[tor-bugs] #26847 [Applications/Tor Browser]: Tor Browser 8a, noscript pops up a full-browser-size window to warn me about x-site scripting

[Tor Bug Tracker & Wiki]

#26847: Tor Browser 8a, noscript pops up a full-browser-size window to warn me
about x-site scripting
------------------------------------------+----------------------
     Reporter:  arma                      |      Owner:  tbb-team
         Type:  defect                    |     Status:  new
     Priority:  Medium                    |  Milestone:
    Component:  Applications/Tor Browser  |    Version:
     Severity:  Normal                    |   Keywords:
Actual Points:                            |  Parent ID:
       Points:                            |   Reviewer:
      Sponsor:                            |
------------------------------------------+----------------------
 When I go to certain sites in the Tor Browser 8 alpha, I get a new window
 popping up, which is the same size as my current browser window, which
 looks like it comes from noscript. It says "NoScript XSS Warning" at the
 top, and the window title is moz-extension://4536b558-.... NoScript XSS
 Warning", and there's a bit of text towards the top that says
 {{{


 NoScript detected a potential Cross-Site Scripting attack

 from http://www.espn.com to https://8397396.fls.doubleclick.net.

 Suspicious data:

 (URL)
 https://8397396.fls.doubleclick.net/activityi;src=8397396;type=espng0;cat=espna0;u1=http://www.espn.com/mlb/story/_/id/24116616
 /mlb-bryce-harper-brings-house-epic-derby-
 comeback;u2=[s.products];u3=[c.promocode];u4=[payment
 method];u5=[c.SWID];u6=[c.UNID];u7=[c.NavMethod];u8=[Trial/Monthly/Annual];dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=9016327828417.457?
 }}}

 and towards the bottom I have the options to block, always block, allow,
 always allow, and then an ok button.

 The example url in this case was
 http://www.espn.com/mlb/story/_/id/24116616/mlb-bryce-harper-brings-house-
 epic-derby-comeback

 (I've noticed the behavior happens pretty consistently with espn urls.)

 I'm not sure quite what behavior I would expect instead, but "making a new
 huge window that's mostly whitespace and that prevents me from doing
 anything on any tab until I've made the window go away" was not it. :)

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/26847>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online