Need help with tumblr posts and XSS

Ask for help about NoScript, no registration needed to post
User avatar
Myol
Posts: 3
Joined: Sat Nov 07, 2015 1:37 pm

Need help with tumblr posts and XSS

Post by Myol »

Hello.
XSS problem:
Problem and NoScript window
original post after refresh image
Link lesstalkmoreillustration
Console image
I can't see all instagram vids on tumblr dash.
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:42.0) Gecko/20100101 Firefox/42.0
barbaz
Senior Member
Posts: 11142
Joined: Sat Aug 03, 2013 5:45 pm

Re: Need help with tumblr posts and XSS

Post by barbaz »

Myol wrote:Problem and NoScript window
Those two images do not load for me.
I therefore don't know what to look for on the link :|
Myol wrote:Console image
This looks like a CORS error, nothing to do with the XSS filter...
Can you please translate the console message to English?
*Always* check the changelogs BEFORE updating that important software!
-
User avatar
Myol
Posts: 3
Joined: Sat Nov 07, 2015 1:37 pm

Re: Need help with tumblr posts and XSS

Post by Myol »

barbaz wrote:This looks like a CORS error, nothing to do with the XSS filter...
Can you please translate the console message to English?
Sorry, wrong console message. Add new in the last reply.
barbaz wrote: Those two images do not load for me.
Ok)
Image Image
Last edited by Myol on Sat Nov 07, 2015 7:44 pm, edited 2 times in total.
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:42.0) Gecko/20100101 Firefox/42.0
User avatar
Myol
Posts: 3
Joined: Sat Nov 07, 2015 1:37 pm

Re: Need help with tumblr posts and XSS

Post by Myol »

Video 1080p with my XSS problem: Here
Code from console: http://wilsonoreg.tumblr.com/post/132741757058/console
Last edited by barbaz on Sat Nov 07, 2015 9:15 pm, edited 1 time in total.
Reason: I don't like tiny URLs
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:42.0) Gecko/20100101 Firefox/42.0
barbaz
Senior Member
Posts: 11142
Joined: Sat Aug 03, 2013 5:45 pm

Re: Need help with tumblr posts and XSS

Post by barbaz »

Thanks for the additional info and fixing the images.

The issue is that they're passing what looks like HTML code around in URLs... which is just asking to be XSSed. I'll leave to someone else to come up with a solution or work-around for you, because I don't have any good ideas here, sorry.
*Always* check the changelogs BEFORE updating that important software!
-
User avatar
Thrawn
Master Bug Buster
Posts: 3106
Joined: Mon Jan 16, 2012 3:46 am
Location: Australia
Contact:

Re: Need help with tumblr posts and XSS

Post by Thrawn »

You might be able to work around this by filtering the site with ABE and adding an XSS exception, but it's safer to just not use the site if you can avoid it.
======
Thrawn
------------
Religion is not the opium of the masses. Daily life is the opium of the masses.

True religion, which dares to acknowledge death and challenge the way we live, is an attempt to wake up.
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:41.0) Gecko/20100101 Firefox/41.0
Post Reply