bugLibreJS - Bugs: bug #62464, LibreJS breaks inline scripts on...

 
 

bug #62464: LibreJS breaks inline scripts on sites using script-src 'sha256-HASH' headers that use a libre license

Submitter:  Arne Babenhauserheide <arnebab>
Submitted:  Sun 15 May 2022 12:45:55 AM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  Need Info
Privacy:  Public Assigned to:  ycp
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Wed 22 Jun 2022 02:08:11 PM UTC, comment #3: 


comment #2:

> comment #1:
> > I'll take a look later this week.  Feel free to follow up / ping me.
> Thank you!


I have applied https://gitlab.com/obsessivefacts/librejs/-/commit/372f192bd2a003744fb60403d5b8e11d12e7f92e - see [1] - does this commit fix your bug?

[1] https://git.savannah.gnu.org/cgit/librejs.git/commit/?id=3d8b24e2b0b7779f03dc4cee9571b2ecd3025805

It will be included in the next release which I should do soon.

It would be good to add some tests against these bugs for this change.

Yuchen Pei <ycp>
Group administrator
Tue 14 Jun 2022 09:54:45 PM UTC, comment #2: 

comment #1:

> I'll take a look later this week.  Feel free to follow up / ping me.

Thank you!

Arne Babenhauserheide <arnebab>
Tue 14 Jun 2022 12:45:16 AM UTC, comment #1: 

Hi sorry for the late response.  I saw you mentioned a potential fix at https://gitlab.com/obsessivefacts/librejs/-/commit/372f192bd2a003744fb60403d5b8e11d12e7f92e

I'll take a look later this week.  Feel free to follow up / ping me.

Yuchen Pei <ycp>
Group administrator
Sun 15 May 2022 12:45:55 AM UTC, original submission:  

When reading a site with an inline script that has correct license headers, LibreJS prefixes the script with:

/* LibreJS: script accepted. */

This changes the script hash and therefore breaks the CSP validation in the site.

This happens not on the initial load of the page, but at the second loading.

It does not happen if all scripts on the page are accepted.

When adding a note to a script tag, this note should be added before the script tag not inside it. Any change to the content of the script tag changes the hash and therefore blocks execution of the script.

To reproduce most easily (sorry for using github here):

$ git clone https://github.com/freenet/browser.git freenetbrowser && cd freenetbrowser && ./bootstrap.sh --prefix=$HOME/.local && make install && ~/.local/bin/freenetbrowser --install USK@~22K5-BaMq8px171N6okVmdI2g9zjLBxs422HshMEgY,lwYlSm7ynpitof79fD4RtmzTx9fbPnid72vTPIdzmq0,AQACAAE/stream-radiocc-again/10/

During the first run, it will load the inline script.
Once the page is loaded, hit F5.
Now the inline script is no longer accepted.

Likely related to https://savannah.gnu.org/bugs/?58131

Arne Babenhauserheide <arnebab>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by ycp (Posted a comment)
  • -email is unavailable- added by ycp
  • -email is unavailable- added by arnebab (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2022-07-02 ycp Open/ClosedOpen Closed
    2022-06-22 ycp StatusNone Need Info
    2022-06-14 ycp Assigned toNone ycp
        Carbon-Copy- Added -email is unavailable-

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code