privacy.resistfingerprinting performance API spoofing breaks vimeo.com
Categories
(Core :: DOM: Security, defect, P2)
Tracking
()
People
(Reporter: ke5trel, Assigned: me)
References
(Blocks 1 open bug, Regression, )
Details
(Keywords: regression, Whiteboard: [fingerprinting][fp-triaged][sci-exclude][domsecurity-active])
Attachments
(1 file)
Console error:
> TypeError: t[0] is undefined; can't access its "startTime" property
Code responsible:
d=function() {
var e = window.performance;
if (!e)
return 0;
if (window.PerformanceNavigationTiming) {
var t = e.getEntriesByType("navigation");
return t[0].startTime;
}
return e.timing.navigationStart;
}
Comment 1•4 years ago
|
||
Oh, this should be easy; we shouldn't expose PerformanceNavigationTiming if we don't support it. We should also check Resource Timing.
Vimeo have fixed it at their end by adding an extra check:
> return t && t.length ? t[0].startTime : 0;
Updated•4 years ago
|
Comment 3•4 years ago
|
||
(In reply to Kestrel from comment #2) > Vimeo have fixed it at their end by adding an extra check: > > return t && t.length ? t[0].startTime : 0; Does this mean we can close this bug as resolved worksforme?
Comment 4•4 years ago
|
||
No, I think we should do what I specify in Comment 1 to be spec-compliant.
Comment 5•4 years ago
|
||
(In reply to Tom Ritter [:tjr] from comment #4) > No, I think we should do what I specify in Comment 1 to be spec-compliant. Thanks for clarification.
Updated•4 years ago
|
Updated•3 years ago
|
I've detected a new website that is broken by resistfingerprinting.
Is there an issue that centralizes all broken websites?
Or do we create one issue per website?
(In reply to monperrus from comment #6)
Is there an issue that centralizes all broken websites?
File and new bug and set the "Blocks" field to "fingerprinting-breakage" (Bug 1507517).
Updated•2 years ago
|
Comment 8•2 years ago
|
||
Hey Kestrel,
Tim and I are checking this issue. We couldn't see the console error in comment 0.
Please feel free to re-open it if you're still able the reproduce the problem.
I already verified that Vimeo fixed it at their end in Comment 2 but Comment 4 recommended leaving this bug open to address the underlying issue.
Comment 10•2 years ago
|
||
(In reply to Kestrel from comment #9)
I already verified that Vimeo fixed it at their end in Comment 2 but Comment 4 recommended leaving this bug open to address the underlying issue.
Sorry, I totally missed the previous comments.
Tim, could you take a look to see if we can do what Tom suggested in comment 1?
Updated•2 years ago
|
Updated•2 years ago
|
Assignee | ||
Comment 11•2 years ago
|
||
In RFP mode, we do not support PerformanceNavigationTiming
, so don't expose
it. In particular, window.PerformanceNavigationTiming
should return
undefined
.
Added a new method PerformanceNavigationTiming::Enabled
which when used with
the WebIDL Func
attribute allows us to toggle whether
window.PerformanceNavigationTiming
is exposed.
Created
dom/tests/mochitest/general/test_toggling_performance_navigation_timing.html
to test whether the toggling works.
Comment 12•2 years ago
|
||
Pushed by tritter@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/61463834bff6 Don't expose PerformanceNavigationTiming in RFP mode r=tjr,baku
Comment 13•2 years ago
|
||
bugherder |
Comment 14•2 years ago
|
||
browser_performanceAPI.js
"For reduceTimerPrecision, there should be 4 entries for performance.getEntries()"
// PerformanceNavigationTiming, PerformanceMark, PerformanceMark, PerformanceMeasure
Doesn't seem right?
Updated•2 years ago
|
Assignee | ||
Comment 15•2 years ago
|
||
(In reply to Simon Mainey from comment #14)
browser_performanceAPI.js
"For reduceTimerPrecision, there should be 4 entries for performance.getEntries()" // PerformanceNavigationTiming, PerformanceMark, PerformanceMark, PerformanceMeasure
Doesn't seem right?
That function is a little hard to read, it took me a while to figure out what it does. Here is what it does:
content.performance.clearMarks();
content.performance.clearMeasures();
content.performance.clearResourceTimings();
content.performance.mark("Test");
content.performance.mark("Test-End");
content.performance.measure("Test-Measure", "Test", "Test-End");
content.performance.getEntries()
In particular, if you don't do the clear, it does not work. :)
Updated•2 years ago
|
Updated•7 months ago
|
Description
•