1475929 - The design of the page store.vmware.com is broken with Tracking Protection Basic

Status: RESOLVED WORKSFORME

(Web Compatibility :: Privacy: Site Reports, defect, P3)

Description

[Oana Arbuzov [:oanaarbuzov]]

[Environment:]
Browser / Version: Firefox Nightly 63.0a1 (2018-07-15)
Operating System: Windows 10 Pro

[Steps to Reproduce:]
    1. Navigate to https://store.vmware.com/store/vmwaus/en_AU/home 
    2. Observe the page.
        
[Expected Behavior:]
The page is correctly displayed.
 
[Actual Behavior:]
The design of the page is broken (css/images). 

[Note:]
    1. Reproducible also with Tracking Protection strict.

Comment 1

[Oana Arbuzov [:oanaarbuzov]]

Looking at the devtools console, here are the blocked resources:
The resource at “https://drh.img.digitalriver.com/DRHM/Storefront/Site/vmware/cm/multimedia/css/styles.css” was blocked because tracking protection is enabled.[Learn More] home
The resource at “https://drh2.img.digitalriver.com/DRHM/Storefront/Site/vmwaus/images/promo/VMW_AU_Launch_Bann_Workstation14Player_Store_HeroBanner_Q3_2017_1131x264_2.jpg” was blocked because tracking protection is enabled.[Learn More] home
The resource at “https://drh1.img.digitalriver.com/DRHM/Storefront/Site/vmwaus/images/promo/VMW_Boxshot_Fusion_10_Pro_L_180x180.png” was blocked because tracking protection is enabled.[Learn More] home
The resource at “https://s7.addthis.com/js/300/addthis_widget.js#pubid=vmwAddThis” was blocked because tracking protection is enabled.[Learn More] home
The resource at “https://cdn.tt.omtrdc.net/cdn/target.js” was blocked because tracking protection is enabled.[Learn More] home
The resource at “https://www.google-analytics.com/analytics.js” was blocked because tracking protection is enabled.[Learn More] home
The resource at “https://www.upsellit.com/launch/vmware.jsp” was blocked because tracking protection is enabled.[Learn More] home
The resource at “https://static.hotjar.com/c/hotjar-216475.js?sv=5” was blocked because tracking protection is enabled.[Learn More] home
The resource at “https://connect.facebook.net/en_US/fbevents.js” was blocked because tracking protection is enabled.[Learn More] home
The resource at “https://www.googleadservices.com/pagead/conversion_async.js” was blocked because tracking protection is enabled.[Learn More] home
The resource at “https://s279193683.t.eloqua.com/visitor/v200/svrGP?pps=3&siteid=279193683&ref2=elqNone&tzo=-120&ms=477&optin=disabled” was blocked because tracking protection is enabled.[Learn More] home

So there were domains to test:
- drh.img.digitalriver.com
- drh2.img.digitalriver.com
- drh1.img.digitalriver.com
- s7.addthis.com
- cdn.tt.omtrdc.net
- vmware.tt.omtrdc.net
- www.google-analytics.com
- www.upsellit.com
- static.hotjar.com
- connect.facebook.net
- www.googleadservices.com
- s279193683.t.eloqua.com

I opened the URL in a fresh browser profile (Firefox Nightly 63, uMatrix installed, normal mode) and loaded the page. The page is loaded correctly.

I disabled the Spoof Referrer option in uMatrix and then blacklisted digitalriver.com (including drh.img.digitalriver.com
, drh2.img.digitalriver.com, drh1.img.digitalriver.com). In this case the page is design becomes broken.

The other resources didn't help. 

So in conclusion:
- digitalriver.com is in the `Advertising` category [tp-ads]

Comment 2

[Oana Arbuzov [:oanaarbuzov]]

Attachment: uMatrixReults.png

Added uMatrix results.

Comment 4

[Thomas Wisniewski [:twisniewski]]

This page seems to work fine now in strict mode.