1511941 - privacy.resistfingerprinting performance API spoofing breaks vimeo.com

Status: RESOLVED FIXED

(Core :: DOM: Security, defect, P2)

Description

[Kestrel]

Console error:
> TypeError: t[0] is undefined; can't access its "startTime" property

Code responsible:

d=function() {
  var e = window.performance;
  if (!e)
    return 0;
  if (window.PerformanceNavigationTiming) {
    var t = e.getEntriesByType("navigation");
    return t[0].startTime;
  }
  return e.timing.navigationStart;
}

Comment 1

[Tom Ritter [:tjr] (ni? for response to sec-[advisories/bounties/ratings/cves])]

Oh, this should be easy; we shouldn't expose PerformanceNavigationTiming if we don't support it. We should also check Resource Timing.

Comment 2

[Kestrel]

Vimeo have fixed it at their end by adding an extra check:

> return t && t.length ? t[0].startTime : 0;

Comment 3

[Ethan Tseng [:ethan]]

(In reply to Kestrel from comment #2)
> Vimeo have fixed it at their end by adding an extra check: 
> > return t && t.length ? t[0].startTime : 0;

Does this mean we can close this bug as resolved worksforme?

Comment 4

[Tom Ritter [:tjr] (ni? for response to sec-[advisories/bounties/ratings/cves])]

No, I think we should do what I specify in Comment 1 to be spec-compliant.

Comment 5

[Ethan Tseng [:ethan]]

(In reply to Tom Ritter [:tjr] from comment #4)
> No, I think we should do what I specify in Comment 1 to be spec-compliant.

Thanks for clarification.

Comment 6

[monperrus]

I've detected a new website that is broken by resistfingerprinting.

Is there an issue that centralizes all broken websites?

Or do we create one issue per website?

Comment 7

[Kestrel]

(In reply to monperrus from comment #6)

Is there an issue that centralizes all broken websites?

File and new bug and set the "Blocks" field to "fingerprinting-breakage" (Bug 1507517).

Comment 8

[Ethan Tseng [:ethan]]

Hey Kestrel,
Tim and I are checking this issue. We couldn't see the console error in comment 0.
Please feel free to re-open it if you're still able the reproduce the problem.

Comment 9

[Kestrel]

I already verified that Vimeo fixed it at their end in Comment 2 but Comment 4 recommended leaving this bug open to address the underlying issue.

Comment 10

[Ethan Tseng [:ethan]]

(In reply to Kestrel from comment #9)

I already verified that Vimeo fixed it at their end in Comment 2 but Comment 4 recommended leaving this bug open to address the underlying issue.

Sorry, I totally missed the previous comments.
Tim, could you take a look to see if we can do what Tom suggested in comment 1?

Comment 11

[sanketh]

Attachment: Bug 1511941 - Don't expose PerformanceNavigationTiming in RFP mode r?tjr

In RFP mode, we do not support PerformanceNavigationTiming, so don't expose
it. In particular, window.PerformanceNavigationTiming should return
undefined.

Added a new method PerformanceNavigationTiming::Enabled which when used with
the WebIDL Func attribute allows us to toggle whether
window.PerformanceNavigationTiming is exposed.

Created
dom/tests/mochitest/general/test_toggling_performance_navigation_timing.html
to test whether the toggling works.

Comment 12

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/61463834bff6
Don't expose PerformanceNavigationTiming in RFP mode r=tjr,baku

Comment 13

[Natalia Csoregi [:nataliaCs]]

https://hg.mozilla.org/mozilla-central/rev/61463834bff6

Comment 14

[Simon Mainey]

browser_performanceAPI.js

      "For reduceTimerPrecision, there should be 4 entries for performance.getEntries()"
      // PerformanceNavigationTiming, PerformanceMark, PerformanceMark, PerformanceMeasure

Doesn't seem right?

Comment 15

[sanketh]

(In reply to Simon Mainey from comment #14)

browser_performanceAPI.js

      "For reduceTimerPrecision, there should be 4 entries for performance.getEntries()"
      // PerformanceNavigationTiming, PerformanceMark, PerformanceMark, PerformanceMeasure

Doesn't seem right?

That function is a little hard to read, it took me a while to figure out what it does. Here is what it does:

    content.performance.clearMarks();
    content.performance.clearMeasures();
    content.performance.clearResourceTimings();
    content.performance.mark("Test");
    content.performance.mark("Test-End");
    content.performance.measure("Test-Measure", "Test", "Test-End");
    content.performance.getEntries()

In particular, if you don't do the clear, it does not work. :)