Let's say we go to a site, like https://unicornify.pictures/, and, for no reason at all, drag some of the text on the page to the space to the right of the new tab plus sign. This should open up a search in a new tab with the same text, but on Tor Browser, it opens a new tab as well as a NoScript window saying that it detected a potential XSS attack from https://unicornify.pictures to https://3g2upl4pq6kufc4m.onion/ (DuckDuckGoOnion). I very well know this is not an XSS attack, even though I am not an expert on them. There is no request sent from https://unicornify.pictures to https://3g2upl4pq6kufc4m.onion/ at all. Why does NoScript act this way?