Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

NoScript XSS warning when following link to jq manual #2455

Closed
jhnc opened this issue Jul 17, 2022 · 1 comment
Closed

NoScript XSS warning when following link to jq manual #2455

jhnc opened this issue Jul 17, 2022 · 1 comment
Labels

Comments

@jhnc
Copy link

jhnc commented Jul 17, 2022

Describe the bug

Following #name links to jq manual website give NoScript XSS warnings in firefox.

To Reproduce

The map description is at: https://stedolan.github.io/jq/manual/v1.6/#map(x),map_values(x)

NoScript reports:

NoScript XSS Warning

NoScript detected a potential Cross-Site Scripting attack from [...] to https://stedolan.github.io
Suspicious data:
(URL) https://stedolan.github.io/jq/manual/v1.6/#map(x),map_values(x)

This happens even if I encode (),%28%29%2C

Expected behavior

No warning from NoScript

Environment (please complete the following information):

  • Linux (xubuntu 20.04)
  • jq 1.6 (website)

Additional context

@itchyny itchyny added the docs label Jun 3, 2023
@itchyny
Copy link
Contributor

itchyny commented Jun 25, 2023

I don't think this is caused by section ids but probably due to CDN resources without subresource integrity. Anyway the manual does nothing wrong, and you can configure NoScript extension to trust the URL. Hopefully resolved by #2628.

@itchyny itchyny closed this as completed Jun 25, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants