false alarms

[noscript user]

I noticed that noscript gives a suspicious request notice when a form of a site is accessed from the spiders cache

[NoScript XSS] Sanitized suspicious request referer. URL [http://www.example.com/test.htm (REF: http://209.85.229.132/search?q=cache:zn ... k&ie=UTF-8)] requested from [http://209.85.229.132/search?q=cache:zn ... k&ie=UTF-8]. Sanitized Referrer: [http://209.85.229.132/search?q=cache%20 ... k&ie=UTF-8].

[NoScript XSS] Sanitized suspicious upload to [http://www.example.com/test.htm] from [http://209.85.229.132/search?q=cache:zn ... k&ie=UTF-8]: transformed into a download-only GET request.

The real url is been replaced with example.com and the script with test.htm. The notice is against the spider's cache. And there is nothing malicious on the site either.

Also Just because I block the UA on my FF doesn't mean I am a bot.

[Giorgio Maone]

That's expected if you don't have http://209.85.229.132 in your whitelist but "example.com" is trusted.
POST requests from untrusted to trusted sites are stripped off of their payload.

[noscript user]

Ok, thanks for the clarification Giorgio, this explains it.