Skip to content

/ servo

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Can't open links in duckduckgo #10309

Closed
paulrouget opened this issue Mar 31, 2016 · 12 comments
Closed

Can't open links in duckduckgo #10309

paulrouget opened this issue Mar 31, 2016 · 12 comments
Labels
S-blocked-on-external

Comments

@paulrouget
Copy link
Contributor

@paulrouget paulrouget commented Mar 31, 2016

Edit: requires #10311

(flagging as P1 as ddg is the search engine used in browserhtml)

Url I use: https://duckduckgo.com/?q=example

Below some JS code from the duckduckgo page. It fails at f.open() with f is undefined.

Took me a while, but apparently, the test ((ie || ip || ir || is || im) && e.indexOf("http") != -1 && kg != "p" && (!kd || kd == 1)) basically means "if a known browser, if url starts with http, if search terms in url, if want to hide referrer" (not sure about kd and referrer).

We enter this block, and then ddg creates a hidden iframe and open the link from there.

So to make it work, we either want to be able to skip the test and go directly to w.location = … or support iframe.contentDocument and window.open from within an iframe. I'm wondering if it's normal that we enter this block (Servo is not a known browser, and I don't think by default ddg is supposed to hide the search terms from the referrer url).

I'm not sure, but I think ddg in Chrome doesn't use this hidden iframe thing and use w.location.

I'll need help from some ddg folks. My question: is it normal that Servo goes through the hidden iframe code path?

function nug(e, g) {
    var b, c, f, a;
    fl = 0;
    fn = 0;
    a = "";
    if (window.getSelection) {
        a = window.getSelection().toString()
    } else {
        if (document.selection) {
            a = document.selection.createRange();
            a = a.text
        }
    }
    var h = a == DDG.last_selection ? 1 : 0;
    DDG.last_selection = a;
    if (!h) {
        return false
    }
    if (g) {
        window.open(e)
    } else {
        if (w.postMessage && !is && !ip && !is_konqueror && kg != "p" && (!kd || kd == 1)) {
            b = document.getElementById("iframe_hidden");
            b.contentWindow.postMessage("ddg:" + e, location.protocol + "//" + location.hostname)
        } else {
            if ((ie || ip || ir || is || im) && e.indexOf("http") != -1 && kg != "p" && (!kd || kd == 1)) {
                if (d.getElementById("iframe_hidden")) {
                    d.body.removeChild(d.getElementById("iframe_hidden"))
                }
                c = "<html><head><meta name='referrer' content='origin'></head><body><script language='JavaScript'>parent.window.location.href=\"" + e + '";<\/script></body></html>';
                b = d.createElement("iframe");
                b.id = "iframe_hidden";
                d.body.appendChild(b);
                f = b.document;
                if (b.contentDocument) {
                    f = b.contentDocument
                } else {
                    if (b.contentWindow) {
                        f = b.contentWindow.document
                    }
                }
                f.open();
                f.writeln(c);
                f.close()
            } else {
                w.location = e
            }
        }
    }
}
@paulrouget paulrouget changed the title Can't open links in duckduckgo Can't open links in duckduckgo (need help from ddg folks) Mar 31, 2016
@jdm
Copy link
Member

@jdm jdm commented Mar 31, 2016

Servo lacks both window.open and window.post message, so it seems logical.
@paulrouget paulrouget mentioned this issue Mar 31, 2016
Open
16 of 24 tasks complete
@paulrouget
Copy link
Contributor Author

@paulrouget paulrouget commented Mar 31, 2016

Pinging @nilnilnil
@nilnilnil
Copy link

@nilnilnil nilnilnil commented Mar 31, 2016

It's because since Servo is a non-known browser, we have no way of asserting that meta referrer is appropriately implemented, so we use the iframe method to preserve user privacy instead. If Servo implements meta referrer (with the origin option), we'd be happy to add Servo to the list that would skip this block.
@paulrouget
Copy link
Contributor Author

@paulrouget paulrouget commented Mar 31, 2016

@nilnilnil Thank you! I'll come back to you once we got that implemented.
@paulrouget paulrouget mentioned this issue Mar 31, 2016
Open
@paulrouget paulrouget changed the title Can't open links in duckduckgo (need help from ddg folks) Can't open links in duckduckgo Mar 31, 2016
@jdm
Copy link
Member

@jdm jdm commented May 25, 2016 •
edited

@paulrouget To answer your question, #11238 implements a per-document referrer policy that is obtained via child <meta> elements and is used in navigation, iframes, XHR, and scripts. I suspect DDG will also want support for referrer policies delivered via content attributes and HTTP headers, which will happen in a separate PR.
@nox
Copy link
Member

@nox nox commented May 25, 2016

So I read the JS code again, and I'm not sure how referrer policy is going to help here: doesn't DDG use referrer policy through an iframe, using contentWindow, too?
@paulrouget
Copy link
Contributor Author

@paulrouget paulrouget commented May 25, 2016

The goal is to support enough of the referrer policy for ddg to allow using window.location and not go through the iframe/postMessage hack.
@paulrouget
Copy link
Contributor Author

@paulrouget paulrouget commented Jun 3, 2016

@nilnilnil , can you comment on that:

@paulrouget To answer your question, #11238 implements a per-document referrer policy that is obtained via child <meta> elements and is used in navigation, iframes, XHR, and scripts. I suspect DDG will also want support for referrer policies delivered via content attributes and HTTP headers, which will happen in a separate PR.

I'd like to know if we implemented enough to add servo to the white list.
@metajack
Copy link
Contributor

@metajack metajack commented Jun 29, 2016

What's the status here?
@atouchet atouchet mentioned this issue Jul 1, 2017
Open
@nox
Copy link
Member

@nox nox commented Oct 1, 2017

Ping on this?
@atouchet atouchet removed the A-browserhtml label Mar 2, 2018
@fabricedesre
Copy link
Contributor

@fabricedesre fabricedesre commented Jun 8, 2018

This works for me with the current build.
@paulrouget
Copy link
Contributor Author

@paulrouget paulrouget commented Jun 19, 2018

Confirmed.
@paulrouget paulrouget closed this Jun 19, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
S-blocked-on-external
Projects
None yet
Milestone
No milestone
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
7 participants
@jdm @metajack @nox @nilnilnil @paulrouget @fabricedesre @atouchet
You can’t perform that action at this time.