bugLibreJS - Bugs: bug #58131, LibreJS breaks scripts using...

 
 

bug #58131: LibreJS breaks scripts using Subresource Integrity

Submitted by:  None
Submitted on:  Tue 07 Apr 2020 01:22:57 AM UTC  
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open

Add a New Comment (Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Tue 07 Apr 2020 05:26:52 AM UTC, comment #1: 

Apologies for not being logged in earlier. I've fixed this bug with a one line commit on my GitLab account: https://gitlab.com/obsessivefacts/librejs/-/commit/372f192bd2a003744fb60403d5b8e11d12e7f92e

Explanation here:

LibreJS' ResponseTextFilter class in ResponseProcessor.js will overwrite remote files with the output ultimately provided by get_script in main_background.js. Typically this adds a comment to the top of the file saying

> /* LibreJS: script accepted. */


This is fine in most cases, but in the case of a Subresource Integrity Hash (https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity) it breaks the hash sum of the script causing the browser to reject it as "tampered with."

Subresource Integrity Hash is a crucial security feature for sites that use CDN or may otherwise have an untrustworthy remote script embed.

The fix is simply to NOT rewrite and re-encode the remote script when we see this "script accepted" comment at the beginning. Doing this will not unblock any scripts that should be blocked, will not break any of the Jasmine tests, will not break reports, and will actually speed up the entire page loading process as we are not unnecessarily re-encoding data.

henriquez <henriquez>
Tue 07 Apr 2020 01:22:57 AM UTC, original submission:  

On my site https://www.obsessivefacts.com all scripts are AGPL. LibreJS correctly identifies these as Free Software, however it appears to be overwriting the script code in a way that breaks the Subresource Integrity (SRI) hash. Any modification to a script with SRI breaks the hash sum and causes the browser to reject them as "tampered."

More about SRI can be found here: https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity

Hopefully it would be possible to detect the free license without modifying the script?

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by henriquez (Posted a comment)
  •  

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

     

     

    No changes have been made to this item

    Back to the top


    Powered by Savane 3.7