False positive xss from GET [https://apis.google.com/u/0/se/

[Semtex]

Since today I see a lot off potential xss, seems to be false positive, example:
Visit this site: http://winaero.com/
You will get xss warning:

Code: Select all

GET [https://apis.google.com/u/0/se/0/_/+1/fastbutton?usegapi=1&annotation=bubble&count=true&size=medium&origin=http%3A%2F%2Fwinaero.com&url=http%3A%2F%2Fwinaero.com%2F&gsrc=3p&ic=1&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.pl.g2YTzie20JY.O%2Fm%3D__features__%2Fam%3DAQ%2Frt%3Dj%2Fd%3D1%2Frs%3DAGLTcCO4OwvWzOu0jA​O5U3VPr-wKo3oHEA#_methods=onPlusOne%2C_ready%2C_close%2C_open%2C_resizeMe%2C_renderstart%2Concircled%2Cdrefresh%2Cerefresh%2Conload&id=I0_1458154573576&parent=http%3A%2F%2Fwinaero.com&pfname=&rpctoken=31939542]

FROM [http://winaero.com/]

Happen on all sites with apis.google.com
Latest stable NS version on latest Nightly.

[Thrawn]

That doesn't look like the whole XSS warning; was there more in the Browser Console than that?

[maba]

I can confirm this error. It happens for example on https://mbruehl.wordpress.com/
From there you can get a log of a false XSS warning.

[Semtex]

That doesn't look like the whole XSS warning; was there more in the Browser Console than that?

First insert was from "unsafe reload page popup"

Here You have info from console:

Code: Select all

expression closures are deprecatedRemoteAddonsParent.jsm:763:56
[NoScript InjectionChecker] JavaScript Injection in null&socialite=2&hl=pl_PL&origin=http://www.dobreprogramy.pl&url=http://www.dobreprogramy.pl/Book-of-Demons-urodziwa-polska-gra-Hack-n-Slash-z-duza-doza-humoru,News,71444.html&gsrc=3p&jsh=m;/_/scs/apps-static/_/js/k=oz.gapi.pl.TNKwYI-wZVY.O/m=__features__/am=AQ/rt=j/d=1/rs=AGLTcCNRVGrY_OAW_R9KDeL3OjYEIKvOFg#_methods=onPlusOne,_ready,_close,_open,_resizeMe,_renderstart,oncircled,drefresh,erefresh,onstartinteraction,onendinteraction&id=I0_1458212910857&parent=http://www.dobreprogramy.pl&pfname=&rpctoken=41093889
(function anonymous() {
_methods=onPlusOne,_ready,_close,_open,_resizeMe,_renderstart,oncircled,drefresh,erefresh,onstartinteraction,onendinteraction /* COMMENT_TERMINATOR */
DUMMY_EXPR
})
[NoScript XSS] Sanitized suspicious request. Original URL [https://apis.google.com/u/0/se/0/_/+1/fastbutton?usegapi=1&size=tall&default-href=null&socialite=2&hl=pl_PL&origin=http%3A%2F%2Fwww.dobreprogramy.pl&url=http%3A%2F%2Fwww.dobreprogramy.pl%2FBook-of-Demons-urodziwa-polska-gra-Hack-n-Slash-z-duza-doza-humoru%2CNews%2C71444.html&gsrc=3p&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.pl.TNKwYI-wZVY.O%2Fm%3D__features__%2Fam%3DAQ%2Frt%3Dj%2Fd%3D1%2Frs%3DAGLTcCNRVGrY_OAW_R9KDeL3OjYEIKvOFg#_methods=onPlusOne%2C_ready%2C_close%2C_open%2C_resizeMe%2C_renderstart%2Concircled%2Cdrefresh%2Cerefresh%2Constartinteraction%2Conendinteraction&id=I0_1458212910857&parent=http%3A%2F%2Fwww.dobreprogramy.pl&pfname=&rpctoken=41093889] requested from [http://www.dobreprogramy.pl/Book-of-Demons-urodziwa-polska-gra-Hack-n-Slash-z-duza-doza-humoru,News,71444.html]. Sanitized URL: [https://apis.google.com/#4008579605503134776].

Another one from Neowin:

Code: Select all

[NoScript InjectionChecker] JavaScript Injection in ///u/0/_/widget/render/follow?usegapi=1&rel=publisher&height=20&annotation=bubble&origin=http://www.neowin.net&url=https://plus.google.com/103621864990923776909&gsrc=3p&ic=1&jsh=m;/_/scs/apps-static/_/js/k=oz.gapi.pl.TNKwYI-wZVY.O/m=__features__/am=AQ/rt=j/d=1/rs=AGLTcCNRVGrY_OAW_R9KDeL3OjYEIKvOFg#_methods=onPlusOne,_ready,_close,_open,_resizeMe,_renderstart,oncircled,drefresh,erefresh,onload&id=I0_1458213752853&parent=http://www.neowin.net&pfname=&rpctoken=41815544
(function anonymous() {
_methods=onPlusOne,_ready,_close,_open,_resizeMe,_renderstart,oncircled,drefresh,erefresh,onload /* COMMENT_TERMINATOR */
DUMMY_EXPR
})
[NoScript XSS] Sanitized suspicious request. Original URL [https://apis.google.com/u/0/_/widget/render/follow?usegapi=1&rel=publisher&height=20&annotation=bubble&origin=http%3A%2F%2Fwww.neowin.net&url=https%3A%2F%2Fplus.google.com%2F103621864990923776909&gsrc=3p&ic=1&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.pl.TNKwYI-wZVY.O%2Fm%3D__features__%2Fam%3DAQ%2Frt%3Dj%2Fd%3D1%2Frs%3DAGLTcCNRVGrY_OAW_R9KDeL3OjYEIKvOFg#_methods=onPlusOne%2C_ready%2C_close%2C_open%2C_resizeMe%2C_renderstart%2Concircled%2Cdrefresh%2Cerefresh%2Conload&id=I0_1458213752853&parent=http%3A%2F%2Fwww.neowin.net&pfname=&rpctoken=41815544] requested from [http://www.neowin.net/]. Sanitized URL: [https://apis.google.com/#447637964145464581].

I see this on every second visited page, annoying a bit... ;/

[Semtex]

Latest dev. build fix this annoying problem.