Page 1 of 1

XSS msg on Ancestry.com

Posted: Wed Sep 12, 2018 7:38 pm
by Jojo999
In Palemoon. Just started. Really slowing down everything. How do I eliminate the msg? Tried to put an exception in the XSS options but that didn't seem to work for me.

Trapped this from the console. Don't know if I grabbed the right part.

Code: Select all

[NoScript InjectionChecker] JavaScript Injection in ##page_name=ancestry us : search : results : global - tree&_pm_optOutTealiumCookies=on&_pm_doptOutDialogTitle=Tealium Opt Out Settings&_pm_optOutDialogLogoURL=http://tags.tiqcdn.com/files/img/tealium-logo.gif&_pm_optOutSwitchGiff=//tags.tiqcdn.com/files/img/switch.gif&_pm_optOutDialogMsgTitle=Your Privacy Options&_pm_optOutDialogVendorLabel=Vendor&_pm_optOutDialogCategoryLabel=Category&_pm_optOutDialogDescriptionLabel=Description&_pm_optOutDialogStatusLabel=Status&_pm_CategoryName_Advertising=Advertising&_pm_AdvertisingText=Advertising cookies collect information about browsing habits. We use them to make sure our advertising and suggestions are relevant to you and your interests (you will also hear this referred to as online behavioral advertising) and to limit the number of times you see an advertisement.&_pm_optOutTealiumCookiesTitle=Tealium Cookies&_pm_optOutTealiumCookiesDesc=Tealium Cookies are used for visitor, session and time
[NoScript XSS] Sanitized suspicious upload to [https://c.lytics.io/c/31959ab513858232dd0e73b71b07401f/default###DATA###page_name%3Dancestry%2520us%2520%253A%2520search%2520%253A%2520results%2520%253A%2520global%2520-%2520tree%26_pm_optOutTealiumCookies%3Don%26_pm_doptOutDialogTitle%3DTealium%2520Opt%2520Out%2520Settings%26_pm_optOutDialogLogoURL%3Dhttp%253A%252F%252Ftags.tiqcdn.com%252Ffiles%252Fimg%252Ftealium-logo.gif%26_pm_optOutSwitchGiff%3D%252F%252Ftags.tiqcdn.com%252Ffiles%252Fimg%252Fswitch.gif%26_pm_optOutDialogMsgTitle%3DYour%2520Privacy%2520Options%26_pm_optOutDialogVendorLabel%3DVendor%26_pm_optOutDialogCategoryLabel%3DCategory%26_pm_optOutDialogDescriptionLabel%3DDescription%26_pm_optOutDialogStatusLabel%3DStatus%26_pm_CategoryName_Advertising%3DAdvertising%26_pm_AdvertisingText%3DAdvertising%2520cookies%2520collect%2520information%2520about%2520browsing%2520habits.%2520We%2520use%2520them%2520to%2520make%2520sure%2520our%2520advertising%2520and%2520suggestions%2520are%252
ReferenceError: reference to undefined property r.event.triggered jquery.min.js:3:8287
ReferenceError: reference to undefined property this.timerId core.js:1:1275
ReferenceError: reference to undefined property b.result jquery.min.js:3:10454
ReferenceError: reference to undefined property j.disabled jquery.min.js:3:10622
ReferenceError: reference to undefined property a.Sb utag.943.js:6:3440
ReferenceError: reference to undefined property aSourceURL[(aSourceURL.length - 1)]

Re: XSS msg on Ancestry.com

Posted: Wed Sep 12, 2018 8:44 pm
by barbaz
I can't tell if those messages are being cut off. If not, it looks like a false positive to me.

Did you try this exception? -

Code: Select all

^https://c\.lytics\.io/
It looks like a tracker to me, so I would suggest additionally blocking it with either ABE or an adblock type addon.

Re: XSS msg on Ancestry.com

Posted: Thu Sep 13, 2018 2:09 am
by Jojo999
barbaz wrote:I can't tell if those messages are being cut off. If not, it looks like a false positive to me.

Did you try this exception? -

Code: Select all

^https://c\.lytics\.io/
It looks like a tracker to me, so I would suggest additionally blocking it with either ABE or an adblock type addon.
I put the exception in and this seems to work. Thanks!

I also run UOrigin but it apparently doesn't block trackers.