search

spmbt / googleSearchExtraButtons

Google Search Extra Buttons
66 stars 20 forks source link

The script does not have a valid include (match) rules #24

Open IRainman opened 4 years ago

IRainman commented 4 years ago

I have a big problem with this script (same for Yandex Extra buttons). The script broke the other sites. I don't want to publish URL here because currently this is XSS, which allows me to create a order without paying. Currently I work with support of the site so that they fix the vulnerability on their site.

You need to set correct include list for google.com, google.ru etc.

ghost commented 3 years ago

I cannot get script to work on mine anymore. Can you?

mikhoul commented 3 years ago

It work here.

spmbt commented 3 years ago

IRainman: which includes do you think are incorrect? (gstatic are not used and may be removed) Maybe, better way - to deactivate script, when it start in frame?

You need to set correct include list for google.com, google.ru etc.

IRainman commented 3 years ago

I don't sure about frames. The problem is probably in rules with There will be probably enough includes without on the end, like this: https://www.google.*/

And * in domain name is needs to be complete local domain from the list. The list is probably exist here https://ipfs.io/ipfs/QmXoypizjW3WknFiJnKLwHCnL72vedxjQkDDP1mXWo6uco/wiki/List_of_Google_domains.html in section Localized & regional domains

spmbt commented 3 years ago

IRainman: is there problem with names like www.google.anotherDomain.com?

mikhoul commented 3 years ago

@spmbt

This: // @include http*://*.google.*/search?* should work on all google domain, at least it does for me.

Including domains like https://www.google.co.uk/ and others like that.

Regards :octocat: