Page 1 of 1
Revoking temp permissions is broken for certain WebM videos
Posted: Tue Apr 12, 2016 7:26 pm
by Soppu
Hi,
I just noticed that NoScript doesn't block some WebM/Gifv embedded video properly. At first it is blocked, but if you click on it so it is allowed temporarily, revoke temporary permissions and reload, the file will still be allowed by NoScript. Restarting Firefox gets back to a blocked video.
Using NS 2.9.0.11.
Go to
http://www.koreus.com/modules/news/article21421.html and search for "Ça aurait pu donner un truc comme ça:" to find the post with the problematic video.
Re: Revoking temp permissions is broken for certain WebM vid
Posted: Tue Apr 12, 2016 7:41 pm
by barbaz
I just get "Video format or MIME type not supported" viewing it on that page, so direct link:
http://i.imgur.com/N73VBUb.webm
Wait, viewing directly doesn't work either - just gives me "Video playback aborted due to a network error."
Revoking temporary permissions does revoke the video allowed state for me, regardless of if I view it directly or view it in the page you linked. Is it required that the video be playable in order to reproduce what you're seeing?
Re: Revoking temp permissions is broken for certain WebM vid
Posted: Tue Apr 12, 2016 9:13 pm
by Soppu
I don't know, but if you use a Firefox alternative instead of the real deal, I'm not sure how reliably you can reproduce since it concerns media that has been very recently enabled in Firefox release branch... Dunno.
As a direct link here's what happens on my end:
- Load
http://i.imgur.com/N73VBUb.webm
- See placeholder, click to temporarily allow
- Get redirected to
http://i.imgur.com/N73VBUb.gifv which displays a static image
- Revoke temporary permissions and reload
- Get redirected to
http://i.imgur.com/N73VBUb.gifv which displays a static image. I should have a placeholder and not be redirected instead
When embedded the video just keeps playing even after I revoke and reload, clear cache, ...
Worth noting that as a direct link I can't reproduce the problem because I am redirected to a .gifv link from the .webm one, which apparently is not the behaviour you see (hint that our browsers may differ on this)
Re: Revoking temp permissions is broken for certain WebM vid
Posted: Tue Apr 12, 2016 9:15 pm
by Soppu
Sorry I meant
- Revoke temporary permissions and go to
http://i.imgur.com/N73VBUb.webm
Because reloading wouldn't be the right url
Re: Revoking temp permissions is broken for certain WebM vid
Posted: Tue Apr 12, 2016 11:09 pm
by barbaz
Soppu wrote:I don't know, but if you use a Firefox alternative instead of the real deal, I'm not sure how reliably you can reproduce since it concerns media that has been very recently enabled in Firefox release branch... Dunno.
I'm on a custom SeaMonkey build based on Firefox 45.0.1 release. How would I check for enabled status of these media features?
Re: Revoking temp permissions is broken for certain WebM vid
Posted: Wed Apr 13, 2016 12:30 am
by Soppu
Odd, I get the same behaviour as you do with a default Firefox profile and NoScript (Except for forbid Frames and IFrames which I turned on).
Something on my main profile makes the video playable but breaks NoScript's temp permission revocation. It's not too customised, I'm using NoScript and uBlock Origin, I have EME disabled and Adobe CDM and Cisco's plugin are not installed. (Basically GMP is disabled completely)
I have some other tweaks but nothing else related to media. Some NoScript customization going on as well. I guess I'll poke again if I ever figure out the cause :/
Gifv is a special WebM or MP4 video (depending on browser support for these). A mimetype of WebM may not be allowed to have an extension other than .webm, so .gifv may be causing the problem in your profile and my default one ? But then why does it work on my main, and why does NoScript breaks, I dunno.
Re: Revoking temp permissions is broken for certain WebM vid
Posted: Wed Apr 13, 2016 1:22 pm
by barbaz
In case I can save you some time...
I also use both NoScript & uBlock Origin (plus a bunch of other extensions).
Start troubleshooting by looking at
prefs.js: try copying your main profile's prefs.js (and user.js, if it exists) into the clean profile. If that alone doesn't do it then import your extensions.
From there if you reproduced the issue it's a matter of bisecting. If you didn't reproduce the issue, then completely quit Firefox then
copy your entire profile contents into a new profile, and bisect the profile files/directories (delete half of them, see if it works, etc...).
If this proves to be a real ghost, always start Firefox with the -purgecaches command-line option when troubleshooting this.
Please let us know the results, thanks.
Re: Revoking temp permissions is broken for certain WebM vid
Posted: Thu Apr 14, 2016 8:37 am
by Soppu
Found it, you can replicate when you disable referrers.
Code: Select all
user_pref("network.http.sendRefererHeader", 0);
user_pref("network.http.sendSecureXSiteReferrer", false);
It should work on your current profile, but just in case, this was replicated on a default Firefox 45 profile with a default NoScript using the following changes:
Code: Select all
user_pref("media.eme.enabled", false);
user_pref("media.gmp-eme-adobe.autoupdate", false);
user_pref("media.gmp-eme-adobe.enabled", false);
user_pref("media.gmp-gmpopenh264.autoupdate", false);
user_pref("media.gmp-gmpopenh264.enabled", false);
user_pref("media.gmp-manager.url.override", "data:text/plain,");
user_pref("media.gmp-provider.enabled", false);
user_pref("network.http.sendRefererHeader", 0);
user_pref("network.http.sendSecureXSiteReferrer", false);
Re: Revoking temp permissions is broken for certain WebM vid
Posted: Thu Apr 14, 2016 1:11 pm
by barbaz
Well, setting those referer prefs like you have does make playing the video work.
And revoke temporary permissions
seems broken when viewing the embedded video... however, if it is then viewed directly it is again blocked and revoking temporary permissions then really does works as expected. I do not get the redirection behavior you experience when viewing it directly.
Some caching thing perhaps?
(Wouldn't be the other media stuff you mentioned, because SeaMonkey has no GMPs and this browser is built specifically to not support EME at all.)
Re: Revoking temp permissions is broken for certain WebM vid
Posted: Thu Apr 14, 2016 3:00 pm
by Soppu
So we got the problem reproduced for embed
As a direct link this is approximative but I get something like:
1- On a fresh profile that never loaded that video embedded, I have the redirection behaviour and never a placeholder when visiting direct link
2- If I go to the webpage where it is embedded, I get a NS placeholder. If I click it, video plays.
3- If I revoke permissions and reload, video is still accessible, no placeholder
4- If I then go to the direct link, I get a placeholder and no redirection
5- If I click that placeholder, the video plays
6- If I revoke permissions and and load the .webm direct link, I get no placeholder and I am redirected to the .gifv one
Re: Revoking temp permissions is broken for certain WebM vid
Posted: Thu Apr 14, 2016 3:52 pm
by barbaz
Okay checking again and this time whether it plays or says unsupported seems just erratic...
I can't make sense of this.
Re: Revoking temp permissions is broken for certain WebM vid
Posted: Thu Apr 14, 2016 3:57 pm
by barbaz
Here's a better test page:
https://blog.imgur.com/2014/10/09/introducing-gifv/
This one is not referer-dependent and not so erratic.
Re: Revoking temp permissions is broken for certain WebM vid
Posted: Thu Apr 14, 2016 9:41 pm
by Soppu
Using your link and the profile I created I seem to be getting consistent behaviour:
1- Go to page, see placeholders
2- Click on them, video works
3- Revoke temp permissions and reload
4- Video is not blocked by NoScript even if cache was cleared before reload
5- Restart Firefox and go to 1, clearing cache isn't necessary