Page 1 of 1
Clearing anti-XSS whitelist entries?
Posted: Sat Dec 19, 2009 11:30 pm
by kukla
I see a number of these. There are four from Google, Google Translate, Yahooo, and Wikipedia. Are they there by default? If so, what is their purpose? If they are not there by default, is there a simple way to delete them? I don't remember whitelisting these sites.
Re: Clearing anti-XSS whitelist entries?
Posted: Sat Dec 19, 2009 11:42 pm
by Alan Baxter
Edit: Never mind. I can type better than I can read.
google.com and yahoo.com are there by default. The other two could have been added by the NoScript top-level site or bookmark options. Any or all of them can be safely removed using this panel:
NoScript Options > Whitelist
See http://noscript.net/faq#qa1_5
Re: Clearing anti-XSS whitelist entries?
Posted: Sun Dec 20, 2009 12:00 am
by Giorgio Maone
@Alan Baxter:
I think he refers to the XSS Exceptions in Tools|Advanced|XSS.
@kookla:
They're there because many sites you don't want to whitelist link either to Google/Yahoo search results or to Wikipedia articles, and those can contain sequence which may trigger XSS false positive warnings while being perfectly innocuous.
The same goes for Google Translate, whose implementation details may produce XSS false positives.
The exceptions are crafted to prevent the false positive while keeping those sites safe, since the matching patterns are already XSS-proof.
However you can clear the text box, but doing so you may experience XSS false positives on those sites.
Re: Clearing anti-XSS whitelist entries?
Posted: Sun Dec 20, 2009 12:22 am
by kukla
OK thanks. They're default entries. I will leave them, but just in case something gets whitelisted I want to clear in the future, how do I do that? When I highlight them I don't see any delete option in NS itself, and the Firefox Menubar with Edit/Delete isn't available.
Re: Clearing anti-XSS whitelist entries?
Posted: Sun Dec 20, 2009 12:25 am
by Giorgio Maone
Select the relevant lines and hit the "Del" key, just like you would do in a forum post.
Re: Clearing anti-XSS whitelist entries?
Posted: Sun Dec 20, 2009 12:35 am
by kukla
OMG!
