Donmai

Bookmarked Search Nuked by NoScript

Posted under General

OOZ662

I have "*donmai.us/*" whitelisted in NoScript. Being obsessed with the still-existing nail versus fingernails thing, I have a bookmark to a search that helps me along in gardening. URL below; note that it contains six tags.

http://danbooru.donmai.us/posts?tags=nail+-fingernails+-nail_bat+-painwheel_(skullgirls)+-shirai_kuroko+-carol_(skullgirls)

Browsing to this, I get redirected to this address:

http://danbooru.donmai.us/posts?tags=nail+-fingernails+-nail_bat+-painwheel_ skullgirls +-shirai_kuroko+-carol_ skullgirls #5035705332889897960

Note the parenthesis have been replaced by spaces and the appended number. "Error: You cannot search for more than 6 tags at a time" is displayed, NoScript mentions a potential XSS action blocked; the two NoScript console entries follow:

[NoScript InjectionChecker] JavaScript Injection in ///posts?tags=nail+-fingernails+-nail_bat+-painwheel_(skullgirls)+-shirai_kuroko+-carol_(skullgirls)
(function anonymous() {
tags=nail+-fingernails+-nail_bat+-painwheel_(skullgirls)+-shirai_kuroko+-carol_(skullgirls) /* COMMENT_TERMINATOR */
DUMMY_EXPR
})
[NoScript XSS] Sanitized suspicious request. Original URL [http://danbooru.donmai.us/posts?tags=nail+-fingernails+-nail_bat+-painwheel_(skullgirls)+-shirai_kuroko+-carol_(skullgirls)] requested from [chrome://browser/content/browser.xul]. Sanitized URL: [http://danbooru.donmai.us/posts?tags=nail+-fingernails+-nail_bat+-painwheel_%20skullgirls%20+-shirai_kuroko+-carol_%20skullgirls%20#7858025236098105631].

An unsafe reload of the page works properly, but as this hasn't happened before today (and I have only the flimsiest understanding of code) I don't know whether it's something that's changed in Danbooru or if's a NoScript bug, though I assume the latter. Since NoScript is decently popular, I thought I'd bring it up.

Also, I have no idea how to use "regular expressions" to whitelist Danbooru on the XSS filter, so if someone wouldn't mind helping me with that, it'd be grand.

(I also created this FireFox console log output from the page during my journey. Probably entirely useless, but I made it, might as well add it.)

Reply
1