Canvasblocker: Direct images are not displayed

[Hurri04]

This addon seems to cause issues with direct links to images. When this addon is activated only a white page is displayed instead when the domain is loaded for the first time. Deactivating the addon and reloading the link makes the image show up correctly. Afterwards the addon can be re-enabled again without making the image disappear again (only lasts for the session though, restarting firefox breaks it again).

Firefox ESR 52.5.0
This happens in a new profile as well.

Steps to reproduce:

• Install the related FF Version
• Install the Addon
• Go to any website with images (e.g. Imgur.com)
• Rightclick on an image and select "View Image"

Result:

• A completely white page

Expected result:

• The image should be displayed centered over a dark grey background

I found this website where I learned that for Firefox ESR 52.x only version 3.8 works, as versions > 4.0 require at least Firefox 55.0.

[DaarkWel]

Yep. I created new profile, installed all my addons and made all my configurations and direct images work for some time. But after several restarts of Firefox they just stopped working. Replacing prefs.js from newly created "fresh" profile doesn't help. Disabling any addons but CB or uBlock doesn't help either.

[kkapsner]

Thanks for the input (the old issue #151 was hidden because the creator has some problems with github).

This issue is really weird. I'm not able to reproduce the problem and therefor do not know what I have to change to solve it.

@Hurri04: are you then using CB 3.8 or the latest version? Which OS are you on? Are you using 32-bit or 64-bit firefox? Is CB the only addon you installed? Or are you using uBlock as well?
@DaarkWel: so you say you only sometimes see the problem? And only if both CB and uBlock are installed?

PS: Regarding the mentioned website - the information there is outdated. The latest versions are working with Firefox 52.5.0 - I do my development tests also there.

[kkapsner]

Are there any setting changes to CB or uBlock you are doing? Or are you using the default settings?

[Hurri04]

Currently I'm using CB 3.8 and direct images are working correctly which is why I'd thought the information on that website seems to be right. The issue happens with 4.2 although I didnt test the versions in between yet.

I'm using Firefox 64bit on Windows 7.

I do use other addons, uBlock Origin is one of them. After I noticed the issue I used a "divide-and conquer" approach to narrow it down to CB.

The settings are pretty much default, yes.

[Hurri04]

To test this some more I just installed CB 4.1 which works as well.
CB 4.2 however does indeed not work.
Versions 4.0, 4.0.1 and 4.0.2 are marked as not compatible with my firefox version.

[DaarkWel]

so you say you only sometimes see the problem? And only if both CB and uBlock are installed?

Yes. When both installed and enabled.

I downgraded CB to version 4.1 — problem gone.

[kkapsner]

This is good information. Between 0.4.1 and 0.4.2 were only a few changes and I think I know which one could cause the problem.

Let's see if I find a solution to the problem - I have an idea...

[Hasshu]

Same issue here. Oddly enough, disabling uBlock Origin and Privacy Badger makes images appear again, so it may be a conflict of sorts.

Firefox ESR v52.5.0 (64-bit)
CanvasBlocker v0.4.2

[angela-d]

Also having the same issue. I use uBlock (v1.14.20) and Privacy Badger (2017.11.20), yet the issue persists.

Firefox ESR 52.5.0 (64-bit)
Canvas Blocker 0.4.2

[kkapsner]

Thanks for all the input. I created the beta of 0.4.3: https://github.com/kkapsner/CanvasBlocker/releases/tag/0.4.3-Beta.1
Please install it (you should disable the normal version before) and tell me if the problem is solved. I want this issue to be gone with 0.4.3!

[Hurri04]

This does not seem to fix it for me, the problem still persists when updating to this new version.
(I uninstalled the old version -> restarted firefox -> installed the new version -> restarted firefox -> tested -> still white pages instead of direct images)

[DaarkWel]

Nope, doesn't work for me either.

[kkapsner]

Thanks for checking. Do you get any errors in the browser console?
What is the output in the console if you switch the debugging level to verbose?

[kkapsner]

You are all using Windows 7 and Firefox 52.5.0 64-bit?

[Hasshu]

Alright, I have some peculiar observations to share: there's still no images under normal circumstances, but now it's enough to disable just the Privacy Badger to make them appear. What's more, images seem to work just fine with Privacy Badger v2017.9.12.1 and versions prior to it. Apparently, v2017.10.25 broke something.

[DaarkWel]

I'm using linux and Firefox 52.5.0 64bit
Console log with "verbose" level: https://pastebin.com/VJYctS7a

[Hurri04]

Here's a log from me: https://pastebin.com/j2czEMip

Newly observed behaviour (happens on 0.4.2 and 0.4.3):
While loading https://i.imgur.com/Zd4wU60.jpg from my bookmarks still results in the white page, going to https://imgur.com/gallery/IouVu and pressing Right Mouse Button -> View Image keeps the same content in the tab. The URL changes correctly and the navigation (previous page, next page) reflects this in that I can go back to the overview page which then reloads. But the content stays the same, I can scroll around the page, even the old context menu entries are still there. I can open links in the comments in a new tab by middle click but not in the same tab by left click. Also many javascript related things don't work anymore (e.g. folding/unfolding comments).

Could it maybe be that somewhere there's an object getting returned with a null value (or something similar) which should normally (when it's not null) replace the old content?

[kkapsner]

Thanks for the logs. They look the same for me where everything is working.
But I looked into the code of PrivacyBadger and they are not really stealthy... Run the following code with and without PrivacyBadgerHTMLCanvasElement.prototype.toDataURL.toString();
And I think this kind of code injection breaks in combination with CB.

This is also the reason why CB is for Firefox only. Chrome does not offer the API the securely inject such code.

I think we are getting closer to the problem. Can you please deactivate both PB and CB, activate PB first and then CB, check if the issue is still there and then do the same the other way round (activate CB first and then PB).

BTW: all that are having problems are using Privacy Badger?

[Hurri04]

I'm not using Privacy Badger. Could it be that uBlock Origin (since it was also mentioned earlier) does this as well?
Although with CB 0.4.1 everything works fine, so I'd asume something changed in CB instead uBO...

[kkapsner]

Could be - I will check their code.

[kkapsner]

The webExtension of it seems not to do this - which version of uBlock do you use?

[Hurri04]

uBlock Origin 1.14.20 which should be the up-to-date webExtension version.

[kkapsner]

That's weird... then I do not get why you are getting the "Error in XHR" log entry. Any other Addons? Does the problem disappear if you deactivate uBlock?

[DaarkWel]

I'm not using PrivacyBadger. I just installed uBlock 1.14.21b0 webext — just to be sure. Still the same. With enabled CB beta and enabled uB — no images. With disabled any one of them — there is images. Logs for HTMLCanvasElement.prototype.toDataURL.toString(); are identical:
HTMLCanvasElement.prototype.toDataURL.toString(); "function toDataURL() { [native code] }"

[kkapsner]

Any special settings for uBlock? Or just plain default ones?
Same question for CB.

[DaarkWel]

Default settings for CB, except for recently turned on expert mode to see verbose logs. In uBlock there was some custom settings (custom rules, some additional third party filters, "advanced user" mode on), but I just reset all settings to "factory defaults", restarted Firefox and nothing changed.

[kkapsner]

Your log shows that something is using the canvas API when the image is shown (otherwise the "Error in XHR" entry would not show up - and it does not when I use uBlock.
Can you please try with a new Firefox profile and only these two addons installed?

Sorry I have to bombard you with these tasks - but I did not see the problem once. If I would have a reliable reproduction scenario I could do all this stuff for myself...

[Thorin-Oakenpants]

There have been a ton of issues with mixing some legacy extensions and web extensions - such as uBlock Origin, uMatrix, Greasemonkey/Violentmonkey (run at document start was f*d), Privacy Badger and so on

One of the most common symptoms that I know of was direct images failing to show. OP is running ESR - use the legacy version of CB

[kkapsner]

I'm not sure if I would suggest version 0.3.8... the newer version also fixes some bugs that were already there:

• unnecessary check for context type in getImageData broke websites
• getContext was not asked in ask mode.
• ask mode did not work for input types
• allow page scripts to overwrite the faked functions
• getImageData also faked when using fakeInput mode

But this is a good question at the people with problems: do you have any legacy addon installed?

[DaarkWel]

do you have any legacy addon installed?

Sure, that's why I'm using ESR version of Firefox. I'll try to locate troublesome addon.

[DaarkWel]

I guess I found it. It's Random Agent Spoofer — https://github.com/dillbyrne/random-agent-spoofer and I'm using fixed version.

Steps to (maybe) reproduce on new profile:

• Install CB (https://github.com/kkapsner/CanvasBlocker/releases/tag/0.4.3-Beta.1)
• Install uBlock (https://github.com/gorhill/uBlock/releases/download/1.14.21b0/uBlock0.webext.xpi)
• Install RAS (https://github.com/dillbyrne/random-agent-spoofer/files/1376895/random_agent_spoofer-0.9.5.7-fx.zip rename to .xpi)

Here appears "Error in XHR: DOMException [NetworkError: "A network error occurred." in console but images still loads and shows. But after some time they stop loading, don't know when exactly. I tried this three addons on three new profiles, on first I restart Firefox after installing RAS and images gone; on second I just disabled and enabled CB — images gone; third profile still works.

[Hurri04]

Here's a list of the addons I'm using: https://i.imgur.com/gC254Rf.png
Are there maybe any intersections with the addons you (the others who have this problem) are using?

[Thorin-Oakenpants]

The good news is come ESR59 you won't have any legacy issues :)

[Hasshu]

Today I finally decided to pull the trigger by installing Firefox Quantum, and... the issue is no more. Running CanvasBlocker v0.4.2 alongside the latest versions of Privacy Badger (v2017.11.20) and uBlock Origin (v1.14.20) with no problems so far.

[DaarkWel]

Are there maybe any intersections with the addons you (the others who have this problem) are using?

I'm using (from that list) CB obviously, uBlock, Google Redirects Fixer, HTTPS Everywhere and NoScript. But disabling any of them except CB and uBlock doesn't fix it.

[angela-d]

@kkapsner No Windows, Debian Stretch on ESR 52.5.0 (64-bit)
Here are my add ons: https://imgur.com/a/SOUu1

After reading DaarkWel's post, I disabled Random Agent Spoofer and uBlock separately, yet images still did not load (using the Beta extension)

I seen Hurri04 is also using Status 4 Evar, so I disabled that - restarted and still no images.

Also noticed: say I open an imgur link, then right click -> view image, I can see the direct image fine. So once it's cached, the direct image works.

[kkapsner]

@DaarkWel: not quite a surprise that RAS can conflict with CB... they use old code from CB: https://github.com/dillbyrne/random-agent-spoofer/blob/master/lib/modifiedAPIs/canvas.js
They always fake the canvas - so I'm not sure if it makes any sense to install both RAS and CB.
@Hurri04: which ones are legacy?
@Hasshu: I also did the cut and still miss two addons... but I already have an idea how to build them myself.

[DaarkWel]

not quite a surprise that RAS can conflict with CB... they use old code from CB

Wow. Didn't know that. But I guess RAS has an option to disable it, "Canvas support", which I used (actually, I tried with and without that option, no difference). And CB version 0.4.1 works with RAS and has no "Error in XHR: DOMException" in web console.

[Hurri04]

Pretty much all except 4-5 are legacy I think. Not sure where to look up which ones specifically though, since Firefox ESR 52.5.0 does not show the "legacy" icon next to the addon names.

The reason I switched to ESR in the first place was to be able to use these legacy addons a bit longer (since many have not been ported to webextensions yet/have webextension replacements) while also getting security updates.

[potassiumchloride]

I would like to join the discussion in this bug report here because I struggle with the same problem after the update of CB from 0.4.1 to 0.4.2 on my systems (all are Firefox 52.5.0 ESR on Debian and Win7). First of all, I have read all comments in this issue report and as you can see I have a similar list of mixed legacy and webext addons:

• Add-on Compatibility Reporter 2.2.4
• Add-on Update Checker 2.15
• Bookmarks Organizer 1.3.0
• Calomel SSL Validation 0.82
• CanvasBlocker 0.4.1
• Certificate Patrol 2.0.16
• Classic Theme Restorer 1.7.3.4
• ColorfulTabs 31.2.3
• Cookie Monster 1.3.4.8
• Copy As Plain Text 2.1.0
• Decentraleyes 1.3.10
• Download Status Bar 15.0.0.1
• Extension List Dumper 2 1.0.2
• Firebug 2.0.19
• Flagfox 5.2.3
• Google search link fix 1.6.5
• HTTPS Everywhere 2017.12.6
• Linkificator 2.3.2
• No Resource URI Leak 1.1.0
• NoScript 5.1.8.1
• Random Agent Spoofer 0.9.5.6
• RefControl 0.8.17.1-signed.1-signed
• RequestPolicy Continued 1.0.beta13.2
• Session Manager 0.8.1.13
• Smart HTTPS 0.2.2
• Tab Mix Plus 0.5.0.4
• uBlock Origin 1.14.20
• Video DownloadHelper 6.3.3
• Web Developer 2.0.1
• Xmarks 4.4.1

Apparently, I'm also using uBO and RAS ("disable canvas support" is not activated in that add-on!). And in common with the other people, downgrading CB from 0.4.2 to 0.4.1 solves the "image issue" for me. I also tried the suggestions mentioned already (such as disabling uBO or RAS) but this didn't change anything. I would like to offer my help in solving this problem, too. If there is any further information which I can provide or test anything please let me know.

[I just run ESR because some essential add-ons are not available for FF > 57 yet, or they are in a very disastrous state (such as Xmarks).]

[kkapsner]

There is a new Beta: https://github.com/kkapsner/CanvasBlocker/releases/tag/0.4.3-Beta.2
In this version a feature is disabled that I think causes the problem. BUT I can not disable it for the release because it is required sometimes for CB to work properly (#147 - the main reason for 0.4.2...).

[potassiumchloride]

I just replaced the 0.4.1 with the new 0.4.3RC2 and after brief testing by calling an image (previously mentioned here before: https://i.imgur.com/Zd4wU60.jpg) I can confirm that this beta version solves the image problem! Hope this fix can make it into your final release somehow, though.

[kkapsner]

@potassiumchloride: unfortunatelly not. This "fix" will reopen #147, which is worse than the not working images. But at least I know now where the problem is - still no clue how to solve it...

[DaarkWel]

0.4.3RC2 works for me.

This "fix" will reopen #147

That's sucks. I hope it can somehow be fixed.

[kkapsner]

That's exactly the point I'm currently trying to wrap my head around... currently I do not see a way.

[kkapsner]

I have a new beta: https://github.com/kkapsner/CanvasBlocker/releases/tag/0.4.3-Beta.3
It does not reopen #147 but may break websites (if the settings are not loaded and the page tries to use the API it will just fall back to blocking everything) - let's see if any complains roll in (the malwarebytes pages is the only URL I saw with that problem. I could not produce a test page for myself).

Please test thoroughly.

PS: The complete problem will be gone in Firefox 59 because the there a new API will be present which allows me to load the settings synchronously.

[potassiumchloride]

Thanks for your continous effort on finding a solution for this problem! I installed your latest 0.4.3-Beta.3 on a couple of machines (Firefox ESR 52.5.0 on Debian, Firefox ESR 52.5.2 and Firefox 57.0.2 Portable on Windows 7, all 64bit) and I'm testing it now. I noticed that 0.4.3-Beta.3 gives me

Api blocked on XXX because CanvasBlocker-settings were not loaded in time

on a certain web page (XXX is the internal login page of the IT service center of a large German university) which does not occur with CB 0.4.2. I'll let you know if I find more issues.

_Update:_ Actually, this message about the blocked API appears on a number of web sites such as https://www.amazon.de/.

[kkapsner]

Did the page break because of this?
If you tell me the URL (you can use the mail address from the addon) I can have a look on it.

[potassiumchloride]

As far as I can say the page works (since I could successfully log in there). Additionally, the amazon page seems to work with 0.4.3-Beta.3 and Firefox ESR, too, although the same api-blocking notification is shown.

[Hasshu]

I also did the cut and still miss two addons... but I already have an idea how to build them myself.

@kkapsner If you'll pardon the off-topic comment, what are the add-ons in question?

[kkapsner]

I think I will include a version switch. This API blocking can break pages (#153) and therefore I will only do this in ESR. FF 57 will do the "XHR"-stuff and FF 59 finally has the API that solves the issue in a good way.

PS: I finally managed to create a test to trigger the "Api blocked on XXX because CanvasBlocker-settings were not loaded in time": 67438d15ffc7a2b02f0e084ac3ac996c11330a61
And that said: Canvas Defender leaks the canvas fingerprint on it...

@Hasshu: They are "It's All Text!" and "Feed Sidebar". The later is simple to implement with a WebExtension but the first one is tough.

[kkapsner]

Just to be sure: none of you saw the direct image problem in Firefox 57? Only on Firefox ESR 52?

[potassiumchloride]

Yes, I can confirm that with 0.4.3-Beta.3 both on Firefox ESR 52 (regularly installed) and Firefox 57 (portable version) the image problem is gone. With ESR 52 (but not with 57!) I still receive all these messages "Api blocked on XXX because CanvasBlocker-settings were not loaded in time" (e.g. when calling the imgur links mentioned in this issue thread), but direct images are loaded. Thanks for planning to maintain even two different versions for ESR and >57! I know, it's just a temporary situation. I really hope that other important legacy add-ons will catch up with recent Firefox versions as more APIs will hopefully become available then. So we don't have to rely on ESR as regular users.

[substanceof]

Can confirm direct image problem on FF57 on Android with CB 0.4.2
I'm using the same version of FF on pc (linux) with same set of extensions (CB, uBlock, uMatrix, Cookie AutoDelete), but problem with images appears only on android.
Also, i noticed that if image already on browser cache - it shows normally, i.e. just 'view image' will work ok but opening a *.jpg link will show a blank page.

[Hurri04]

I can also confirm that 0.4.3-Beta.3 seems to work. So far I haven't had any problems.

[substanceof]

Tested 0.4.3-Beta.3 on Android FF 57: direct images works ok in all cases

[kkapsner]

Then it's settled: two versions not one... sigh
One for Firefox >= 52 and < 59 (fixes this issue but may break some web pages: #153 - called version A) and one for >= 52 (does not fix this issue - called version B). The question is: which one should have the higher version number - i.e. the user of the other would have to turn off the automatic updates.

[potassiumchloride]

Good question. :-) Well, comfort (i. e. comparatively less significant image loading here in #160) versus privacy (#153). I guess for us CB users the latter is more important than the former, and hence, I vote for option B (which ensures privacy and doesn't break web pages) to receive the priority and get higher version numbers for automatic updates (although it is against my current needs as I'm restricted to Firefox 52 ESR at the moment). I really appreciate your efforts that you are willing to support two versions and take care of us (few?) ESR users! Many thanks! I really hope that this damn add-on/webext disaster, since FF57 was released, will be over soon.

[kkapsner]

Privacy is not an issue in any case. But the API blocking can render web pages completely broken without any way for the user to fix it unless disabling CB - so maybe you are right... in the consequence it affects privacy.

[kkapsner]

Both releases are out:
https://github.com/kkapsner/CanvasBlocker/releases/tag/0.4.3a-Release
https://github.com/kkapsner/CanvasBlocker/releases/tag/0.4.3b-Release

@Hurri04: you may consider updating your addon rating.

[Hurri04]

Done.
One small suggestion: Maybe add a note in the descriptions mentioning which one is for ESR to make it clearer for other users.

[kkapsner]

Also done on AMO ;)

[potassiumchloride]

Great, many thanks for investigating and solving this issue! I also dropped a rating for CB at AMO.

[Hasshu]

They are "It's All Text!" and "Feed Sidebar". The later is simple to implement with a WebExtension but the first one is tough.

@kkapsner I see. And keep up the good work!

[kkapsner]

I'll do my very best ;)

[kkapsner]

Can you please check if 0.4.4 still has the same direct image problem?
If it does not work I will create a version for you guys.

[DaarkWel]

Yes, same problem is back with 0.4.4. Version for us retrogrades would be nice :-)

[potassiumchloride]

Yes, a classic "me, too"! :-) I tested 0.4.4 on Firefox Portable 57.0.2 where it works, but on my regular installation Firefox ESR 52.5.2 the new version 0.4.4 brings back "the old image problem" because direct images are not displaced. It would be kind if you do a version split again for us ESR users (and announce it on AMO). Thanks a lot for remembering us and taking care of us ESR grandpas. ;-)

UPDATE: Just now I installed your split release 0.4.4a from AMO on my Firefox ESR and images are loading fine again!

[kkapsner]

0.4.4a and 0.4.4b are out and announcement on AMO is updated.

... and ... you're welcome.

PS: It's just the process of publishing the release that is doubled. The adjustments in the code are minimal (you can look at the commit 637665bd6e42fb21a52a6cfc3609a90f2141a82f)