Page 1 of 1
flash version check fails in new youtube ui (flash blocked)
Posted: Thu Mar 11, 2010 5:49 am
by al_9x
Fx 3.6.0, NS 1.9.9.53, new profile, flash blocked on trusted
youtube has started rolling out a
new ui. It seems to appear randomly, but can be forced with this
url from the blog post.
The new version detection
code seems to be (it's obfuscated) on line 30 and is doing basically the following:
Code: Select all
<html>
<head>
<script>
function checkFlash()
{
var body = document.getElementsByTagName("body")[0];
var flashObj = document.createElement("object");
flashObj.setAttribute("type", "application/x-shockwave-flash");
var flashEl = body.appendChild(flashObj);
alert(flashEl);
var hasGetVariable = "GetVariable" in flashEl;
alert(hasGetVariable);
if (hasGetVariable)
alert(flashEl.GetVariable("$version"));
body.removeChild(flashObj);
}
</script>
</head>
<body>
<button onclick="checkFlash();">check flash version</button>
</body>
<html>
This sample fails to get the flash version with flash blocked ("GetVariable" in flashEl). Giorgio, is flash patching no longer working?
Re: flash version check fails in new youtube ui (flash blocked)
Posted: Thu Mar 11, 2010 10:11 pm
by al_9x
I noticed that you only do flash patching for js includes
Code: Select all
if (aContentType == 2) { // "real" JavaScript include
so I had to modify my sample.
Code: Select all
<html>
<head>
<script src="checkFlash.js"></script>
</head>
<body>
<button onclick="checkFlash();">check flash version</button>
</body>
<html>
checkFlash.js
Code: Select all
function checkFlash()
{
var body = document.getElementsByTagName("body")[0];
var flashObj = document.createElement("object");
flashObj.setAttribute("type", "application/x-shockwave-flash");
var flashEl = body.appendChild(flashObj);
alert(flashEl);
var hasGetVariable = "GetVariable" in flashEl;
alert(hasGetVariable);
if (hasGetVariable)
alert(flashEl.GetVariable("$version"));
body.removeChild(flashObj);
}
Curious, why only includes? I suppose it's unlikely but the version code could be inline.
So the problem appears to be that the patched GetVariable doesn't return the version
Code: Select all
this.GetVariable = function(n) {
if (n != "$version") return;
if (!ver) {
ver = navigator.plugins["Shockwave Flash"]
.description.match(/(\d+)\.(\d+)(?:\s*r(\d+))?/);
ver.shift();
ver.push('99');
ver = "WIN " + ver.join(",");
}
return;
}
Another odd thing I noticed with my sample is that GetVariable is no longer defined on subsequent calls to checkFlash. That doesn't look deliberate on your part, any idea what's going on?
Re: flash version check fails in new youtube ui (flash blocked)
Posted: Thu Mar 11, 2010 10:28 pm
by Giorgio Maone
Investigating, thanks.
Re: flash version check fails in new youtube ui (flash blocked)
Posted: Thu Mar 11, 2010 10:34 pm
by al_9x
From what I remember flash patching was introduces for SWFObject v2.2 and it never needed GetVariable("$version") to work, merely for typeof GetVariable not to throw an exception. I guess GetVariable("$version") never actually worked?
Re: flash version check fails in new youtube ui (flash blocked)
Posted: Thu Mar 11, 2010 10:56 pm
by Giorgio Maone
Fixed in
latest development build.
Notice that NoScript will keep applying Silverlight and Flash version check patches on first external script inclusion for optimal balance between performance and convenience, since applying them on plugin load would be too late (it wouldn't work) and applying them early on document load start would be an unnecessary overhead for the simplest pages, because all the relevant real-world instances of plugin version checking use either SWFObject or its Silverlight counterpart as an external script inclusion.
Re: flash version check fails in new youtube ui (flash blocked)
Posted: Fri Mar 12, 2010 12:00 am
by al_9x
al_9x wrote:Another odd thing I noticed with my sample is that GetVariable is no longer defined on subsequent calls to checkFlash. That doesn't look deliberate on your part, any idea what's going on?
Well that was rather obvious, somehow I missed that "if (!ver)"
Minor point, as it probably doesn't matter, but you seem to be returning ver now for any variable requested. Conceivably, if some code asked for some other variable from the dummy after $version it would fail better if undefined or null were returned.
Re: flash version check fails in new youtube ui (flash blocked)
Posted: Fri Mar 12, 2010 12:41 am
by Giorgio Maone
al_9x wrote:Conceivably, if some code asked for some other variable from the dummy after $version it would fail better if undefined or null were returned.
Good point, will be fixed in next version.