bugLibreJS - Bugs: bug #58131, LibreJS breaks scripts using...


bug #58131: LibreJS breaks scripts using Subresource Integrity

Submitter:  None
Submitted:  Tue 07 Apr 2020 01:22:57 AM UTC
Category:  None Severity:  3 - Normal
Item Group:  None Status:  Fixed
Privacy:  Public Assigned to:  ycp
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment (Rich Markup)

Comment Type & Canned Response:
       No canned response available


Wed 22 Jun 2022 02:10:39 PM UTC, comment #2: 
Yuchen Pei <ycp>
Project Administrator
Tue 07 Apr 2020 05:26:52 AM UTC, comment #1: 

Apologies for not being logged in earlier. I've fixed this bug with a one line commit on my GitLab account: https://gitlab.com/obsessivefacts/librejs/-/commit/372f192bd2a003744fb60403d5b8e11d12e7f92e

Explanation here:

LibreJS' ResponseTextFilter class in ResponseProcessor.js will overwrite remote files with the output ultimately provided by get_script in main_background.js. Typically this adds a comment to the top of the file saying

> /* LibreJS: script accepted. */

This is fine in most cases, but in the case of a Subresource Integrity Hash (https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity) it breaks the hash sum of the script causing the browser to reject it as "tampered with."

Subresource Integrity Hash is a crucial security feature for sites that use CDN or may otherwise have an untrustworthy remote script embed.

The fix is simply to NOT rewrite and re-encode the remote script when we see this "script accepted" comment at the beginning. Doing this will not unblock any scripts that should be blocked, will not break any of the Jasmine tests, will not break reports, and will actually speed up the entire page loading process as we are not unnecessarily re-encoding data.

henriquez <henriquez>
Tue 07 Apr 2020 01:22:57 AM UTC, original submission:  

On my site https://www.obsessivefacts.com all scripts are AGPL. LibreJS correctly identifies these as Free Software, however it appears to be overwriting the script code in a way that breaks the Subresource Integrity (SRI) hash. Any modification to a script with SRI breaks the hash sum and causes the browser to reject them as "tampered."

More about SRI can be found here: https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity

Hopefully it would be possible to detect the free license without modifying the script?



(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by ycp
  • -email is unavailable- added by ycp (Updated the item)
  • -email is unavailable- added by henriquez (Posted a comment)

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.





    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2022-06-24 ycp Open/ClosedOpen Closed
    2022-06-22 ycp Carbon-Copy- Added -email is unavailable-
    2022-06-22 ycp StatusNone Fixed
    2022-04-28 ycp Assigned toNone ycp

    Back to the top

    Powered by Savane 3.9