post_7183_1233429776.png 3.98K
0 downloadsNoScript 2 - Unparalleled Web Security! by Giorgio Maone
Main good news
- Further anti-XSS enhancements (thanks Soroush Dalili, Masato Kinugawa and Phil Purviance)
- Better compatibility with some misbehaving websites.
- Several InjectionChecker improvements especially in double injections detection (thanks Soroush Dalili, Krzysztof Kotowicz, Gareth Heyes and others).
- Fixed Surrogate Scripts, which had been broken by a Nightly change.
- Vastly improved ClearClick algorithms increase accuracy and reduces false positives.
- Smart integration with the new (Firefox 14) browser-native click to play : if a plugin object is manually allowed from NoScript's UI, it gets also natively activated.
- Improved active content identity tracking, to avoid redundant blocking steps across reloads, e.g. on Youtube.
- ClearClick compatibility with add-ons which mix their UI with content, such as FloatNotes (thanks endofmiles and Tom T. for reports), 1Password, Bitdefender TrafficLight (thanks Christopher A. M. Gerlach for reporting) and others.
- Better InjectionChecker tolerance to certain URL patterns containing domain-names as parameter values (thanks gazer75 for report)
- Work-around for 32-bit Flash player bug causing incompatibilities on certain sites (e.g. Google Music).
- Improved XSS protection against window.name attacks (thanks Masato Kinugawa for reports).
- ClearClick protection against partial obscuration attacks via Flash objects with OS-native wmode values (thanks David Lin-Shung Huang for reporting).
- Improved >XSS filtercompatibility with some complex Yahoo and Ebay URLs.
- Enhanced accuracy of the InjectionChecker XSS filter (thanks Masato Kinugawa for reports).
- Improved surrogate against Google's scriptless tracking of search results navigation
- Better compatibility with Facebook, Digg and other websites.
- Increased ClearClick protection (thanks .mario for reporting).
- adf.ly surrogate to automaticaly skip the interstitial page even if scripts are disabled
- Right-clicking on NoScript menu items copy site domains to the clipboard (useful for reporting and investigating sites, thanks Tom T. for RFE)
- Browserid.org has been added to the default whitelist.
- Protection against Koto's Cursorjacking attack.
- Protection against new kind of response splitting + XSS combo attack disclosed by Mike Brooks (still bypassing Google Chrome's XSS Auditor and MSIE's XSS Filter).
- Protection against new Clickjacking technique based on HTML5 drag and drop (thanks .mario for reporting).
- Enhanced compatibility of XSS filter with recent "Verified by VISA" changes.
- Restored ClearClick compatibility with the Disqus comments system.
- Updated Firefox Aurora and Nightly compatibility.
- ClearClick protection against timing attacks demonstrated by Michal Zalewski.
- Defense against a new kind of XSS attack based on HTML5 features and discovered by Soroush Dalili and .mario.
- More reliable and manageable Script Surrogates.
- Protection against a scriptless keylogging attack reported by .mario.
- XSS filter now explicitly checks for potentially dangerous SMIL elements (thanks .mario for suggestion)
- Improved XSS filter decoding and sanitization accuracy (thanks .mario for reporting).
- ClearClick compatibility with some add-ons (e.g. FoxTab).
- Updated Hebrew translation (thanks baryoni).
- Enhanced protection against Clickjacking on nested windowed Flash targets (thanks Sommerrain and Tom T for reporting)
- Improved heuristic for Cross-Site Script Inclusion (XSSI) detection, fixes some issues with chat widgets on Yahoo! Mail and Hotmail.
- Protection against reflected Cross-Site Script Inclusion (XSSI).
- noscript.keys.tempAllowPage- about:config preference to configure a keyboard shortcut for "Temporarily allow all this page"
- noscript.keys.revokeTemp - about:config preference to configure a keyboard shortcut for "Revoke temporary permissions"
- noscript.menuAccelerators - about:config preference to switch keyboard accelerators for "(Temporary) allow all this page" menu items on/off
- Smoother placeholder activation when a page reload is not required.
- Better compatibility with latest and upcoming changes in Firefox internals.
- "Before" and "After" new kinds of script surrogates (whose sources are prefixed with '<' and '>' respectively) get executed immediately before and after the matching external script runs (thanks al_9x for RFE).
- Enhanced HTML 5 video/audio compatibility.
- Disqus surrogate prevents blocked Disqus placeholders to overlap the content(thanks al_9x).
- Facebook Connect surrogate prevents many sites from breaking even if connect.facebook.net is forbidden (thanks al_9x).
- New Google Plus One surrogate prevents many sites from breaking even if Plus One is blocked (thanks al_9x).
- Enhanced Google Analytics surrogate.
- NoScript now prevents view-source URIs from being embedded by web pages in frames: this disables a class of information leakage attacks while preserving web-compatibility.
- Compatibility with Firefox 9.0a1 (Nightly).
- Better out-of-the-box compatibility with Twitter and related services, such as the t.co URL shortener
(NoScript emulates its script-based redirections with no need to allow JavaScript). - Improved Java blocking usability.
- Increased performance boost on non-whitelisted pages.
- Enhanced Surrogate Scripts.
- Halved startup time impact (< 50ms).
- Various compatibility improvements.
- Specific protection against so called Double-clickjacking, independent from JavaScript permissions.
- Protection against against view-source content extraction attacks.
- Forbid <AUDIO>/<VIDEO> now prevents also Mozilla's Audio API from being abused when embedding restrictions are extended to whitelisted sites.
- Improved compatibility with Hotmail, Amazon and other popular services.
- Fixed Firebug conflict.
- Enhanced dynamic activation of blocked embedded objects when JavaScript is allowed (e.g. Yahoo videos).
- More compatible anti-XSS filters.
- "Click to play" protection against WebGL exploitation, now also on whitelisted sites (can be enabled in NoScript Options|Embeddings)
- Enhanced anti-XSS filters.
- Better Firefox 4 UI integration.
- Security and Privacy Info page is shown whenever you middle-click on sites exposed by NoScript's UI, either in the menus or in the Whitelist options tab.
- Middle clicking NoScript's toolbar button temporarily allows all on current page.
- More reliable WAN IP detection for router protection.
- Better out-of-the-box compatibility with Paypal buttons on non whitelisted sites.
- StrictX-Content-Type-Options: nosniff support, to prevent "upsniffing" of script, image and stylesheet content, in addition to the inclusion type checks already enforced by NoScript on cross-site requests.
This features lets Firefox 4 + NoScript (in "Allow Scripts Globally" mode!) achieve a 14/16 score on Browserscope's Security Test - More compliant HSTS implementation.
- java script: and data: URIs typed or pasted in the address bar are not executed anymore by default, in order to prevent social engineering attacks which are quite common now on Facebook and similar sites. Bookmarklets still works as expected, and power users can re-enable address bar execution by setting the noscript.allowURLBarJS about:config preference to true.
- Boosted performance and memory efficiency in cross-site checks.
- Several site and extensions compatibility improvements.
- Better Firefox 4 UI integration.
- Enhanced Google Analytics Surrogate Script.
- Fixed Yahoo! Toolbar incompatibility.
- Several performance optimiziations, with halved startup time.
- Transparent Firefox Sync support, to share all your NoScript settings across multiple workstations.
- Several optimizationsfor Firefox 4.
- Transparent Firefox Sync support, to share all your NoScript settings across multiple workstations (disabled by default, can be activated by setting the noscript.sync.enabled about:config preference to true.
- Major performance enhancements.
- Improved anti-XSS protection against potential risks from new HTML 5 features.
- Automatic fallback for some types of AJAX-rendered web pages (e.g. on Gawker's sites) via Google's _escaped_fragment_ recommendation.
- More reliable WAN IP detection for router protection.
- Improved IPv6 ABE
Abe.png 1.24K
0 downloadscompatibility.
- Enhanced embedding placeholder tooltips.
- Better out-of-the-box compatibility with Paypal buttons on non whitelisted sites.
- Do Not Track feature updated to the new "official" DNT HTTP header.
- Restored status bar label by popular demand.
- Update localizations.
- More web-compatible X-Content-Type-Options: nosniff implementation, compensates for JSON and JavaScript cross-site resources served by Google some sites with both nosniff and a wrong content-type.
- Work around for buggy routers having their web console login broken by Do Not Track tracking opt-out support
- Middle clicking NoScript's toolbar button temporarily allows all on current page.
- Finer grained embedded content control.
- Improved integration with Firefox 4's "add-on bar".
- Removed vestigial/obsolete components and features (TLD service emulation, SeaMonkey uninstaller, embedding opacization, JAR blocking).
- Several performance optimizations.
- LiveConnect interception and blocking without any noticeable overhead.
- Protection against hexadecimal and binary encoded reflected XSS through SQL injection (SQLXSSI), partially found and disclosed (raw hexadecimal variant only) by Aditya K Sood.
- Configurable interception and disablement of LiveConnect Java VM scripting.
- Security and Privacy Info page is shown whenever you middle-click on sites exposed by NoScript's UI, either in the menus or in the Whitelist options tab.
- Fixed Flash video issues due to recent Firefox changes.
- Improved HTTPS enforcement engine.
- Work-around for a bug in Google's X-Contet-Type-Options: nosniff support, affecting several Google properties, including Webmaster Tools and Youtube.
- Strict X-Content-Type-Options: nosniff support, to prevent "upsniffing" of script, image and stylesheet content, in addition to the inclusion type checks already enforced by NoScript on cross-site requests. This features lets Firefox 4 + NoScript (in "Allow Scripts Globally" mode!) achieve a 14/16 score on Browserscope's Security Test.
- The Recently blocked sites submenu is now rendered in bold when one or more of its subitems (in bold, too) had been requested from the current top-level website (thanks therube for RFE).
Optimized ClearClick anti-clickjacking protection. - Improved
ABE_Icon.png 1.24K
0 downloads ABE address-matching engine.
- Several web compatibility enhancements.
- Improved - Optimal calibration for the "one click" permission switching:
NoScript's menu gets opened as soon as you point the status bar icon or the toolbar button. This behavior can be turned off by unchecking NoScript Options|Appearance|Open permissions menu when mouse hovers over NoScript's icon. - Improved compatibility with Firefox 4 development builds and with web sites which handle cookies in buggy ways.
- "One click" permission switching behavior made smoother and extended to the toolbar button.
- True "one click" permission switching: NoScript's menu gets automatically opened as soon as you hover over the status bar icon. This behavior can be turned off by unchecking NoScript Options|Appearance|Open permissions menu when mouse hovers over NoScript's icon.
- Enhanced anti-XSS protection usability.
- Improved Surrogate Scripts.
- Better ClearClick compatibility with Flash movies inside frames when Adblock Plus is installed.
- More compliant HSTS implementation.
- Protection against XSS attacks exploiting Microsoft ASP's homographic unicode translation misfeature.
- Faster and more compatible Surrogate Script support.
- Improved UI accessibility (thanks Jonathan Ely for his help).
- More administrators-friendly protection against protection against DNS-rebinding attacks targeted to routers: device fingerprinting can be turned off by sending a "X-ABE-Fingerprint: Off" HTTP header, and fingerprinting requests (sent every 15 minutes instead of 5 now) are identified by a "Mozilla/5.0 (ABE, http://noscript.net/abe/wan)" User-Agent header. Furthermore, custom local subnets or IPs can be configured as a space-separated list in the noscript.abe.localExtras about:config preference.
- Restored compatibility with latest SeaMonkey and Firefox trunk builds.
- Better ClearClick accuracy on very tiny iframes.
- Faster and more compatible anti-XSS protection.
- Exclusive protection against DNS-rebinding attacks targeted to routers, including WAN IP variants.
- Several new Anti-anti-adblocker Surrogate Scripts to prevent pages from breaking when ads are disabled.
- NoScript 1.10.x is the last serie supporting Firefox 2.0 and older browsers.
- It will be updated only if affected by serious security vulnerabilities (very unlikely). This will allow the upcoming NoScript 2.x series to be developed faster and better, by removing legacy compatibility code and fully leveraging the latest APIs and language features.
- Built-in ABE
Abe.png 1.24K
0 downloads ruleset editor.
post_7183_1274931037.png 917bytes
0 downloads Get it!View the extensive development in NoScript v. 1.9.x here: NoScript 1.9.x - 'Your Friendly Web Cop'
