Re: XSS protection with an noscripts attribute
joris <[email protected]> Sun, 7 Apr 2019 10:00:54 +0200
| Newsgroups | gmane.comp.mozilla.security |
|---|---|
| Message-ID | <[email protected]> |
CkkgYWdyZWUsIHRoYXQgd291bGQgYmUgYSB2dWxuZXJhYmlsaXR5LgpCdXQgSSB0aGluayB0aGlz IGlzIG5vdCB0aGUgY29yZSBvZiBteSB3b25kZXIuCkkgd29uZGVyLCB3aHkgZG8gV2ViIGRldmVs b3BlcnMgaGF2ZSB0bwpndWVzcyB3aGF0IHRoZSBCcm93c2VyIHRoaW5rcyBpcyBKUyBhbmQgZXhl Y3V0ZXMKaXQgYW5kIHdoYXQgaXNuJ3Q/CldoeSBjYW4ndCB0aGV5IGp1c3QgYXNrIHRoZSBXZWIg QnJvd3NlciB0byBkbyB0aGF0CmZvciB0aGVtPwpUaGF0IHdvdWxkIGJlIG1vcmUgc2VjdXJlIGJl Y2F1c2UKYWxsIHRoaXJkLXBhcnR5IGxpYnJhcmllcyBwYXJzZSBzb21ld2hhdCBkaWZmZXJlbnRs eQp0aGFuIGFsbCB0aGUgV2ViIEJyb3dzZXIgdGhleSBhcmUgdXNlZCB3aXRoLgpPbiA0LzYvMTkg MTI6NTEgUE0sIENyYWlnIEZyYW5jaXMgd3JvdGU6Cj4gV2hpbGUgSSBxdWl0ZSBsaWtlIHRoZSBz aW1wbGljaXR5IG9mIHRoaXMgaWRlYSwgd2hlcmUgaXQga2luZCBvZiAKPiByZW1pbmRzIG1lIG9m IHRoZcKgQGluZXJ0IGF0dHJpYnV0ZS4KPgo+IE15IG1haW4gY29uY2VybiBpcyBob3cgdG8gYnlw YXNzIGl0LCB0YWtlIHRoZSBjb2RlOgo+Cj4gPGRpdiBub3NjcmlwdHM9InRydWUiPjw/PSAkdW5z YWZlX3VzZXJfbmFtZSA/PjwvZGl2Pgo+Cj4gV2hlcmUgdGhlIGF0dGFja2VyIGNhbiBzZXQgdGhl aXIgdXNlcm5hbWUgdG8gCj4gYFgqPC9kaXY+KjxzY3JpcHQ+ZXZpbF9jb2RlPC9zY3JpcHQ+PGRp dj5gCj4KPiAtLS0KPgo+IFVuZm9ydHVuYXRlbHksIEkgdGhpbmsgdGhpcyBpcyB3aHkgd2UgbmVl ZCB0byB3b3JrIHdpdGggbW9yZSAKPiBjb21wbGljYXRlZC9hZHZhbmNlZCBzb2x1dGlvbnMuLi4K Pgo+IFdlIG5lZWQgdG8gc2FuaXRpc2UgYWxsIHN0cmluZ3MgdGhhdCBhcmUgaW5jbHVkZWQgaW4g dGhlIEhUTUwgb24gdGhlIAo+IHNlcnZlciBzaWRlIC0gZS5nLiB1c2luZyB0ZW1wbGF0aW5nIHN5 c3RlbXM7IG9yIHBhc3NpbmcgdGhlIHN0cmluZyAKPiB0aG91Z2ggc29tZXRoaW5nIGxpa2UgSFRN TCBQdXJpZmllcjoKPgo+IGh0dHA6Ly9odG1scHVyaWZpZXIub3JnLwo+Cj4gT3IsIGFuZCB5b3Ug aGF2ZSB0byBiZSBjYXJlZnVsIGhlcmUuLi4gZXNjYXBpbmcgYWxsIEhUTUwgb3V0cHV0IHRob3Vn aCAKPiBmdW5jdGlvbnMgbGlrZSBodG1sZW50aXRpZXMoKSAvIGh0bWxlbmNvZGUoKSwgd2hlcmUg dGhpcyBkb2VzIG5vdCBmaXggCj4gYDxhIGhyZWY9PD89IGh0bWxlbnRpdGllcygkdW5zYWZlX3Vy bCk+YCBkdWUgdG8gdGhlIHVybCBiZWluZyBhYmxlIHRvIAo+IHN0YXJ0IHdpdGggYGphdmFzY3Jp cHQ6YCwgb3IgYmVpbmcgYWJsZSB0byB0YWtlIGFkdmFudGFnZSBvZiB0aGUgCj4gbWlzc2luZyBx dW90YXRpb24gbWFya3Mgb24gdGhlIGF0dHJpYnV0ZSB2aWEgYCBvbmNsaWNrPWV2aWxfY29kZWAu Cj4KPiBBbmQgd2hlbiB3b3JraW5nIHdpdGggc3RyaW5ncyBpbiBKYXZhU2NyaXB0IC0geW91IHNo b3VsZCB1c2Ugc2FmZSAKPiBtZXRob2RzIGxpa2UgYGVsZW1lbnQudGV4dENvbnRlbnRgLCBvciBw YXNzIHRoZW0gdGhvdWdoIHNvbWV0aGluZyB0byAKPiBzYW5pdGlzZSB0aGUgSFRNTCAoYm90aCBp biByZW1vdmluZyB0aGUgbWFueSB3YXlzIEphdmFTY3JpcHQgY2FuIGJlIAo+IGluY2x1ZGVkLCBi dXQgYWxzbyBqdXN0IG1ha2luZyBzdXJlIHRoZSBIVE1MIGlzIHdlbGwgZm9ybWVkKToKPgo+IGh0 dHBzOi8vZ2l0aHViLmNvbS9nb29nbGUvY2xvc3VyZS1saWJyYXJ5L2Jsb2IvbWFzdGVyL2Nsb3N1 cmUvZ29vZy9odG1sL3Nhbml0aXplci9odG1sc2FuaXRpemVyLmpzCj4KPiBodHRwczovL2dpdGh1 Yi5jb20vcHVua2F2ZS9zYW5pdGl6ZS1odG1sCj4KPiBUaGVuIHlvdSB3b3VsZCBpZGVhbGx5IGFk ZCBhIENvbnRlbnQgU2VjdXJpdHkgUG9saWN5IHRvIGxpbWl0IHRoZSAKPiBzY3JpcHRzIG9uIHRo ZSBwYWdlLCBqdXN0IGluY2FzZSB5b3UgbWlzcyBzb21ldGhpbmcuCj4KPiBodHRwczovL2RldmVs b3Blci5tb3ppbGxhLm9yZy9lbi1VUy9kb2NzL1dlYi9IVFRQL0NTUAo+Cj4gQW5kIGFzIGFuIGV4 dHJhIGJvbnVzLCBzdGFydCBwbGF5aW5nIHdpdGggdGhlIChjdXJyZW50bHkgaW4gCj4gZGV2ZWxv cG1lbnQpIFRydXN0ZWQgVHlwZXMsIHRvIG1ha2Ugc3VyZSB5b3UgYXJlbid0IHVzaW5nIHVuc2Fm ZSAKPiB0aGluZ3MgbGlrZSBlbGVtZW50LmlubmVySFRNTC4KPgo+IGh0dHBzOi8vZGV2ZWxvcGVy cy5nb29nbGUuY29tL3dlYi91cGRhdGVzLzIwMTkvMDIvdHJ1c3RlZC10eXBlcwo+Cj4gT3IgZm9y IGV2ZW4gbW9yZSBmdW4gKHBhaW4pLCBvbiB5b3VyIGxvY2FsIGRldmVsb3BtZW50IHNlcnZlciwg dHJ5IAo+IHNldHRpbmcgdGhlIGhlYWRlcjoKPgo+IMKgIMKgIENvbnRlbnQtVHlwZTogYXBwbGlj YXRpb24veGh0bWwreG1sOyBjaGFyc2V0PVVURi04Cj4KPiBEbyBub3QgZG8gdGhpcyBvbiBsaXZl LCBhcyBhbnkgYmFkIGZvcm1hdHRpbmcgb2YgeW91ciBIVE1MIHdpbGwgYnJlYWsgCj4gdGhlIHBh Z2UgLSBidXQgdGhpcyBlbnN1cmVzIGFsbCBvZiB5b3VyIGF0dHJpYnV0ZXMgYXJlIHF1b3RlZCwg YW5kIGFsbCAKPiBvZiB5b3VyIHRhZ3MgYXJlIHBlcmZlY3RseSBuZXN0ZWQgKHRoaXMgaW5jbHVk ZXMgYDxicj5gIG5lZWRpbmcgdG8gYmUgCj4gYDxiciAvPmAsIHRoZSBhdHRyaWJ1dGUgYHNlbGVj dGVkYCBuZWVkaW5nIHRvIGJlIAo+IGBzZWxlY3RlZD0ic2VsZWN0ZWQiYCwgZXRjKS4KPgo+IENy YWlnCj4KPgo+Cj4gT24gRnJpLCA1IEFwciAyMDE5IGF0IDIzOjQ3LCBZb2cgQmlpIDxqb3Jpcy5n dXRqYWhyQGdtYWlsLmNvbSAKPiA8bWFpbHRvOmpvcmlzLmd1dGphaHJAZ21haWwuY29tPj4gd3Jv dGU6Cj4KPiAgICAgWFNTIHByZXZlbnRpb24gaXMgYSB2ZXJ5IGltcG9ydGFudCBhbmQgY29zdGx5 IHBhcnQgb2YgYSBXZWJzaXRlcwo+ICAgICBTZWN1cml0eS4KPiAgICAgQmVjYXVzZSBYU1MgaXMg Y3VycmVudGx5IHByZXZlbnRlZCBieSBtYXRjaGluZyBmb3IgSlMgaW4gdXNlciBpbnB1dAo+ICAg ICBhbmQgaXMgdGhhbiBlaXRoZXIgYmxvY2tlZCBvciBtYXNrZWQgYnkgdGhlIFdlYiBEZXZlbG9w ZXIsIGVhY2ggb24gaGlzCj4gICAgIG93biBzaXRlLAo+ICAgICBYU1MgYXR0YWNrcyBmaW5kIGRp ZmZlcmVuY2VzIGJldHdlZW4gdGhlIG1hdGNoaW5nIG9mIHRoZSBXZWIgRGV2ZWxvcGVyCj4gICAg IGFuZCB0aGUgQnJvd3Nlciwgc3VjaCB0aGF0IHRoZSBXZWIgRGV2ZWxvcGVyJ3MgbWF0Y2hpbmcg ZG9lc24ndAo+ICAgICByZWNvZ25pemUgSlMgYXMgSlMsIGJ1dCB0aGUgQnJvd3NlciBleGVjdXRl cyBpdC4KPgo+ICAgICBUaGlzIGlzIGEgY29uc3RhbnQgZmlnaHQgYmV0d2VlbiB0aGUgV2ViIERl dmVsb3BlciBhbmQgdGhlIFhTUwo+ICAgICBhdHRhY2tlciwKPiAgICAgdGhhdCBjb3N0cyBtYW55 IHJlc291cmNlcyBuZWVkZWQgc29tZXdoZXJlIGVsc2UgaW5zdGVhZC4KPiAgICAgQW5kIHRoaXMg ZmlnaHQgZmF2b3JzIGxhcmdlciBidXNpbmVzcyBvdmVyIHNtYWxsIFdlYiBkZXZlbG9wZXJzLgo+ Cj4gICAgIEkgdGhpbmsgdGhhdCB0aGlzIGZpZ2h0IGNhbiBiZSB0ZXJtaW5hdGVkIGJ5IGxldHRp bmcgdGhlCj4gICAgIFdlYiBEZXZlbG9wZXIgbm90IGd1ZXNzIHdoYXQgdGhlIEJyb3dzZXIgbWF5 IHRoaW5rIHRvIGJlIEpTCj4gICAgIGFuZCBpbnN0ZWFkIHRlbGwgaGltIGV4cGxpY2l0bHkgdGhh dCBzb21ld2hlcmUgc2hvdWxkbid0IGJlIGFueSBjb2RlLgo+ICAgICBUaGUgQnJvd3NlciB0aGVu IGJlaGF2ZXMgaW4gdGhhdCByZWdpb24gbGlrZQo+ICAgICBoZSB3b3VsZCBoYXZlIEpTIGRpc2Fi bGVkLgo+Cj4gICAgIEkgd291bGQgZG8gdGhhdCB3aXRoIGEgbmV3IGF0dHJpYnV0ZSwgY2FsbGVk IG5vc2NyaXB0cy4KPiAgICAgSW5zaWRlIGFuIEhUTUwgZWxlbWVudCB3aXRoIG5vc2NyaXB0cyA9 ICJ0cnVlIiwKPiAgICAgdGhlIEJyb3dzZXIgaGFuZGxlIGFueXRoaW5nIGluc2lkZSB0aGF0IGVs ZW1lbnQgbGlrZQo+ICAgICBKUyB3b3VsZCBiZSBkaXNhYmxlZCBnbG9iYWxseS4KPgo+ICAgICBB biBleGFtcGxlIEhUTUwgd291bGQgbG9vayBsaWtlIHRoaXM6Cj4gICAgIDwhZG9jdHlwZSBodG1s Pgo+ICAgICA8aHRtbD4KPiAgICAgLi4uCj4gICAgIDxkaXYgbm9zY3JpcHRzPSJ0cnVlIj4KPiAg ICAgPHNjcmlwdD4KPiAgICAgLy8gTm8gZGFuZ2VyIGJ5IHVuZXNjYXBlZCA8c2NyaXB0PiB0YWdz Cj4gICAgIDwvc2NyaXB0Pgo+ICAgICA8YnV0dG9uIG9uY2xpY2s9Im5vciBieSBFdmVudCBsaXN0 ZW5lcnMiPkNsaWNrIG1lPC9idXR0b24+Cj4gICAgIC4uLgo+ICAgICA8L2h0bWw+Cj4KPiAgICAg SWYgeW91IGtub3cgYSB3YXkgdG8gZG8gdGhpcyB3aXRob3V0IGFueSBkaWZmZXJlbmNlcyBiZXR3 ZWVuIHdoYXQgdGhlCj4gICAgIEJyb3dzZXIgZXhlY3V0ZXMgYW5kIHdoYXQgZXZlciB0aGF0IG1l Y2hhbmljIGxldHMgcGFzcywgbGV0IG1lIGtub3cKPiAgICAgYW5kIGxldCBtZSBrbm93IHdoeSBp dCBpc24ndCB0aG91Z2h0IGluIGV2ZXJ5IEhUTUwvSlMgVHV0b3JpYWwgYW5kCj4gICAgIGV2ZXJ5 IERvY3VtZW50YXRpb24gYWJvdXQgV2ViIERldmVsb3BtZW50Lgo+ICAgICBfX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwo+ICAgICBkZXYtc2VjdXJpdHkgbWFp bGluZyBsaXN0Cj4gICAgIGRldi1zZWN1cml0eUBsaXN0cy5tb3ppbGxhLm9yZyA8bWFpbHRvOmRl di1zZWN1cml0eUBsaXN0cy5tb3ppbGxhLm9yZz4KPiAgICAgaHR0cHM6Ly9saXN0cy5tb3ppbGxh Lm9yZy9saXN0aW5mby9kZXYtc2VjdXJpdHkKPgoKX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX18KZGV2LXNlY3VyaXR5IG1haWxpbmcgbGlzdApkZXYtc2VjdXJp dHlAbGlzdHMubW96aWxsYS5vcmcKaHR0cHM6Ly9saXN0cy5tb3ppbGxhLm9yZy9saXN0aW5mby9k ZXYtc2VjdXJpdHkK