InformAction Forums

NoScripters and WebSec nerds of all lands, unite!
https://forums.informaction.com/

USA Today video does not load when XSS

https://forums.informaction.com/viewtopic.php?t=21720

Page 1 of 1

USA Today video does not load when XSS

Posted: Thu Mar 17, 2016 12:03 pm
by tancrackers
When this option is enabled in NoScript:
"Sanitize cross-site suspicious requests"

The video on this page does not load:
http://www.usatoday.com/story/money/bus ... /81884078/

I narrowed it down to this specific option. I even allowed all scripts and disabled my other Firefox addons.

I am using:
Firefox 45.0
NoScript 2.9.0.5
Arch Linux
Plasma 5.5.5
Linux 4.4.5-1-ARCH

Re: USA Today video does not load when XSS

Posted: Thu Mar 17, 2016 5:12 pm
by barbaz
Please check the Browser Console (Ctrl-Shift-J) when this issue happens and post here any messages related to NoScript.
(related messages usually start with either "[NoScript" or "[ABE]"; if you don't know what's related, turn off CSS warnings and post everything else you see)

EDIT Does downgrading to NoScript 2.9.0.5rc2 let it work again?
Old NoScript @
https://addons.mozilla.org/addon/noscript/versions
*or*
https://noscript.net/feed?c=100&t=a

Re: USA Today video does not load when XSS

Posted: Fri Mar 25, 2016 4:37 pm
by tancrackers
I tested with this video:
http://www.usatoday.com/videos/news/wor ... /82119260/
The problem happens with this, too.

The logs from the Browser Console are as follows:

Code: Select all

unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4208:31
unsafe CPOW usage noscriptService.js:4211:10
unsafe CPOW usage noscriptService.js:4213:10
unsafe CPOW usage noscriptService.js:4215:0
unsafe CPOW usage noscriptService.js:5430:11
unsafe CPOW usage noscriptService.js:5505:8
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage DOM.js:68:6
unsafe CPOW usage DOM.js:68:13
unsafe CPOW usage noscriptOverlay.js:2031:42
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptOverlay.js:2120:8
unsafe CPOW usage noscriptService.js:3959:8
unsafe CPOW usage noscriptService.js:3959:38
unsafe CPOW usage noscriptService.js:3960:0
unsafe CPOW usage noscriptService.js:3960:37
unsafe CPOW usage remote-browser.xml:164:0
unsafe CPOW usage warning.js:742:18
"App: Overlay-with-arrows/Video Asset" main.min.js:6
Site Loaded main.min.js:7
Router: Preloading:  /news/ main.min.js:6
unsafe CPOW usage RemoteAddonsParent.jsm:798:2
unsafe CPOW usage noscriptService.js:5422:10
unsafe CPOW usage RemoteAddonsParent.jsm:798:2
unsafe CPOW usage noscriptService.js:5424:0
unsafe CPOW usage noscriptService.js:5422:22
unsafe CPOW usage noscriptService.js:5430:11
unsafe CPOW usage noscriptService.js:5431:10
unsafe CPOW usage noscriptService.js:5431:21
unsafe CPOW usage noscriptService.js:5452:10
unsafe CPOW usage noscriptService.js:5456:0
unsafe CPOW usage noscriptService.js:5461:10
unsafe CPOW usage noscriptService.js:5462:10
unsafe CPOW usage noscriptService.js:5467:14
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptService.js:5491:0
unsafe CPOW usage noscriptService.js:5496:19
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptService.js:4164:10
unsafe CPOW usage noscriptService.js:4164:20
unsafe CPOW usage noscriptService.js:4165:8
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptService.js:4168:10
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4208:31
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4208:31
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:5430:11
unsafe CPOW usage noscriptService.js:5505:8
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage DOM.js:68:6
unsafe CPOW usage DOM.js:68:13
unsafe CPOW usage noscriptOverlay.js:2031:42
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptOverlay.js:2120:8
unsafe CPOW usage noscriptService.js:3959:8
unsafe CPOW usage noscriptService.js:3960:0
unsafe CPOW usage noscriptService.js:3960:37
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:2354:10
[NoScript InjectionChecker] JavaScript Injection in ///services/viewer/federated_f9?&width=880&height=495&flashID=myExperience2&bgcolor=#FFFFFF&playerID=2245242285001&autoStart=false&isVid=true&isUI=true&wmode=transparent&htmlFallback=true&dynamicStreaming=true&includeAPI=true&usat_hasEmbed=true&templateReadyHandler=brightcove["templateReadyHandlermyExperience2"]&templateLoadHandler=BCCallbacks.myExperience2.onTemplateLoad&templateErrorHandler=BCCallbacks.myExperience2.onTemplateError&adServerURL=http://pubads.g.doubleclick.net/gampad/ads?env=vp&gdfp_req=1&impl=s&output=xml_vast2&iu=7103/usatoday/preroll_video/news/world&sz=920x508&unviewed_position_start=1&cust_params=contentid%3D82119260%26pagetype%3Dvideo-asset%26aam%3D%26u%3Dundefined&cmsid=12768&url=""&usat_linkurl=http://www.usatoday.com/videos/news/world/2016/03/23/82119260/&SSTSCode=news/world/&usat_shareFunction=function(){setTimeout(BCCallbacks.myExperience2.onClickShareButton(), 1)}&@videoPlayer=ref:82119260&debuggerID=&originalTemplateReadyHandler=BCCallbacks.myExperience2.onTemplateReady&startTime=1458923627604
(function anonymous() {
setTimeout(BCCallbacks.myExperience2.onClickShareButton(), 1) /* COMMENT_TERMINATOR */
DUMMY_EXPR
})
[NoScript XSS] Sanitized suspicious request. Original URL [http://c.brightcove.com/services/viewer/federated_f9?&width=880&height=495&flashID=myExperience2&bgcolor=%23FFFFFF&playerID=2245242285001&autoStart=false&isVid=true&isUI=true&wmode=transparent&htmlFallback=true&dynamicStreaming=true&includeAPI=true&usat_hasEmbed=true&templateReadyHandler=brightcove%5B%22templateReadyHandlermyExperience2%22%5D&templateLoadHandler=BCCallbacks.myExperience2.onTemplateLoad&templateErrorHandler=BCCallbacks.myExperience2.onTemplateError&adServerURL=http%3A%2F%2Fpubads.g.doubleclick.net%2Fgampad%2Fads%3Fenv%3Dvp%26gdfp_req%3D1%26impl%3Ds%26output%3Dxml_vast2%26iu%3D7103%2Fusatoday%2Fpreroll_video%2Fnews%2Fworld%26sz%3D920x508%26unviewed_position_start%3D1%26cust_params%3Dcontentid%253D82119260%2526pagetype%253Dvideo-asset%2526aam%253D%2526u%253Dundefined%26cmsid%3D12768%26url%3D%22%22&usat_linkurl=http%3A%2F%2Fwww.usatoday.com%2Fvideos%2Fnews%2Fworld%2F2016%2F03%2F23%2F82119260%2F&SSTSCode=news%2Fworld%2F&usat_shareFunction=function()%7BsetTimeout(BCCallbacks.myExperience2.onClickShareButton()%2C%201)%7D&%40videoPlayer=ref%3A82119260&debuggerID=&originalTemplateReadyHandler=BCCallbacks.myExperience2.onTemplateReady&startTime=1458923627604] requested from [chrome://browser/content/browser.xul]. Sanitized URL: [http://c.brightcove.com/#22718382928081915266].
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage RemoteAddonsParent.jsm:798:2
unsafe CPOW usage noscriptService.js:5422:10
unsafe CPOW usage RemoteAddonsParent.jsm:798:2
unsafe CPOW usage noscriptService.js:5424:0
unsafe CPOW usage noscriptService.js:5422:22
unsafe CPOW usage noscriptService.js:5430:11
unsafe CPOW usage noscriptService.js:5431:10
unsafe CPOW usage noscriptService.js:5431:21
unsafe CPOW usage noscriptService.js:5452:10
unsafe CPOW usage noscriptService.js:5456:0
unsafe CPOW usage noscriptService.js:5461:10
unsafe CPOW usage noscriptService.js:5462:10
unsafe CPOW usage noscriptService.js:5467:14
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptService.js:5491:0
unsafe CPOW usage noscriptService.js:5496:19
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptService.js:4164:10
unsafe CPOW usage noscriptService.js:4164:20
unsafe CPOW usage noscriptService.js:4165:8
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptService.js:4168:10
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4208:31
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4208:31
unsafe CPOW usage noscriptService.js:4211:10
unsafe CPOW usage noscriptService.js:4213:10
unsafe CPOW usage noscriptService.js:4215:0
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:5430:11
unsafe CPOW usage noscriptService.js:5431:10
unsafe CPOW usage noscriptService.js:5431:21
unsafe CPOW usage noscriptService.js:5452:10
unsafe CPOW usage noscriptService.js:5456:0
unsafe CPOW usage noscriptService.js:5461:10
unsafe CPOW usage noscriptService.js:5462:10
unsafe CPOW usage noscriptService.js:5467:14
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptService.js:5496:19
unsafe CPOW usage noscriptService.js:5430:11
unsafe CPOW usage noscriptService.js:5431:10
unsafe CPOW usage noscriptService.js:5431:21
unsafe CPOW usage noscriptService.js:5452:10
unsafe CPOW usage noscriptService.js:5456:0
unsafe CPOW usage noscriptService.js:5461:10
unsafe CPOW usage noscriptService.js:5462:10
unsafe CPOW usage noscriptService.js:5467:14
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptService.js:5496:19
unsafe CPOW usage noscriptService.js:5430:11
unsafe CPOW usage noscriptService.js:5431:10
unsafe CPOW usage noscriptService.js:5431:21
unsafe CPOW usage noscriptService.js:5452:10
unsafe CPOW usage noscriptService.js:5456:0
unsafe CPOW usage noscriptService.js:5461:10
unsafe CPOW usage noscriptService.js:5462:10
unsafe CPOW usage noscriptService.js:5467:14
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptService.js:5496:19
unsafe CPOW usage noscriptService.js:5430:11
unsafe CPOW usage noscriptService.js:5431:10
unsafe CPOW usage noscriptService.js:5431:21
unsafe CPOW usage noscriptService.js:5452:10
unsafe CPOW usage noscriptService.js:5456:0
unsafe CPOW usage noscriptService.js:5461:10
unsafe CPOW usage noscriptService.js:5462:10
unsafe CPOW usage noscriptService.js:5467:14
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptService.js:5496:19
unsafe CPOW usage noscriptService.js:5430:11
unsafe CPOW usage noscriptService.js:5431:10
unsafe CPOW usage noscriptService.js:5431:21
unsafe CPOW usage noscriptService.js:5452:10
unsafe CPOW usage noscriptService.js:5456:0
unsafe CPOW usage noscriptService.js:5461:10
unsafe CPOW usage noscriptService.js:5462:10
unsafe CPOW usage noscriptService.js:5467:14
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptService.js:5496:19
unsafe CPOW usage noscriptService.js:5430:11
unsafe CPOW usage noscriptService.js:5431:10
unsafe CPOW usage noscriptService.js:5431:21
unsafe CPOW usage noscriptService.js:5452:10
unsafe CPOW usage noscriptService.js:5456:0
unsafe CPOW usage noscriptService.js:5461:10
unsafe CPOW usage noscriptService.js:5462:10
unsafe CPOW usage noscriptService.js:5467:14
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptService.js:5496:19
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptService.js:3959:8
unsafe CPOW usage noscriptService.js:3959:38
unsafe CPOW usage noscriptService.js:3960:0
unsafe CPOW usage noscriptService.js:3960:37
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptService.js:4164:10
unsafe CPOW usage noscriptService.js:4164:20
unsafe CPOW usage noscriptService.js:4165:8
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptService.js:3959:8
unsafe CPOW usage noscriptService.js:3960:0
unsafe CPOW usage noscriptService.js:3960:37
unsafe CPOW usage noscriptService.js:5430:11
unsafe CPOW usage noscriptService.js:5505:8
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage DOM.js:68:6
unsafe CPOW usage DOM.js:68:13
unsafe CPOW usage noscriptOverlay.js:2031:42
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptOverlay.js:2120:8
unsafe CPOW usage noscriptService.js:3959:8
unsafe CPOW usage noscriptService.js:3960:0
unsafe CPOW usage noscriptService.js:3960:37
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage RemoteAddonsParent.jsm:798:2
unsafe CPOW usage noscriptService.js:5422:10
unsafe CPOW usage RemoteAddonsParent.jsm:798:2
unsafe CPOW usage noscriptService.js:5424:0
unsafe CPOW usage noscriptService.js:5422:22
unsafe CPOW usage noscriptService.js:5430:11
unsafe CPOW usage noscriptService.js:5431:10
unsafe CPOW usage noscriptService.js:5431:21
unsafe CPOW usage noscriptService.js:5452:10
unsafe CPOW usage noscriptService.js:5456:0
unsafe CPOW usage noscriptService.js:5461:10
unsafe CPOW usage noscriptService.js:5462:10
unsafe CPOW usage noscriptService.js:5467:14
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptService.js:5491:0
unsafe CPOW usage noscriptService.js:5496:19
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptService.js:4164:10
unsafe CPOW usage noscriptService.js:4164:20
unsafe CPOW usage noscriptService.js:4165:8
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptService.js:4168:10
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4208:31
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4208:31
unsafe CPOW usage noscriptService.js:4211:10
unsafe CPOW usage noscriptService.js:4213:10
unsafe CPOW usage noscriptService.js:4215:0
unsafe CPOW usage noscriptService.js:5430:11
unsafe CPOW usage noscriptService.js:5431:10
unsafe CPOW usage noscriptService.js:5431:21
unsafe CPOW usage noscriptService.js:5452:10
unsafe CPOW usage noscriptService.js:5456:0
unsafe CPOW usage noscriptService.js:5461:10
unsafe CPOW usage noscriptService.js:5462:10
unsafe CPOW usage noscriptService.js:5467:14
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptService.js:5496:19
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptService.js:3959:8
unsafe CPOW usage noscriptService.js:3960:0
unsafe CPOW usage noscriptService.js:3960:37
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptService.js:4164:10
unsafe CPOW usage noscriptService.js:4164:20
unsafe CPOW usage noscriptService.js:4165:8
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptService.js:3959:8
unsafe CPOW usage noscriptService.js:3960:0
unsafe CPOW usage noscriptService.js:3960:37
unsafe CPOW usage noscriptService.js:4168:10
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:5430:11
unsafe CPOW usage noscriptService.js:5431:10
unsafe CPOW usage noscriptService.js:5431:21
unsafe CPOW usage noscriptService.js:5452:10
unsafe CPOW usage noscriptService.js:5456:0
unsafe CPOW usage noscriptService.js:5461:10
unsafe CPOW usage noscriptService.js:5462:10
unsafe CPOW usage noscriptService.js:5467:14
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptService.js:5496:19
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptService.js:3959:8
unsafe CPOW usage noscriptService.js:3960:0
unsafe CPOW usage noscriptService.js:3960:37
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptService.js:4164:10
unsafe CPOW usage noscriptService.js:4164:20
unsafe CPOW usage noscriptService.js:4165:8
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptService.js:3959:8
unsafe CPOW usage noscriptService.js:3960:0
unsafe CPOW usage noscriptService.js:3960:37
unsafe CPOW usage noscriptService.js:4168:10
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:5430:11
unsafe CPOW usage noscriptService.js:5431:10
unsafe CPOW usage noscriptService.js:5431:21
unsafe CPOW usage noscriptService.js:5452:10
unsafe CPOW usage noscriptService.js:5456:0
unsafe CPOW usage noscriptService.js:5461:10
unsafe CPOW usage noscriptService.js:5462:10
unsafe CPOW usage noscriptService.js:5467:14
unsafe CPOW usage RemoteAddonsParent.jsm:798:2
unsafe CPOW usage noscriptService.js:5470:16
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptService.js:5496:19
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptService.js:3959:8
unsafe CPOW usage noscriptService.js:3960:0
unsafe CPOW usage noscriptService.js:3960:37
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptService.js:4164:10
unsafe CPOW usage noscriptService.js:4164:20
unsafe CPOW usage noscriptService.js:4165:8
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptService.js:3959:8
unsafe CPOW usage noscriptService.js:3960:0
unsafe CPOW usage noscriptService.js:3960:37
unsafe CPOW usage noscriptService.js:4168:10
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:5430:11
unsafe CPOW usage noscriptService.js:5431:10
unsafe CPOW usage noscriptService.js:5431:21
unsafe CPOW usage noscriptService.js:5452:10
unsafe CPOW usage noscriptService.js:5456:0
unsafe CPOW usage noscriptService.js:5461:10
unsafe CPOW usage noscriptService.js:5462:10
unsafe CPOW usage noscriptService.js:5467:14
unsafe CPOW usage RemoteAddonsParent.jsm:798:2
unsafe CPOW usage noscriptService.js:5470:16
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptService.js:5496:19
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptService.js:3959:8
unsafe CPOW usage noscriptService.js:3960:0
unsafe CPOW usage noscriptService.js:3960:37
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptService.js:4164:10
unsafe CPOW usage noscriptService.js:4164:20
unsafe CPOW usage noscriptService.js:4165:8
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptService.js:3959:8
unsafe CPOW usage noscriptService.js:3960:0
unsafe CPOW usage noscriptService.js:3960:37
unsafe CPOW usage noscriptService.js:4168:10
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:5430:11
unsafe CPOW usage noscriptService.js:5431:10
unsafe CPOW usage noscriptService.js:5431:21
unsafe CPOW usage noscriptService.js:5452:10
unsafe CPOW usage noscriptService.js:5456:0
unsafe CPOW usage noscriptService.js:5461:10
unsafe CPOW usage noscriptService.js:5462:10
unsafe CPOW usage noscriptService.js:5467:14
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptService.js:5496:19
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptService.js:4164:10
unsafe CPOW usage noscriptService.js:4164:20
unsafe CPOW usage noscriptService.js:4165:8
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptService.js:5430:11
unsafe CPOW usage noscriptService.js:5505:8
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage DOM.js:68:6
unsafe CPOW usage DOM.js:68:13
unsafe CPOW usage noscriptOverlay.js:2031:42
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptOverlay.js:2120:8
unsafe CPOW usage noscriptService.js:3959:8
unsafe CPOW usage noscriptService.js:3960:0
unsafe CPOW usage noscriptService.js:3960:37
unsafe CPOW usage RemoteAddonsParent.jsm:798:2
unsafe CPOW usage noscriptService.js:5422:10
unsafe CPOW usage RemoteAddonsParent.jsm:798:2
unsafe CPOW usage noscriptService.js:5424:0
unsafe CPOW usage noscriptService.js:5422:22
unsafe CPOW usage noscriptService.js:5430:11
unsafe CPOW usage noscriptService.js:5431:10
unsafe CPOW usage noscriptService.js:5431:21
unsafe CPOW usage noscriptService.js:5452:10
unsafe CPOW usage noscriptService.js:5456:0
unsafe CPOW usage noscriptService.js:5461:10
unsafe CPOW usage noscriptService.js:5462:10
unsafe CPOW usage noscriptService.js:5467:14
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptService.js:5491:0
unsafe CPOW usage noscriptService.js:5496:19
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptService.js:4164:10
unsafe CPOW usage noscriptService.js:4164:20
unsafe CPOW usage noscriptService.js:4165:8
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptService.js:4168:10
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4208:31
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:5430:11
unsafe CPOW usage noscriptService.js:5431:10
unsafe CPOW usage noscriptService.js:5431:21
unsafe CPOW usage noscriptService.js:5452:10
unsafe CPOW usage noscriptService.js:5456:0
unsafe CPOW usage noscriptService.js:5461:10
unsafe CPOW usage noscriptService.js:5462:10
unsafe CPOW usage noscriptService.js:5467:14
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptService.js:5496:19
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptService.js:4164:10
unsafe CPOW usage noscriptService.js:4164:20
unsafe CPOW usage noscriptService.js:4165:8
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptService.js:4168:10
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:5430:11
unsafe CPOW usage noscriptService.js:5431:10
unsafe CPOW usage noscriptService.js:5431:21
unsafe CPOW usage noscriptService.js:5452:10
unsafe CPOW usage noscriptService.js:5456:0
unsafe CPOW usage noscriptService.js:5461:10
unsafe CPOW usage noscriptService.js:5462:10
unsafe CPOW usage noscriptService.js:5467:14
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptService.js:5496:19
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptService.js:4164:10
unsafe CPOW usage noscriptService.js:4164:20
unsafe CPOW usage noscriptService.js:4165:8
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptService.js:4168:10
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4191:14
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:5430:11
unsafe CPOW usage noscriptService.js:5431:10
unsafe CPOW usage noscriptService.js:5431:21
unsafe CPOW usage noscriptService.js:5452:10
unsafe CPOW usage noscriptService.js:5456:0
unsafe CPOW usage noscriptService.js:5461:10
unsafe CPOW usage noscriptService.js:5462:10
unsafe CPOW usage noscriptService.js:5467:14
unsafe CPOW usage RemoteAddonsParent.jsm:798:2
unsafe CPOW usage noscriptService.js:5470:16
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptService.js:5496:19
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptService.js:4164:10
unsafe CPOW usage noscriptService.js:4164:20
unsafe CPOW usage noscriptService.js:4165:8
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptService.js:4168:10
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:5430:11
unsafe CPOW usage noscriptService.js:5431:10
unsafe CPOW usage noscriptService.js:5431:21
unsafe CPOW usage noscriptService.js:5452:10
unsafe CPOW usage noscriptService.js:5456:0
unsafe CPOW usage noscriptService.js:5461:10
unsafe CPOW usage noscriptService.js:5462:10
unsafe CPOW usage noscriptService.js:5467:14
unsafe CPOW usage RemoteAddonsParent.jsm:798:2
unsafe CPOW usage noscriptService.js:5470:16
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptService.js:5496:19
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptService.js:4164:10
unsafe CPOW usage noscriptService.js:4164:20
unsafe CPOW usage noscriptService.js:4165:8
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptService.js:4168:10
unsafe CPOW usage noscriptService.js:2354:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:4174:12
unsafe CPOW usage noscriptService.js:4174:21
unsafe CPOW usage noscriptService.js:4178:10
unsafe CPOW usage noscriptService.js:5430:11
unsafe CPOW usage noscriptService.js:5431:10
unsafe CPOW usage noscriptService.js:5431:21
unsafe CPOW usage noscriptService.js:5452:10
unsafe CPOW usage noscriptService.js:5456:0
unsafe CPOW usage noscriptService.js:5461:10
unsafe CPOW usage noscriptService.js:5462:10
unsafe CPOW usage noscriptService.js:5467:14
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptService.js:5496:19
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptService.js:4164:10
unsafe CPOW usage noscriptService.js:4164:20
unsafe CPOW usage noscriptService.js:4165:8
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptService.js:5430:11
unsafe CPOW usage noscriptService.js:5505:8
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage DOM.js:68:6
unsafe CPOW usage DOM.js:68:13
unsafe CPOW usage noscriptOverlay.js:2031:42
unsafe CPOW usage noscriptService.js:3954:4
unsafe CPOW usage noscriptOverlay.js:2120:8
unsafe CPOW usage noscriptService.js:3959:8
unsafe CPOW usage noscriptService.js:3960:0
unsafe CPOW usage noscriptService.js:3960:37
video player error: serviceUnavailable main.min.js:12
1458923638098	Toolkit.Telemetry	WARN	TelemetryStorage::_scanArchive - have seen this id before: f8ed9d19-3a2d-4b68-9f25-8bf4e246b1e3, overwrite: false
OpenGL compositor Initialized Succesfully.
Version: 4.5.0 NVIDIA 361.28
Vendor: NVIDIA Corporation
Renderer: GeForce GTX 960M/PCIe/SSE2
FBO Texture Target: TEXTURE_2D

Re: USA Today video does not load when XSS

Posted: Fri Mar 25, 2016 4:48 pm
by barbaz
Is this with NoScript 2.9.0.10 (or 2.9.0.10rc1)? If not please upgrade then re-try.

Re: USA Today video does not load when XSS

Posted: Fri Mar 25, 2016 6:09 pm
by tancrackers
barbaz wrote:Is this with NoScript 2.9.0.10 (or 2.9.0.10rc1)? If not please upgrade then re-try.
This log was with NoScript 2.9.0.10

I also tried 2.9.0.5RC2, but to no avail

Re: USA Today video does not load when XSS

Posted: Fri Mar 25, 2016 7:01 pm
by barbaz
Oh jeez, I can't believe I completely missed one of the two relevant console messages :roll: Sorry about that.


They're literally including JavaScript fragment in the URL!!!!!!!!!!! It is extremely likely that it is vulnerable to XSS!!!!!!
Image
The XSS filter is saving you, please leave it enabled for your own safety!

Re: USA Today video does not load when XSS

Posted: Fri Mar 25, 2016 8:16 pm
by tancrackers
Here's the XSS notification NoScript gives:
http://pastebin.com/ev4zaaNb

Also, if I do an unsafe reload, this is the url in the address bar:
http://pastebin.com/UquGgwde

I have to pastebin these since the forum wouldn't allow them.
I'm assuming that USA Today should be notified?

Re: USA Today video does not load when XSS

Posted: Fri Mar 25, 2016 8:36 pm
by barbaz
Not sure whether USA Today or Brightcove. Please be sure to point whoever you contact to this thread.

I'll extract the relevant parts of the console messages you posted, for convenience:

The problem, spelled out:

Code: Select all

[NoScript InjectionChecker] JavaScript Injection in ///services/viewer/federated_f9?&width=880&height=495&flashID=myExperience2&bgcolor=#FFFFFF&playerID=2245242285001&autoStart=false&isVid=true&isUI=true&wmode=transparent&htmlFallback=true&dynamicStreaming=true&includeAPI=true&usat_hasEmbed=true&templateReadyHandler=brightcove["templateReadyHandlermyExperience2"]&templateLoadHandler=BCCallbacks.myExperience2.onTemplateLoad&templateErrorHandler=BCCallbacks.myExperience2.onTemplateError&adServerURL=http://pubads.g.doubleclick.net/gampad/ads?env=vp&gdfp_req=1&impl=s&output=xml_vast2&iu=7103/usatoday/preroll_video/news/world&sz=920x508&unviewed_position_start=1&cust_params=contentid%3D82119260%26pagetype%3Dvideo-asset%26aam%3D%26u%3Dundefined&cmsid=12768&url=""&usat_linkurl=http://www.usatoday.com/videos/news/world/2016/03/23/82119260/&SSTSCode=news/world/&usat_shareFunction=function(){setTimeout(BCCallbacks.myExperience2.onClickShareButton(), 1)}&@videoPlayer=ref:82119260&debuggerID=&originalTemplateReadyHandler=BCCallbacks.myExperience2.onTemplateReady&startTime=1458923627604
(function anonymous() {
setTimeout(BCCallbacks.myExperience2.onClickShareButton(), 1) /* COMMENT_TERMINATOR */
DUMMY_EXPR
})
What NoScript sees needs to be done about it:

Code: Select all

[NoScript XSS] Sanitized suspicious request. Original URL [http://c.brightcove.com/services/viewer/federated_f9?&width=880&height=495&flashID=myExperience2&bgcolor=%23FFFFFF&playerID=2245242285001&autoStart=false&isVid=true&isUI=true&wmode=transparent&htmlFallback=true&dynamicStreaming=true&includeAPI=true&usat_hasEmbed=true&templateReadyHandler=brightcove%5B%22templateReadyHandlermyExperience2%22%5D&templateLoadHandler=BCCallbacks.myExperience2.onTemplateLoad&templateErrorHandler=BCCallbacks.myExperience2.onTemplateError&adServerURL=http%3A%2F%2Fpubads.g.doubleclick.net%2Fgampad%2Fads%3Fenv%3Dvp%26gdfp_req%3D1%26impl%3Ds%26output%3Dxml_vast2%26iu%3D7103%2Fusatoday%2Fpreroll_video%2Fnews%2Fworld%26sz%3D920x508%26unviewed_position_start%3D1%26cust_params%3Dcontentid%253D82119260%2526pagetype%253Dvideo-asset%2526aam%253D%2526u%253Dundefined%26cmsid%3D12768%26url%3D%22%22&usat_linkurl=http%3A%2F%2Fwww.usatoday.com%2Fvideos%2Fnews%2Fworld%2F2016%2F03%2F23%2F82119260%2F&SSTSCode=news%2Fworld%2F&usat_shareFunction=function()%7BsetTimeout(BCCallbacks.myExperience2.onClickShareButton()%2C%201)%7D&%40videoPlayer=ref%3A82119260&debuggerID=&originalTemplateReadyHandler=BCCallbacks.myExperience2.onTemplateReady&startTime=1458923627604] requested from [chrome://browser/content/browser.xul]. Sanitized URL: [http://c.brightcove.com/#22718382928081915266].

I'll also leave this here: https://hackademix.net/2008/04/16/false ... t-typepad/
(and note that passing JS fragments in a URL is just as bad, if not worse, than passing HTML fragments.)

Re: USA Today video does not load when XSS

Posted: Tue Mar 29, 2016 4:29 am
by Thrawn
barbaz wrote:(and note that passing JS fragments in a URL is just as bad, if not worse, than passing HTML fragments.)
Worse. Almost certainly worse.
All times are UTC
Page 1 of 1

Powered by phpBB® Forum Software © phpBB Limited