Recently there is a new website that launches a URI scheme data that ABP can't block:
data:text/html;base64,PGh0bWw+PGJvZHk+PHNjcmlwdD53aW5kb3cubG9jYXRpb249Imh0dHA6Ly9kYXRhLnJldGFpbmd1YW5pbmVmbHVvcml0ZS5pbmZvL3pDZnZ2ZXlKeWIzVjBaU0k2SW1kbGRGOXdiM0FpTENKemRHbGtJam9pTWpnek1DSXNJbk5pYVdRaU9pSXhJaXdpZG1WeWMybHZiaUk2SWpRaUxDSndZV2RsWDNWeWJDSTZJbWgwZEhBNkx5OTFjR3h2WVdSbFpDNXVaWFF2Wm1sc1pTODRlRGcxWldwamRDODJiV0kxTmk1Q1pXRjFkR2xtZFd3dVIybHliSE11VUdGeWRDNDFPVGd1Y21GeUluMD1DVTdFOSI7PC9zY3JpcHQ+PC9ib2R5PjwvaHRtbD4=
this decodes into:
<html><body><script>window.location="http://data.retainguaninefluorite.info/ ... ody></html>
Can anybody help me write a custom rule to block this? Or is it better to remove the data scheme from the whitelist at
extensions.adblockplus.whitelistschemes?
Thanks.
Filter to block URI scheme data
Re: Filter to block URI scheme data
There is no HTTP request associated with the data URI scheme, so ABP can't block that; however, you can block the domain this HTML page redirects to:
I don't know how this data URI is activated, but for one possible way (iframe), if your domain is example.com, you could tryif this domain doesn't break with iframes inactive.
Code: Select all
||retainguaninefluorite.info^
||retainguaninefluorite.info^$popup
*$domain=retainguaninefluorite.info
retainguaninefluorite.info##body
Code: Select all
*$subdocument,domain=example.com
example.com##iframe
There's a buzzin' in my brain I really can't explain; I think about it before they make me go to bed.
Re: Filter to block URI scheme data
Thanks.
The URL that has this URI data scheme launch is
uploaded.net/file/16tc88nn/zka26.LIFE.N.MX.I.W.P.841.rar
Click on the grey Free Download button and the click will launch the URI data scheme.
The URL that has this URI data scheme launch is
uploaded.net/file/16tc88nn/zka26.LIFE.N.MX.I.W.P.841.rar
Click on the grey Free Download button and the click will launch the URI data scheme.
Re: Filter to block URI scheme data
add
Code: Select all
@@||retainguaninefluorite.info^$script,domain=uploaded.net
@@||letsadvertisetogether.com^$script