InformAction Forums

vmac wrote:same here with this website: https://www.tripadvisor.de/Hotel_Review ... Kinki.html

I can reproduce the hang on this link. Firefox 53.0.3, NoScript 5.0.6rc4

In my case the XSS filter does filter an XSS attempt on bluekai, but an exception for that doesn't help. No hang if I disable the XSS filter entirely.

Looks like there might be something in your facebook.net observation.

My environment:
Firefox 53.0.3
NoScript 5.0.6rc4

Scripts Allowed on theguardian.com.

Several pages have been hanging for me on theguardian.com, but many are live update pages so their content is probably too dynamic to be useful for diagnosis. However one of them is https://www.theguardian.com/crosswords/cryptic/27218 which is unlikely to change over time (except visitor comments).

If I have scripts Allowed for facebook.net, that page hangs Firefox a few seconds after loading.
If I Forbid scripts from facebook.net (not even marking it as Untrusted), the page loads without hanging.

Perhaps not surprisingly, if I Forbid scripts from theguardian.com (and Allow from facebook.net), the page loads without hanging, but only as a static page.

For now I'll Forbid scripts from facebook.net as a workaround until this is fixed.

Cheers.

barbaz wrote:@js26, vmac: Thank you for letting us know, but please note that disabling the XSS filter is not a solution! It is only a test. It's not safe for normal browsing.

When saying it works with XSS filter disabled, can you please post the console messages you get with the XSS filter enabled? Without that, we don't have enough information to help you.

Thanks

just an update, blocking facebook.net seems to fix things. have re-enabled XSS and no problems so far.

Still the same here, e.g. https://www.tripadvisor.de/Hotel_Review ... Kinki.html

Where should I block "facebook.net"?

vmac wrote:Where should I block "facebook.net"?

viewtopic.php?p=88477#p88477

barbaz wrote:

vmac wrote:Where should I block "facebook.net"?

viewtopic.php?p=88477#p88477

Thanks. But the problem still exists.

vmac wrote:the problem still exists.

Yeah, it would. I think there are two separate issues going on here. One is that facebook.net script freezes the browser. The other is a bug in NoScript's XSS filter causing hanging.

Unfortunately for you, you're hitting the latter.

It is reportedly possible to work around the problem using XSS exceptions. But since the XSS filter doesn't actually take any action, it provides no information. As such, I'm not sure how to make a good workaround, sorry.

barbaz wrote:

vmac wrote:the problem still exists.

Yeah, it would. I think there are two separate issues going on here. One is that facebook.net script freezes the browser. The other is a bug in NoScript's XSS filter causing hanging.

Unfortunately for you, you're hitting the latter.

It is reportedly possible to work around the problem using XSS exceptions. But since the XSS filter doesn't actually take any action, it provides no information. As such, I'm not sure how to make a good workaround, sorry.

Nevertheless, thanks and I hope a future version of noscript will solve the problem.

... and: more and more websites doesn't work well when noscript is active. I hope there will be an update soon.

I have the same issue.
Test page: https://www.tripadvisor.ru/Attractions- ... Hanoi.html

Adding facebook.net to Untrusted doesn't fix the issue.
Please suggest anything for me.
I need to plan my holiday

You could just temporarily disable the XSS filter. Not the safest work-around, but should let you use the site.
NoScript Options > Advanced > XSS, un-check both boxes

Make sure you don't do other things in the browser, and re-enable the XSS filter when done.

Thanks. It works!
I expect a fix in future releases.

No updates since 2017/05/31

This seems to be a regression in the XSS filter performance in face of large JSON payloads, due to the recently added protection against several attacks exploiting popular template engines.

I'm about to release a fix for it, in the meanwhile as a work-around please try adding in the NoScript Options>Advanced>XSS exceptions box.

I have the same issue. Firefox freezes and I have to kill it.
This happens on most online shops I vizit (like http://www.cel.ro/ , https://www.emag.ro/, https://altex.ro/ , http://www.marketonline.ro/ ) and any other "heavy" website.