1481386 - Basic Tracking Protection breaks https://www.home.neustar/

Status: RESOLVED FIXED

(Web Compatibility :: Site Reports, defect, P3)

Description

[Sergiu Logigan [:sergiu]]

Attachment: Screenshot_1.png

Environment:
Operating system: Windows 10 Pro
Firefox version: Firefox Nightly 63.0a1 (2018-08-06) (64-bit)

Prerequisites:
Enable Basic Tracking Protection

Steps to reproduce:
1. Navigate to: https://www.home.neustar/
2. Observe the way the website is displayed.

Expected Behavior:
The website is correctly displayed.

Actual Behavior:
The website is not correctly displayed.

Notes:
1. Screenshot attached.

Comment 1

[Sergiu Logigan [:sergiu]]

This is related to `trackingprotection` breakage #1101005

Looking at the devtools console, here are the blocked resources:

The resource at “https://ns-cdn.neustar.biz/creative_services/biz/neustar/www/base/img/2017/icon-youtube.png” was blocked because tracking protection is enabled.[Learn More] www.home.neustar
The resource at “https://app-ab24.marketo.com/js/forms2/js/forms2.min.js” was blocked because tracking protection is enabled.[Learn More] www.home.neustar
The resource at “https://www.googletagmanager.com/gtm.js?id=GTM-DG2P” was blocked because tracking protection is enabled.[Learn More] www.home.neustar
The resource at “https://rum-collector.wpm.neustar.biz/beacon?u=https%3A%2F%2Fwww.home.neustar%2F%3F_ptc%3D3&mid=036A970FE9904A259303F3DCD5F032B5&tz=-180&rt.start=navigation&t_done=3102&t_page=2532&r=https%3A%2F%2Fwww.home.neustar%2F&res_data=%5B%5Bfavicon.ico%2Cwww.home.neustar%2C1883%2C1124%5D%2C%5Btl813.js%2C1.tl813.com%2C472%2C2039%5D%2C%5Bbase%2Fcss%2Ftools.css%2Cwww.home.neustar%2C456%2C588%5D%2C%5Bprivacy-seal%2Fseal%2Cprivacy-policy.truste.com%2C405%2C1081%5D%2C%5D&res_outlier_cnt=4&res_median=0&res_domain_cnt=11&res_cnt=66&nt_redirectCount=0&nt_navigationType=1&nt_redirectTime=0&nt_dnsTime=0&nt_connectTime=197&nt_firstPacket=570&nt_domReady=2240&nt_pageDone=3100&nt_sslTime=87&error_count=10&errors=%5B%5B%22%3F_ptc%3D3%22%2C%2278%22%2C%22ReferenceError%3A%20%24%20is%20not%20defined%22%5D%2C%5B%22%3F_ptc%3D3%22%2C%22278%22%2C%22ReferenceError%3A%20%24%20is%20not%20defined%22%5D%2C%5B%22%3F_ptc%3D3%22%2C%22338%22%2C%22ReferenceError%3A%20%24%20is%20not%20defined%22%5D%2C%5B%22%3F_ptc%3D3%22%2C%22703%22%2C%22ReferenceError%3A%20%24%20is%20not%20defined%22%5D%2C%5B%22%3F_ptc%3D3%22%2C%221194%22%2C%22ReferenceError%3A%20%24%20is%20not%20defined%22%5D%2C%5D&pl_offset=1008” was blocked because tracking protection is enabled.[Learn More] www.home.neustar 

So these are the domains to test:
ns-cdn.neustar.biz
app-ab24.marketo.com
www.googletagmanager.com
rum-collector.wpm.neustar.biz

I opened the URL in a fresh browser profile (Firefox Nightly 63, uMatrix installed, normal mode) and loaded the page. The page did NOT load correctly.

I disabled the Spoof Referrer option in uMatrix and then *WHITELISTED*:

all the scripts (in order to load the page)
ns-cdn.neustar.biz

After this, the webpage was correctly loaded.
The other resources didn't help.

http://prntscr.com/kfmih6

ns-cdn.neustar.biz can be found in the disconnect-blacklist.json and disconnect-entitylist.json.

So in conclusion:

neustar.biz - Advertising = [tp-ads]

Comment 3

[Thomas Wisniewski [:twisniewski]]

It looks like unblocking just https://ns-cdn.neustar.biz/biz/neustar/base/js/_min/ns2019_jq_min.js (but leaving the others blocked) lets the site work.

That script seems to only contain jQuery 1.7.2 and other plugins/libraries. Replacing it with just a clean copy of jQuery 1.7.2 gets most of the site working, but it clearly relies on some more plugins/libraries to fully load. So if we can verify it's acceptable then unblocking it would be the way to go (or at least creating a custom replacement with just the plugins/libraries we confirm it needs, if we want to go that route).

They may also be using Marketo forms (see 1476572), as I see console errors related to that, but leaving it blocked doesn't seem to actually break anything on the main page at least.

Comment 4

[Steven Englehardt [:englehardt]]

This can be fixed by the entity list, since we shouldn't be blocking neustar's subresources on their own homepage. I filed https://github.com/disconnectme/disconnect-tracking-protection/issues/172 with Disconnect.

Comment 5

[Steven Englehardt [:englehardt]]

This was fixed by https://github.com/mozilla-services/shavar-prod-lists/pull/187. The page now loads as expected.