[Firefox] External script not blocked #1134

quilloss · Mar 31, 2015

Steps to Reproduce

Place an img tag containing script
Place a script tag containing the same script

Example:

<!DOCTYPE html>
<html>
    <head>
        <meta charset="utf8">
    </head>
    <body>
        <h1 id="status">Script Blocked</h1>
        <img src="https://gist.githubusercontent.com/anonymous/3988344ba5aba30784bc/raw/4359ff0ab75c95fbaa4e677c595f0138c7a66bd4/gistfile1.js" style="display:none;">
        <script src="https://gist.githubusercontent.com/anonymous/3988344ba5aba30784bc/raw/4359ff0ab75c95fbaa4e677c595f0138c7a66bd4/gistfile1.js"></script>
    </body>
</html>

Symptoms

Script is not blocked.

Preferences Different From Defaults

||githubusercontent.com^$script

* * 1p-script block
* * 3p-script block
* * inline-script block

Info

uBlock version:
    0.9.2.3
Browser and version:
    Firefox 36.0.4
OS and version:
    Windows 7 x64

Other Extensions

None.
Empty Profile

gorhill · Mar 31, 2015

~~This happens only on Firefox, and only if the HTML document is loaded from file://.~~

That Chromium was not showing the issue is just luck, depends whether the image was pull before the script.

Actually, Chromium does not want to execute the scripts in there because:

Refused to execute script from 'https://gist.githubusercontent.com/anonymous/3988344ba5aba30784bc/raw/4359ff0ab75c95fbaa4e677c595f0138c7a66bd4/gistfile1.js'
because its MIME type ('text/plain') is not executable, and strict MIME type checking is enabled.

Probably Github is setting the MIME type to text and apparently Firefox disregards this, while Chromium enforces it.

gorhill added a commit that closed this issue Mar 31, 2015

gorhill this fixes #1134 cd76d79

gorhill closed this in cd76d79 Mar 31, 2015

gorhill added a commit that referenced this issue Mar 31, 2015

gorhill #1134: code review f417e37

gorhill added a commit that referenced this issue Mar 31, 2015

gorhill #1134: code review to fix unwanted side effect if previous fix 12fc8fa

chrisaljoudi/uBlock

[Firefox] External script not blocked #1134

Labels

Milestone

Assignee

2 participants