Re: XSS protection with an noscripts attribute
joris <[email protected]> Sun, 7 Apr 2019 16:24:54 +0200
| Newsgroups | gmane.comp.mozilla.security |
|---|---|
| Message-ID | <[email protected]> |
QWxyaWdodCwgSSB0aGluayB3ZSB0aGF0IDx0ZW1wbGF0ZT4gaXMgdGhlIGZ1cnRoZXN0CndlIGdl dCBub3cgYW5kIHdlIGdvdCB0byBtaW5kIHRoZSBzcGVjcyEKVGhhbmtzIENyYWlnLgoKT24gNC83 LzE5IDI6MDEgUE0sIENyYWlnIEZyYW5jaXMgd3JvdGU6Cj4gSGkgSm9yaXMsCj4KPiBJIHN1c3Bl Y3QgaXQncyBqdXN0IGhvdyB0aGUgd2ViIGhhcyBkZXZlbG9wZWQsIHdoZXJlIHRoZSBtaXhpbmcg b2YgCj4gSmF2YVNjcmlwdCBhbmQgaW1wZXJmZWN0IEhUTUwgaXMgbm9ybWFsLgo+Cj4gSSBxdWl0 ZSBsaWtlIHRoaXMgdmlkZW8gYXMgYSBkZW1vOgo+Cj4gaHR0cHM6Ly93d3cueW91dHViZS5jb20v d2F0Y2g/dj1sRzdVM2Z1TnczQQo+Cj4gV2hlcmUgSSB0aGluayB5b3VyIHBvaW50IGlzIHJhaXNl ZCB3aGVuIGNvbXBhcmluZyB0aGUgZGlmZmVyZW50IAo+IHBhcnNpbmcgb2Y6Cj4KPiAxKSA8ZGl2 PjxzY3JpcHQgdGl0bGU9IjwvZGl2PiI+Cj4gMikgPHNjcmlwdD48ZGl2IHRpdGxlPSI8L3Njcmlw dCI+Cj4KPiBNeSBmYXZvdXJpdGUgZXhwbG9pdMKgaXMgdmVyeSBzaW1pbGFyLi4uCj4KPiAqPHNj cmlwdD4qCj4gdXNlcl9uYW1lID0gIkNyYWlnKjwvc2NyaXB0PipIZWxsbyI7Cj4gPC9zY3JpcHQ+ Cj4KPiBQZXJzb25hbGx5IEknZCBsaWtlIHRvIHNheSB0byB0aGUgYnJvd3Nlciwgc2ltaWxhciB0 byB0aGUgb2xkL29ic29sZXRlIAo+IDxwbGFpbnRleHQ+IGVsZW1lbnQsIHlvdSB3b24ndCBmaW5k IGFueSBKYXZhU2NyaXB0IGNvZGUgYWZ0ZXIgdGhpcyAKPiBwb2ludCAobWF5YmUgaXQgY2FuIGJs b2NrIGFsbCBzY3JpcHRzIGluIHRoZSA8Ym9keT4/KS4uLiBidXQgdGhpcyBpcyAKPiBvbmx5IGJl Y2F1c2UgSSBsb2FkIG15IEpTIGZpbGVzIGluIHRoZSA8aGVhZD4sIGFuZCBhdHRhY2ggZXZlbnQg Cj4gbGlzdGVuZXJzIGFmdGVyIERPTUNvbnRlbnRMb2FkZWQsIGJ1dCBJIGtub3cgc28gZmV3IGRl dmVsb3BlcnMgZG8gCj4gdGhpcywgc28gaXQgd29uJ3QgYmUgdXNlZnVsIHRvIGFkZC4KPgo+IEkg dGhpbmsgdGhpcyBpcyB0aGUgbWFpbiByZWFzb24gQ29udGVudCBTZWN1cml0eSBQb2xpY3kgY2Ft ZSBpbnRvIAo+IGV4aXN0ZW5jZSwgd2hlcmUgSSBjYW4gc2tpcCAidW5zYWZlLWlubGluZSIgdG8g YmxvY2sgYW55IGlubGluZSAKPiBKYXZhU2NyaXB0LCBhbmQgbGltaXQgdGhlIEphdmFTY3JpcHQg ZmlsZXMgdGhhdCBjYW4gYmUgaW5jbHVkZWQuCj4KPiBZb3UgY2FuIGtpbmQgb2YgZ2V0IGFuIGlk ZWEgb2Ygd2hhdCBoYXBwZW5zIHdpdGggdGhlIGJyb3dzZXIgcGFyc2luZyAKPiBieSB1c2luZyBK YXZhU2NyaXB0IHRvIGxvYWQgdGhlIEhUTUwgaW50byBhIDx0ZW1wbGF0ZT4gZWxlbWVudC4uLiBi dXQgCj4gdGhhdCBkb2VzIHJhaXNlIHRoZSBxdWVzdGlvbiBvbiBob3cgeW91IGdldCB0aGUgdW5z YWZlIHZhcmlhYmxlcyB0byAKPiB0aGUgSmF2YVNjcmlwdCBpbiB0aGUgZmlyc3QgcGxhY2UuCj4K PiBBcyBhbiBhc2lkZSwgSSB1c2UgPG1ldGEgbmFtZT0ianNfbmFtZSIgY29udGVudD0iLi4uIiAv PiB0YWdzLi4uIAo+IHNvbWV0aW1lcyB3aXRoIEpTT04gZW5jb2RlZCBkYXRhIGluIHRoZSBjb250 ZW50IGF0dHJpYnV0ZSwgd2hlcmUgSSdkIAo+IHVzZSBzb21ldGhpbmcgbGlrZSB0aGUgZm9sbG93 aW5nIHRvIGdldCB0aGUgY29udGVudDoKPgo+IMKgIHZhciBteV9kYXRhID0gZG9jdW1lbnQucXVl cnlTZWxlY3RvcignbWV0YVtuYW1lPSJqc19kYXRhIl0nKTsKPiDCoCBpZiAobXlfZGF0YSkgewo+ IMKgIMKgIHRyeSB7Cj4gwqAgwqAgwqAgbXlfZGF0YSA9IEpTT04ucGFyc2UobXlfZGF0YS5nZXRB dHRyaWJ1dGUoJ2NvbnRlbnQnKSk7Cj4gwqAgwqAgfSBjYXRjaCAoZSkgewo+IMKgIMKgIMKgIG15 X2RhdGEgPSBudWxsOwo+IMKgIMKgIH0KPiDCoCB9Cj4KPiBCdXQgZ29pbmcgZm9yd2FyZHMsIHRo ZSBIVE1MNSBzcGVjIGRvZXMgY292ZXIgaG93IHRoZSBicm93c2VyIChhbmQgCj4gdGhpcmQtcGFy dHkgbGlicmFyaWVzKSBzaG91bGQgYmUgcGFyc2luZyBpbXBlcmZlY3QgSFRNTCwgc28gaG9wZWZ1 bGx5IAo+IHRoZXNlIGRpZmZlcmVuY2VzIHdpbGwgcmVkdWNlIChidXQgSSBkb24ndCBpbWFnaW5l IHRoZXkgd2lsbCBhbGwgYmUgCj4gcGVyZmVjdGx5IGFsaWduZWQsIGluIHRoZSBzYW1lIHdheSBk aWZmZXJlbnQgYnJvd3NlcnMgYXJlbid0KS4KPgo+IENyYWlnCj4KPgo+Cj4KPgo+IE9uIFN1biwg NyBBcHIgMjAxOSBhdCAwOTowMCwgam9yaXMgPGpvcmlzLmd1dGphaHJAZ21haWwuY29tIAo+IDxt YWlsdG86am9yaXMuZ3V0amFockBnbWFpbC5jb20+PiB3cm90ZToKPgo+Cj4gICAgIEkgYWdyZWUs IHRoYXQgd291bGQgYmUgYSB2dWxuZXJhYmlsaXR5Lgo+ICAgICBCdXQgSSB0aGluayB0aGlzIGlz IG5vdCB0aGUgY29yZSBvZiBteSB3b25kZXIuCj4gICAgIEkgd29uZGVyLCB3aHkgZG8gV2ViIGRl dmVsb3BlcnMgaGF2ZSB0bwo+ICAgICBndWVzcyB3aGF0IHRoZSBCcm93c2VyIHRoaW5rcyBpcyBK UyBhbmQgZXhlY3V0ZXMKPiAgICAgaXQgYW5kIHdoYXQgaXNuJ3Q/Cj4gICAgIFdoeSBjYW4ndCB0 aGV5IGp1c3QgYXNrIHRoZSBXZWIgQnJvd3NlciB0byBkbyB0aGF0Cj4gICAgIGZvciB0aGVtPwo+ ICAgICBUaGF0IHdvdWxkIGJlIG1vcmUgc2VjdXJlIGJlY2F1c2UKPiAgICAgYWxsIHRoaXJkLXBh cnR5IGxpYnJhcmllcyBwYXJzZSBzb21ld2hhdCBkaWZmZXJlbnRseQo+ICAgICB0aGFuIGFsbCB0 aGUgV2ViIEJyb3dzZXIgdGhleSBhcmUgdXNlZCB3aXRoLgo+ICAgICBPbiA0LzYvMTkgMTI6NTEg UE0sIENyYWlnIEZyYW5jaXMgd3JvdGU6Cj4+ICAgICBXaGlsZSBJIHF1aXRlIGxpa2UgdGhlIHNp bXBsaWNpdHkgb2YgdGhpcyBpZGVhLCB3aGVyZSBpdCBraW5kIG9mCj4+ICAgICByZW1pbmRzIG1l IG9mIHRoZcKgQGluZXJ0IGF0dHJpYnV0ZS4KPj4KPj4gICAgIE15IG1haW4gY29uY2VybiBpcyBo b3cgdG8gYnlwYXNzIGl0LCB0YWtlIHRoZSBjb2RlOgo+Pgo+PiAgICAgPGRpdiBub3NjcmlwdHM9 InRydWUiPjw/PSAkdW5zYWZlX3VzZXJfbmFtZSA/PjwvZGl2Pgo+Pgo+PiAgICAgV2hlcmUgdGhl IGF0dGFja2VyIGNhbiBzZXQgdGhlaXIgdXNlcm5hbWUgdG8KPj4gICAgIGBYKjwvZGl2Pio8c2Ny aXB0PmV2aWxfY29kZTwvc2NyaXB0PjxkaXY+YAo+Pgo+PiAgICAgLS0tCj4+Cj4+ICAgICBVbmZv cnR1bmF0ZWx5LCBJIHRoaW5rIHRoaXMgaXMgd2h5IHdlIG5lZWQgdG8gd29yayB3aXRoIG1vcmUK Pj4gICAgIGNvbXBsaWNhdGVkL2FkdmFuY2VkIHNvbHV0aW9ucy4uLgo+Pgo+PiAgICAgV2UgbmVl ZCB0byBzYW5pdGlzZSBhbGwgc3RyaW5ncyB0aGF0IGFyZSBpbmNsdWRlZCBpbiB0aGUgSFRNTCBv bgo+PiAgICAgdGhlIHNlcnZlciBzaWRlIC0gZS5nLiB1c2luZyB0ZW1wbGF0aW5nIHN5c3RlbXM7 IG9yIHBhc3NpbmcgdGhlCj4+ICAgICBzdHJpbmcgdGhvdWdoIHNvbWV0aGluZyBsaWtlIEhUTUwg UHVyaWZpZXI6Cj4+Cj4+ICAgICBodHRwOi8vaHRtbHB1cmlmaWVyLm9yZy8KPj4KPj4gICAgIE9y LCBhbmQgeW91IGhhdmUgdG8gYmUgY2FyZWZ1bCBoZXJlLi4uIGVzY2FwaW5nIGFsbCBIVE1MIG91 dHB1dAo+PiAgICAgdGhvdWdoIGZ1bmN0aW9ucyBsaWtlIGh0bWxlbnRpdGllcygpIC8gaHRtbGVu Y29kZSgpLCB3aGVyZSB0aGlzCj4+ICAgICBkb2VzIG5vdCBmaXggYDxhIGhyZWY9PD89IGh0bWxl bnRpdGllcygkdW5zYWZlX3VybCk+YCBkdWUgdG8gdGhlCj4+ICAgICB1cmwgYmVpbmcgYWJsZSB0 byBzdGFydCB3aXRoIGBqYXZhc2NyaXB0OmAsIG9yIGJlaW5nIGFibGUgdG8gdGFrZQo+PiAgICAg YWR2YW50YWdlIG9mIHRoZSBtaXNzaW5nIHF1b3RhdGlvbiBtYXJrcyBvbiB0aGUgYXR0cmlidXRl IHZpYSBgCj4+ICAgICBvbmNsaWNrPWV2aWxfY29kZWAuCj4+Cj4+ICAgICBBbmQgd2hlbiB3b3Jr aW5nIHdpdGggc3RyaW5ncyBpbiBKYXZhU2NyaXB0IC0geW91IHNob3VsZCB1c2Ugc2FmZQo+PiAg ICAgbWV0aG9kcyBsaWtlIGBlbGVtZW50LnRleHRDb250ZW50YCwgb3IgcGFzcyB0aGVtIHRob3Vn aCBzb21ldGhpbmcKPj4gICAgIHRvIHNhbml0aXNlIHRoZSBIVE1MIChib3RoIGluIHJlbW92aW5n IHRoZSBtYW55IHdheXMgSmF2YVNjcmlwdAo+PiAgICAgY2FuIGJlIGluY2x1ZGVkLCBidXQgYWxz byBqdXN0IG1ha2luZyBzdXJlIHRoZSBIVE1MIGlzIHdlbGwgZm9ybWVkKToKPj4KPj4gICAgIGh0 dHBzOi8vZ2l0aHViLmNvbS9nb29nbGUvY2xvc3VyZS1saWJyYXJ5L2Jsb2IvbWFzdGVyL2Nsb3N1 cmUvZ29vZy9odG1sL3Nhbml0aXplci9odG1sc2FuaXRpemVyLmpzCj4+Cj4+ICAgICBodHRwczov L2dpdGh1Yi5jb20vcHVua2F2ZS9zYW5pdGl6ZS1odG1sCj4+Cj4+ICAgICBUaGVuIHlvdSB3b3Vs ZCBpZGVhbGx5IGFkZCBhIENvbnRlbnQgU2VjdXJpdHkgUG9saWN5IHRvIGxpbWl0IHRoZQo+PiAg ICAgc2NyaXB0cyBvbiB0aGUgcGFnZSwganVzdCBpbmNhc2UgeW91IG1pc3Mgc29tZXRoaW5nLgo+ Pgo+PiAgICAgaHR0cHM6Ly9kZXZlbG9wZXIubW96aWxsYS5vcmcvZW4tVVMvZG9jcy9XZWIvSFRU UC9DU1AKPj4KPj4gICAgIEFuZCBhcyBhbiBleHRyYSBib251cywgc3RhcnQgcGxheWluZyB3aXRo IHRoZSAoY3VycmVudGx5IGluCj4+ICAgICBkZXZlbG9wbWVudCkgVHJ1c3RlZCBUeXBlcywgdG8g bWFrZSBzdXJlIHlvdSBhcmVuJ3QgdXNpbmcgdW5zYWZlCj4+ICAgICB0aGluZ3MgbGlrZSBlbGVt ZW50LmlubmVySFRNTC4KPj4KPj4gICAgIGh0dHBzOi8vZGV2ZWxvcGVycy5nb29nbGUuY29tL3dl Yi91cGRhdGVzLzIwMTkvMDIvdHJ1c3RlZC10eXBlcwo+Pgo+PiAgICAgT3IgZm9yIGV2ZW4gbW9y ZSBmdW4gKHBhaW4pLCBvbiB5b3VyIGxvY2FsIGRldmVsb3BtZW50IHNlcnZlciwKPj4gICAgIHRy eSBzZXR0aW5nIHRoZSBoZWFkZXI6Cj4+Cj4+ICAgICDCoCDCoCBDb250ZW50LVR5cGU6IGFwcGxp Y2F0aW9uL3hodG1sK3htbDsgY2hhcnNldD1VVEYtOAo+Pgo+PiAgICAgRG8gbm90IGRvIHRoaXMg b24gbGl2ZSwgYXMgYW55IGJhZCBmb3JtYXR0aW5nIG9mIHlvdXIgSFRNTCB3aWxsCj4+ICAgICBi cmVhayB0aGUgcGFnZSAtIGJ1dCB0aGlzIGVuc3VyZXMgYWxsIG9mIHlvdXIgYXR0cmlidXRlcyBh cmUKPj4gICAgIHF1b3RlZCwgYW5kIGFsbCBvZiB5b3VyIHRhZ3MgYXJlIHBlcmZlY3RseSBuZXN0 ZWQgKHRoaXMgaW5jbHVkZXMKPj4gICAgIGA8YnI+YCBuZWVkaW5nIHRvIGJlIGA8YnIgLz5gLCB0 aGUgYXR0cmlidXRlIGBzZWxlY3RlZGAgbmVlZGluZwo+PiAgICAgdG8gYmUgYHNlbGVjdGVkPSJz ZWxlY3RlZCJgLCBldGMpLgo+Pgo+PiAgICAgQ3JhaWcKPj4KPj4KPj4KPj4gICAgIE9uIEZyaSwg NSBBcHIgMjAxOSBhdCAyMzo0NywgWW9nIEJpaSA8am9yaXMuZ3V0amFockBnbWFpbC5jb20KPj4g ICAgIDxtYWlsdG86am9yaXMuZ3V0amFockBnbWFpbC5jb20+PiB3cm90ZToKPj4KPj4gICAgICAg ICBYU1MgcHJldmVudGlvbiBpcyBhIHZlcnkgaW1wb3J0YW50IGFuZCBjb3N0bHkgcGFydCBvZiBh Cj4+ICAgICAgICAgV2Vic2l0ZXMgU2VjdXJpdHkuCj4+ICAgICAgICAgQmVjYXVzZSBYU1MgaXMg Y3VycmVudGx5IHByZXZlbnRlZCBieSBtYXRjaGluZyBmb3IgSlMgaW4gdXNlcgo+PiAgICAgICAg IGlucHV0Cj4+ICAgICAgICAgYW5kIGlzIHRoYW4gZWl0aGVyIGJsb2NrZWQgb3IgbWFza2VkIGJ5 IHRoZSBXZWIgRGV2ZWxvcGVyLAo+PiAgICAgICAgIGVhY2ggb24gaGlzCj4+ICAgICAgICAgb3du IHNpdGUsCj4+ICAgICAgICAgWFNTIGF0dGFja3MgZmluZCBkaWZmZXJlbmNlcyBiZXR3ZWVuIHRo ZSBtYXRjaGluZyBvZiB0aGUgV2ViCj4+ICAgICAgICAgRGV2ZWxvcGVyCj4+ICAgICAgICAgYW5k IHRoZSBCcm93c2VyLCBzdWNoIHRoYXQgdGhlIFdlYiBEZXZlbG9wZXIncyBtYXRjaGluZyBkb2Vz bid0Cj4+ICAgICAgICAgcmVjb2duaXplIEpTIGFzIEpTLCBidXQgdGhlIEJyb3dzZXIgZXhlY3V0 ZXMgaXQuCj4+Cj4+ICAgICAgICAgVGhpcyBpcyBhIGNvbnN0YW50IGZpZ2h0IGJldHdlZW4gdGhl IFdlYiBEZXZlbG9wZXIgYW5kIHRoZQo+PiAgICAgICAgIFhTUyBhdHRhY2tlciwKPj4gICAgICAg ICB0aGF0IGNvc3RzIG1hbnkgcmVzb3VyY2VzIG5lZWRlZCBzb21ld2hlcmUgZWxzZSBpbnN0ZWFk Lgo+PiAgICAgICAgIEFuZCB0aGlzIGZpZ2h0IGZhdm9ycyBsYXJnZXIgYnVzaW5lc3Mgb3ZlciBz bWFsbCBXZWIgZGV2ZWxvcGVycy4KPj4KPj4gICAgICAgICBJIHRoaW5rIHRoYXQgdGhpcyBmaWdo dCBjYW4gYmUgdGVybWluYXRlZCBieSBsZXR0aW5nIHRoZQo+PiAgICAgICAgIFdlYiBEZXZlbG9w ZXIgbm90IGd1ZXNzIHdoYXQgdGhlIEJyb3dzZXIgbWF5IHRoaW5rIHRvIGJlIEpTCj4+ICAgICAg ICAgYW5kIGluc3RlYWQgdGVsbCBoaW0gZXhwbGljaXRseSB0aGF0IHNvbWV3aGVyZSBzaG91bGRu J3QgYmUKPj4gICAgICAgICBhbnkgY29kZS4KPj4gICAgICAgICBUaGUgQnJvd3NlciB0aGVuIGJl aGF2ZXMgaW4gdGhhdCByZWdpb24gbGlrZQo+PiAgICAgICAgIGhlIHdvdWxkIGhhdmUgSlMgZGlz YWJsZWQuCj4+Cj4+ICAgICAgICAgSSB3b3VsZCBkbyB0aGF0IHdpdGggYSBuZXcgYXR0cmlidXRl LCBjYWxsZWQgbm9zY3JpcHRzLgo+PiAgICAgICAgIEluc2lkZSBhbiBIVE1MIGVsZW1lbnQgd2l0 aCBub3NjcmlwdHMgPSAidHJ1ZSIsCj4+ICAgICAgICAgdGhlIEJyb3dzZXIgaGFuZGxlIGFueXRo aW5nIGluc2lkZSB0aGF0IGVsZW1lbnQgbGlrZQo+PiAgICAgICAgIEpTIHdvdWxkIGJlIGRpc2Fi bGVkIGdsb2JhbGx5Lgo+Pgo+PiAgICAgICAgIEFuIGV4YW1wbGUgSFRNTCB3b3VsZCBsb29rIGxp a2UgdGhpczoKPj4gICAgICAgICA8IWRvY3R5cGUgaHRtbD4KPj4gICAgICAgICA8aHRtbD4KPj4g ICAgICAgICAuLi4KPj4gICAgICAgICA8ZGl2IG5vc2NyaXB0cz0idHJ1ZSI+Cj4+ICAgICAgICAg PHNjcmlwdD4KPj4gICAgICAgICAvLyBObyBkYW5nZXIgYnkgdW5lc2NhcGVkIDxzY3JpcHQ+IHRh Z3MKPj4gICAgICAgICA8L3NjcmlwdD4KPj4gICAgICAgICA8YnV0dG9uIG9uY2xpY2s9Im5vciBi eSBFdmVudCBsaXN0ZW5lcnMiPkNsaWNrIG1lPC9idXR0b24+Cj4+ICAgICAgICAgLi4uCj4+ICAg ICAgICAgPC9odG1sPgo+Pgo+PiAgICAgICAgIElmIHlvdSBrbm93IGEgd2F5IHRvIGRvIHRoaXMg d2l0aG91dCBhbnkgZGlmZmVyZW5jZXMgYmV0d2Vlbgo+PiAgICAgICAgIHdoYXQgdGhlCj4+ICAg ICAgICAgQnJvd3NlciBleGVjdXRlcyBhbmQgd2hhdCBldmVyIHRoYXQgbWVjaGFuaWMgbGV0cyBw YXNzLCBsZXQKPj4gICAgICAgICBtZSBrbm93Cj4+ICAgICAgICAgYW5kIGxldCBtZSBrbm93IHdo eSBpdCBpc24ndCB0aG91Z2h0IGluIGV2ZXJ5IEhUTUwvSlMKPj4gICAgICAgICBUdXRvcmlhbCBh bmQKPj4gICAgICAgICBldmVyeSBEb2N1bWVudGF0aW9uIGFib3V0IFdlYiBEZXZlbG9wbWVudC4K Pj4gICAgICAgICBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f Xwo+PiAgICAgICAgIGRldi1zZWN1cml0eSBtYWlsaW5nIGxpc3QKPj4gICAgICAgICBkZXYtc2Vj dXJpdHlAbGlzdHMubW96aWxsYS5vcmcKPj4gICAgICAgICA8bWFpbHRvOmRldi1zZWN1cml0eUBs aXN0cy5tb3ppbGxhLm9yZz4KPj4gICAgICAgICBodHRwczovL2xpc3RzLm1vemlsbGEub3JnL2xp c3RpbmZvL2Rldi1zZWN1cml0eQo+Pgo+CgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fXwpkZXYtc2VjdXJpdHkgbWFpbGluZyBsaXN0CmRldi1zZWN1cml0eUBs aXN0cy5tb3ppbGxhLm9yZwpodHRwczovL2xpc3RzLm1vemlsbGEub3JnL2xpc3RpbmZvL2Rldi1z ZWN1cml0eQo=