1892803 - Redirected Yahoo Finance links cause Firefox to slow down (yimg script)

Status: NEW

(Core :: Networking, defect)

Description

[Chris]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0

Steps to reproduce:

1. Search for "<ticker symbol> stock quote yahoo", where <ticker symbol> is a valid stock ticker; e.g., "DEO stock quote yahoo" -- on Google, Bing, or DuckDuckGo
2. Click on a link that goes to finance.yahoo.com

I have tried these steps in a new Firefox profile, in a private window, and following an uninstall/reinstall of FF with deletion of the Program Files folder in between. Further information about the steps I've taken to remedy this problem are available here:
https://support.mozilla.org/en-US/questions/1445005
You can also find there some diagnostic information that I submitted through FF.

The following things also did not resolve the problem:

• Turning off Enhanced Tracking protection
• Using Troubleshoot mode
• Clearing cache and cookies

The following URLs are search engine links that cause FF to exhibit this behavior (using "DEO" as the ticker symbol -- although any other ticker symbol will generate similar URLs that cause the behavior):

Google search: https://www.google.com/url?sa=t&source=web&rct=j&opi=89978449&url=https://finance.yahoo.com/quote/DEO/&ved=2ahUKEwiZ-9y6zdaFAxXLF1kFHXNtDLIQFnoECB0QAQ&usg=AOvVaw0zvKHp1oKDKOeJESuePEqK

Bing search: https://www.bing.com/ck/a?!&&p=ac244f0140d3993aJmltdHM9MTcxMzc0NDAwMCZpZ3VpZD0yOWYxYTkwMy1hMjgxLTYxN2UtMWIxYS1iYTRlYTY4MTZmMjkmaW5zaWQ9NTE5OQ&ptn=3&ver=2&hsh=3&fclid=29f1a903-a281-617e-1b1a-ba4ea6816f29&psq=deo+stock+quote+yahoo&u=a1aHR0cHM6Ly9maW5hbmNlLnlhaG9vLmNvbS9xdW90ZS9ERU8&ntb=1

DuckDuckGo search: https://finance.yahoo.com/quote/DEO

It's especially interesting to note that the DuckDuckGo link seems to contain no extraneous information in the URL; nonetheless, clicking the URL from the search results page in FF reproduces the bug, while copying the URL and pasting it into a new FF tab does not.

Actual results:

On the resulting page, the graph representing the stock price over time will be blank except for a message that says "Loading chart for <ticker symbol>". That graph will never get populated.

Furthermore, Firefox functionality will be "broken"; for example, the "report a broken site" dialog will be unavailable (trying to submit the report does nothing); and right-clicking on the page will not bring up the right-click menu. Ctrl-shift-S does nothing, ctrl-reload results in a blank page, and the Web Console cannot be accessed (ctrl-shift-K does nothing; the Web Developer tools menu displays a black box).

Expected results:

The page should have been displayed with a populated graph, and the "report broken site" dialog should have been available; also, the Web Console should have been accessible.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::Privacy: Anti-Tracking' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[Adrian Florinescu [:aflorinescu]]

Reduced STR:

1. Open a new tab and load https://www.google.com/url?sa=t&source=web&url=https://finance.yahoo.com/quote/DEO and continue throught the redirect
2. If the chart is loaded, redo step 1
3. Wait a bit -> Browser is slowing down, script issues -> stop script
4. Check dev console.

Actual Result:

• Page is not responsive - report page won't work, devtools won't work
• Once script stopped, dev console lists:
  Script terminated by timeout at:
  r_C$Gav@https://s.yimg.com/uc/finance/cosaic/js/chartiq.3120ae4c09da7892a808.js:2:7830
  4603/n.F1g@https://s.yimg.com/uc/finance/cosaic/js/chartiq.3120ae4c09da7892a808.js:2:19334
  4603/Z/a/<@https://s.yimg.com/uc/finance/cosaic/js/chartiq.3120ae4c09da7892a808.js:2:260992
  a@https://s.yimg.com/uc/finance/cosaic/js/chartiq.3120ae4c09da7892a808.js:2:261373
  4603/Z/t.ChartEngine.prototype.createDataSet@https://s.yimg.com/uc/finance/cosaic/js/chartiq.3120ae4c09da7892a808.js:2:263885
  4603/M/t.ChartEngine.prototype.setTimeZone@https://s.yimg.com/uc/finance/cosaic/js/chartiq.3120ae4c09da7892a808.js:2:153316
  loadChart@https://s.yimg.com/uc/finance/cosaic/js/common-756fe656.bba6ef11f11f4183f8f7.js:2:6314

Expected Result:
Yahoo finance page loads the same regardless if the page was redirected or loaded directly.

Tentatively triaging this to newtworking, @Valentin, could you please take a look and advise/confirm if this is a CORS problem?