uBlockOrigin / uMatrix-issues

This is the community-maintained issue tracker for uMatrix
https://github.com/gorhill/uMatrix
123 stars 17 forks source link

Blocking JavaScript does not work in local html files (file://...) if the character encoding is not specified. #267

Open achvo opened 4 years ago

achvo commented 4 years ago

Prerequisites

Description

Blocking JavaScript does not work in local html files (file://...) if the character encoding is not specified. This bug does not occur if the character encoding is specified.

A specific URL where the issue occurs

See Steps to Reproduce.

Steps to Reproduce

  1. Block JavaScript in uMatrix completely. Rule: * * script block
  2. Create the following local html file:
    <!DOCTYPE html>
    <html lang="en">
        <head>
            <!-- Do not specify character encoding <meta charset="UTF-8"> -->
            <title>Test</title>
        </head>
        <body>
            <h1>Is JavaScript being executed?</h1>
            <h1 id='answer'>No, it is not.</h1>
            <script>document.getElementById('answer').innerText = 'Yes, it is.'</script>
        </body>
    </html>
  3. Open the local html file in Firefox (file://pathToFile/test.html).
  4. Reload page (F5).
  5. Blocking does not work and JavaScript is being executed.

Ruleset

Default + * * script block

Supporting evidence

supporting_evidence

Your environment

gorhill commented 4 years ago

I can reproduce.

It's not even about the character encoding, just having an empty meta tag causes the CSP directive to take effect. This looks like a Firefox issue to me, whether the CSP directive takes effect or not should not depend on the existence of another meta tag.