-
Notifications
You must be signed in to change notification settings - Fork 60
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
GM not working in Firefox 81.0.2 with DuckDuckGo Privacy Essentials extension #607
Comments
|
Is the DDG extension injecting an anonymous script into the page? That seem like an odd thing to do and a bit of a difficult environment to target/test if the browser is rendering a different page than we coded. However, adding the null check in the name of defensive programming seems like a good thing to do.
|
|
Those were my thoughts too. I think there is a pitched battle between sites trying to harvest info about users and browsers/users trying to prevent it. And like you say, we need to code to expect the unexpected. |
The DuckDuckGo Privacy Essentials extension for Firefox and Chrome injects anonymous script elements into the webpage. This breaks an assumption in index.js that all script elements have a valid src attribute. In the name of defensive coding and playing well with others, this commit protects access to the src element with a null check. However, this seems like very sketchy behavior to me on the part of DDG PE. It appears identical to a malicious code injection attack. And I'm really not sure how we are supposed to reliably code for an environment where the definition of the environment, and even our own application code, can be changed out from under us at any time. fixes geomoose#607
But it works if in FF I turn off the DuckDuckGo Privacy Essentials extension.
Symptom
Using the demo GM stops after it shows the basic HTML and does not show the Catalog entries.
Investigation
After I switch the index.html to use geomoose.js instead of geomoose.min.js, the FF console shows an error in GM's index.js line 94
The error is at the
if(src.indexofbecause the first of the threescriptTags[]does not have a 'src' attribute sosrcis null. While the other twoscriptTags[]look legit (gemoose.js and config.js), this bit of JavaScript looks odd. It's about 25 lines of things likeObject.defineProperty(navigator, "doNotTrack", { value: "unspecified" });(Thanks, Privacy Essentials extension!)Fix
Anyways, the fix is to test if src is not null prior to the
(src.indexOftest.The text was updated successfully, but these errors were encountered: