Update Bilibili.com.xml #7495

ivysrono · 2016-11-02T14:42:44Z

No description provided.

gloomy-ghost · 2016-11-11T22:27:30Z

src/chrome/content/rules/Bilibili.com.xml

-		- bangumi       FROM static.hdslb.com, s[1-3].hdslb.com
-		- pay, passport FROM api*
-	* Secured by us
+	MCB:


Any reasons to do so?

gloomy-ghost · 2016-11-11T22:29:06Z

src/chrome/content/rules/Bilibili.com.xml

-		- app           FROM activity.hdslb.com
-		- bangumi       FROM static.hdslb.com, s[1-3].hdslb.com
-		- pay, passport FROM api*
-	* Secured by us


hdslb.com supports https now, I think we can create a mixcontent ruleset for them.

要写排除规则啊……懒癌发作~

今后再也不没事找事写复杂的排除规则了，累死了。

#7961 (comment)

一来我都写了排除规则了，二来页面里有 http://push-msg.bilibili.com:8090/sub 这种玩意，恐怕也不适合写成 mixcontent

gloomy-ghost · 2016-11-12T07:07:50Z

src/chrome/content/rules/Bilibili.com.xml

 	MCB:
 		- app
 		- bangumi
-		- passport


Mixed Content: The page at 'https://passport.bilibili.com/site/site.html' was loaded over HTTPS, but requested an insecure script 'http://data.bilibili.com/a/access.js?_=1478934401113'. This request has been blocked; the content must be served over HTTPS.

控制台里也没看到啊

没账号……那要加排除规则不？

其实 pay. 也有mixed js，但是都没有发现功能丢失

控制台确实找不到MCB的记录。

/a/account.js 只在登录界面有啊……登录之后有 /a/access.js 的 MCB

退出重新登录，全程开着控制台，你说的还真没找到。不过发现了其他MCB

有 MCB 但是没有 functional broken, 留着注释就行没必要去掉 target……

那 bmall.bilibili.com 似乎也可以放进去

gloomy-ghost · 2017-01-02T11:50:41Z

src/chrome/content/rules/Bilibili.com.xml

@@ -31,6 +33,7 @@
 		<test url="http://interface.bilibili.com/msg.xml" />
 	<target host="passport.bilibili.com" />
 	<target host="pay.bilibili.com" />
+	<target host="planet2017.bilibili.com" />


XMLHttpRequest cannot load https://www.bilibili.com/activity/web/view/data/5. The 'Access-Control-Allow-Origin' header has a value 'http://planet2017.bilibili.com' that is not equal to the supplied origin. Origin 'https://planet2017.bilibili.com' is therefore not allowed access.

公告里的内容挂掉了

这种头不对的怎么找啊

直接打开 console 看啊

居然不是火眼金睛，太令人失望了……

gloomy-ghost · 2017-01-03T08:09:10Z

src/chrome/content/rules/Bilibili.com.xml

+	<target host="www.bilibili.com" />
+		<exclusion pattern="^http://www\.bilibili\.com/(?!online\.js|widget/)" />
+		<test url="http://www.bilibili.com/online.js" />
+		<test url="http://www.bilibili.com/widget/getSearchDefaultWords" />


XMLHttpRequest cannot load https://www.bilibili.com/widget/getSearchDefaultWords. The 'Access-Control-Allow-Origin' header has a value 'http://bangumi.bilibili.com' that is not equal to the supplied origin. Origin 'http://www.bilibili.com' is therefore not allowed access.

ivysrono · 2017-01-03T11:43:51Z

今年再也不新建这种复杂规则了，再写就剁手（哭

ivysrono · 2017-01-09T08:41:29Z

@gloomy-ghost 突然有种鬼畜大哥盯着我们的恐慌感——这些问题大都不存在了！啊啊啊……

ivysrono · 2017-01-09T14:26:26Z

竭尽全力规避CORS
其实是今天才明白CORS是怎么回事（ε=ε=ε=┏(゜ロ゜;)┛

ivysrono · 2017-01-09T15:31:25Z

我还开着的PR又有整整3页75个了……
今天受你刺激，立个flag：在这些解决前不再提交新的了！
做不了学霸，只能做梦去ε=ε=ε=┏(゜ロ゜;)┛

gloomy-ghost · 2017-01-09T15:37:45Z

年底了，reviewers也要假期啊……

211毕业的人就别纠结学霸了，还在象牙塔里的人才说这个（逃

ivysrono · 2017-01-09T15:40:07Z

现在的确不纠结了，只考虑雾霾下还有几年阳寿……

gloomy-ghost · 2017-01-10T06:06:48Z

src/chrome/content/rules/Bilibili.com.xml

+		<exclusion pattern="^http://www\.bilibili\.com/index/index-icon\.json" />
+		<exclusion pattern="^http://www\.bilibili\.com/widget/getSearchDefaultWords" />
+		<test url="http://www.bilibili.com/index/index-icon.json" />
+		<test url="http://www.bilibili.com/widget/getSearchDefaultWords" />


和之前 #7944 一样把触发 CORS 的网址也在注释里写上吧，也方便以后维护

gloomy-ghost · 2017-01-10T06:29:23Z

src/chrome/content/rules/Bilibili.com.xml

+
+	<target host="data.bilibili.com" />
+		<exclusion pattern="^http://data\.bilibili\.com/$" />
+		<exclusion pattern="^http://data\.bilibili\.com/e/p" />


参照 #6629 (comment) 的说法，把广告/统计搞挂了也不要紧（逃

ivysrono · 2017-01-11T12:18:38Z

#8179

gloomy-ghost · 2017-01-11T13:40:23Z

src/chrome/content/rules/Bilibili.com.xml

+	<target host="game.bilibili.com" />
+	<target host="interface.bilibili.com" />
+		<test url="http://interface.bilibili.com/msg.xml" />
+	<target host="api.live.bilibili.com" />


api.live.bilibili.com 和 https://api.live.bilibili.com 内容不一样，有https下正常的API例子么？

gloomy-ghost · 2017-01-11T14:31:16Z

src/chrome/content/rules/Bilibili.com.xml

+	<target host="bmall.bilibili.com" />
+	<target host="game.bilibili.com" />
+	<target host="interface.bilibili.com" />
+		<test url="http://interface.bilibili.com/msg.xml" />


Note:

Access-Control-Allow-Credentials:true Access-Control-Allow-Methods:POST, GET Access-Control-Allow-Origin:http://www.bilibili.com

If the origin in request is https, then the server will use Access-Control-Allow-Origin:https://www.bilibili.com instead.

which means any redirection executed by https everywhere will be blocked because the origin is dropped after redirect. However, the player requests a protocol-relative URL, so it should be safe to keep this target as we also secured www.bilibili.com

gloomy-ghost · 2017-01-11T14:35:17Z

src/chrome/content/rules/Bilibili.com.xml

+	<!--	Directly:	-->
+	<target host="account.bilibili.com" />
+		<test url="http://account.bilibili.com/site/nameplate.html" />
+	<target host="big.bilibili.com" />


Mixed Content: The page at 'https://big.bilibili.com/site/big.html' was loaded over HTTPS, but requested an insecure resource 'http://vip.bilibili.com/site/vip-exchange-plugin.html?'. This request has been blocked; the content must be served over HTTPS.

gloomy-ghost · 2017-01-12T08:20:58Z

src/chrome/content/rules/Bilibili.com.xml

+	If the origin in request is https, then the server will use Access-Control-Allow-Origin:https://www.bilibili.com instead.
+
+	Which means any redirection executed by https everywhere will be blocked because the origin is dropped after redirect. However, the player requests a protocol-relative URL, so it should be safe to keep this target as we also secured www.bilibili.com .
+


……我只是写在那里备查的，毕竟这个只要一重定向就会被block，万一出问题查到这个PR有点说不过去

gloomy-ghost · 2017-01-12T14:53:56Z

src/chrome/content/rules/Bilibili.com.xml

-			( test: http://h.bilibili.com/dy\d+ )
-		- comment.bilibili.com
-			( test: https://www.bilibili.com/video/av\d+/ )
+			( Functional breakage. Test: http://h.bilibili.com/dy\d+ )


Please list the issue specifically, something likes "Comments are not displaying properly"

Update Bilibili.com.xml

640fe1d

gloomy-ghost reviewed Nov 11, 2016

View reviewed changes

Update Bilibili.com.xml

c325b02

gloomy-ghost reviewed Nov 12, 2016

View reviewed changes

ivysrono added 7 commits November 12, 2016 16:56

Update Bilibili.com.xml

1daf4e2

Update Bilibili.com.xml

d002781

Update Bilibili.com.xml

4b088f8

Update Bilibili.com.xml

ebd5700

Update Bilibili.com.xml

0ca0bc5

Update Bilibili.com.xml

110e7ae

Update Bilibili.com.xml

570923f

gloomy-ghost reviewed Jan 2, 2017

View reviewed changes

gloomy-ghost self-assigned this Jan 2, 2017

ivysrono added 3 commits January 2, 2017 20:09

Update Bilibili.com.xml

dca1e10

Update Bilibili.com.xml

3f78c6c

Update Bilibili.com.xml

fc7f509

gloomy-ghost reviewed Jan 3, 2017

View reviewed changes

Update Bilibili.com.xml

04c78c5

Update Bilibili.com.xml

8f117d8

gloomy-ghost reviewed Jan 10, 2017

View reviewed changes

ivysrono added 3 commits January 11, 2017 20:01

Update Bilibili.com.xml

d4fa572

Update Bilibili.com.xml

495a0d6

Update Bilibili.com.xml

f7935c8

gloomy-ghost reviewed Jan 11, 2017

View reviewed changes

ivysrono added 2 commits January 11, 2017 23:38

Update Bilibili.com.xml

877ab5d

Update Bilibili.com.xml

40f80a3

gloomy-ghost reviewed Jan 12, 2017

View reviewed changes

Update Bilibili.com.xml

ab788f9

ivysrono closed this Jan 12, 2017

ivysrono reopened this Jan 12, 2017

ivysrono added 2 commits January 12, 2017 22:48

Update Bilibili.com.xml

5173b99

Update Bilibili.com.xml

0097db2

gloomy-ghost reviewed Jan 12, 2017

View reviewed changes

ivysrono added 2 commits January 12, 2017 23:06

Update Bilibili.com.xml

1e9de26

Update Bilibili.com.xml

4f4a930

gloomy-ghost merged commit ac32ccf into EFForg:master Jan 12, 2017

gloomy-ghost removed their assignment Jan 12, 2017

		If the origin in request is https, then the server will use Access-Control-Allow-Origin:https://www.bilibili.com instead.

		Which means any redirection executed by https everywhere will be blocked because the origin is dropped after redirect. However, the player requests a protocol-relative URL, so it should be safe to keep this target as we also secured www.bilibili.com .

Update Bilibili.com.xml #7495

Update Bilibili.com.xml #7495

Conversation

ivysrono commented Nov 2, 2016

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ivysrono Jan 2, 2017 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ivysrono commented Jan 3, 2017

ivysrono commented Jan 9, 2017 • edited Loading

ivysrono commented Jan 9, 2017

ivysrono commented Jan 9, 2017

gloomy-ghost commented Jan 9, 2017

ivysrono commented Jan 9, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ivysrono commented Jan 11, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ivysrono Jan 2, 2017 •

edited

Loading

ivysrono commented Jan 9, 2017 •

edited

Loading