bugLibreJS - Bugs: bug #50551, installation in Firefox 54.0a2...

 
 

bug #50551: installation in Firefox 54.0a2 (2017-03-15) results in ALL sites returning compressed responses being blocked

Submitted by:  None
Submitted on:  Wed 15 Mar 2017 12:10:55 PM UTC  
Votes:  200  
 
Category:  None Severity:  4 - Important
Item Group:  None Status:  Wont Fix
Privacy:  Public Assigned to:  zach wick <zwick>
Open/Closed:  Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

( Jump to the original submission)

Mon 04 Jun 2018 05:56:03 PM UTC, comment #8:

It works, though, alas not well enough to be enabled all the time.

Going to for example :

https://www.theguardian.com/us-news/2018/jun/04/edward-snowden-people-still-powerless-but-aware

with LibreJS enabled results in a floating banner accross
the middle of the screen that cannot be closed and renders
it impossible to read the article - this is because it
is trying to notify me of the Guardian's new cookie policy,
and I am in Europe ( they have to re-notify everybody according
to GDPR) -but without LibreJS enabled, this appears as a floating
dialog that I can close. With LibreJS enabled, the floating
dialog repeats the page header, obscuring the entire page,
and cannot be closed.

So, nice try, but still not of sufficient quality for
general purpose use . I'd like to block obfuscated
closed-source javascript / complain about it, but being able
to use the web reliably on an everyday basis is more important.

I think the code should be prompting for user input
if it decides not to run / modify incoming code /
block anything ?
Then users could choose to complain about it , block it,
or run it just this once.
But somehow instead librejs is just running the code, but
differently, in a way that breaks websites :-(

Jason Vas Dias <jvd>
Mon 04 Jun 2018 05:26:38 PM UTC, comment #7:

I just installed libreJS-7.14.1 under firefox 61.0b10
and so far it seems to be working fine and is accepting
gzip encoded content. Thanks!

Just one niggle: I unpacked librejs-7.14.1.tar.gz, and
it extracted a large number of files and directories
into my build directory - it should really just extract
one directory named './librejs-7.14.1' .

What's a good test site for obfuscated javascript to test with ?
my current bet would be something like : stenaline.ie

Jason Vas Dias <jvd>
Mon 04 Jun 2018 04:57:38 PM UTC, comment #6:

RE: Comment #5 :

Aha ! But I am now running firefox 61.0b10 (64-bit) -

Does latest libreJS-v7 support gzip encoding in that
firefox version ?
I will try installing and find out.

Thanks!

Jason Vas Dias <jvd>
Sun 03 Jun 2018 10:02:18 PM UTC, comment #5:

jason

the version of firefox you are running does not support the latest version of firefox add-ons (including librejs v7); and the latest version of firefox does not support the firefox add-ons you are using (such as librejs v6) - that is a decision that mozilla made and it caused much confusion to users and made a lot of work for developers - all of the attention is on the current version v7 with is only supported on firefox version 57 and above - v7 was a total re-write; so moving forward, it is most important to know if a similar problem exists in the current v7

the previous message on this thread noted that librejs v6 was no longer going to be maintained and any bugs present in v6 would probably not be fixed - a similar message was added to all other open issue that were reported against v6 and they were all marked as 'wont-fix' - the messages went on to ask if anyone using v7 had a similar problem - in the several months since february when the question was raised, no one has indicated that this issue affects v7; so this week i closed the issue along with the others marked as 'wont-fix'

bill-auger <bill_auger>
Project Member
Sun 03 Jun 2018 11:33:09 AM UTC, comment #4:

So is this working now ?
Can I install latest libreJS and browse web
letting firefox request gzip encoded content?

Jason Vas Dias <jvd>
Fri 23 Feb 2018 04:07:54 AM UTC, comment #3:

libreJS v7 is now considered to be the current stable release and is a nearly total re-write; so this issue very likely refers to only to the previous version that was obsoleted my mozilla - all further development will be on libreJS v7 so this issue is marked as "wont-fix" for now (previously "Confirmed") unless it can be show to pertain also to libreJS v7

as this behavior was seen using libreJS v6, could someone try libreJS v7 on a firefox derivative >= v57 to see if the same issue still exists?

bill-auger <bill_auger>
Project Member
Sat 15 Apr 2017 08:52:54 AM UTC, comment #2:

Same behaviour on Firefox 52.0.2 on Arch GNU/Linux

Mike <mikee3000>
Sun 26 Mar 2017 02:36:05 PM UTC, comment #1:

Anecdotally, I've seen this behavior on my work machine (a macOS machine).

zach wick <zwick>
Project AdministratorIn charge of this item.
Wed 15 Mar 2017 12:10:55 PM UTC, original submission:

Today I decided to give LibreJS a try, installing it in
my Firefox 54.0a2 (Developer Edition, Aurora Channel)
x86_64 Linux browser .

After installation, ALL sites, including
http://savannah.gnu.org/project/librejs
and
http://google.com
are blocked - attempts to make any request from them
result in the error:
'Content Encoding Error:
The page you are trying to view cannot be shown because
it uses an invalid or unsupported form of compression.

Please contact the web site owners to inform them of this
problem.
'

Here are the request header and responses from LibreJS site:
Request:
Request URL: http://savannah.gnu.org/projects/librejs/
Request method: GET
Remote address: http://savannah.gnu.org/projects/librejs/
Status code: 200
Version: HTTP/2.0
Host: savannah.gnu.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:54.0) Gecko/20100101 Firefox/54.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0, no-cache
Pragma: no-cache

Note the status code is 200 (OK) . Something in LibreJS is
rejecting the response because it is compressed , as it does
for http://www.google.com:

Request URL: https://www.google.ie/?gws_rd=cr,ssl&ei=oSfJWMD5NuaBgAa_nLeYCw

Actually, I requested 'https://www.google.com', but am
redirected to the above URL. A tool to disable this redirection
would be more valuable to have than a working LibreJS !

Request method: GET
Remote address: 159.134.168.52:443
Status code: 200
Version: HTTP/2.0

Response headers (311 B)
Date: "Wed, 15 Mar 2017 11:39:30 GMT"
Expires: "-1"
Cache-Control "private, max-age=0"
Content-Type: "text/html; charset=UTF-8"
Content-Encoding:"gzip"
Server: "gws"
x-xss-protection:"1; mode=block"
x-frame-options: "SAMEORIGIN"
Alt-Svc: "quic=\":443\"; ma=2592000; v=\"36,35,34\""
X-Firefox-Spdy: "h2"
Request headers (903 B)
Host: "www.google.ie"
User-Agent: "Mozilla/5.0 (X11; Linux x86_6… Gecko/20100101 Firefox/54.0"
Accept: "text/html,application/xhtml+x…lication/xml;q=0.9,*/*;q=0.8"
Accept-Language: "en-GB,en;q=0.5"
Accept-Encoding: "gzip, deflate, br"
Cookie: "NID=99=X5qE1d1COaUAMzbSTmWPNK…-KRjBbmwqB; OGPC=5061821-25:"
Connection: "keep-alive"
Upgrade-Insecure-Requests: "1"
Cache-Control: "max-age=0"

In both cases, the 'Content Encoding Error' occurs, even though
the negotiated content encoding is 'gzip' . Is 'gzip' now
'an invalid or unsupported form of compression' ?

Why is LibreJS concerning itself at all with the Content Encoding - I thought its only job was to detect non-free / obfuscated JavaScript ?

It must be something to do with LibreJS, since simply disabling
the add-on fixes the problem & allows me to browse the web again.

I would like a tool like LibreJS to detect & complain about
proprietary & obfuscated JavaScript, which IMHO are destroying the usability of the web .

Better luck with future versions!

Thanks & Regards,
Jason

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by jvd (Posted a comment)
  • -email is unavailable- added by rubenquidam (Updated the item)
  • -email is unavailable- added by bill_auger (Posted a comment)
  • -email is unavailable- added by usename135 (Voted in favor of this item)
  • -email is unavailable- added by barslmn (Voted in favor of this item)
  • -email is unavailable- added by mikee3000 (Posted a comment)
  • -email is unavailable- added by zwick (Posted a comment)
  • -email is unavailable- added by jvd (Reporter of this bug (sorry, didn't mean to file anonymously).)
  •  

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 200 encouragements so far.

    Only logged-in users can vote.

     

     

     

    Follow 8 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2018-06-01 rubenquidam Open/ClosedOpen => Closed
    2018-02-23 bill_auger StatusConfirmed => Wont Fix
    2017-07-28 usename135 Carbon-Copy- => Added usename135
    2017-06-21 barslmn Carbon-Copy- => Added barslmn
    2017-03-26 zwick Severity3 - Normal => 4 - Important
        StatusNone => Confirmed
        Assigned toNone => zwick
    2017-03-15 jvd Carbon-Copy- => Added reporter

    Back to the top


    Powered by Savane 3.3