kkapsner / CanvasBlocker

A Firefox extension to protect from being fingerprinted.
https://canvasblocker.kkapsner.de
Mozilla Public License 2.0
1.17k stars 87 forks source link

Canvasblocker intercepting calls from proxy object to .innerHTML in website without a single <canvas> element #714

Closed TheGhostOfInky closed 3 months ago

TheGhostOfInky commented 5 months ago

Description

I am the developer of an open source test called ideosorter and I noticed canvasblocker causes the test to stop loading the localized frontend.

Expected Behaviour

I expected firefox to load the page as it does without canvasblocker, as I am the developer of the site and can confirm it has 0 canvas elements, much less tracking ones.

Current Behaviour

The following happens: broken

Possible Solution

Unfortunately I am not familiar enough with canvasblocker's codebase to know of a solution.

Steps to Reproduce (for bugs)

  1. create a fresh Firefox profile
  2. install canvasblocker and select stealth settings
  3. navigate to https://ideosorter.pages.dev/
  4. get an error message and see the UI plastered with undefined

Context

I tried logging the values and the localization strings are always working, the faulty interception seems to happen when the strings are attached to an HTML element's innerHTML property, innerText is not affected and recreating the string (by splitting it into characters and rejoining) bypasses the fault.

Your Environment

Your Settings

<!--- Copy your CanvasBlocker settings here. -->
<!-- They can be retrieved by checking the expert mode and going to export settings. -->
<!--- You may consider deleting personal data - especially the "persistentRndStorage". -->
{
    "logLevel": 1,
    "urlSettings": [],
    "hiddenSettings": {},
    "expandStatus": {},
    "displayHiddenSettings": true,
    "whiteList": "",
    "sessionWhiteList": "",
    "blackList": "",
    "blockMode": "fake",
    "protectedCanvasPart": "input",
    "minFakeSize": 10,
    "maxFakeSize": 0,
    "rng": "persistent",
    "protectedAPIFeatures": {},
    "useCanvasCache": true,
    "ignoreFrequentColors": 3,
    "minColors": 3,
    "fakeAlphaChannel": false,
    "webGLVendor": "",
    "webGLRenderer": "",
    "webGLUnmaskedVendor": "",
    "webGLUnmaskedRenderer": "",
    "persistentRndStorage": "{}",
    "persistentIncognitoRndStorage": "",
    "storePersistentRnd": true,
    "persistentRndClearIntervalValue": 0,
    "persistentRndClearIntervalUnit": "days",
    "lastPersistentRndClearing": 1718608514842,
    "sharePersistentRndBetweenDomains": false,
    "askOnlyOnce": "individual",
    "askDenyMode": "block",
    "showCanvasWhileAsking": true,
    "showNotifications": true,
    "highlightPageAction": "none",
    "highlightBrowserAction": "color",
    "displayBadge": true,
    "storeNotificationData": false,
    "storeImageForInspection": false,
    "ignoreList": "",
    "ignoredAPIs": {},
    "showCallingFile": false,
    "showCompleteCallingStack": false,
    "enableStackList": false,
    "stackList": "",
    "protectAudio": true,
    "audioFakeRate": "100",
    "audioNoiseLevel": "minimal",
    "useAudioCache": true,
    "audioUseFixedIndices": true,
    "audioFixedIndices": "20",
    "historyLengthThreshold": 2,
    "protectWindow": false,
    "allowWindowNameInFrames": false,
    "protectDOMRect": true,
    "domRectIntegerFactor": 4,
    "protectSVG": true,
    "protectTextMetrics": true,
    "blockDataURLs": true,
    "protectNavigator": false,
    "navigatorDetails": {},
    "protectScreen": true,
    "screenSize": "",
    "fakeMinimalScreenSize": false,
    "displayAdvancedSettings": true,
    "displayDescriptions": false,
    "theme": "auto",
    "showPresetsOnInstallation": true,
    "dontShowOptionsOnUpdate": false,
    "disruptSessionOnUpdate": false,
    "updatePending": false,
    "isStillDefault": false,
    "storageVersion": 1
}
kkapsner commented 3 months ago

The problem is cause by the fact that you pass a string object not a string literal to .innerHTML. If you perform a .toString() on your values it works.

In the Firefox core these string objects are not propagated correctly to my code that protects innerHTML somehow. But I think I found a solution.