Page 1 of 1

[RESOLVED] Smugmug & Fark.com

Posted: Sat Apr 26, 2014 9:18 pm
by QJ
My Noscript updated 4/25/14, and since the update, I cannot post with pictures in what is principally a picture based thread on Fark.com.
The pictures I post are hosted in a gallery on Smugmug.
The syntax necessary to show both the text of the post and a sample picture from Smugmug would be as follow...

This is a sample/test with a photo
[unfortunately, I cannot post the sample syntax for linking to embed the photo without tripping your spam filter]

The first line is the text, the second line links to the photo I want to display.
This is a weekly thread on Fark.com and I have never had trouble posting.
Since the update, NoScript has prevented me from making any posts.
From what I can discern from reading the console report, it's due to XSS in the hotlink for the picture.
That pretty much is all I can figure out and I could not figure out how to configure an exception to allow it.
I don't have the know-how.
Any suggestions or insight?

Re: Smugmug & Fark.com

Posted: Sat Apr 26, 2014 9:35 pm
by barbaz
read the xss sticky in this forum
if you need help with writing the regex, post here the message from the browser console and exactly what you want to do (allow the origin or trust the destination?)

Re: Smugmug & Fark.com

Posted: Sat Apr 26, 2014 11:20 pm
by QJ
Here is (what I hope) is the pertinant message from the console after I enabled NoScript...

Code: Select all

[NoScript XSS] Sanitized suspicious upload to [https://www.fark.com/comments/8234613/We-are-seeing-rapid-development-of-story-with-first-video-live-from-scene-in-New-York-at-first-North-American-Cat-Cafe-where-adoptable-cats-interact-with-New-Yorkers-All-new-just-in-time-for-Caturday-Livestream-in-progress###DATA###Testing+1-2-3%0D%0A%0D%0A%3Cimg+src%3D%22http%3A%2F%2Freneau.smugmug.com%2Fphotos%2Fi-q2VPQqF%2F0%2FO%2Fi-q2VPQqF.jpg%22%3E] from [http://www.fark.com/comments/8234613/We-are-seeing-rapid-development-of-story-with-first-video-live-from-scene-in-New-York-at-first-North-American-Cat-Cafe-where-adoptable-cats-interact-with-New-Yorkers-All-new-just-in-time-for-Caturday-Livestream-in-progress]: transformed into a download-only GET request.

Re: Smugmug & Fark.com

Posted: Sun Apr 27, 2014 1:04 am
by barbaz
yes that's the right message
you want to add to your xss exceptions

Code: Select all

^@https?://www\.fark\.com/comments/
(blargh, encoded HTML as part of the URL?? :shock: no wonder the xss filter tripped)

Re: Smugmug & Fark.com

Posted: Sun Apr 27, 2014 1:51 am
by QJ
That took care of it!
Thank you so very much for your assistance!

Re: Smugmug & Fark.com

Posted: Mon Apr 28, 2014 2:14 am
by Thrawn
barbaz wrote: (blargh, encoded HTML as part of the URL?? :shock: no wonder the xss filter tripped)
This is known as Vulnerable By Design...