winbank XSS exception

[gvp]

I get he following error in my console

Code: Select all

[NoScript XSS] Sanitized suspicious upload to [https://ebanking.winbank.gr/Login.aspx###DATA###something_here.+something_here] from [https://www.winbank.gr/el/Pages/Home.aspx]: transformed into a download-only GET request.

Which exception is safer

^https?://([a-z]+)\.winbank\.(?:[a-z]{1,3}\.)?[a-z]
or
^@https://[a-z]+\.winbank\.gr/

both of them work ...

[Giorgio Maone]

^@https://[a-z]+\.winbank\.gr/

This one, which authorizes https://*.winbank.gr to bypass the filter when loading another resource.

[gvp]

thank you ...