Page 1 of 1

Tumblr XSS block

Posted: Tue Jan 29, 2013 11:59 pm
by Hannes
Hello

Sometimes a page gets blocked by the XSSprotection like just now, when i wanted to see a preview of my tumblr-post.
Now the question: Is there a function where i just click on and an exception is generated and integrated in the list in the settings of noscript?
If not, where can i find a help file that tells me HOW to do that exception on my own, as neither the software nor the website can tell me how to do it, how the syntax has to be, which operators have to be in the command.
What do all these special characters mean in here for example: ^https?://([a-z]+)\.google\.(?:[a-z]{1,3}\.)?[a-z]+/(?:search|custom|\1)\?

Thank you

Re: Tumblr XSS block

Posted: Wed Jan 30, 2013 5:49 am
by Tom T.
Could you please reproduce the situation which causes the XSS message, then open Error Console (Ctrl+Shift+J), look at the blue "Info" messages, and copy/paste here any messages relating to NoScript? In particular, those that start with [XSS].

Then we can help you write a specific rule for that site, *after ensuring that is in fact a false positive* (false alarm).

The many characters in the sample regular expression that you cited were needed for broad-based exceptions such as searches at Google or Ebay, where any of millions of search results are possible. So the exception had to be generalized. Hopefully, yours can be shorter and more specific. (and easier to understand)