Summary

This issue was originally reported as https://github.com/polcak/jsrestrictor/issues/110.

The length property indicates the number of parameters expected by the function. JShelter changes the values of the Function.length property, which is unintentional and undesirable. Changed value of the Function.length property can serve as an indication to fingerprinting scripts that JShelter is installed in the browser.

Function.length documentation: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Function/length

Example in Mozilla Firefox ESR (Extended Support Release) Version 78.14.0esr (64-bit) on Windows 10. Same behaviour observed in newer Firefox. Chromium-based browsers might be unaffected.

Without JShelter:

> Date.now.length
< 0

With JShelter:

> Date.now.length
< 1

Setup

Pages affected: All pages, for example, jshelter.org
JShelter Version: 0.10, originally reported for 0.3

1. Is JavaScript Shield active? Yes
2. Is Fingerprint Detector active? Yes

The issue gets fixed (for Date.now) when disabling the time precision wrapper group and FPD.

Browser: Possibly Firefox-only

Reproducibility

Martin complained that it is not always reproducible but I am not sure why.

Additional information / notes

https://pagure.io/JShelter/webextension/blob/c305e08e0419bb4e59afdd58fc42660437176b0e/f/common/wrappingS-ECMA-DATE.js#_74. Have a look at the generated code when investigating the bug.

We might need to revise the policy to write wrappers (wrapping_function_args) because the number of arguments there should affect the length property. Note that some wrappers are modified by FPD.