Opened 4 months ago

Last modified 6 weeks ago

#29246 new defect

WebGL is sometimes blocked outright instead of put behind a click-to-play placeholder

Reported by: gk Owned by: tbb-team
Priority: Medium Milestone:
Component: Applications/Tor Browser Version:
Severity: Normal Keywords: noscript, tbb-usability-website, GeorgKoppen201903, tbb-8.5, TorBrowserTeam201904
Cc: ma1 Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

In #21805 we put WebGL behind a placeholder with the help of NoScript. This works well e.g. for http://webglsamples.org/aquarium/aquarium.html. However other sites report just that WebGL is not supported and it therefore gets blocked outright:

https://demo.marpi.pl/biomes/

Giorgio, you mentioned in comment:5:ticket:21805 that this worked correctly with NoScript 10.1.8.2. Is that a regression on NoScript's side or an issue with WebGL detection on the website?

Child Tickets

Change History (11)

comment:1 Changed 4 months ago by gk

FWIW, to reproduce this bug you have to set webgl.disable-extensions to false. By default we disable those extensions and I guess in that case the behavior is okay-ish in the sense that the website is saying "Your browser does not support WebGL" and no click-to-play placeholder shows up.

However, this happens even if the necessary extensions are allowed and going in the NoScript menu and enabling WebGL there shows the demo in that scenario.

comment:2 Changed 4 months ago by gk

Let's use #15825 for the "let's make WebGL extensions usable without addding fingerprinting surface"-task.

Last edited 4 months ago by gk (previous) (diff)

comment:3 Changed 3 months ago by gk

Keywords: TorBrowserTeam201903 tbb-8.5 added

comment:4 Changed 2 months ago by gk

Keywords: tbb-8.5-must added; tbb-8.5 removed

Marking blockers for Tor Browser 8.5.

comment:5 Changed 2 months ago by gk

Keywords: tbb-8.5-must-alpha added; tbb-8.5-must removed

Tickets that block the next 8.5 alpha.

comment:6 Changed 2 months ago by gk

Keywords: GeorgKoppen201903 added

comment:7 Changed 2 months ago by cypherpunks

I think a similar thing happens with videos, at Safest security level if I visit a page that contains a video, it tells me no videos with supported format are found with no click-to-play option, if I copy the video link and visit it directly, then I can click-to-play as expected. When I visit the same page with an older Tor Browser (ESR52) I can click to play directly on the page.

comment:8 in reply to:  1 Changed 2 months ago by gk

Replying to gk:

FWIW, to reproduce this bug you have to set webgl.disable-extensions to false. By default we disable those extensions and I guess in that case the behavior is okay-ish in the sense that the website is saying "Your browser does not support WebGL" and no click-to-play placeholder shows up.

However, this happens even if the necessary extensions are allowed and going in the NoScript menu and enabling WebGL there shows the demo in that scenario.

Alright, I bisected the problem and the first bad version is 10.1.9, and more exactly 10.1.9rc1.

ma1: Can you please have a look? This reproduces easily in a vanilla Firefox 60 ESR with the following steps:

1) Create a clean, new profile and install NoScript 10.1.9rc1.
2) Make sure everything but WebGL is allowed in NoScript's settings menu
3) Go to https://demo.marpi.pl/biomes/
4) Expected outcome: Click-to-play placeholders (as in 10.1.8.23)
5) Actual outcome: No click-to-play placeholders

I guess we found out about that so late because we had WebGL not working at all in Tor Browser 8 at the beginning.

comment:9 in reply to:  7 Changed 2 months ago by gk

Replying to cypherpunks:

I think a similar thing happens with videos, at Safest security level if I visit a page that contains a video, it tells me no videos with supported format are found with no click-to-play option, if I copy the video link and visit it directly, then I can click-to-play as expected. When I visit the same page with an older Tor Browser (ESR52) I can click to play directly on the page.

I think that's a different bug. Not sure which videos you are talking about, but I've opened a ticket collecting a bunch of URLs where click-to-play for videos is (still) not working, see: #29904.

comment:10 Changed 7 weeks ago by gk

Keywords: TorBrowserTeam201904 added; TorBrowserTeam201903 removed

Moving tickets to April.

comment:11 Changed 6 weeks ago by gk

Keywords: tbb-8.5 added; tbb-8.5-must-alpha removed

I guess ma1 is the best one to deal with this NoScript regression. We'd still be very happy to have this for 8.5, thus adjusting keyword.

Note: See TracTickets for help on using tickets.