1487654 - Photos are not displayed on www.recalbox.com with Basic Tracking Protection ON

Status: RESOLVED WORKSFORME

(Core :: Privacy: Anti-Tracking, defect, P3)

Description

[Sergiu Logigan [:sergiu]]

Environment:
Operating system: Windows 10 Pro
Firefox version: Firefox Nightly 63.0a1 (2018-08-30) (64-bit)

Prerequisites:
Enable Basic Tracking Protection

Steps to reproduce:
1. Navigate to: https://www.recalbox.com/shop#
2. Observe the photo carousel.

Expected Behavior:
The photos are displayed.

Actual Behavior:
The photos are not displayed.

Notes:
1. Screenshot attached: http://prntscr.com/kp1771

Comment 1

[Sergiu Logigan [:sergiu]]

This is related to `tpimages` breakage #1101005

Looking at the devtools console, here are the blocked resources:

The resource at “https://connect.facebook.net/en_US/fbevents.js” was blocked because content blocking is enabled.[Learn More] shop
The resource at “https://www.google-analytics.com/analytics.js” was blocked because content blocking is enabled.[Learn More] shop
The resource at “https://wms-na.amazon-adsystem.com/panda/20070822/US/img/prime.png” was blocked because content blocking is enabled.[Learn More] shop
The resource at “https://ws-na.amazon-adsystem.com/widgets/q?_encoding=UTF8&Format=_SX522_&ID=AsinImage&MarketPlace=US&ServiceVersion=20070822&WS=1&ASIN=B01CULJVXI” was blocked because content blocking is enabled.[Learn More] shop

So these are the domains to test:
connect.facebook.net
www.google-analytics.com
wms-na.amazon-adsystem.com
ws-na.amazon-adsystem.com

I opened the URL in a fresh browser profile (Firefox Nightly 63, uMatrix installed, normal mode) and loaded the page. The photos did not load.

I disabled the Spoof Referrer option in uMatrix and then *WHITELISTED*:
amazon-adsystem.com 
bootstrapcdn.com
ssl-images-amazon.com

After this, the videos were displayed.
The other resources didn't help.

http://prntscr.com/kp182x

amazon-adsystem.com can be found in the disconnect-blacklist.json and disconnect-entitylist.json.
bootstrapcdn.com can not be found in any of the lists.
ssl-images-amazon.com can be found in the disconnect-blacklist.json, disconnect-entitylist.json and disconnect_mapping.py.

So in conclusion:
amazon-adsystem.com - Advertising = [tp-ads]
ssl-images-amazon.com - Content [tp-content]

Comment 2

[Thomas Wisniewski [:twisniewski]]

The images all link to the landing https://ws-na.amazon-adsystem.com/widgets/q, so it seems that our only option would be to yellow-list that endpoint.

Comment 3

[Oana Arbuzov [:oanaarbuzov]]

The issue is no longer reproducible with ETP - Standard, carousel images load now.
https://prnt.sc/x813r3

Note: The issue still occurs with ETP - Strict.

Tested with:
Browser / Version: Firefox Nightly 86.0a1 (2021-01-18)
Operating System: Windows 10 Pro

Comment 4

[Thomas Wisniewski [:twisniewski]]

https://www.recalbox.com/shop gives me a 404 page now, and their new shop link doesn't seem to have missing images.