Page 1 of 1
Latest NS update causing Pale Moon to generate NS errors
Posted: Fri Aug 12, 2016 11:10 pm
by Jojo999
I have been seeing this on multiple sites in Pale Moon today. I am in a GMail account now and I have the yellow bar at the top stating "The XSS Filter has detected a potential XSS attack. Type JS Action.
I can "View unsafe content" or corner x. If I corner X, the msg just stays at the top of the window. If I click "View..." I see:
["ExtensionResource.axd?c=21297\u0026t=-1\uu0026r=js%2FFlashHandler.js"]
If I OK in the box displaying the above, nothing happens again and the yellow bar mesg is still at the top of the window.
What to do?
Re: Latest NS update causing Pale Moon to generate NS errors
Posted: Fri Aug 12, 2016 11:33 pm
by barbaz
Are you sure that's from NoScript and not Pale Moon's builtin XSS filter?
Re: Latest NS update causing Pale Moon to generate NS errors
Posted: Sat Aug 13, 2016 5:58 am
by Jojo999
How do I tell one from the other? I did not know that PM does XSS filtering. I don't keep up on the gory details of PM.
Re: Latest NS update causing Pale Moon to generate NS errors
Posted: Sat Aug 13, 2016 2:25 pm
by yes_noscript
This is a Pale Moon XSS filter message.
Since Pale Moon 26.0.0 this is a feature.
Take a look here:
https://forum.palemoon.org/viewtopic.php?f=5&t=10817
Re: Latest NS update causing Pale Moon to generate NS errors
Posted: Sat Aug 13, 2016 2:30 pm
by barbaz
Just to double-check something, does disabling NoScript (Tools > Add-ons Manager > NoScript > Disable > Yes, remove ALL protections) stop Pale Moon from producing that notice? (I don't think it would, but...)
Let us know, thanks.
Re: Latest NS update causing Pale Moon to generate NS errors
Posted: Sun Aug 14, 2016 5:17 pm
by Jojo999
I did nothing and the alerts went away. So I guess this was PM at work. People must have complained to them.
Having two different processes doing XSS filtering seems like a recipe for problems.
Perhaps NS should ID your msgs with an "NS" at the left?
Re: Latest NS update causing Pale Moon to generate NS errors
Posted: Sun Aug 14, 2016 5:48 pm
by barbaz
Jojo999 wrote:Having two different processes doing XSS filtering seems like a recipe for problems.
Quite the contrary - because they are different methods of filtering XSS, it's defense-in-depth and that's always a good thing.
Jojo999 wrote:Perhaps NS should ID your msgs with an "NS" at the left?
See the screenshot here
https://noscript.net/features#xss