XSS on blogspot/blogger
Posted: Tue Jun 15, 2010 12:16 pm
Blogger has a new layout editor where you can see your changes live before you save them, and NoScript blocks an XSS request every time I go into it. With the request blocked, the editor doesn't work (my blog doesn't show in the lower pane), and upon doing an unsafe reload, everything works as expected.
I suspect this is because they use two domains, blogspot.com and blogger.com. I've already had third-party cookie issues because of this.
Adding the following line to the XSS exceptions list fixes the issue:
I suspect this is because they use two domains, blogspot.com and blogger.com. I've already had third-party cookie issues because of this.
Adding the following line to the XSS exceptions list fixes the issue:
Code: Select all
^https?://[^\.]+\.blogspot\.com/b/preview