Privacybadger: broken navigation on FF 54 with synchronous ajax calls on unload

[adimascio]

With firefox 54, there seems to be a conflict between synchronous
ajax queries performed on window.unload and Privacy Badger. When
the user clicks on a link, the url changes in the URL navigation bar
but the page content doesn't update. The user has to reload the page
manually.

Although synchronous ajax queries are a very bad idea, and hooking
on unload event is probably bad too, it happens to break navigation
on some websites (e.g. https://www.logilab.org/).

NOTE: This is specific to firefox

This bug was observed in the following environment:

• Privacy Badger version: 2017.6.13.1
• Firefox version: 54.0 (64 bits)
• Debian package version: 54.0-1
• Debian Version: Stretch

Steps to reproduce the bug (using a minimal test website):
$ git clone https://github.com/adimascio/testff.git $ cd testff $ npm install $ node index.js

Now, open your browser on http://locahost:3000 and try to follow page1 and page2 links.

I'm willing to provide a PR but I'll need some help to know where to start digging in Privacy Badger code base.

[ghostwords]

Sounds related to https://github.com/EFForg/privacybadger/issues/1357#issuecomment-298348827, https://github.com/EFForg/privacybadger/issues/1295, https://github.com/EFForg/privacybadger/issues/1266.

[cowlicks]

Where on the logilab site were you navigating when you saw this? I was not able to reproduce this there.

Same PB version, same FF version. But I'm on Archlinux.

[cowlicks]

I think issues like this are a good use case for https://github.com/EFForg/privacybadger/pull/1221

[adimascio]

@ghostwords this seems very similar indeed

[adimascio]

@cowlicks after I disabled all extensions but PrivacyBadger, I can't navigate on any page of logilab.org without reloading the page after a click on a link.

I might not have been clear in the issue description but the small github repository I mentioned there is the tiniest test program I could come up with to reproduce the bug.

[cowlicks]

@adimascio I'll try it out thanks!

[adimascio]

@cowlicks great, thanks !

[cowlicks]

@adimascio I think the "server.js" file is missing.

[cowlicks]

ah I see you meant "index.js"

[adimascio]

You're right, sorry. I should have proofread my README :-/

[ghostwords]

I made a minimal extension to reproduce the issue. @adimascio Could you double-check that you run into the bug using just the attached add-on and nothing else? It would be good to know affected Firefox versions as well.

firefox_webext_onunload_bug_demo.zip

The next step would be to file a Mozilla Bugzilla bug.

[ghostwords]

To load the above add-on in Firefox, unzip the archive somewhere, visit about:debugging, click on Load Temporary Add-on, and pick the manifest.json file inside the unzipped folder.

[ghostwords]

I think issues like this are a good use case for #1221

I dunno, I don't see any helpful messages. Everything seems fine, it's just that Firefox fails to render the newly navigated-to page.

[adimascio]

@ghostwords Thanks ! I confirm that I run into the bug after loading your extension (I created a new firefox profile with no other extension).

[adimascio]

@ghostwords I've just made a few more tests with your extension. It looks like returning undefined or explicitly setting a responseHeaders property with at least content-type and content-length solves the problem.

[adimascio]

Seems like https://github.com/adimascio/privacybadger/commit/8483d8c249ced9ba8eb7567310769a59fe48eb4f might fix the problem. I will try to double-check later today

[ghostwords]

Filed https://bugzilla.mozilla.org/show_bug.cgi?id=1373776 with Bugzilla.

[naught101]

That zip file link is not working for me. Returns an xml file with an error from amazon AWS complaining about "The request signature we calculated does not match the signature you provided. Check your key and signing method." when I try to click the link.

[ghostwords]

This one? Is it still an issue? Just worked for me.

[naught101]

Ahh.. NoScript was blocking it as and XSS attempt. Got it now.

[naught101]

Yep, that debug addon does cause the same problem as Privacy Badger for me.

[ghostwords]

According to https://github.com/EFForg/privacybadger/issues/1295#issuecomment-315998618, you should be able to get rid of this issue in your Firefox profile without having to start over from scratch by refreshing your Firefox and then reinstalling all your add-ons.

[naught101]

Browser refresh worked for ebay for me, but not for my internet banking login screen, for some reason (https://ibanking.stgeorge.com.au/ibank/loginPage.action). Not sure why... Let me know if there is more testing I can do.

[ghost]

@adimascio File a bug on Mozilla tracker.

[ghostwords]

This might be fixed now that Firefox 55 reached stable.

[arthurlogilab]

@ghostwords unfortunately I can confirm that this bug still present on firefox 55

[ghostwords]

@arthurlogilab Are you using the latest stable (not beta) Firefox 55 version? Could you chime in on the Firefox issue for this bug, following up on my findings there?

[arthurlogilab]

Sorry, I take it back, it is solved on my firefox 55.0.1 on ubuntu zesty version. 🍾