search

titaniumnetwork-dev / Ultraviolet

A highly sophisticated proxy used for evading internet censorship or accessing websites in a controlled sandbox using the power of service-workers. Works by intercepting HTTP requests with a service worker script that follows the TompHTTP specifications.
https://docs.titaniumnetwork.org/proxies/ultraviolet
GNU Affero General Public License v3.0
565 stars 4.13k forks source link

hCaptcha will not load when UV is iframed (about:blank) #128

Open itschasa opened 7 months ago

itschasa commented 7 months ago

without about:blank cloak: image

with about:blank cloak (iframe): image

iframe to front end:

<iframe src="https://******" style="height:100%; width: 100%; border: none; position: fixed; top: 0; right: 0; left: 0; bottom: 0; border: none" sandbox="allow-forms allow-downloads allow-modals allow-orientation-lock allow-pointer-lock allow-popups allow-popups-to-escape-sandbox allow-presentation allow-same-origin allow-scripts allow-top-navigation allow-top-navigation-by-user-activation"></iframe>

iframe for service worker to pickup:

<iframe sandbox="allow-same-origin allow-downloads allow-scripts allow-forms allow-modals allow-orientation-lock allow-pointer-lock allow-presentation" srv="us1" src="https://******/'service'/*****"></iframe>

this probably isn't fixable, as no errors are appearing in console. most likely hcaptcha blocking when 2 iframes deep (3 iframes deep from its perspective (about:blank > uv > hcaptcha iframe))? not sure, but best to report it incase others have issues

recaptcha still works fine when about:blank-ed

Percslol commented 7 months ago

yeah this is a known issue, not sure how we would go about fixing it

probably going to keep this issue open though for further discussion

allmors commented 6 months ago

Which version are you using? image you can try https://hideip.network/

itschasa commented 6 months ago

Which version are you using?

image

you can try https://hideip.network/

Did you try it whilst about:blank cloaking was enabled?

allmors commented 6 months ago

Which version are you using? image you can try https://hideip.network/

Did you try it whilst about:blank cloaking was enabled?

After testing, uv cannot rewrite iframe again

itschasa commented 6 months ago

After testing, uv cannot rewrite iframe again

image

looks like UV can inject itself into an iframe whilst about:blank cloaked, but hcaptcha just refuses to load, most likely a security mesaure by hcaptcha, preventing captchas being done whilst 2 iframes deep already

itschasa commented 6 months ago

probably need to check if hcaptcha uses postMessage, and if it requires a trusted Message event, or correct origin?