InformAction Forums

Posted: **Thu Jun 16, 2016 6:59 pm**

Hi,
NoScript's ClearClick adds the following CSS rule to every website:

body:not([id]) { cursor: auto !important }

(https://addons.mozilla.org/de/firefox/f ... e.js#L1790)

This rule disables custom cursors set via CSS on the body element for all websites, where the body element has not the id attribute set.

1. question: Why is this needed? A "malicious" website can just add the id attribute to the body element and is not affected by this rule anymore.
2. question: Is there a way to disable this specific rule? I really want to use NoScript and ClearClick, but for now i had to disable ClearClick to see the cursors (or even better, dont see them at all, because on some websites the cursor stays even when playing a video in fullscreen). Maybe with a usercss rule?

I found someone else who had the exact problem: http://stackoverflow.com/questions/3730 ... erty-value but no one posted an answer :/

Posted: **Thu Jun 16, 2016 7:07 pm**

viewtopic.php?f=10&t=20278

Posted: **Thu Jun 16, 2016 10:19 pm**

Ok, so it's known for some years, but neither the thread nor the blog post explains how the override of custom cursors on a body without and id ads anything in terms of security.
The are just myriads of ways to do it without being affected by this css rule, e.g. creating a div thats the exact same size than the <body> (margin/padding 0 etc) and use it for the cursor, or add the id attribute...

The 5th post tho:

Actually, upon review, I'm gonna change this countermeasure in the near future: specifying an id won't work anymore, but custom cursors won't be affected unless there's a subdocument embedded in the page.

seems promising, any news on this?

Posted: **Thu Jun 16, 2016 11:31 pm**

That's the only news about it that I know of... normally I'd bump that thread but with Giorgio being busy designing WebExtensions API I don't know if he'd be able to do anything towards fixing that...

Posted: **Sun Jun 19, 2016 1:11 pm**

Well, not that much of a problem tho, i "fixed" it by adding the id attribute to all the websites where it matters to me via userscript.

What didn't worked was disabling ClearClick only for trusted websites, since the css is still injected (maybe this would be the easier fix, not injecting the css rule into trusted websites if ClearCLick is disabled for those).

InformAction Forums

ClearClick disables css cursor

ClearClick disables css cursor

Re: ClearClick disables css cursor

Re: ClearClick disables css cursor

Re: ClearClick disables css cursor

Re: ClearClick disables css cursor