[HANG] Firefox hangs When Visiting HKTV with NoScript on

[barbaz]

Please don't start multiple threads on the same problem. I also would really like to see this fixed but as said I don't know enough to figure exactly what's causing the hang, and seems no one else has looked into this enough to offer more info.
Merging with your other thread.

Probably the next thing to do would be to use Firefox's debugger (or attach Firefox as a remote debugger to SeaMonkey) on the page code, prettifying all sources and step through the page's code and see if that offers any insight.. but in order for me to do this I'd have to reproduce in a system I actually can have Firefox (meaning, Linux)...

[ReporterX]

Please don't start multiple threads on the same problem. I also would really like to see this fixed but as said I don't know enough to figure exactly what's causing the hang, and seems no one else has looked into this enough to offer more info.
Merging with your other thread.

Probably the next thing to do would be to use Firefox's debugger (or attach Firefox as a remote debugger to SeaMonkey) on the page code, prettifying all sources and step through the page's code and see if that offers any insight.. but in order for me to do this I'd have to reproduce in a system I actually can have Firefox (meaning, Linux)...

Argh! So sorry! I almost forget this thread. It is month old. Well I'm not sure if I should bump an old thread.
You know some forums hate you when you bump an old thread and ask you to open a new one.

And the question I asked is not the same this time.
Actually I'm not asking for a fix this time. Although a fix is great, I know it is not going to happen any time soon.

I'm looking for any way or method or workaround to bypass this issue.
Let's say if noscipt can be disabled automatically when we visit this site. Hmm... but how?
Maybe even with the help of some third-party tools, addons, or whatever.
I'm open to any suggestion which can help my clients. Thanks.

[barbaz]

Argh! So sorry! I almost forget this thread. It is month old. Well I'm not sure if I should bump an old thread.
You know some forums hate you when you bump an old thread and ask you to open a new one.

No problem. We don't mind legitimate posters such as yourself bumping old threads.

Actually I'm not asking for a fix this time. Although a fix is great, I know it is not going to happen any time soon.

I'm looking for any way or method or workaround to bypass this issue.
Let's say if noscipt can be disabled automatically when we visit this site. Hmm... but how?
Maybe even with the help of some third-party tools, addons, or whatever.
I'm open to any suggestion which can help my clients. Thanks.

So probably the fix is some kind of surrogate script, which could be applied as a workaround, but we can't know what to put in the surrogate if we don't know what's causing the OOM crash...

When I get the chance I'll try play around with it a bit, see if I can reproduce the issue on a system I can run Firefox developer edition, hopefully that will give all the needed information.

[ReporterX]

Actually I'm not asking for a fix this time. Although a fix is great, I know it is not going to happen any time soon.

I'm looking for any way or method or workaround to bypass this issue.
Let's say if noscipt can be disabled automatically when we visit this site. Hmm... but how?
Maybe even with the help of some third-party tools, addons, or whatever.
I'm open to any suggestion which can help my clients. Thanks.

So probably the fix is some kind of surrogate script, which could be applied as a workaround, but we can't know what to put in the surrogate if we don't know what's causing the OOM crash...

When I get the chance I'll try play around with it a bit, see if I can reproduce the issue on a system I can run Firefox developer edition, hopefully that will give all the needed information.

Ar great! A surrogate script might be a solution.
It is ok just to disable noscript (or its function) when it is on that site, if a surrogate script can do it.
I hate to see them uninstalling noscript just because of this bug.
I don't feel safe if I browse the Internet without noscript. Others should feel the same.

[barbaz]

OK what I see now is different from what I saw before... no OOM crash but I do get an 'Unresponsive script' warning in the JS file I had singled out earlier.

What if you manually add

Code: Select all

jwpcdn.com

to NoScript Options > Whitelist before visiting the site?
(in any case, jwpcdn is probably a sensible thing to add to the whitelist for newbies who want things to "just work"...)

[ReporterX]

OK what I see now is different from what I saw before... no OOM crash but I do get an 'Unresponsive script' warning in the JS file I had singled out earlier.

What if you manually add

Code: Select all

jwpcdn.com

to NoScript Options > Whitelist before visiting the site?
(in any case, jwpcdn is probably a sensible thing to add to the whitelist for newbies who want things to "just work"...)

Brilliant! It fixes the crash.

What if I want to restrict it to run on this site only?
Is this the code that I need to put it in ABE?

Code: Select all

Site .jwpcdn.com
Accept INCLUSION from .hktvmall.com
Deny INCLUSION

Thank you.

[barbaz]

Brilliant! It fixes the crash.

Yay!!!
So that's all there is to be done, jwpcdn isn't the sort of site suitable for surrogate script.

What if I want to restrict it to run on this site only?
Is this the code that I need to put it in ABE?

Code: Select all

Site .jwpcdn.com
Accept INCLUSION from .hktvmall.com
Deny INCLUSION

In this case I'd recommend you not do that. jwpcdn is a commonly used video player site, and having that rule *will* break other sites - in possibly similar ways.
However, if you really want to restrict jwpcdn, you'll definitely need to add .jwpcdn.com to the Accept line. Whether or not it's only hktvmall.com requesting needed jwpcdn stuff on that site, I don't know and don't have time to investigate atm. If you don't have a virtual machine to play with, you can experiment with significantly less risk of data loss on a test profile constructed as follows: completely shut down Firefox, create a new profile, exit profile manager, delete anything in the new profile directory, then copy your entire normal profile into the new profile (then use the new profile to figure the right ABE rule, copy the ABE rule to a text editor to add to your main profile, then delete the test profile).
Please let us know the result if you do this, thanks.

[ReporterX]

Brilliant! It fixes the crash.

Yay!!!
So that's all there is to be done, jwpcdn isn't the sort of site suitable for surrogate script.

This bug has to be fixed though. Not everyone reads this thread.

What if I want to restrict it to run on this site only?
Is this the code that I need to put it in ABE?

Code: Select all

Site .jwpcdn.com
Accept INCLUSION from .hktvmall.com
Deny INCLUSION

In this case I'd recommend you not do that. jwpcdn is a commonly used video player site, and having that rule *will* break other sites - in possibly similar ways.
However, if you really want to restrict jwpcdn, you'll definitely need to add .jwpcdn.com to the Accept line. Whether or not it's only hktvmall.com requesting needed jwpcdn stuff on that site, I don't know and don't have time to investigate atm. If you don't have a virtual machine to play with, you can experiment with significantly less risk of data loss on a test profile constructed as follows: completely shut down Firefox, create a new profile, exit profile manager, delete anything in the new profile directory, then copy your entire normal profile into the new profile (then use the new profile to figure the right ABE rule, copy the ABE rule to a text editor to add to your main profile, then delete the test profile).
Please let us know the result if you do this, thanks.

I thought jwpcdn is a content delivery network which can be used by various subscribers, but it seems like it is actually a domain solely used by JW Player. Did I get it right?
Is there any security benefits to restrict it?

BTW I tested the ABE code above. It works. TV plays normally. No hang.
You do not need to add .jwpcdn.com to the Accept line (although it does not hurt to add it).

[barbaz]

This bug has to be fixed though. Not everyone reads this thread.

The bug, if any, is on the site's end. NoScript is just the messenger.

I thought jwpcdn is a content delivery network which can be used by various subscribers, but it seems like it is actually a domain solely used by JW Player. Did I get it right?

Yes, as far as I know.

Is there any security benefits to restrict it?

Probably not significant with a site like that. You would however get a potential privacy benefit, when you visit sites that use jwpcdn and whose videos you *don't* want to watch.

[ReporterX]

This bug has to be fixed though. Not everyone reads this thread.

The bug, if any, is on the site's end. NoScript is just the messenger.

As far as the site is concerned it is actually running well if you don't use Noscript. It is just we install Noscript to block the script and this crashes Firefox.
I tried another website which uses jwpcdn too. It does not crash even if I block it (although the video can't be loaded).

Is there any security benefits to restrict it?

Probably not significant with a site like that. You would however get a potential privacy benefit, when you visit sites that use jwpcdn and whose videos you *don't* want to watch.

Then I guess it will only tracks us when I click to play the video, not when I just visit the website, right?
Some website will autoplay videos but I control when the Flash player should be run, so no much benefit in my case.

[barbaz]

As far as the site is concerned it is actually running well if you don't use Noscript. It is just we install Noscript to block the script and this crashes Firefox.

Right but is NoScript the *only* thing that can make jwpcdn not load? What if jwpcdn goes down temporarily or is accidentally set to 0.0.0.0 in someone's hosts file?
How does the site handle errors to load jwpcdn? From the looks of it, very badly.

That's why I say it's the site's bug even though on your side, NoScript is the culprit.

Is there any security benefits to restrict it?

Probably not significant with a site like that. You would however get a potential privacy benefit, when you visit sites that use jwpcdn and whose videos you *don't* want to watch.

Then I guess it will only tracks us when I click to play the video, not when I just visit the website, right?
Some website will autoplay videos but I control when the Flash player should be run, so no much benefit in my case.

jwpcdn also loads JS files. So that depends on jwpcdn's privacy policy and how much you trust what it says...

[ReporterX]

As far as the site is concerned it is actually running well if you don't use Noscript. It is just we install Noscript to block the script and this crashes Firefox.

Right but is NoScript the *only* thing that can make jwpcdn not load? What if jwpcdn goes down temporarily or is accidentally set to 0.0.0.0 in someone's hosts file?
How does the site handle errors to load jwpcdn? From the looks of it, very badly.

That's why I say it's the site's bug even though on your side, NoScript is the culprit.

I don't really know if the blocking alone crashes Firefox. To me it looks like some quirks happening when Noscript intercepts and stops that script from running (somehow mishandle?).

It would be interesting to know if Firefox (or any other browser) still crashes if jwpcdn is blocked in another way.

[barbaz]

I don't really know if the blocking alone crashes Firefox. To me it looks like some quirks happening when Noscript intercepts and stops that script from running (somehow mishandle?).

It would be interesting to know if Firefox (or any other browser) still crashes if jwpcdn is blocked in another way.

I've got VMs to play with, I will try blocking it various ways and see how the site reacts

[barbaz]

Update: Temporary fix
Whitelist jwpcdn.com before you visit HKTV.
This site does not show up in the noscript context menu when you visit HKTV. It is hard to find it out.
And it will cause your browser to crash, so this bug needs to be fixed ASAP.

But not that the context menu can't see it, I found it there going to the site with Scripts Globally Allowed.

[barbaz]

I've got VMs to play with, I will try blocking it various ways and see how the site reacts

Done that in my Firefox testing VM - and doesn't matter how jwpcdn is blocked, same result. I tried setting it to 0.0.0.0 and using an addon that rejects requests instead of stopping them dead like nsIContentPolicy / NoScript.
So it's a problem with the site's handling of error to contact jwpcdn server (I'd like to try making the response HTTP 404 errors as well, but I don't have a safe way to test it).
Further investigation would involve debugging the unresponsive script from the warning, but my attempt to do that crashed Firefox.

If this matters enough to you, you might consider pointing the hktvmall webmasters to this thread and let them know this could happen also if jwpcdn just goes down for some reason.