mlgualtieri / CSS-Exfil-Protection

Official repository for the CSS Exfil Protection browser extensions.
MIT License
155 stars 11 forks source link

Waterfox Classic + uBlock Origin + CSS Exfil Protection = bug #23

Closed MichaelViV closed 4 years ago

MichaelViV commented 4 years ago

When you use uBlock Origin in conjunction with CSS Exfil Protection on Waterfox Classic then they interfere with each other.

Step to reproduce: 1: Install Waterfox Classic. 2: Add uBlock Origin and CSS Exfil Protection 3: Create in uBlock Origin blocking rule ||fonts.googleapis.com 4: Go to https://www.mike-gualtieri.com/css-exfil-vulnerability-tester 5: Despite the fact that fonts.googleapis.com is blocked, connection still occurs. 6: Disable CSS Exfil Protection in about:addons 7: Go again to https://www.mike-gualtieri.com/css-exfil-vulnerability-tester 8: uBlock Origin rule for fonts.googleapis.com works fine. No connections.

Sorry, I don’t know your attitude to Waterfox Classic. This browser is using old but highly modified version Firefox 56.3. But some APIs, that CSS Exfil Protection can use, may be old and cause this bug.

mlgualtieri commented 4 years ago

Right now I only can support Chrome and Firefox. The alternative Firefox browsers create a lot of incompatibility issues and I don't have the time at the moment to keep on top of them. Sorry. The extension is 100% open source though, so if you can track down the issue I'd certainly consider a patch, as long as the patch doesn't disrupt the functionality of the supported browsers.

The question of uBlock and my extension keeps coming up. I have not been able to replicate the error in any of my setups. If you or anyone can replicate the issue (in Chrome/Firefox) and provide the steps to reproduce, I'd certainly try to fix.

Here's what the network connections look like with and without uBlock set to block Google Fonts:

Chrome with uBlock set to block Google fonts: chrome

Firefox with uBlock set to allow Google Fonts: ff1

Firefox with uBlock set to block Google Fonts: ff2

MichaelViV commented 4 years ago

I understand. I am sorry.

mlgualtieri commented 4 years ago

No need to be sorry! I welcome all bug reports and feedback.