AdguardTeam / AdguardBrowserExtension

AdGuard browser extension
https://adguard.com/
GNU General Public License v3.0
2.99k stars 320 forks source link

AdGuard extension for Firefox causes 60-120 seconds delay in loading Stripe-powered payment forms #2331

Open zloyden opened 1 year ago

zloyden commented 1 year ago

@adguard-bot commented on Tue Apr 11 2023

Issue URL (Incorrect Blocking)

https://www.treetix.com/buytix.cfm?id=198538&cal=highwatermark

Comment

Username: @LionelHolt

The page has an order form which uses Stripe.com's JavaScript API. The CSP reports delay the display of the page by about 60 seconds!

Screenshots

Screenshot 1 ![Screenshot 1](https://reports-img.adguard.com/CYT1jFc.png)
Screenshot 2 ![Screenshot 2](https://reports-img.adguard.com/Fo5rT0B.png)

System configuration

Information value
AdGuard product: AdGuard Browser extension v4.1.53
Browser: Firefox
Stealth mode: disabled
Filters: Ad Blocking:
AdGuard Base

Other:
Filter unblocking search ads and self-promotion

Language-specific:AdGuard French,
AdGuard Russian,
AdGuard Chinese,
AdGuard German,
AdGuard Japanese,
AdGuard Dutch,
AdGuard Spanish/Portuguese,
Bulgarian list,
EasyList Czech and Slovak,
EasyList Italy,
Liste AR,
AdBlockID,
Hungarian,
ABPVN List,
Official Polish filters for AdBlock, uBlock Origin & AdGuard,
List-KR,
Adblock List for Finland,
Polish Anti Adblock Filters
Other extensions used: OneTab, Video DownloadHelper, Privacy Pass, Gnome Shell Extensions, Maximize All Windows

@zloyden commented on Tue Apr 11 2023

Not reproduced it with AdGuard filters. Try to check the site only with them and without other extensions.


@adguard-bot commented on Wed Apr 12 2023

Issue URL (Incorrect Blocking)

https://www.treetix.com/DEV/adguard-stripe-issue.html

Comment

Username: @LionelHolt

In Firefox 111 tested in Windows 10 and Ubuntu, when a page contains , AdGuard AdBlocker triggers csp-report uploads to q.stripe.com. This happens even when either site is added to the Allowlist. The triggering of CSP reports potentially interferes with the performance of the page because it is not fully loaded until the csp-report POST responses are done, which can take 90-120 seconds.

Screenshots

Screenshot 1 ![Screenshot 1](https://reports-img.adguard.com/CMSyItA.png)
Screenshot 2 ![Screenshot 2](https://reports-img.adguard.com/JXztkZw.png)

System configuration

Information value
AdGuard product: AdGuard Browser extension v4.1.53
Browser: Firefox
Stealth mode: disabled
Filters: Ad Blocking:
AdGuard Base

Other:
Filter unblocking search ads and self-promotion

Language-specific:AdGuard French,
AdGuard Russian,
AdGuard Chinese,
AdGuard German,
AdGuard Japanese,
AdGuard Dutch,
AdGuard Spanish/Portuguese,
Bulgarian list,
EasyList Czech and Slovak,
EasyList Italy,
Liste AR,
AdBlockID,
Hungarian,
ABPVN List,
Official Polish filters for AdBlock, uBlock Origin & AdGuard,
List-KR,
Adblock List for Finland,
Polish Anti Adblock Filters
Other extensions used: all other extensions disabled for verification of this issue

@LionelHolt commented on Fri Apr 14 2023

After two escalations with Stripe Support I received a reply from Thomas in the dev team:

"We do see those requests and they are caused by the extension itself apparently injecting a script in our own iframe which violates our own CSP rules. We made an infrastructure change on our end to make those CSP reports requests a lot faster. This should alleviate the issue though it could happen again over time as it depends a lot on the volume of requests those servers get."

So AdGuard still has a negative impact on Stripe-powered payment forms for Firefox users.

zloyden commented 1 year ago

@mozartinio there is a problem with Stripe.com's JavaScript API (delay like or more 60 seconds) that you can check https://www.treetix.com/DEV/adguard-stripe-issue.html here on Firefox. The request is blocked by our extension, not the filters.

@LionelHolt please be ready to answer developers' questions.

LionelHolt commented 1 year ago

Sorry I didn't know there was a distinction of extension vs filters for reporting issues. I arrived at the form by clicking on the green shield in the toolbar then "Report an issue" and much of the form was pre-filled. I suggest making that process more clear and/or better automation.

alexx7311 commented 1 year ago

Expected behavior: Stripe-powered payment forms in Firefox open instantly with AdGuard Extension enabled

Actual behavior: Stripe-powered payment forms open with 60-120 seconds delay when AdGuard Extension is enabled

Steps to reproduce: 1) Open Firefox with AdGuard Extension enabled 2) Go to https://www.treetix.com/_DEV_/adguard-stripe-issue.html 3) Open DevTools and check Network tab for csp related errors

LionelHolt commented 1 year ago

Since Stripe resolved the issue with their CSP reports taking so long, the actual behavior is observed in the JavaScript Console:

Content Security Policy: The page’s settings blocked the loading of a resource at inline (“script-src”). Content Security Policy: The page’s settings observed the loading of a resource at inline (“script-src”). A CSP report is being sent. Content Security Policy: The page’s settings blocked the loading of a resource at inline (“script-src”).

All originating from the AdGuard script:

content-script-start.js:7829:11