hostfil.es: nuisance

[Steering7253]

Prerequisites

• I verified that this is not a filter list issue. Report any issues with filter lists or broken website functionality in the uAssets issue tracker.
• This is NOT a YouTube, Facebook or Twitch report. These sites MUST be reported by clicking their respective links.
• This is not a support issue or a question. For support, questions, or help, visit /r/uBlockOrigin.
• I performed a cursory search of the issue tracker to avoid opening a duplicate issue.
• The issue is not present after disabling uBO in the browser.
• I checked the documentation to understand that the issue I am reporting is not normal behavior.

I tried to reproduce the issue when...

• uBO is the only extension.
• uBO uses default lists and settings.
• using a new, unmodified browser profile.

Description

uBO causes a CSP error. And no, I'm not making a new browser profile, I already did enough work to report this, thanks.

A specific URL where the issue occurs.

https://www.hostfil.es/

Steps to Reproduce

Have uBO enabled on site and open dev console

Expected behavior

Not trying to inject a script that will be blocked

Troubleshooting information

uBlock Origin: 1.73.0
Firefox: 154
filterset (summary):
 network: 181752
 cosmetic: 43614
 scriptlet: 34634
 html: 3779
listset (total-discarded, last-updated):
 default:
  user-filters: 1-0, never
  ublock-filters: 53947-72, 32m Δ
  ublock-badware: 10194-17, 32m Δ
  ublock-privacy: 4121-2, 32m Δ
  ublock-unbreak: 2865-1, 32m Δ
  ublock-quick-fixes: 503-13, 32m Δ
  easylist: 86345-139, 32m Δ
  easyprivacy: 56399-43, 32m Δ
  urlhaus-1: 47345-6, 32m
  plowe-0: 3526-1044, 8d.15h.44m
filterset (user): [array of 1 redacted]
trustedset:
 added: [array of 33 redacted]
userSettings: [none]
hiddenSettings: [none]
supportStats:
 allReadyAfter: 142 ms (selfie)
 maxAssetCacheWait: 39 ms
 cacheBackend: indexedDB

[Steering7253]

PS: The code that's getting injected doesn't even appear to come from the repo, so god only knows what it is or does.

[uBlock-user]

uBO injects

*##+js(prevent-clipboard-write, /^mshta |^msiexec |^(bash <<<|curl -kfsSL) \$\(echo\b.+?base64 -d\b|^cmd \/c\b.+?\bcurl .+?(\.exe|\.bat)\b|^cmd\b.+?\bfor \/f\b.+?\bdelims\b.+?\bpow\b|^powershell.+?-w(indowStyle)? h(idden)?\b|^powershell.+?-W H(idden)?\b|^powershell.+?-NoP\b|^powershell.+?-ep bypass\b|^powershell.+?-EP (B|U)\b|^powershell.+?-ExecutionPolicy (Bypass|Unrestricted)|\\PowerShell\.exe.+?-ep bypass\b|^powershell.+?\biex\(|^powershell.+?Invoke-Expression|^powershell.+?Invoke-WebRequest|^powershell.+?-UseBasicParsing|^cmd.+?\/c.+?-nop\b.+?\biex\(|^(cmd|powershell)\b.+?recaptcha|^(cmd|powershell)\b.+?#(Verification|     )|^(cmd|powershell)\b.+?     #|^osascript .+?\bcurl http|^curl -s\b.+?\| (bash|sh|zsh)\b|^\/bin\/(bash|sh|zsh) -c\b.+?\bcurl|^bash -c\b.+?\$\(curl|^python3? -c\b.+?\b(exec|urllib|subprocess)\b|^echo\b.+?base64 (--decode|-D|-d)\b.+?\| (bash|sh)\b|openssl base64 -d|^curl\b .+?chmod \+x.+?&&|^(bash|sh|osascript)\b.+?recaptcha|^(bash|sh|osascript)\b.+?#(Verification|     )|^(bash|sh|osascript)\b.+?     #|^wget .+?\| (bash|sh)\b|^curl\b.+?-o\b.+?\/tmp\/.+?&&|^nc .+?-e \/bin\/(bash|sh)\b|^\/tmp\/.+?chmod \+x.+?&&|^wget -q.+?\.(sh|py|bin|elf)\b|^cmd .+?\bcertutil .+?\b(\.exe|\.bat)\b|^powershell .+?\birm .+?\.[a-z]+\/.+?powershell|^echo .+?\bbase64 .+?\bzsh\b/msi, domAlert, 'Beware, uBlock Origin blocked a potential ClickFix attack: ${text}', excludeMatches, /Maintainer|Contributor|^import /i)

in every page except on exceptions. Site's CSP policy throws an error, not an issue.