search

keraf / NoCoin

No Coin is a tiny browser extension aiming to block coin miners such as Coinhive.
MIT License
1.58k stars 146 forks source link

Stripe.js/v3 intermittently malfunctions w/ NoCoin installed #147

Closed anelder-stripe closed 6 years ago

anelder-stripe commented 6 years ago

Hey Keraf!

I just wanted to reach out to let you know that a user has reported that your Chrome Extension produces negative interactions with the Stripe.js/v3 library and causes our Javascript to crash.

This is a Javascript library that Stripe publishes to enable merchants to collect payment details. It happens intermittently but can easily be reproduced by refreshing the browser a few times (it's about ~10% of page loads fail). I'm not sure what might be causing it, but if you have any insights, I'd love to hear them! Alternatively, if your application has any kind of whitelist, it'd be amazing if you could add our Javascipt URLs to it! The following are the three possible Javascripts someone might load from Stripe:

https://js.stripe.com/v2/
https://js.stripe.com/v3/
https://checkout.stripe.com/checkout.js

You should be able to mimic the behavior with this JSFiddle:

https://jsfiddle.net/ydwkkntx/

Cheers, Andrew @ Stripe

Firminator commented 6 years ago

Shouldn't be the case as NoCoin is not blocking any resources from stripe.com, nor is it blocking the stripe.js file on any website. The blocks are usually very selective (down to a single file instead of an IP or domainname), so it's highly unlikely that NoCoin is causing a crash. The user might have other local problems on the device and/or the site might have been compromised.

keraf commented 6 years ago

Hi @anelder-stripe

Sorry of the late reply. As @Firminator wrote, No Coin is not blocking any ressources from stripe.com (see blacklist file in src/blacklist.txt) and therefore shouldn't interfere with any scripts from your domain. I'm afraid there's nothing I can do except wish you the best for solving your issue.

Cheers

anelder-stripe commented 6 years ago

No problemo. Thanks a lot for following up. This issue was raised to us by one of our users who is hopefully following this thread. I'm happy to leave as-is, if you've got no reason to believe the incident is correlated.

Cheers! 🍺