We have a SaaS (web app) that uses Froala YSIWYG HTML Editor, but users with KIS Anti Banner since 2020-05-11 cannot use this feature, as it is blocked by KIS.

[ThePokyWizard]

We have a SaaS (web app) that uses Froala YSIWYG HTML Editor, but users with Kaspersky Internet Security since 2020-05-11 cannot use this feature, as it is blocked by KIS.

 

What could be happening?
How can we find out how to get around this problem?

 

Several users have reported this problem to us.

 

The problem occurs in all browsers, Google Chrome, Mozilla Firefox, Microsoft Edge, etc ...

 

Is there a technical channel that can verify this problem?

 

This is the component working perfectly with KIS disabled.

 

This is the component not working when KIS is activated.

-----------------------------------------------------------------------------------------------

Edit

I found that the problem is caused by the KIS Antibanner feature.
But this is not an advertising banner.

[Flood and Flood's wife]

Hello @ThePokyWizard, 

Welcome!

• Clearly something changed on or about the 11th, the question is what🤔
• Please provide KIS All events, 7day Report, see video  - note: the video shows 24hr Report extraction, please change to 7days & post back please? 

Link

 

• If there’s an actual URL, for the SaaS app, try adding a domain exclusion to Network, encrypted connections (scanning) 

• Or a File Anti-Virus exclusion

 

Please post back?

Thank you🙏

Flood🐳

[Flood and Flood's wife]

@ThePokyWizard,

Additional:

Or an Anti-Banner exclusion

Or a Private Browsing exclusion

Thank you🙏

Flood🐳

 

[ThePokyWizard]

I generated two logs, one for all events and one for antibanner.
When my website is displayed it is only related to Google Ads, but nothing more.
For privacy I renamed my site in the log to my-saas.example.com

 

I performed all the exclusions (Private Browsing, File Anti-Virus, Network, encrypted connections (scanning) and Anti-banner), but only Anti-banner worked.

[Flood and Flood's wife]

Hello @ThePokyWizard,

You’re welcome!

Thank you for the reports, however, we require the 7day Report? (as requested above)

• Does “only Anti-banner worked” mean the original  issue is resolved? 

If “no”

1. Post screen images of all exclusions applied?
2. Run a GSI & Windows Logs & post back? 

Thank you🙏

Flood🐳

[ThePokyWizard]

Hello @FLOOD ,

 

The log is small because I installed KSI today to perform the tests to reproduce the problem that my users were reporting.

Using Anti-Banner exclusion the problem was solved. But checking the log I found nothing related to my website,

only with Google Ads, but technically this shouldn't interfere.

 

Best regards

ThePokyWizard

[Flood and Flood's wife]

Hello @ThePokyWizard,

Thank you for replying.

• If the issue began 2020-05-11, a KIS Report that covers that date is required, bc, clearly something changed, was it: software, hardware, network, environmental, something else, we don’t know & you’ve not provided enough information for us make any qualified assessment🤔
• We’re delighted the issue is resolved by applying the AB exclusion🤸 . 

Thank you🙏

Flood🐳

[ThePokyWizard]

Hello @FLOOD,
 

I will check with some of the users if they can provide the log.
Because they are reports of users who do not know each other, do not work at the same company and do not use the same machine.
The site has also not received any updates in the last 14 days.

Best regards

ThePokyWizard

[Flood and Flood's wife]

Hello @ThePokyWizard,

Thank you👌

We don’t know what “ The site has also not received any updates in the last 14 days “, means, if an update is the root cause, it may be Windows, KIS, the SAAS software, something else, without data, we have absolutely no way of knowing. 

For “in-depth” analysis:

• Log a case with Kaspersky Technical Support, select Application malfunction template, include images, detailed history, Traces & a GSI & Windows Logs - from systems that  were impacted on the 11th of May 2020.
• After submitting the case, you’ll receive an automated email with an INC+12digits reference number, then, normally, within 5 business days, a Kaspersky Technical Support human will communicate with you, also by email, you may continue to engage with the Kaspersky Technical Team via email or by updating the INC in your MyKaspersky account.
• Note: just like us, Support do not have a 🔮 , the more correct and detailed information you provide, the more likely they’ll be able to assist. 

Thank you🙏

Flood🐳

[ThePokyWizard]

Hello @FLOOD ,

 

I performed more in-depth tests and verified that the problem is triggered with the HTML element iframes that have the src property as "about:blank", eg.:
 

<iframe src="about:blank" class="fr-iframe" style="height: 90px;" frameborder="0"></iframe>

And this does not only affect my website, but also for example the publisher's supplier site, as can be seen in their URL: Iframe - Froala, until I deactivated the KSI protection, the website was blocked from being accessed, and after being accessed and with the protection reactivated, the hidden iframe problem was triggered.

This affects all sites that use iframes in this way.

Best Regards
ThePokyWizard

[Flood and Flood's wife]

Hello @ThePokyWizard,

Thank you👌

• If you believe that KIS is not functioning correctly, create a video of the issue and how the output should appear and log a case with Kaspersky Technical Support, select Application malfunction template, include your analysis, Developer logs & or browser logs, images, the video, detailed history, including that adding an AB exclusion resolves the problem; Traces & a GSI & Windows Logs - from systems that  were impacted on the 11th of May 2020.
• After submitting the case, you’ll receive an automated email with an INC+12digits reference number, then, normally, within 5 business days, a Kaspersky Technical Support human will communicate with you, also by email, you may continue to engage with the Kaspersky Technical Team via email or by updating the INC in your MyKaspersky account.
• As per our previous reply, Support do not have a 🔮 , the more detailed information provided, the more likely they’ll be able to assist. 

Thank you🙏

Flood🐳