[NoScript Classic] XSS false positives on wikipedia (split from t=26968)
Posted: Sun Apr 16, 2023 6:26 pm
Like BardRT, 100% repeatably, the Wikipedia URL
https://en.wikipedia.org/wiki/Lockwood_ ... _series%29
works, but then when I try to append
?useskin=vector
NoScript changes the URL to
https://en.wikipedia.org/wiki/Lockwood_ ... 8486105782
most notably replacing parentheses with spaces which breaks it.
If I then manually change the spaces back to parentheses using their codes %28 and %29 leaving the pound-random-number then it works, but if I use the characters ( ) or scrape off the pound-random-number then it continues to fail.
NoScript XSS preferences contains the exception
^https?://[a-z]+\.wikipedia\.org/wiki/[^"<>\?%]+$
and I tried adding more punctuation (both escaped and unescaped) to the [] list as well as deleting the list entirely, but did not find anything that helped. And I cannot understand the "Pattern matching sample" test -- whether a URL shows red or black in the test does not seem to correlate with whether or not NoScript replaces parentheses with spaces in practice.
https://en.wikipedia.org/wiki/Lockwood_ ... _series%29
works, but then when I try to append
?useskin=vector
NoScript changes the URL to
https://en.wikipedia.org/wiki/Lockwood_ ... 8486105782
most notably replacing parentheses with spaces which breaks it.
If I then manually change the spaces back to parentheses using their codes %28 and %29 leaving the pound-random-number then it works, but if I use the characters ( ) or scrape off the pound-random-number then it continues to fail.
NoScript XSS preferences contains the exception
^https?://[a-z]+\.wikipedia\.org/wiki/[^"<>\?%]+$
and I tried adding more punctuation (both escaped and unescaped) to the [] list as well as deleting the list entirely, but did not find anything that helped. And I cannot understand the "Pattern matching sample" test -- whether a URL shows red or black in the test does not seem to correlate with whether or not NoScript replaces parentheses with spaces in practice.