Revoking temp permissions is broken for certain WebM videos

[Soppu]

Hi,

I just noticed that NoScript doesn't block some WebM/Gifv embedded video properly. At first it is blocked, but if you click on it so it is allowed temporarily, revoke temporary permissions and reload, the file will still be allowed by NoScript. Restarting Firefox gets back to a blocked video.

Using NS 2.9.0.11.

Go to http://www.koreus.com/modules/news/article21421.html and search for "Ça aurait pu donner un truc comme ça:" to find the post with the problematic video.

[barbaz]

I just get "Video format or MIME type not supported" viewing it on that page, so direct link: http://i.imgur.com/N73VBUb.webm
Wait, viewing directly doesn't work either - just gives me "Video playback aborted due to a network error."

Revoking temporary permissions does revoke the video allowed state for me, regardless of if I view it directly or view it in the page you linked. Is it required that the video be playable in order to reproduce what you're seeing?

[Soppu]

I don't know, but if you use a Firefox alternative instead of the real deal, I'm not sure how reliably you can reproduce since it concerns media that has been very recently enabled in Firefox release branch... Dunno.

As a direct link here's what happens on my end:
- Load http://i.imgur.com/N73VBUb.webm
- See placeholder, click to temporarily allow
- Get redirected to http://i.imgur.com/N73VBUb.gifv which displays a static image
- Revoke temporary permissions and reload
- Get redirected to http://i.imgur.com/N73VBUb.gifv which displays a static image. I should have a placeholder and not be redirected instead

When embedded the video just keeps playing even after I revoke and reload, clear cache, ...



Worth noting that as a direct link I can't reproduce the problem because I am redirected to a .gifv link from the .webm one, which apparently is not the behaviour you see (hint that our browsers may differ on this)

[Soppu]

Sorry I meant
- Revoke temporary permissions and go to http://i.imgur.com/N73VBUb.webm

Because reloading wouldn't be the right url

[barbaz]

I don't know, but if you use a Firefox alternative instead of the real deal, I'm not sure how reliably you can reproduce since it concerns media that has been very recently enabled in Firefox release branch... Dunno.

I'm on a custom SeaMonkey build based on Firefox 45.0.1 release. How would I check for enabled status of these media features?

[Soppu]

Odd, I get the same behaviour as you do with a default Firefox profile and NoScript (Except for forbid Frames and IFrames which I turned on).

Something on my main profile makes the video playable but breaks NoScript's temp permission revocation. It's not too customised, I'm using NoScript and uBlock Origin, I have EME disabled and Adobe CDM and Cisco's plugin are not installed. (Basically GMP is disabled completely)

I have some other tweaks but nothing else related to media. Some NoScript customization going on as well. I guess I'll poke again if I ever figure out the cause :/


Gifv is a special WebM or MP4 video (depending on browser support for these). A mimetype of WebM may not be allowed to have an extension other than .webm, so .gifv may be causing the problem in your profile and my default one ? But then why does it work on my main, and why does NoScript breaks, I dunno.

[barbaz]

In case I can save you some time...

I also use both NoScript & uBlock Origin (plus a bunch of other extensions).

Start troubleshooting by looking at prefs.js: try copying your main profile's prefs.js (and user.js, if it exists) into the clean profile. If that alone doesn't do it then import your extensions.
From there if you reproduced the issue it's a matter of bisecting. If you didn't reproduce the issue, then completely quit Firefox then copy your entire profile contents into a new profile, and bisect the profile files/directories (delete half of them, see if it works, etc...).

If this proves to be a real ghost, always start Firefox with the -purgecaches command-line option when troubleshooting this.

Please let us know the results, thanks.

[Soppu]

Found it, you can replicate when you disable referrers.

Code: Select all

user_pref("network.http.sendRefererHeader", 0);
user_pref("network.http.sendSecureXSiteReferrer", false);

It should work on your current profile, but just in case, this was replicated on a default Firefox 45 profile with a default NoScript using the following changes:

Code: Select all

user_pref("media.eme.enabled", false);
user_pref("media.gmp-eme-adobe.autoupdate", false);
user_pref("media.gmp-eme-adobe.enabled", false);
user_pref("media.gmp-gmpopenh264.autoupdate", false);
user_pref("media.gmp-gmpopenh264.enabled", false);
user_pref("media.gmp-manager.url.override", "data:text/plain,");
user_pref("media.gmp-provider.enabled", false);
user_pref("network.http.sendRefererHeader", 0);
user_pref("network.http.sendSecureXSiteReferrer", false);

[barbaz]

Well, setting those referer prefs like you have does make playing the video work. And revoke temporary permissions seems broken when viewing the embedded video... however, if it is then viewed directly it is again blocked and revoking temporary permissions then really does works as expected. I do not get the redirection behavior you experience when viewing it directly.
Some caching thing perhaps?

(Wouldn't be the other media stuff you mentioned, because SeaMonkey has no GMPs and this browser is built specifically to not support EME at all.)

[Soppu]

So we got the problem reproduced for embed

As a direct link this is approximative but I get something like:
1- On a fresh profile that never loaded that video embedded, I have the redirection behaviour and never a placeholder when visiting direct link
2- If I go to the webpage where it is embedded, I get a NS placeholder. If I click it, video plays.
3- If I revoke permissions and reload, video is still accessible, no placeholder
4- If I then go to the direct link, I get a placeholder and no redirection
5- If I click that placeholder, the video plays
6- If I revoke permissions and and load the .webm direct link, I get no placeholder and I am redirected to the .gifv one

[barbaz]

Okay checking again and this time whether it plays or says unsupported seems just erratic...

I can't make sense of this.

[barbaz]

Here's a better test page: https://blog.imgur.com/2014/10/09/introducing-gifv/
This one is not referer-dependent and not so erratic.

[Soppu]

Using your link and the profile I created I seem to be getting consistent behaviour:
1- Go to page, see placeholders
2- Click on them, video works
3- Revoke temp permissions and reload
4- Video is not blocked by NoScript even if cache was cleared before reload
5- Restart Firefox and go to 1, clearing cache isn't necessary