uBlockOrigin / uAssets

Resources for uBlock Origin, uMatrix: static filter lists, ready-to-use rulesets, etc.
GNU General Public License v3.0
4.07k stars 762 forks source link

Any URL Containing "action=browse" is Blocked #11345

Closed HoldOffHunger closed 2 years ago

HoldOffHunger commented 2 years ago

Prerequisites

I tried to reproduce the issue when...

URL(s) where the issue occurs

https://www.revoltlib.com/people/view.php?action=browse&perpage=20

Describe the issue

As you can see, this is blocked: php?action=browse&

Source: https://easylist.to/easylist/easyprivacy.txt

I have no idea why this is blocked. I was able to get around it by changing my URL to .php?blahblah=1&action=browse (OOoooOOoooOOooooOOooooo, super secure!)

Also, the list maintainers, so-called "Easy List", do not allow anyone now to join their forum to complain. Source: https://forums.lanik.us/ucp.php?mode=register

Can this list be permanently removed from uBlockOrigin? I know it can be customized and disabled (that's how I found out it was responsible for blocking valid websites). But why is it even included at all, if there's no accountability for those who maintain and work on the list, and especially when the list contains clearly valid, good URI components?

There is absolutely nothing about "action=browse" being malicious. Actions are defined as the interface of MVC (model-view-control) and ORM (object-relational modeling) -- so why would you ban something that basically runs half of the Internet?

Screenshot(s)

No response

uBlock Origin version

1.40.8

Browser name and version

Chrome 97.0.4692.71

Settings

Notes

No response

mapx- commented 2 years ago

some issue on registering on forum => @LanikSJ

for php?action=browse& => @ryanbr

gorhill commented 2 years ago

Discussion on Reddit, I asked OP to report here: https://www.reddit.com/r/uBlockOrigin/comments/s65qiq/why_is_actionbrowse_blocked/

gorhill commented 2 years ago

OOoooOOoooOOooooOOooooo, super secure! so-called "Easy List"

@HoldOffHunger I asked you to drop the sarcasm, this accomplishes nothing of value.

uBlock-user commented 2 years ago

Can this list be permanently removed from uBlockOrigin? I know it can be customized and disabled (that's how I found out it was responsible for blocking valid websites). But why is it even included at all, if there's no accountability for those who maintain and work on the list, and especially when the list contains clearly valid, good URI components?

No, breakages are to be reported, no list is perfect. Neither are the web-admins who in the first place decided to use such phrases to collect some data which caused such filters to be added in the first place.

gorhill commented 2 years ago

https://www.revoltlib.com/people/view.php?action=browse&perpage=20

As you can see, this is blocked: php?action=browse&

I don't see anything blocked by that filter when I navigate to the provided URL.

uBlock-user commented 2 years ago

https://www.reddit.com/r/uBlockOrigin/comments/s65qiq/why_is_actionbrowse_blocked/ht1n3e0/

He bypassed the filter already.

uBlock-user commented 2 years ago

git blame https://github.com/easylist/easylist/commit/71a74c7159d5ba5734ecb009dadcf14385057507

gorhill commented 2 years ago

He bypassed the filter already.

When I filter the logger output using action=browse, I see nothing which would be blocked. Only the main document shows a match with action=browse, and uBO does not block the main document when the match is a generic filter.

uBlock-user commented 2 years ago

I know, the filter has existed for 4 years and not a single report has been filed over here or on reddit.

iam-py-test commented 2 years ago

Also, the list maintainers, so-called "Easy List", do not allow anyone now to join their forum to complain

Spam prevention. Issues can be reported at https://github.com/easylist/easylist on GitHub. In terms of issue reporting, EasyList is far better than many lists

Can this list be permanently removed from uBlockOrigin? I know it can be customized and disabled (that's how I found out it was responsible for blocking valid websites). But why is it even included at all, if there's no accountability for those who maintain and work on the list, and especially when the list contains clearly valid, good URI components?

The answer is NO. All lists will have false positives or issues. What matters is what happens next. If Easylist just ignored all the issues reported and @ryanbr (and the rest of the @EasyList team) refused to change, then we would consider removing EasyList. That hasn't happened yet and probably won't happen ever. Keep in mind that we all are volunteers - which includes the EL team.

gorhill commented 2 years ago

Given the filter has existed for four years and the case is not made that the filter is actually interfering at the provided URL, I think we should just revert the badfilter until there is more good faith effort to discuss what is the issue. At first I was open to consider that maybe php?action=browse& could be too unspecific (unlike say, php?action=track&) but due to the tone of the request and the inability to reproduce anything that resemble an issue made me change my stance.

uBlock-user commented 2 years ago

He copy-pasted his pompous rant from reddit, very LQ effort. Should have stayed on reddit only.

LanikSJ commented 2 years ago

Also, the list maintainers, so-called "Easy List", do not allow anyone now to join their forum to complain. Source: https://forums.lanik.us/ucp.php?mode=register

There's been 2 registration as of this morning so without any more info I'm not able do anything for you. And if you bothered to read the rules you'd know that EastList project has no connection what so ever to their forum aside from the shared name.