Issue #55: Many reports of Permission denied to access object on https://www.theguardian.com/world/2021/dec/01/eu-must-consider-mandatory-covid-jabs-says-von-der-leyen - webextension

JShelter / webextension

#55 Many reports of Permission denied to access object on https://www.theguardian.com/world/2021/dec/01/eu-must-consider-mandatory-covid-jabs-says-von-der-leyen

Opened 2 years ago by polcak. Modified 2 years ago

Summary

I investigated https://github.com/polcak/jsrestrictor/issues/158. I found that there are many issues with access to the wrapped objects in Firefox. When I start playing a video, I see problems in both Firefox and Edge with cross-origin objects. These issues do not appear when JavaScript Shield is off.

Setup

Pages affected: https://www.theguardian.com/world/2021/dec/01/eu-must-consider-mandatory-covid-jabs-says-von-der-leyen
JShelter Version: 0.9

Is JavaScript Shield active? ON
Is Network Boundary Shield active? ON
Is Fingerprint Detector active? ON
Selected level Recommended.

I see time precision, device memory and CPU, connected cameras and microphones, and unreliable transfers to server triggered. No Web GL.

[Optional:]

OS: Windows
Browser: Firefox and Edge
Other extensions that might affect JShelter behaviour: No other extension

How to reproduce

Go to https://www.theguardian.com/world/2021/dec/01/eu-must-consider-mandatory-covid-jabs-says-von-der-leyen
Open web dev console and see the errors
Play the video and see the errors

Expected result

Only messages not caused by JShelter visible

Actual result

Many problems with wrapped objects visible.

Reproducibility

Just the two browsers on one computer for now.

Additional information / notes

Example of errors (I'll try to upload a file or I can send by e-mail):

Firefox before playing video:

Uncaught (in promise) Error: Permission denied to access object
    end initPerf.ts:21
    o startup.ts:13
    promise callback*o/< startup.ts:11
    o startup.ts:14
    <anonymous> startup.ts:21
    <anonymous> startup.ts:25
    <anonymous> init.ts:146
initPerf.ts:21:22
...
Uncaught (in promise) Error: Permission denied to access object
Uncaught (in promise) Error: Permission denied to access object
Uncaught (in promise) Error: Permission denied to access object
Content Security Policy: Ignoring duplicate source 'unsafe-inline'
Content Security Policy: Couldn’t parse invalid host 'unsafe-inline'
Uncaught (in promise) Error: Permission denied to access object SyncMessage.js:241:13
Uncaught (in promise) Error: Permission denied to access object
    end initPerf.ts:21
    i doHydration.ts:39
initPerf.ts:21:22
Uncaught (in promise) Error: Permission denied to access object
...
Uncaught (in promise) Error: Permission denied to access object SyncMessage.js:241:13
Uncaught (in promise) Error: Permission denied to access object SyncMessage.js:241:13
Uncaught (in promise) Error: Permission denied to access object
Uncaught (in promise) Error: Permission denied to access object
    end initPerf.ts:21
    i doHydration.ts:39
    promise callback*i doHydration.ts:27
    t initHydration.ts:27
initPerf.ts:21:22
...

When I start playing video in Firefox, I see:

DOMException: Permission denied to access property "WebGLRenderingContext" on cross-origin object
DOMException: Permission denied to access property "WebGL2RenderingContext" on cross-origin object
DOMException: Permission denied to access property "AudioBuffer" on cross-origin object
DOMException: Permission denied to access property "AudioBuffer" on cross-origin object
DOMException: Permission denied to access property "WebGLRenderingContext" on cross-origin object
DOMException: Permission denied to access property "WebGL2RenderingContext" on cross-origin object
DOMException: Permission denied to access property "WebGLRenderingContext" on cross-origin object
DOMException: Permission denied to access property "WebGL2RenderingContext" on cross-origin object
DOMException: Permission denied to access property "WebGLRenderingContext" on cross-origin object
DOMException: Permission denied to access property "WebGL2RenderingContext" on cross-origin object
DOMException: Permission denied to access property "WebGLRenderingContext" on cross-origin object
DOMException: Permission denied to access property "WebGL2RenderingContext" on cross-origin object
DOMException: Permission denied to access property "WebGLRenderingContext" on cross-origin object
DOMException: Permission denied to access property "WebGL2RenderingContext" on cross-origin object
DOMException: Permission denied to access property "WebGLRenderingContext" on cross-origin object
DOMException: Permission denied to access property "WebGL2RenderingContext" on cross-origin object
DOMException: Permission denied to access property "WebGLRenderingContext" on cross-origin object
DOMException: Permission denied to access property "WebGL2RenderingContext" on cross-origin object
DOMException: Permission denied to access property "WebGLRenderingContext" on cross-origin object
DOMException: Permission denied to access property "WebGL2RenderingContext" on cross-origin object
DOMException: Permission denied to access property "WebGLRenderingContext" on cross-origin object
DOMException: Permission denied to access property "WebGL2RenderingContext" on cross-origin object
DOMException: Permission denied to access property "WebGLRenderingContext" on cross-origin object
DOMException: Permission denied to access property "WebGL2RenderingContext" on cross-origin object
DOMException: Permission denied to access property "WebGLRenderingContext" on cross-origin object
DOMException: Permission denied to access property "WebGL2RenderingContext" on cross-origin object
DOMException: Permission denied to access property "WebGLRenderingContext" on cross-origin object
DOMException: Permission denied to access property "WebGL2RenderingContext" on cross-origin object
DOMException: Permission denied to access property "WebGLRenderingContext" on cross-origin object
DOMException: Permission denied to access property "WebGL2RenderingContext" on cross-origin object
DOMException: Permission denied to access property "WebGLRenderingContext" on cross-origin object
DOMException: Permission denied to access property "WebGL2RenderingContext" on cross-origin object
DOMException: Permission denied to access property "WebGLRenderingContext" on cross-origin object
DOMException: Permission denied to access property "WebGL2RenderingContext" on cross-origin object
Uncaught (in promise) Error: Permission denied to access object
Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://googleads.g.doubleclick.net/pagead/id. (Reason: CORS request did not succeed). Status code: (null).

The resource at “<URL>” was blocked because content blocking is enabled. 2
Some cookies are misusing the recommended “SameSite“ attribute 8
Uncaught (in promise) Error: Permission denied to access object SyncMessage.js:241:13
Uncaught (in promise) Error: Permission denied to access object
...

When I open the page in Edge, I do not see any Error produced by JShelter but when I start playing the video, I see:

DOMException: Blocked a frame with origin "https://www.youtube.com" from accessing a cross-origin frame.
    at <anonymous>:2242:25
    at <anonymous>:2276:4
    at <anonymous>:2280:4
    at <anonymous>:10600:4
    at anonymous (<anonymous>:10601:4)
    at modifyWindow (<anonymous>:199:7)
    at Object.patchWindow (<anonymous>:322:3)
    at <anonymous>:446:10
    at <anonymous>:10603:7
(anonymous) @ VM1420:2276
(anonymous) @ VM1420:2280
(anonymous) @ VM1420:10600
anonymous @ VM1420:10601
modifyWindow @ VM1420:199
patchWindow @ VM1420:322
(anonymous) @ VM1420:446
(anonymous) @ VM1420:10603
patchWindow @ patchWindow.js:201
configureInjection @ document_start.js:56
(anonymous) @ document_start.js:80
VM1420:2441 

       DOMException: Blocked a frame with origin "https://www.youtube.com" from accessing a cross-origin frame.
 ...

Metadata Update from @polcak:
- Issue assigned to gioma1
- Issue set to the milestone: NLNet evaluation
- Issue tagged with: bug

2 years ago

polcak commented 2 years ago

Similar issues appear on https://archive.org/donate, see #56, and test page #57

Edited 2 years ago by polcak

Metadata

Assignee

gioma1

Tags

Blocking

None

Depending on

None

Priority

Normal

Milestone

NLNet evaluation