1247132 - Tracking protection breaks the image slideshow on this page on news.discovery.com

Status: RESOLVED WORKSFORME

(Web Compatibility :: Site Reports, defect, P5)

Description

[Caspy7]

1. Enable tracking protection
2. Navigate to http://news.discovery.com/history/archaeology/pompeii-victims-bodies-revealed-in-scans-photos-151008.htm
3. Attempt to navigate through the slideshow via the arrows.
4. Fail to do so
5. Disable tracking protection 
6. Succeed at navigating the slideshow.

Comment 1

[Rebecca Billings [:rbillings]]

All links for news.discovery.com now redirect to https://www.rebelmouse.com/wordpress-vip-alternative-2401656056.html. I checked https://www.discovery.com/ and there is a lot of content that remains blocked.

Comment 2

[Oana Arbuzov [:oanaarbuzov]]

The layout seems to be changed, I did not find any slideshows on the provided URL.

Verified with the provided URLs and with Tracking Protection Strict enabled:
1) https://www.rebelmouse.com/wordpress-vip-alternative-2401656056.html (http://news.discovery.com/history/archaeology/pompeii-victims-bodies-revealed-in-scans-photos-151008.htm)- some images are not displayed
2) https://www.discovery.com/ - main slideshow works, but the embedded video player (YouTube) is not displayed - I will report a new issue. 

[Tested with:]
Browser / Version: Firefox Nightly 63.0a1 (2018-07-16)
Operating System: Windows 10 Pro

Regarding the broken images:

[Prerequisites:]
    1. Tracking Protection Strict enabled.
[Steps to Reproduce:]
    1. Navigate to https://www.rebelmouse.com/wordpress-vip-alternative-2401656056.html.
    2. Scroll down the page and observe images from the article.
        
[Expected Behavior:]
Images are displayed.
 
[Actual Behavior:]
Images are not displayed.

[Note:]
    1. Not reproducible with Tracking Protection Basic.


Looking at the devtools console, here are the blocked resources:
The resource at “https://pi.pardot.com/pd.js” was blocked because tracking protection is enabled.[Learn More] wordpress-vip-alternative-2401656056.html 
The resource at “https://www.google-analytics.com/analytics.js” was blocked because tracking protection is enabled.[Learn More] wordpress-vip-alternative-2401656056.html 
The resource at “https://www.googletagmanager.com/gtm.js?id=GTM-PFFH6L” was blocked because tracking protection is enabled.[Learn More] wordpress-vip-alternative-2401656056.html 
The resource at “https://go.pardot.com/l/72532/2016-10-13/6kw15h” was blocked because tracking protection is enabled.[Learn More] wordpress-vip-alternative-2401656056.html 
The resource at “https://lh3.googleusercontent.com/IAZTm8K0ufhwMwWKn1yf-GgMfX5qB7Tw6w6KMw0j9xsJNtPL1RpllRZvNkcz7alrt86fHQkVwR-p3qxKQGjOQGkW66M2_p4GVlV7IQ8PvthCdpC0iPpeTM3hpwnOpe-wv-vDxh2A” was blocked because tracking protection is enabled.[Learn More] wordpress-vip-alternative-2401656056.html 
The resource at “https://lh4.googleusercontent.com/RaKlDYeH22eAp7KeBYz42MDWe2skdkRz0awejg3r1hUWgQCtQLWpB_1VZ3HuWuzVnG5k_QB4LEHMn01mznym5TAEt7Oz-HTBMNwKkD8pRXxhWOA3vJVbV9UpKVC2OoxFXIkqIQFz” was blocked because tracking protection is enabled.[Learn More] wordpress-vip-alternative-2401656056.html 
The resource at “https://lh5.googleusercontent.com/2lj9MHSWgN4bHDWD69zWdtVDbW77obmeSCfEvyOWA_QAWyHQbXzllJSCBuWnUe4MdeOeoUEiUQ6CYOd4C0LJXh5saey55xQ72rl0oVn5DS3psv4l9gz_0Pfwz5nZNzh-eces0upU” was blocked because tracking protection is enabled.[Learn More] wordpress-vip-alternative-2401656056.html 
The resource at “https://lh6.googleusercontent.com/K1PHH9OVEHv7q2xUp2oGjDujyqV5S6_C-QDbEk7SetetNCMjK19LQQvWgEnlbYcUccCpNEHF9nU0JZ7lb35O_EaWHG4AruWblaijQ0vCrqk0YaS3BbYZ6vR3cFsx1EHir1c3XfGG” was blocked because tracking protection is enabled.[Learn More] wordpress-vip-alternative-2401656056.html 
The resource at “https://connect.facebook.net/en_US/sdk.js” was blocked because tracking protection is enabled.[Learn More] wordpress-vip-alternative-2401656056.html 

So there were the following domains to test:
- pi.pardot.com
- go.pardot.com
- www.google-analytics.com
- www.googletagmanager.com
- lh3.googleusercontent.com
- lh4.googleusercontent.com
- lh5.googleusercontent.com
- lh6.googleusercontent.com
- connect.facebook.net

I opened the URL in a fresh browser profile (Firefox Nightly 63, uMatrix installed, normal mode) and loaded the page. The images are displayed.

I disabled the Spoof Referrer option in uMatrix and then blacklisted googleusercontent.com (including the related domains). In this case the images are not longer displayed.

The other resources (pi.pardot.com, go.pardot.com, www.google-analytics.com, www.googletagmanager.com, connect.facebook.net) didn't help. 

So in conclusion:
- googletagmanager.com is in the `Disconnect` category which is `Advertising` category [tp-ads]

Comment 3

[Oana Arbuzov [:oanaarbuzov]]

Attachment: uMatrixResultsImagesBroken.png

Added uMatrix results.

Comment 4

[Thomas Wisniewski [:twisniewski]]

I see the same images now in strict mode as I do in Chrome (I also don't see any galleries there which I can navigate with arrow icons).