bugLibreJS - Bugs: bug #59533, Script tags inserted by JS not...

 
 

bug #59533: Script tags inserted by JS not tracked by LibreJS?

Submitter:  Andrew Engelbrecht <sudoman>
Submitted:  Tue 24 Nov 2020 05:23:20 PM UTC
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  Need Info
Privacy:  Public Assigned to:  None
Open/Closed:  Open
* Mandatory Fields

Add a New Comment (Rich Markup)
   

Comment Type & Canned Response:
       No canned response available

 

Sun 01 May 2022 01:00:08 AM UTC, comment #3: 

comment #2:

> This is the part I'm referring to:
>
>      var d=document, g=d.createElement("script"), s=d.getElementsByTagName("script")[0]; g.type="text/javascript";
>     g.defer=true; g.async=true; g.src=u+"piwik.js"; s.parentNode.insertBefore(g,s);
>
> That code dynamically inserts a <script> tag into the DOM, and I believe that LibreJS isn't checking that script.
>


This is surprising, as the stream filter should be able to intercept any scripts requested by the site.

Do you by any chance have a more complete example (e.g. a webpage where librejs fails like this)?

Yuchen Pei <ycp>
Project Administrator
Fri 29 Apr 2022 07:20:51 PM UTC, comment #2: 

This is the part I'm referring to:

     var d=document, g=d.createElement("script"), s=d.getElementsByTagName("script")[0]; g.type="text/javascript";
    g.defer=true; g.async=true; g.src=u+"piwik.js"; s.parentNode.insertBefore(g,s);

That code dynamically inserts a <script> tag into the DOM, and I believe that LibreJS isn't checking that script.

Andrew Engelbrecht <sudoman>
Mon 18 Apr 2022 01:19:45 PM UTC, comment #1: 

original submission:

> On this page: <https://static.fsf.org/nosvn/demos/matomo/>, Matomo's JS inserts a script tag that links to a JS file that is supported by LibreJS. However the script is not mentioned in LibreJS' report, which leads me to believe that it doesn't check the license of that script.
>


Do you mean the following script?  It is accepted by LibreJS in my test.  Could you confirm whether it is still not tracked by LibreJS?

<script type="text/javascript">/* LibreJS: script accepted. */
// @license magnet:?xt=urn:btih:cf05388f2679ee054f2beb29a391d25f4e673ac3&dn=gpl-2.0.txt GPL-2.0-or-later
  var _paq = _paq || [];
  _paq.push(["trackPageView"]);
  _paq.push(["enableLinkTracking"]);

  (function() {
    var u = (("https:" == document.location.protocol) ? "https" : "http") + "://"+"matomo1p.fsf.org//";
    _paq.push(["setTrackerUrl", u+"piwik.php"]);
    _paq.push(["setSiteId", "18"]);
    var d=document, g=d.createElement("script"), s=d.getElementsByTagName("script")[0]; g.type="text/javascript";
    g.defer=true; g.async=true; g.src=u+"piwik.js"; s.parentNode.insertBefore(g,s);
  })();
  // @license-end</script>

Yuchen Pei <ycp>
Project Administrator
Tue 24 Nov 2020 05:23:20 PM UTC, original submission:  

On this page: <https://static.fsf.org/nosvn/demos/matomo/>, Matomo's JS inserts a script tag that links to a JS file that is supported by LibreJS. However the script is not mentioned in LibreJS' report, which leads me to believe that it doesn't check the license of that script.

Andrew Engelbrecht <sudoman>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by ycp (Posted a comment)
  • -email is unavailable- added by sudoman (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

     

     

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2022-05-01 ycp Open/ClosedClosed Open
    2022-04-28 ycp Open/ClosedOpen Closed
    2022-04-18 ycp StatusNone Need Info

    Back to the top


    Powered by Savane 3.9