[tbb-bugs] #26847 [Applications/Tor Browser]: Tor Browser 8a, noscript pops up a full-browser-size window to warn me about x-site scripting

Tor Bug Tracker & Wiki blackhole at torproject.org
Tue Jul 17 17:48:57 UTC 2018

#26847: Tor Browser 8a, noscript pops up a full-browser-size window to warn me
about x-site scripting
     Reporter:  arma                      |      Owner:  tbb-team
         Type:  defect                    |     Status:  new
     Priority:  Medium                    |  Milestone:
    Component:  Applications/Tor Browser  |    Version:
     Severity:  Normal                    |   Keywords:
Actual Points:                            |  Parent ID:
       Points:                            |   Reviewer:
      Sponsor:                            |
 When I go to certain sites in the Tor Browser 8 alpha, I get a new window
 popping up, which is the same size as my current browser window, which
 looks like it comes from noscript. It says "NoScript XSS Warning" at the
 top, and the window title is moz-extension://4536b558-.... NoScript XSS
 Warning", and there's a bit of text towards the top that says

 NoScript detected a potential Cross-Site Scripting attack

 from http://www.espn.com to https://8397396.fls.doubleclick.net.

 Suspicious data:


 and towards the bottom I have the options to block, always block, allow,
 always allow, and then an ok button.

 The example url in this case was

 (I've noticed the behavior happens pretty consistently with espn urls.)

 I'm not sure quite what behavior I would expect instead, but "making a new
 huge window that's mostly whitespace and that prevents me from doing
 anything on any tab until I've made the window go away" was not it. :)

Ticket URL: <https://trac.torproject.org/projects/tor/ticket/26847>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online

More information about the tbb-bugs mailing list