[WONTFIX] blocked object duplication

al_9x · Post by **al_9x** » Sun Jun 13, 2010 1:43 am

http://s0.ilike.com/play

caused by flashvars attribute on the <embed> nested in the <object>

if flashvars is removed from the following, the dupe goes away

Code: Select all

<html>
<head>
</head>
<body>
<object type="application/x-shockwave-flash" data="http://url.invalid/">
	<embed src="http://url.invalid/" type="application/x-shockwave-flash" flashvars="a=b" >
</object>
</body>
</html>

al_9x · Post by **al_9x** » Sun Jun 13, 2010 3:09 am

here is another dupe example

Code: Select all

<html>
<head></head>
<body>
<object type="video/x-ms-wmv" data="http://url2.invalid/">
	<param name="src" value="http://url2.invalid/">
	<embed type="video/x-ms-wmv" src="http://url2.invalid/">
</object>
</body>
</html>

in this case it's the src param that triggers it

Post by **Giorgio Maone** » Sun Jun 20, 2010 9:31 pm

NoScript treats objects/embeds with different params/flashvars as different instances, otherwise allowing one Youtube movie would allow every other Youtube movie for the session.
This "bug" is a byproduct of this feature: even though I understand in reality when NoScript is not installed only one of the two instances "wins" (either the embed or the object), but frankly this is too edgy a case to deserve a possibly risky fix.

al_9x · Post by **al_9x** » Mon Jun 21, 2010 12:42 am

I understand why this might be low priority, but I hope you reconsider the wontfix. The attempted instantiation of all inner objects in a nested chain is an artifact of NS blocking, that should not be exposed to the user. The fix would seem to be safe in that it's only about deciding what to surface to the UI.

The rule is:

If the user agent is not able to render the object for whatever reason (configured not to, lack of resources, wrong architecture, etc.), it must try to render its contents.

That means that a nested objects/embed chain can result in no more than a single live object, so NS should expose only a single blocked object for such chains and hide the rest. The child instantiation attempt should only happen after you block the parent, so it should be possible to check if there is an ancestor that has already been blocked and not surface the child block.

Code: Select all

<object type="application/x-shockwave-flash" data="http://url3.invalid/">
	<object type="application/x-shockwave-flash" data="http://url4.invalid/">
		<object type="application/x-shockwave-flash" data="http://url5.invalid/">
		</object>
	</object>
</object>

then the above would properly result is a single blocked object, rather than three.

One other thing, in the following example, the placeholder gets the style of the inner object, not the outer, by design?

Code: Select all

<object id="outer" type="application/x-shockwave-flash" 
		data="http://s.ytimg.com/yt/swf/watch-vfl172193.swf" 
		style="position: absolute; width: 200px; height: 200px; top: 0px; left: 0px">
	<object id="inner" style="position: absolute; width: 200px; height: 200px; top: 200px; left: 200px" type="application/x-shockwave-flash" data="http://s.ytimg.com/yt/swf/watch-vfl172193.swf">
	</object>
</object>

Post by **Giorgio Maone** » Mon Jun 21, 2010 9:48 pm

al_9x wrote:The attempted instantiation of all inner objects in a nested chain is an artifact of NS blocking

Nope, unfortunately it is a side effect of the order Gecko tries to instatiate those object with.

al_9x wrote: The rule is:
If the user agent is not able to render the object for whatever reason (configured not to, lack of resources, wrong architecture, etc.), it must try to render its contents.
That means that a nested objects/embed chain can result in no more than a single live object, so NS should expose only a single blocked object for such chains and hide the rest. The child instantiation attempt should only happen after you block the parent, so it should be possible to check if there is an ancestor that has already been blocked and not surface the child block.

This, in an ideal world. In reality your code,

al_9x wrote:

Code: Select all

<object type="application/x-shockwave-flash" data="http://url3.invalid/">
	<object type="application/x-shockwave-flash" data="http://url4.invalid/">
		<object type="application/x-shockwave-flash" data="http://url5.invalid/">
		</object>
	</object>
</object>

calls into nsIContentPolicy (i.e. attempts to load) in this order:

url5.invalid
url4.invalid
url3.invalid

which is quite opposite what you'd expect by spec.
Beside this being the "natural" DOM parsing order, my suspect is that this is is seen as a kind of optimization (let's try to load everything early), and eventually the outermost successful load suppresses its inner content.

al_9x wrote: One other thing, in the following example, the placeholder gets the style of the inner object, not the outer, by design?

Code: Select all

<object id="outer" type="application/x-shockwave-flash" 
		data="http://s.ytimg.com/yt/swf/watch-vfl172193.swf" 
		style="position: absolute; width: 200px; height: 200px; top: 0px; left: 0px">
	<object id="inner" style="position: absolute; width: 200px; height: 200px; top: 200px; left: 200px" type="application/x-shockwave-flash" data="http://s.ytimg.com/yt/swf/watch-vfl172193.swf">
	</object>
</object>

Nope, this is another side effect of the weird instantiation order. One I can try to fix, though.

al_9x · Post by **al_9x** » Mon Jun 21, 2010 10:32 pm

Giorgio Maone wrote:In reality your code,
al_9x wrote:
Code: Select all
<object type="application/x-shockwave-flash" data="http://url3.invalid/">
	<object type="application/x-shockwave-flash" data="http://url4.invalid/">
		<object type="application/x-shockwave-flash" data="http://url5.invalid/">
		</object>
	</object>
</object>
calls into nsIContentPolicy (i.e. attempts to load) in this order:

url5.invalid

url4.invalid

url3.invalid
which is quite opposite what you'd expect by spec.

I think it's still doable. Instead of checking if there is a blocked parent, you'd check for a blocked child, marking it, rather than self, not to be shown.

al_9x · Post by **al_9x** » Tue Jun 22, 2010 7:45 pm

It appears you decided to fix this? There are still problem: ns 1.9.9.94 & fx 3.6.4

for the following sample
Code: Select all
```
<object type="application/x-shockwave-flash" data="http://url1.invalid/">
	<object type="application/x-shockwave-flash" data="http://url2.invalid/">
		<object type="application/x-shockwave-flash" data="http://url3.invalid/">
			<object type="application/x-shockwave-flash" data="http://url4.invalid/">
			</object>
		</object>
	</object>
</object>
```
1. on initial load after browser start (also everything cleared), I get a single blocked object: url1.invalid
2. However, when refreshing (F5), it randomly shows between 1 and 4 blocked objcts ({1}, {1,2}, {1,2,3}, {1,2,3,4})
3. Without "apply to whitelisted" all 4 urls are in the NS menu even when only a single blocked object is shown

for the following:

Code: Select all

<object id="outer" type="application/x-shockwave-flash" 
		data="http://s.ytimg.com/yt/swf/watch-vfl172193.swf" 
		style="position: absolute; width: 100px; height: 100px; top: 0px; left: 0px">
	<object id="inner" style="position: absolute; width: 100px; height: 100px; top: 100px; left: 100px" type="application/x-shockwave-flash" data="http://s.ytimg.com/yt/swf/watch-vfl172193.swf">
	</object>
</object>

sometimes (refresh), the wrong style placeholder briefly appears before being replaced by the correct one
sometimes, it never gets replaced, and both remain visible:
sometimes (initial load), activating the placeholder does not load the object in the page, but navigates to the swf url

Post by **Giorgio Maone** » Wed Jun 23, 2010 1:08 am

al_9x wrote:It appears you decided to fix this?

Partially, see below.

al_9x wrote: However, when refreshing (F5), it randomly shows between 1 and 4 blocked objcts (1, {1,2}, {1,2,3}, {1,2,3,4})

I couldn't reproduce this, but I suspect it's due to a glitch in JS redirects detection, see below.

al_9x wrote: Without "apply to whitelisted" all 4 urls are in the NS menu even when only a single blocked object is shown

I do not care about it. We've got also script sources from redirections and document.domain switching. At least these are useful to see (and, in most case, nested object will be all from the same site, causing just one menu item).

al_9x wrote:
Code: Select all
<object id="outer" type="application/x-shockwave-flash" 
		data="http://s.ytimg.com/yt/swf/watch-vfl172193.swf" 
		style="position: absolute; width: 100px; height: 100px; top: 0px; left: 0px">
	<object id="inner" style="position: absolute; width: 100px; height: 100px; top: 100px; left: 100px" type="application/x-shockwave-flash" data="http://s.ytimg.com/yt/swf/watch-vfl172193.swf">
	</object>
</object>
sometimes (refresh), the wrong style placeholder briefly appears before being replaced by the correct one

sometimes, it never gets replaced, and both remain visible:

sometimes (initial load), activating the placeholder does not load the object in the page, but navigates to the swf url

This should all be the JS redirect detection glitch I mentioned above, and should be fixed in latest development build.

al_9x · Post by **al_9x** » Wed Jun 23, 2010 2:31 am

List numbers refer to my previous post:

1.2 - still present, xp32sp3, Fx 3.6.4, NS 1.9.9.95rc1, Flash 10.1.53.64, default settings - as clean as it gets. Can you try it on your slower xp32 machine?

1.3 - if you don't care because it's an edge case and not worth the effort, I won't argue; but you also suggested they are useful, with that I have to disagree.

a) they misrepresent what is (logically) blocked on the page
b) whitelisting them should have no effect
c) their presence has the deleterious effect of obscuring the one real blocked object url, allowing which will actually make a difference on the page.

2.1 - still present, can you repro? on the slower xp32 system?

Post by **Giorgio Maone** » Wed Jun 23, 2010 6:05 am

Do 1.2 and 2.1 persist even if you set noscript.jsredirectIgnore to true? (I can't reproduce anyway).

al_9x · Post by **al_9x** » Wed Jun 23, 2010 6:49 am

Giorgio Maone wrote:Do 1.2 and 2.1 persist even if you set noscript.jsredirectIgnore to true? (I can't reproduce anyway).

yes

al_9x · Post by **al_9x** » Wed Jun 23, 2010 7:42 am

confirmed also on a clean, xp32sp3 fresh install, vm snapshot

good max dump: 1 blocked object (of 4)

Code: Select all

[NoScript] Document OK: @file:///C:/tmp/embedding.htm --- PGFM: null
 ----------
[NoScript] DocShell JS Switch: file:///C:/tmp/embedding.htm - true/true/false
 ----------
[NoScript] Location Change - req.URI: file:///C:/tmp/embedding.htm, window.location: file:///C:/tmp/embedding.htm, location: file:///C:/tmp/embedding.htm
 ----------
[NoScript] Document OK: text/html@file:///C:/tmp/embedding.htm --- PGFM: null
 ----------
[NoScript] Content processing -- type: 5, location: http://url4.invalid/, origin: file:///C:/tmp/embedding.htm, ctx: <HTML Element>, mime: application/x-shockwave-flash, null
 ----------
[NoScript] Error()@:0
(5,[object XPCWrappedNative_NoHelper],[object XPCWrappedNative_NoHelper],[object XPCNativeWrapper],"application/x-shockwave-flash",null)@chrome://noscript/content/Policy.js:159

 ----------
[NoScript] [CP PASS 2] application/x-shockwave-flash*http://url4.invalid/, 5, null
 ----------
[NoScript] tagForReplacement
 ----------
[NoScript] Content BLOCKED Forbidden Content -- type: 5, location: http://url4.invalid/, origin: file:///C:/tmp/embedding.htm, ctx: <HTML Element>, mime: application/x-shockwave-flash, null
 ----------
[NoScript] Error()@:0
("Forbidden Content",[object Object])@chrome://noscript/content/Main.js:1862
(5,[object XPCWrappedNative_NoHelper],[object XPCWrappedNative_NoHelper],[object XPCNativeWrapper],"application/x-shockwave-flash",null)@chrome://noscript/content/Policy.js:619

 ----------
[NoScript] Content processing -- type: 5, location: http://url3.invalid/, origin: file:///C:/tmp/embedding.htm, ctx: <HTML Element>, mime: application/x-shockwave-flash, null
 ----------
[NoScript] Error()@:0
(5,[object XPCWrappedNative_NoHelper],[object XPCWrappedNative_NoHelper],[object XPCNativeWrapper],"application/x-shockwave-flash",null)@chrome://noscript/content/Policy.js:159

 ----------
[NoScript] [CP PASS 2] application/x-shockwave-flash*http://url3.invalid/, 5, null
 ----------
[NoScript] tagForReplacement
 ----------
[NoScript] Content BLOCKED Forbidden Content -- type: 5, location: http://url3.invalid/, origin: file:///C:/tmp/embedding.htm, ctx: <HTML Element>, mime: application/x-shockwave-flash, null
 ----------
[NoScript] Error()@:0
("Forbidden Content",[object Object])@chrome://noscript/content/Main.js:1862
(5,[object XPCWrappedNative_NoHelper],[object XPCWrappedNative_NoHelper],[object XPCNativeWrapper],"application/x-shockwave-flash",null)@chrome://noscript/content/Policy.js:619

 ----------
[NoScript] Content processing -- type: 5, location: http://url2.invalid/, origin: file:///C:/tmp/embedding.htm, ctx: <HTML Element>, mime: application/x-shockwave-flash, null
 ----------
[NoScript] Error()@:0
(5,[object XPCWrappedNative_NoHelper],[object XPCWrappedNative_NoHelper],[object XPCNativeWrapper],"application/x-shockwave-flash",null)@chrome://noscript/content/Policy.js:159

 ----------
[NoScript] [CP PASS 2] application/x-shockwave-flash*http://url2.invalid/, 5, null
 ----------
[NoScript] tagForReplacement
 ----------
[NoScript] Content BLOCKED Forbidden Content -- type: 5, location: http://url2.invalid/, origin: file:///C:/tmp/embedding.htm, ctx: <HTML Element>, mime: application/x-shockwave-flash, null
 ----------
[NoScript] Error()@:0
("Forbidden Content",[object Object])@chrome://noscript/content/Main.js:1862
(5,[object XPCWrappedNative_NoHelper],[object XPCWrappedNative_NoHelper],[object XPCNativeWrapper],"application/x-shockwave-flash",null)@chrome://noscript/content/Policy.js:619

 ----------
[NoScript] Content processing -- type: 5, location: http://url1.invalid/, origin: file:///C:/tmp/embedding.htm, ctx: <HTML Element>, mime: application/x-shockwave-flash, null
 ----------
[NoScript] Error()@:0
(5,[object XPCWrappedNative_NoHelper],[object XPCWrappedNative_NoHelper],[object XPCNativeWrapper],"application/x-shockwave-flash",null)@chrome://noscript/content/Policy.js:159

 ----------
[NoScript] [CP PASS 2] application/x-shockwave-flash*http://url1.invalid/, 5, null
 ----------
[NoScript] tagForReplacement
 ----------
[NoScript] Content BLOCKED Forbidden Content -- type: 5, location: http://url1.invalid/, origin: file:///C:/tmp/embedding.htm, ctx: <HTML Element>, mime: application/x-shockwave-flash, null
 ----------
[NoScript] Error()@:0
("Forbidden Content",[object Object])@chrome://noscript/content/Main.js:1862
(5,[object XPCWrappedNative_NoHelper],[object XPCWrappedNative_NoHelper],[object XPCNativeWrapper],"application/x-shockwave-flash",null)@chrome://noscript/content/Policy.js:619

 ----------
[NoScript] Adding plugin sites: ["http://url4.invalid", "http://url3.invalid", "http://url2.invalid", "http://url1.invalid"] to ["file://"]
 ----------
[NoScript] Setting plugin extras on [object XPCNativeWrapper [object HTMLObjectElement]] -> true, ({url:"http://url1.invalid/", mime:"application/x-shockwave-flash"})
 ----------
[NoScript] Setting plugin extras on http://url1.invalid/ -> true, ({url:"http://url1.invalid/", mime:"application/x-shockwave-flash", site:"http://url1.invalid", tag:"<OBJECT>", title:"<OBJECT>, shockwave-flash@http://url1.invalid/", alt:null})
 ----------
[NoScript] Adding plugin sites: ["http://url4.invalid", "http://url3.invalid", "http://url2.invalid", "http://url1.invalid"] to ["file://"]

bad max dump: 3 blocked objects (of 4)

Code: Select all

[NoScript] Document OK: @file:///C:/tmp/embedding.htm --- PGFM: null
 ----------
[NoScript] DocShell JS Switch: file:///C:/tmp/embedding.htm - true/true/false
 ----------
[NoScript] Location Change - req.URI: file:///C:/tmp/embedding.htm, window.location: file:///C:/tmp/embedding.htm, location: file:///C:/tmp/embedding.htm
 ----------
[NoScript] Document OK: text/html@file:///C:/tmp/embedding.htm --- PGFM: null
 ----------
[NoScript] Content processing -- type: 5, location: http://url4.invalid/, origin: file:///C:/tmp/embedding.htm, ctx: <HTML Element>, mime: application/x-shockwave-flash, null
 ----------
[NoScript] Error()@:0
(5,[object XPCWrappedNative_NoHelper],[object XPCWrappedNative_NoHelper],[object XPCNativeWrapper],"application/x-shockwave-flash",null)@chrome://noscript/content/Policy.js:159

 ----------
[NoScript] [CP PASS 2] application/x-shockwave-flash*http://url4.invalid/, 5, null
 ----------
[NoScript] tagForReplacement
 ----------
[NoScript] Content BLOCKED Forbidden Content -- type: 5, location: http://url4.invalid/, origin: file:///C:/tmp/embedding.htm, ctx: <HTML Element>, mime: application/x-shockwave-flash, null
 ----------
[NoScript] Error()@:0
("Forbidden Content",[object Object])@chrome://noscript/content/Main.js:1862
(5,[object XPCWrappedNative_NoHelper],[object XPCWrappedNative_NoHelper],[object XPCNativeWrapper],"application/x-shockwave-flash",null)@chrome://noscript/content/Policy.js:619

 ----------
[NoScript] Content processing -- type: 5, location: http://url3.invalid/, origin: file:///C:/tmp/embedding.htm, ctx: <HTML Element>, mime: application/x-shockwave-flash, null
 ----------
[NoScript] Error()@:0
(5,[object XPCWrappedNative_NoHelper],[object XPCWrappedNative_NoHelper],[object XPCNativeWrapper],"application/x-shockwave-flash",null)@chrome://noscript/content/Policy.js:159

 ----------
[NoScript] [CP PASS 2] application/x-shockwave-flash*http://url3.invalid/, 5, null
 ----------
[NoScript] tagForReplacement
 ----------
[NoScript] Content BLOCKED Forbidden Content -- type: 5, location: http://url3.invalid/, origin: file:///C:/tmp/embedding.htm, ctx: <HTML Element>, mime: application/x-shockwave-flash, null
 ----------
[NoScript] Error()@:0
("Forbidden Content",[object Object])@chrome://noscript/content/Main.js:1862
(5,[object XPCWrappedNative_NoHelper],[object XPCWrappedNative_NoHelper],[object XPCNativeWrapper],"application/x-shockwave-flash",null)@chrome://noscript/content/Policy.js:619

 ----------
[NoScript] Content processing -- type: 5, location: http://url2.invalid/, origin: file:///C:/tmp/embedding.htm, ctx: <HTML Element>, mime: application/x-shockwave-flash, null
 ----------
[NoScript] Error()@:0
(5,[object XPCWrappedNative_NoHelper],[object XPCWrappedNative_NoHelper],[object XPCNativeWrapper],"application/x-shockwave-flash",null)@chrome://noscript/content/Policy.js:159

 ----------
[NoScript] [CP PASS 2] application/x-shockwave-flash*http://url2.invalid/, 5, null
 ----------
[NoScript] tagForReplacement
 ----------
[NoScript] Content BLOCKED Forbidden Content -- type: 5, location: http://url2.invalid/, origin: file:///C:/tmp/embedding.htm, ctx: <HTML Element>, mime: application/x-shockwave-flash, null
 ----------
[NoScript] Error()@:0
("Forbidden Content",[object Object])@chrome://noscript/content/Main.js:1862
(5,[object XPCWrappedNative_NoHelper],[object XPCWrappedNative_NoHelper],[object XPCNativeWrapper],"application/x-shockwave-flash",null)@chrome://noscript/content/Policy.js:619

 ----------
[NoScript] Content processing -- type: 5, location: http://url1.invalid/, origin: file:///C:/tmp/embedding.htm, ctx: <HTML Element>, mime: application/x-shockwave-flash, null
 ----------
[NoScript] Error()@:0
(5,[object XPCWrappedNative_NoHelper],[object XPCWrappedNative_NoHelper],[object XPCNativeWrapper],"application/x-shockwave-flash",null)@chrome://noscript/content/Policy.js:159

 ----------
[NoScript] [CP PASS 2] application/x-shockwave-flash*http://url1.invalid/, 5, null
 ----------
[NoScript] tagForReplacement
 ----------
[NoScript] Content BLOCKED Forbidden Content -- type: 5, location: http://url1.invalid/, origin: file:///C:/tmp/embedding.htm, ctx: <HTML Element>, mime: application/x-shockwave-flash, null
 ----------
[NoScript] Error()@:0
("Forbidden Content",[object Object])@chrome://noscript/content/Main.js:1862
(5,[object XPCWrappedNative_NoHelper],[object XPCWrappedNative_NoHelper],[object XPCNativeWrapper],"application/x-shockwave-flash",null)@chrome://noscript/content/Policy.js:619

 ----------
[NoScript] Adding plugin sites: ["http://url4.invalid", "http://url3.invalid"] to ["file://"]
 ----------
[NoScript] Setting plugin extras on [object XPCNativeWrapper [object HTMLObjectElement]] -> true, ({url:"http://url3.invalid/", mime:"application/x-shockwave-flash"})
 ----------
[NoScript] Setting plugin extras on http://url3.invalid/ -> true, ({url:"http://url3.invalid/", mime:"application/x-shockwave-flash", site:"http://url3.invalid", tag:"<OBJECT>", title:"<OBJECT>, shockwave-flash@http://url3.invalid/", alt:null})
 ----------
[NoScript] Adding plugin sites: ["http://url4.invalid", "http://url3.invalid", "http://url2.invalid", "http://url1.invalid"] to ["file://"]
 ----------
[NoScript] Setting plugin extras on [object XPCNativeWrapper [object HTMLObjectElement]] -> true, ({url:"http://url1.invalid/", mime:"application/x-shockwave-flash"})
 ----------
[NoScript] Setting plugin extras on [object XPCNativeWrapper [object HTMLObjectElement]] -> true, ({url:"http://url2.invalid/", mime:"application/x-shockwave-flash"})
 ----------
[NoScript] Setting plugin extras on http://url2.invalid/ -> true, ({url:"http://url2.invalid/", mime:"application/x-shockwave-flash", site:"http://url2.invalid", tag:"<OBJECT>", title:"<OBJECT>, shockwave-flash@http://url2.invalid/", alt:null})
 ----------
[NoScript] Setting plugin extras on http://url1.invalid/ -> true, ({url:"http://url1.invalid/", mime:"application/x-shockwave-flash", site:"http://url1.invalid", tag:"<OBJECT>", title:"<OBJECT>, shockwave-flash@http://url1.invalid/", alt:null})
 ----------
[NoScript] Adding plugin sites: ["http://url4.invalid", "http://url3.invalid", "http://url2.invalid", "http://url1.invalid"] to ["file://"]

Post by **Giorgio Maone** » Wed Jun 23, 2010 7:57 am

Please check latest development build.

al_9x · Post by **al_9x** » Wed Jun 23, 2010 8:45 am

Giorgio Maone wrote:Please check latest development build.

All issues resolved, thanks. Did you repro or were you able to guess what it was?

Post by **Giorgio Maone** » Wed Jun 23, 2010 8:52 am

al_9x wrote:Did you repro or were you able to guess what it was?

I couldn't reproduce, but I based my (quite complex) fix on the assumption you were getting a totally random order, rather than DOM-parsing based, in nsIContentPolicy calls (something I could never observe, but I guessed could be a byproduct of your system's slowness).

InformAction Forums

[WONTFIX] blocked object duplication

[WONTFIX] blocked object duplication

Re: blocked object duplication

Re: [WONTFIX] blocked object duplication

Re: [WONTFIX] blocked object duplication

Re: [WONTFIX] blocked object duplication

Re: [WONTFIX] blocked object duplication

Re: [WONTFIX] blocked object duplication

Re: [WONTFIX] blocked object duplication

Re: [WONTFIX] blocked object duplication

Re: [WONTFIX] blocked object duplication

Re: [WONTFIX] blocked object duplication

Re: [WONTFIX] blocked object duplication

Re: [WONTFIX] blocked object duplication

Re: [WONTFIX] blocked object duplication

Re: [WONTFIX] blocked object duplication