886132 - Disqus comments system on CNN claims that Firefox is not supported

Status: RESOLVED DUPLICATE of bug 885433

(Tech Evangelism Graveyard :: English US, defect)

Description

[Alexander L. Slovesnik]

STR:
1) Open http://edition.cnn.com/2013/06/22/politics/nsa-leaks/index.html

Expected results:
Comments are shown as usual

Actual results:
Comments are shown in legacy mode with following comment:

Sorry, the browser you are using is not currently supported. Disqus actively supports the following browsers:

    Firefox
    Chrome
    Internet Explorer 8+
    Safari

This page is forcing your browser to use legacy mode, which is not compatible with Disqus. Please see our troubleshooting guide to get more information about this error.

I see a ton of warnings in Firefox error console like:

Warning: Content Security Policy: Directive inline style base restriction violated
Source: http://disqus.com/embed/comments/?f=cnn&t_i=%2F2013%2F06%2F23%2Fpolitics%2Fnsa-leaks%2Findex.html&t_u=http%3A%2F%2Fwww.cnn.com%2F2013%2F06%2F23%2Fpolitics%2Fnsa-leaks%2Findex.html&t_t=WikiLeaks%3A%20Snowden%20arrives%20in%20Moscow&t_e=WikiLeaks%3A%20Snowden%20arrives%20in%20Moscow&t_d=WikiLeaks%3A%20Snowden%20arrives%20in%20Moscow&t_c=207582&s_o=popular&disqus_version=1371773468#3

so probaly it caused some change in Content Security Policy, perhaps Bug 764937

Comment 1

[Alexander L. Slovesnik]

Same error on Disqus test page - http://newsbusters.org/here-test-disqus-page.html

Comment 2

[Alexander L. Slovesnik]

Actually on test page comments are shown twice - first in legacy mode, second in normal mode.

Comment 3

[Sid Stamm [:geekboy or :sstamm]]

I can't reproduce this in Nightly 24a1 on Mac OS X.  Are you using any add-ons that apply a content security policy (like UserCSP)?  What version of Firefox are you using, and on which platform?

Comment 4

[Alexander L. Slovesnik]

(In reply to Sid Stamm [:geekboy or :sstamm] from comment #3)
> I can't reproduce this in Nightly 24a1 on Mac OS X.  Are you using any
> add-ons that apply a content security policy (like UserCSP)?  What version
> of Firefox are you using, and on which platform?

I see it on Nightly 24a1 on 64-bit Linux with new Firefox profile - Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20130624 Firefox/24.0 ID:20130624031040 CSet: 76820c6dff7b
Also I've reproduced it on Nightly 24a1 on Windows XP - Mozilla/5.0 (Windows NT 5.1; rv:24.0) Gecko/20130624 Firefox/24.0
Some people on Mozillazine claim that they have seen it too - http://forums.mozillazine.org/viewtopic.php?p=12929261#p12929261

Comment 5

[[:Aleksej]]

I see it too: a warning and two sets of comments.  2013-06-24-03-10-40-mozilla-central-firefox-24.0a1.ru.linux-x86_64

Comment 6

[Sid Stamm [:geekboy or :sstamm]]

Are you using any add-ons?

Also, can you help me identify the content security policy (since I can't reproduce it myself)?  It will be sent as an HTTP header on one of the HTML documents.

Comment 7

[[:Aleksej]]

comment 5 is without any add-ons, with a "temporary profile" created with the external ProfileManager.

Comment 8

[Alexander L. Slovesnik]

(In reply to Sid Stamm [:geekboy or :sstamm] from comment #6)
> Are you using any add-ons?
No.

 
> Also, can you help me identify the content security policy (since I can't
> reproduce it myself)?  It will be sent as an HTTP header on one of the HTML
> documents.
Probably this header (taken from Firefox network console):
Vary:	Accept-Encoding
Surrogate-Control:	max-age=5
P3P:	CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Date:	Mon, 24 Jun 2013 18:09:49 GMT
Content-Type:	text/html; charset=utf-8
content-security-policy:	script-src 'unsafe-eval' 'self' *.disqus.com:* *.google-analytics.com:* *.scorecardresearch.com:*
Content-Length:	3297
Content-Encoding:	gzip
Connection:	close
Cache-Control:	no-cache, public, must-revalidate
Accept-Ranges:	bytes

Comment 9

[Alexander L. Slovesnik]

Attachment: Screenshot of error

I also can reproduce it on http://www.gossipcop.com/

Comment 10

[Ian Melven :imelven]

Reproduces for me on Nightly 24.0a1 (2013-06-23) on Windows 7. Does not reproduce for me on Aurora 23.0a2 (2013-06-24). Fresh profiles in both cases. I looked at the requests going to disqus.com but didn't actually see any CSP headers...

Comment 11

[Ian Melven :imelven]

Ah, good work finding the CSP header, Alexander, thanks ! 

What may be happening here is that Disqus isn't expecting the style blocking to be happening if they don't provide a style-src or default-src directive. That's bug 885433.

Comment 12

[Alexander L. Slovesnik]

Requesting for tracking Firefox 24 and 25. Disqus is very popular online discussion and commenting service for websites ( http://en.wikipedia.org/wiki/Disqus ) and it would be quite bad to leave it broken for users.
Disqus support claims that they support only Firefox release builds, but not nightly builds - https://twitter.com/disqushelp/status/349587272670248961

Comment 13

[Alexander L. Slovesnik]

FWIW this user ( https://twitter.com/disqushelp/status/349587272670248961 ) claims that he doesn't see any issues in Firefox Nightly on Mac. Sid hadn't seen any issues on Mac OS X too.
Perhaps this bug is Windows/Linux only.

Comment 14

[Anthony Ricaud (:rik)]

(In reply to Alexander L. Slovesnik from comment #13)
I can definitely reproduce on Mac.

Comment 15

[iamjayakumars]

Hi, I'm Using Firefox Nightly on Mac, But I'm facing the issues. 
I'm unable to comment using DIsqus.

System Info : MAC OS X 10.8.4

Comment 16

[iamjayakumars]

Attachment: MAC - Firefox Nightly

Comment 17

[bhavana bajaj [:bajaj]]

(In reply to Ian Melven :imelven from comment #11)
> Ah, good work finding the CSP header, Alexander, thanks ! 
> 
> What may be happening here is that Disqus isn't expecting the style blocking
> to be happening if they don't provide a style-src or default-src directive.
> That's bug 885433.

Hey Ian, is Bug 885433 going to be the right fix from our side to resolve the issue ?

Comment 18

[Ian Melven :imelven]

(In reply to bhavana bajaj [:bajaj] from comment #17)
> (In reply to Ian Melven :imelven from comment #11)
> > Ah, good work finding the CSP header, Alexander, thanks ! 
> > 
> > What may be happening here is that Disqus isn't expecting the style blocking
> > to be happening if they don't provide a style-src or default-src directive.
> > That's bug 885433.
> 
> Hey Ian, is Bug 885433 going to be the right fix from our side to resolve
> the issue ?

that's my impression right now based on Alexander's information in comment 8, but I haven't looked too deeply at what's going on. Btw, grobinson mentioned to me earlier today he's looking at bug 885433.

Comment 19

[Sid Stamm [:geekboy or :sstamm]]

Attachment: crappy hack

Yeah, looks like bug 885433 should fix this issue.  I whipped up a hacky fix that allows inline-styles by default but disallows them when style-src is present (without the unsafe-inline keyword).  Seems to fix the problem, but not sure it's the right way forward.  What do you think, garrett?

Comment 20

[iamjayakumars]

Hi, 
One of the Nightly Tester Mentioned Disqus works fine on 10.7.5 on all Firefox browsers even Nightly and Aurora"

Comment 21

[Edo Karabas]

Same error on www.geforce.com (example http://www.geforce.com/whats-new/articles/introducing-the-geforce-gtx-760#disqus_thread)
in Nightly 25.0a1 (2013-06-26), Windows 8 Pro

Comment 22

[Hubert Figuiere [:hub]]

I have the issues on Mac and Linux. all running the greatest and latest nightly.

Comment 23

[Ian Melven :imelven]

Garrett is working on a fix for 885433 that should take care of this based on Sid's experiment in comment 19, we had to divert briefly to fix bug 887974 which his work uncovered.

Comment 24

[Ian Melven :imelven]

In https://bugzilla.mozilla.org/show_bug.cgi?id=885433#c5 Garrett says his patch fixes the issue with Disqus so duping this to that.

Comment 25

[bhavana bajaj [:bajaj]]

Tracking the DUP here.