3

The feature:

The text editor allows code snippets to be submitted as a sandbox like JSFiddle. I'm referring to the button that reads:

JavaScript/HTML/CSS snippet Ctrl-M

...rather than:

Code Sample <pre><code> Ctrl+K

The problem:

When I attempt to use this feature, NoScript disables its functionality due to detecting an XSS attempt.

Cross-site scripting (XSS) is a type of computer security vulnerability typically found in web applications. XSS enables attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to bypass access controls such as the same-origin policy.

Source

Tests:

<p>This works fine.</p>

...however, externally sourced images or scripts do not:

<img src="https://placehold.it/60x60">

  • I have not seen this with NoScript. Does it only happen on specific posts? – Alexander O'Mara Apr 25 '16 at 17:57
  • @AlexanderO'Mara Now that you mention it, it occurs only when external images or scripts are referenced (see section titled "Tests" of edited question). – Clarus Dignus Apr 25 '16 at 18:05
  • 1
    There's been a lot of discussion about the security of snippets already here. There are bigger problems... – Laurel Apr 25 '16 at 20:19
  • 1
    The second stack snippet is working at this time. – Rubén Jun 25 '17 at 16:20
  • 1
    @Rubén Acknowledged. Thanks for testing. I can now confirm that the second snippet is also working on my end. – Clarus Dignus Jun 26 '17 at 20:41
4

NoScript warns when a request is made containing potentially malicious code in the URL or the request body, such as a script tag or an img tag.

The actual warning from NoScript in the browser console is:

[NoScript XSS] Sanitized suspicious upload to [http://stacksnippets.net/js###DATA###%3Cimg+src%3D%22https%3A%2F%2Fplacehold.it%2F60x60%22%3E] from [NoScript XSS protection for code snippets: transformed into a download-only GET request.

As we can see, the raw source is being POSTed to the URL. Similar tricks are used in XSS attacks to have malicious HTML echoed on a page, and NoScript airs on the side of caution to gives a warning.

Since stacksnippets.net is a dedicated domain, there is no XSS risk here, so you can safely click Options > Unsafe Reload. Or you can disable it for that domain complete:

Solution for Users:

  1. Click Options > Options from the yellow bar that appears, or click the NoScript icon and click Options.
  2. Click Advanced > XSS if not already on that tab.
  3. Under "Anti-XSS Protection Exceptions", add the following and click OK:
^https?://stacksnippets\.net/

A Potential Solution for Stack Exchange:

If you were to encode the POST body with base64 or something similar, or perhaps use some other escaping, these requests probably would not be flagged.

  • This answer is a work-around until such time as the Stack Exchange is compliant with rudimentary XSS checks. Thank for a thorough and well-formatted answer. – Clarus Dignus Apr 25 '16 at 23:45
  • 3
    @ClarusDignus to be fair, there's nothing of value that can be accessed by stacksnippets.net as Same-Origin Policy prevents access to anything of interest. NoScript is basically creating a false-positive because it doesn't know stacksnippets.net has nothing of value. The CSRF issue from the other meta post is a separate issue, which NoScript is actually quite excellent at solving for the local network. – Alexander O'Mara Apr 25 '16 at 23:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .