InformAction Forums

Hi,

after NoScript got updated to 5.0.6 (Firefox is 54.0.1 and 64-bit on Windows 8.1), logging into treeherder.mozilla.org fails. One can sign into the credential management app (login.taskcluster.net), but it doesn't log on into treeherder and doesn't redirect there. From the browser console:

[NoScript XSS] xss.reason.SyntaxError: invalid range in character class --- reduceJSON@chrome://noscript/content/InjectionChecker.js:167:15
InjectionChecker_checkJSBreak@chrome://noscript/content/InjectionChecker.js:475:30
checkJS@chrome://noscript/content/InjectionChecker.js:748:70
_checkRecursive@chrome://noscript/content/InjectionChecker.js:997:30
_checkRecursive@chrome://noscript/content/InjectionChecker.js:1046:11
checkRecursive@chrome://noscript/content/InjectionChecker.js:992:12
checkURL@chrome://noscript/content/InjectionChecker.js:941:12
filterXSS@chrome://noscript/content/RequestWatchdog.js:793:43
onHttpStart/<@chrome://noscript/content/RequestWatchdog.js:148:18
run@chrome://noscript/content/RequestWatchdog.js:1104:22
onHttpStart@chrome://noscript/content/RequestWatchdog.js:146:9
observe@chrome://noscript/content/MainParent.js:82:24
gotoRedirectTarget@https://login.taskcluster.net/assets/script.js:149:5
showGrant@https://login.taskcluster.net/assets/script.js:153:12
showCredentials@https://login.taskcluster.net/assets/script.js:205:5
@https://login.taskcluster.net/:9:1

As a test, does disabling the XSS filter help? (NoScript Options > Advanced > XSS, un-check both boxes)

Yes, disabling the XSS protection fixes the issue (the latest release mentions a change related to XSS and JSON in the changelog).

Moving to NoScript Development as a bug report. Thanks