Latest NS update causing Pale Moon to generate NS errors

[Jojo999]

I have been seeing this on multiple sites in Pale Moon today. I am in a GMail account now and I have the yellow bar at the top stating "The XSS Filter has detected a potential XSS attack. Type JS Action.

I can "View unsafe content" or corner x. If I corner X, the msg just stays at the top of the window. If I click "View..." I see:

["ExtensionResource.axd?c=21297\u0026t=-1\uu0026r=js%2FFlashHandler.js"]

If I OK in the box displaying the above, nothing happens again and the yellow bar mesg is still at the top of the window.

What to do?

[barbaz]

Are you sure that's from NoScript and not Pale Moon's builtin XSS filter?

[Jojo999]

How do I tell one from the other? I did not know that PM does XSS filtering. I don't keep up on the gory details of PM.

[yes_noscript]

This is a Pale Moon XSS filter message.
Since Pale Moon 26.0.0 this is a feature.

Take a look here: https://forum.palemoon.org/viewtopic.php?f=5&t=10817

[barbaz]

Just to double-check something, does disabling NoScript (Tools > Add-ons Manager > NoScript > Disable > Yes, remove ALL protections) stop Pale Moon from producing that notice? (I don't think it would, but...)

Let us know, thanks.

[Jojo999]

I did nothing and the alerts went away. So I guess this was PM at work. People must have complained to them.

Having two different processes doing XSS filtering seems like a recipe for problems.

Perhaps NS should ID your msgs with an "NS" at the left?

[barbaz]

Having two different processes doing XSS filtering seems like a recipe for problems.

Quite the contrary - because they are different methods of filtering XSS, it's defense-in-depth and that's always a good thing.

Perhaps NS should ID your msgs with an "NS" at the left?

See the screenshot here https://noscript.net/features#xss