bugLibreJS - Bugs: bug #62823, librejs blocking scripts with...

 
 

bug #62823: librejs blocking scripts with license info on fsf member forum

Submitter:  Andrew Engelbrecht <sudoman>
Submitted:  Wed 27 Jul 2022 04:54:30 PM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  Need Info
Privacy:  Public Assigned to:  None
Open/Closed:  Open
* Mandatory Fields

Add a New Comment Rich Markup
   

Thu 28 Jul 2022 10:28:27 PM UTC, comment #5: 


comment #4:

> Do you have a reproducible example, preferably as small as possible?


I don't have a simple example of this, just the tweaked version of Discourse running on the member forum: https://forum.members.fsf.org/

My guess is that this is an issue with LibreJS interacting with Discourse's dynamic loading of HTML and JavaScript. This might affect some other sites, but I don't know which.


(file #53483)

Andrew Engelbrecht <sudoman>
Thu 28 Jul 2022 10:17:25 PM UTC, comment #4: 


>
> Ah, sorry about that. I must have mis-pasted somewhere. I did try the correct hash, and I get the same error.
>
>       // @license magnet:?xt=urn:btih:8e4f440f4c65981c5bf93c76d35135ba5064d8b7&dn=apache-2.0.txt Apache 2.0
>


I cannot reproduce.  I created an html file with the following content and started a python webserver.  LibreJS did not block anything.  Do you have a reproducible example, preferably as small as possible?

    <script>
// @license magnet:?xt=urn:btih:8e4f440f4c65981c5bf93c76d35135ba5064d8b7&dn=apache-2.0.txt Apache 2.0
      $('#main-outlet').parent().hide();
// @license-end
    </script>

Yuchen Pei <ycp>
Group administrator
Thu 28 Jul 2022 04:27:54 PM UTC, comment #3: 


comment #2:

> The hash is wrong, it should be
> 8e4f440f4c65981c5bf93c76d35135ba5064d8b7
> looks like it got pasted twice:
> 8e4f440f4c65981c5bf|8e4f440f4c65981c5bf93c76d35135ba5064d8b7|93c76d35135ba5064d8b7
>
> Can you try the correct hash?


Hi Yuchen,

Ah, sorry about that. I must have mis-pasted somewhere. I did try the correct hash, and I get the same error.

      // @license magnet:?xt=urn:btih:8e4f440f4c65981c5bf93c76d35135ba5064d8b7&dn=apache-2.0.txt Apache 2.0

Andrew Engelbrecht <sudoman>
Wed 27 Jul 2022 11:59:10 PM UTC, comment #2: 


original submission:

> Hi Yuchen,
>
> Any idea why this code is blocked? I got the magnet string from https://www.gnu.org/software/librejs/free-your-javascript.html
>
>     &lt;script&gt;
>       // @license magnet:?xt=urn:btih:8e4f440f4c65981c5bf8e4f440f4c65981c5bf93c76d35135ba5064d8b793c76d35135ba5064d8b7&dn=apache-2.0.txt Apache 2.0


The hash is wrong, it should be
8e4f440f4c65981c5bf93c76d35135ba5064d8b7
looks like it got pasted twice:
8e4f440f4c65981c5bf|8e4f440f4c65981c5bf93c76d35135ba5064d8b7|93c76d35135ba5064d8b7

Can you try the correct hash?

Yuchen Pei <ycp>
Group administrator
Wed 27 Jul 2022 04:55:40 PM UTC, comment #1: 

Er, sorry, "&lt;script&gt;" was supposed to look like "<script>". I guess that the preview mode is different from what is displayed.

Andrew Engelbrecht <sudoman>
Wed 27 Jul 2022 04:54:30 PM UTC, original submission:  

Hi Yuchen,

Any idea why this code is blocked? I got the magnet string from https://www.gnu.org/software/librejs/free-your-javascript.html

    &lt;script&gt;
      // @license magnet:?xt=urn:btih:8e4f440f4c65981c5bf8e4f440f4c65981c5bf93c76d35135ba5064d8b793c76d35135ba5064d8b7&dn=apache-2.0.txt Apache 2.0
      $('#main-outlet').parent().hide();
      // @license-end


    &lt;script&gt;/* LibreJS: script blocked. */
/*
LIBREJS BLOCKED: NONTRIVIAL: nontrivial token: 'parent'
*/&lt;/script&gt;

I also have the following license higher up on the page template, but other code on that page is also blocked. It may be that the blocked code is loaded before the template with the license text, so this might be red herring. anyhow:

    &lt;script&gt;
    /*
    @licstart  The following is the entire license notice for the
    JavaScript code in this page.

    Copyright (C) 2013-2022 Discourse developers

    The JavaScript code in this page is free software: you can
    redistribute it and/or modify it under the terms of the GNU
    General Public License (GNU GPL) as published by the Free Software
    Foundation, either version 2 of the License, or (at your option)
    any later version.  The code is distributed WITHOUT ANY WARRANTY;
    without even the implied warranty of MERCHANTABILITY or FITNESS
    FOR A PARTICULAR PURPOSE.  See the GNU GPL for more details.

    @licend  The above is the entire license notice
    for the JavaScript code in this page.
    */
        &lt;/script&gt;

The reason for the custom code is because &lt;noscript&gt; tags are active on the forum, causing the non-JS version of the site to appear at the top of the page, despite only one or two scripts being blocked by LibreJS when browsing in a private window.

Any thoughts?

Thanks, : )
Andrew


Andrew Engelbrecht <sudoman>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #53483:  discourse.diff added by sudoman (2KiB - text/x-patch)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by ycp (Posted a comment)
  • -email is unavailable- added by sudoman (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2022-07-28 sudoman Attached File- Added discourse.diff, #53483
    2022-07-27 ycp StatusNone Need Info

    Back to the top

    Powered by Savane 3.14-f13d.
    Corresponding source code