GNU bug report logs - #45609
LibreJS blocked from restricted domains

Message received at submit <at> debbugs.gnu.org:

Received: (at submit) by debbugs.gnu.org; 2 Jan 2021 11:34:02 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Sat Jan 02 06:34:02 2021
Received: from localhost ([127.0.0.1]:52614 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1kvfAY-0007Mw-Fi
	for submit <at> debbugs.gnu.org; Sat, 02 Jan 2021 06:34:02 -0500
Received: from lists.gnu.org ([209.51.188.17]:35724)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <jahoti@HIDDEN>) id 1kveeY-0006Md-UU
 for submit <at> debbugs.gnu.org; Sat, 02 Jan 2021 06:00:59 -0500
Received: from eggs.gnu.org ([2001:470:142:3::10]:59736)
 by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)
 (Exim 4.90_1) (envelope-from <jahoti@HIDDEN>) id 1kveeY-0006qh-M5
 for bug-gnuzilla@HIDDEN; Sat, 02 Jan 2021 06:00:58 -0500
Received: from mail.envs.net ([5.199.136.28]:36766)
 by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)
 (Exim 4.90_1) (envelope-from <jahoti@HIDDEN>) id 1kveeV-00016c-DN
 for bug-gnuzilla@HIDDEN; Sat, 02 Jan 2021 06:00:57 -0500
Received: from localhost (mail.envs.net [127.0.0.1])
 by mail.envs.net (Postfix) with ESMTP id D172412A096E
 for <bug-gnuzilla@HIDDEN>; Sat,  2 Jan 2021 07:24:56 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=envs.net; s=modoboa;
 t=1609572296; bh=2RamEqOSxR+xtg4mnko8rotkwsI69PLpjMloNsVXu3o=;
 h=To:From:Subject:Date:From;
 b=c3jZ6gIjjSi1GA2eEtgf4sGkvESfeWNWeKz4KmLQxlqAtvRnCndRwBdv+9bhAKvVb
 kqT+GL8tiGjyrDVYqwMwsx7i1nx516925QYE4uVExqaD4ioL6jqQV2qcDQjHA6EULx
 omqCjo2dUut7r00tEvrzn5cFo/WCJ2XQc/BHU/VclMT+H4KxxYCEtscWXTGWPWWI0X
 elEgbSLPDhszaUGdZcvkdzS3bLkdAGqIO+nvqROnV+VGKZoZPOIogCDWTCgEgNlQol
 yaJ8C9MgRH2LUmry7+5xlcwNmAgztyzcc0p1R+/b3tkZu/A9eiYlB4Hbop9h+tFTzV
 18aWzQsWLKPYVGvQP0nfdHuw2k35rlSCRybPgaTlSNkpVHTeztJDIClmG+3ryCdHlm
 wXa74HFZZFPbcS8eep+QT3IYq/h7Z7zHjDyvX8e2JsA+w8IJWzMN2CalrltrFsJv2z
 1522kzP9JY5HyIS0hXPlNspGFgjE4FHtm/SFGjNP168tbZ7etxC5ojanD6OSE2s43D
 NCxidvrfSxT47AqY8BpzibYziVqAnl7ZCmNVeKLqFJ5r4CsG99f3MG8MHTpGgyihIE
 Nmf2IzS9efpFGHin5/xHcE6C/3gOl871cb56dCs6Ip4rPZxFo1FvLVpGV382V9M+qu
 BQZM6suHUImDJHVPv7+Vw5+A=
X-Virus-Scanned: Debian amavisd-new at mail.envs.net
Received: from mail.envs.net ([127.0.0.1])
 by localhost (mail.envs.net [127.0.0.1]) (amavisd-new, port 10026)
 with ESMTP id WTgkobk-amRs for <bug-gnuzilla@HIDDEN>;
 Sat,  2 Jan 2021 07:24:53 +0000 (UTC)
Received: from [127.0.0.1] (tor-exit-2.zbau.f3netze.de [185.220.100.253])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (No client certificate requested)
 (Authenticated sender: jahoti@HIDDEN)
 by mail.envs.net (Postfix) with ESMTPSA
 for <bug-gnuzilla@HIDDEN>; Sat,  2 Jan 2021 07:24:52 +0000 (UTC)
To: bug-gnuzilla@HIDDEN
From: jahoti <jahoti@HIDDEN>
Subject: LibreJS blocked from restricted domains
Message-ID: <17ad0b92-68c7-7ad0-197c-469705170434@HIDDEN>
Date: Sat, 2 Jan 2021 07:24:00 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
Received-SPF: pass client-ip=5.199.136.28; envelope-from=jahoti@HIDDEN;
 helo=mail.envs.net
X-Spam_score_int: -7
X-Spam_score: -0.8
X-Spam_bar: /
X-Spam_report: (-0.8 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1,
 DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1,
 RCVD_IN_BL_SPAMCOP_NET=1.347, SPF_HELO_NONE=0.001,
 SPF_PASS=-0.001 autolearn=no autolearn_force=no
X-Spam_action: no action
X-Spam-Score: -0.1 (/)
X-Debbugs-Envelope-To: submit
X-Mailman-Approved-At: Sat, 02 Jan 2021 06:34:01 -0500
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -1.1 (-)

Hi!

Using the latest IceCat binaries (v60.7.0) as-is, scripts are allowed to 
run freely on the restricted domains listed in the 
"extensions.webextensions.restrictedDomains" configuration option due to 
limitations imposed on extensions (including LibreJS) for these domains. 
LibreJS cannot even see the script and therefore suggests the page is 
devoid of scripts entirely.

In particular, when visiting to the Developer Hub on addons.mozilla.org 
with a new account and going "submit a new extension" (or "Manage API 
keys"), the user is redirected to an agreement page where seemingly 
non-free initialization scripts for a Google reCAPTCHA will be loaded 
and executed.

Voiding the aforementioned configuration option seems to have some 
effect, but fails to block all scripts from executing on the page 
https://addons.mozilla.org/ and still fails to register anything in the 
pop-up. It hasn't been tested on the offending page above, however. If 
it's any help the problem doesn't seem to affect Tor Browser.

~~~ notrms/jahoti