Page 1 of 1
XSS false positive breaks OpenID on stackexchange sites
Posted: Mon Aug 03, 2015 10:02 pm
by forest
NoScript 2.6.9.34's XSS protection currently breaks OpenID login on stackexchange (and sister sites including stackoverflow.com).
I'm testing with a launchpad.net OpenID. The browser console shows several "[NoScript XSS] Sanitized suspicious request" messages, a yellow banner says "NoScript filtered a potential cross-site scripting (XSS) attempt from [
https://gaming.stackexchange.com], and the launchpad OpenID endpoint produces a 404 error.
Re: XSS false positive breaks OpenID on stackexchange sites
Posted: Mon Aug 03, 2015 10:53 pm
by Giorgio Maone
Could you please PM or email me the exact [NoScript XSS] and [InjectionChecker] messages you get in the browser console?
Thanks!
Re: XSS false positive breaks OpenID on stackexchange sites
Posted: Mon Aug 03, 2015 11:56 pm
by forest
Giorgio Maone wrote:Could you please PM or email me the exact [NoScript XSS] and [InjectionChecker] messages you get in the browser console?
Thanks!
Done.
Re: XSS false positive breaks OpenID on stackexchange sites
Posted: Tue Aug 04, 2015 12:06 am
by forest
FYI, I don't remember this being a problem when I logged in to stackexchange yesterday. Unless my memory is failing me, it's probably related to a new login system that they
apparently patched today.
Re: XSS false positive breaks OpenID on stackexchange sites
Posted: Tue Mar 15, 2016 2:05 pm
by Jackalus
Just to confirm that this is now repeating... unable to log in today, even using Unsafely Reload, without disabling: Options | Advanced | XSS | 'Sanitise...' and 'Turn Cross Site...'
When I've disabled these, I'm able to log in fine. I can pm you Console details... How much do you want?
Re: XSS false positive breaks OpenID on stackexchange sites
Posted: Tue Mar 15, 2016 5:00 pm
by barbaz
Jackalus wrote:I can pm you Console details... How much do you want?
The full InjectionChecker and/or XSS mesages would be great, thanks.
Re: XSS false positive breaks OpenID on stackexchange sites
Posted: Wed Mar 16, 2016 4:25 am
by barbaz
Actually does
latest development build 2.9.0.5rc3 still have this problem?
Re: XSS false positive breaks OpenID on stackexchange sites
Posted: Wed Mar 16, 2016 6:43 pm
by foresto
Some stackexchange users have reported working around the problem by adding a regex like this to NoScript's Anti-XSS Protection Exceptions:
Code: Select all
^https://login\.launchpad\.net/\+[Oo][Pp][Ee][Nn][Ii][Dd]\?
Re: XSS false positive breaks OpenID on stackexchange sites
Posted: Thu Mar 17, 2016 6:35 pm
by forest
The just-released 2.9.0.5 still has this problem.