Reply to thread

Message

<blockquote data-quote="Jan Willy" data-source="post: 1038645" data-attributes="member: 80838">Some user rules.Prevent unauthorized writing to clipboard (Chromium based browsers). View ! <a href="https://www.ghacks.net/2022/08/27/websites-may-write-to-the-clipboard-in-chrome-without-user-permission/" target="_blank">Websites may write to the clipboard in Chrome without user permission - gHacks Tech News</a>Testpage: <a href="https://fluoridated-showy-fog.glitch.me/" target="_blank">https://fluoridated-showy-fog.glitch.me/</a>*##+js(aopw,navigator.clipboard)Edit: I did now some testing again and it seems that at least in MS Edge the problem is solved.Blocking fingerprinting adblockers on the site browserleaks.com:*proxy.jsBlocking abused EVAL javascript. View <a href="https://malwaretips.com/threads/ublock-i-exfiltrate-exploiting-ad-blockers-with-css.111338/post-967499" target="_blank">Need Advice - uBlock, I exfiltrate: exploiting ad blockers with CSS</a>Testsite: <a href="https://webbrowsertools.com/test-eval/" target="_blank">Test Eval</a>*##+js(noeval)If you want the result &#039;blocked&#039; on all sections of abovementioned testsite:*$csp=script-src &#039;unsafe-inline&#039;But it will break many sites. Instead of whitelisting every broken site, you can soften the rule by excluding regular TLD&#039;s, e.g.:*$csp=script-src &#039;unsafe-inline&#039;,domain=~com|~eu|~inf|~io|~ms|~net|~nl|~org</blockquote>

[QUOTE="Jan Willy, post: 1038645, member: 80838"] Some user rules. Prevent unauthorized writing to clipboard (Chromium based browsers). View ! [URL='https://www.ghacks.net/2022/08/27/websites-may-write-to-the-clipboard-in-chrome-without-user-permission/']Websites may write to the clipboard in Chrome without user permission - gHacks Tech News[/URL] Testpage: [URL]https://fluoridated-showy-fog.glitch.me/[/URL] *##+js(aopw,navigator.clipboard) Edit: I did now some testing again and it seems that at least in MS Edge the problem is solved. Blocking fingerprinting adblockers on the site browserleaks.com: *proxy.js Blocking abused EVAL javascript. View [URL='https://malwaretips.com/threads/ublock-i-exfiltrate-exploiting-ad-blockers-with-css.111338/post-967499']Need Advice - uBlock, I exfiltrate: exploiting ad blockers with CSS[/URL] Testsite: [URL='https://webbrowsertools.com/test-eval/']Test Eval[/URL] *##+js(noeval) If you want the result 'blocked' on all sections of abovementioned testsite: *$csp=script-src 'unsafe-inline' But it will break many sites. Instead of whitelisting every broken site, you can soften the rule by excluding regular TLD's, e.g.: *$csp=script-src 'unsafe-inline',domain=~com|~eu|~inf|~io|~ms|~net|~nl|~org [/QUOTE]

Verification