XSS filter - what's wrong with my URL?

[Steven.Colby]

Hi all - the XSS filter in NoScript 2.1.2.7 (latest) is sanitizing a URL in my development application and I'm not sure why. Here's an example of the console output:

[NoScript XSS] Sanitized suspicious request. Original URL [http://myserver/app/WebSoilSurvey.aspx? ... 566185826)] requested from [chrome://browser/content/browser.xul]. Sanitized URL: [http://myserver/app/WebSoilSurvey.aspx? ... 5450294197].

Note the parentheses have been scrubbed. Anybody have any idea why? It doesn't look like a particularly evil query string to me... And yep, I sure could just whitelist the server/app, but I'm curious to know what about the query string is making XSS unhappy.

Thanks!
Steven Colby

[obiwan]

Yes, the XSS filter appears to be broken. It flags requests that can't possibly be considered a XSS risk...

[obiwan]

I did some testing and simplified your example. It flags this query string:

?location=(2)

but not this one

?location=()

Maybe I don't understand, but how are either of those a XSS risk? And if the first is, why isn't the second?