Page 1 of 4
New gmx web interface
Posted: Mon May 19, 2014 4:37 pm
by Luigi
Hello,
2.8.24 breaks the new gmx.com web interface due to XSS.
I wish there was a way to whitelist it, it keeps asking me for confirmation.
It can be tested even without an account, problem being on login.
Regards
Re: New gmx web interface
Posted: Mon May 19, 2014 6:44 pm
by therube
URL to gmx?
What is the XSS message in Error Console?
Re: New gmx web interface
Posted: Mon May 19, 2014 7:12 pm
by Luigi
therube wrote:URL to gmx?
https://www.gmx.com, as I said you can use fake login credentials
and this error will still show up.
therube wrote:What is the XSS message in Error Console?
Code: Select all
[NoScript XSS] Sanitized suspicious upload to [https://login.gmx.com/login#.1559516-header-login1-1###DATA###https%3A%2F%2F%24%28clientName%29-%24%28dataCenter%29.gmx.com%2Flogin] from [https://www.gmx.com/]: transformed into a download-only GET request.
Use of getPreventDefault() is deprecated. Use defaultPrevented instead. jquery.min.js:3
Use of getUserData() or setUserData() is deprecated. Use WeakMap or element.dataset instead. requestNotifier.js:64
Blocked loading mixed active content "http://s.uicdn.com/gmx.com/current/min/lib-head-final.js"
Blocked loading mixed active content "http://s.uicdn.com/gmx.com/current/min/default-final.css"
Blocked loading mixed active content "http://s.uicdn.com/gmx.com/current/min/lib-body-end-final.js"
Loading mixed (insecure) display content on a secure page "http://s.uicdn.com/gmx.com/current/img/favicon.ico"
Re: New gmx web interface
Posted: Mon May 19, 2014 7:28 pm
by Giorgio Maone
Please try adding the following line to your NoScript Options|Advanced|XSS exceptions box:
Re: New gmx web interface
Posted: Mon May 19, 2014 7:32 pm
by Guest
Giorgio Maone wrote:Please try adding the following line to your NoScript Options|Advanced|XSS exceptions box:
Thanks, that did the trick.
Re: New gmx web interface
Posted: Tue May 20, 2014 1:09 am
by Giorgio Maone
Guest wrote:Giorgio Maone wrote:Please try adding the following line to your NoScript Options|Advanced|XSS exceptions box:
Thanks, that did the trick.
You can drop the exception and check
latest development build 2.6.8.25rc1 instead, now, thanks.
Re: New gmx web interface
Posted: Tue May 20, 2014 7:40 am
by Luigi
Giorgio Maone wrote:Guest wrote:Giorgio Maone wrote:Please try adding the following line to your NoScript Options|Advanced|XSS exceptions box:
Thanks, that did the trick.
You can drop the exception and check
latest development build 2.6.8.25rc1 instead, now, thanks.
Works for https, but not http

Re: New gmx web interface
Posted: Tue May 20, 2014 8:51 am
by Giorgio Maone
Luigi wrote:
Works for https, but not http

NoScript Options|Advanced|HTTPS, force
.gmx.com.
Re: New gmx web interface
Posted: Tue May 20, 2014 9:11 am
by LeeB
Re: New gmx web interface
Posted: Tue May 20, 2014 9:38 am
by Giorgio Maone
Oh well, then just
Code: Select all
^@https?://(?:(?:www\.)?gmx|s\.uicdn)\.com/
Re: New gmx web interface
Posted: Tue May 20, 2014 10:47 am
by NS User
Thanks Giorgio, the dev build fixed the GMX login (https)
I thought I`d been hacked, phished or some other awful disaster when I first saw it.
Re: New gmx web interface
Posted: Tue May 20, 2014 11:08 am
by Luigi
Giorgio Maone wrote:
Oh well, then just
Code: Select all
^@https?://(?:(?:www\.)?gmx|s\.uicdn)\.com/
I'm confused. Do I have to ad that rule even on the devel preview?

Re: New gmx web interface
Posted: Tue May 20, 2014 11:34 am
by Giorgio Maone
Luigi wrote:
Code: Select all
^@https?://(?:(?:www\.)?gmx|s\.uicdn)\.com/
I'm confused. Do I have to ad that rule even on the devel preview?

Only if you still have got problems
after forcing HTTPS on .gmx.com.
Re: New gmx web interface
Posted: Wed May 21, 2014 6:51 am
by Luigi
Giorgio Maone wrote:Luigi wrote:
Code: Select all
^@https?://(?:(?:www\.)?gmx|s\.uicdn)\.com/
I'm confused. Do I have to ad that rule even on the devel preview?

Only if you still have got problems
after forcing HTTPS on .gmx.com.
I had to login twice every time, that line seems to have solved that.
Re: New gmx web interface
Posted: Wed May 21, 2014 10:28 am
by Giorgio Maone
Included in
NoScript 2.6.8.25.
The built-im implementation is slightly safer, thus please remove the hand-made exception.