, XP Pro SP2/1.4 MHZ Intel C2D 3.5GB RAM
Can anybody help me with this? Please?
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1) Gecko/20090624 Firefox/3.5 (.NET CLR 3.5.30729)
User avatar
Giorgio Maone
Site Admin
Posts: 9524
Joined: Wed Mar 18, 2009 11:22 pm
Location: Palermo - Italy
Contact:

Re: Facebook Google Gadget

Post by Giorgio Maone »

Try to add the following line to XSS exceptions:

Code: Select all

^@https?://api\.connect\.facebook\.com/
Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.9.1) Gecko/20090624 Firefox/3.5 (.NET CLR 3.5.30729)
Guest

Re: Facebook Google Gadget

Post by Guest »

it worked! thank you.
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.4) Gecko/20070515 Firefox/2.0.0.4 (.NET CLR 3.5.30729)
Dateline 4:20

Re: Facebook Google Gadget

Post by Dateline 4:20 »

If you don't mind, would you explain why it worked, in case I run into a similar problem in the future?
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1) Gecko/20090624 Firefox/3.5 (.NET CLR 3.5.30729)
User avatar
Giorgio Maone
Site Admin
Posts: 9524
Joined: Wed Mar 18, 2009 11:22 pm
Location: Palermo - Italy
Contact:

Re: Facebook Google Gadget

Post by Giorgio Maone »

Regular expression exceptions starting with ^@ exempt some origin from checks, while normal exceptions match the destination.
The rule means "Exempt from XSS checks requests originated from api.connect.facebook.com, both on http and https".
Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.9.1) Gecko/20090624 Firefox/3.5 (.NET CLR 3.5.30729)
Post Reply