Uassets: deadstate.org malicious redirect via mediapass.com

[lpar]

URL(s) where the issue occurs

https://deadstate.org/

Describe the issue

Malicious redirect to an anti-adblock page happens on any page load with scripts disabled.

Versions

• Browser/version: Firefox 68.0
• uBlock Origin version: 1.21.2

Settings

The relevant change is that I disable JavaScript by default and allow it for domains I trust.

Notes

Appears to be implemented by putting a noscript element in the head of the page:

<noscript><meta http-equiv="REFRESH" content="0; url=https://www.mediapass.com/subscription/noscriptredirect?key=6678&asset=7281&uri=deadstate.org"></noscript>
<script type="text/javascript" src="https://www.mediapass.com/static/js/mm.js"></script>
<script type="text/javascript">MediaPass.init(6678, { asset:7281 });</script>
</head>

A possible fix is to just block everything from www.mediapass.com. Since it's a paywall platform I don't imagine there's anything worthwhile to be found there? Might want to come up with something more fine-grained though.

Have also reported the issue on the EasyList forums.

[llacb47]

Test deadstate.org##^meta[http-equiv="refresh"]

[lpar]

Works for me.

[okiehsch]

The relevant change is that I disable JavaScript by default and allow it for domains I trust.

I use the same setup, however filters will only be added to uAssets for issues that can be reproduced with a default setup, so the suggested working filter will not be added.

[llacb47]

@okiehsch can you add ||mediapass.com^$third-party,script, as they provide paywall and anti-adblock services.

Please see https://www.mediapass.com and https://theislandnow.com -- click on 6 articles and you will be paywalled by mediapass.

On http://tooeleonline.com articles cannot be read at all, they are all paywalled by mediapass.

Subscription nag powered by mediapass

Paywall powered by mediapass

[okiehsch]

https://github.com/uBlockOrigin/uAssets/issues/2317#issuecomment-392009540

[okiehsch]

I don't know what the confused emoji means.
The linked comment from gorhill is pretty clear to me.
uBO will not add filters to circumvent paywalls.
The difference between a paywall and an anti-adblock wall - as far as uBO is concerned - is that a paywall blocks every user from accessing the content regardless if one uses an adblocker or not.

http://tooeleonline.com uses a genuine paywall. It is laughably easy to circumvent it but it is a paywall nonetheless.