random-agent-spoofer icon indicating copy to clipboard operation
random-agent-spoofer copied to clipboard

Script injection brakes in Firefox version >= 45

Open Ghebraant opened this issue 9 years ago • 23 comments

Verify by checking ip-check.info

Ghebraant avatar Feb 06 '16 05:02 Ghebraant

@Ghebraant Thanks for reporting this. I am also experiencing this on FF dev edition which is at 46. I am actively looking for a fix for this. Nothing so far stands out as to why it should not work.

What OS are you using ? , just so I can rule it out.

dillbyrne avatar Feb 09 '16 17:02 dillbyrne

I'mn running Windows 7 64-bit.

Ghebraant avatar Feb 10 '16 17:02 Ghebraant

@Ghebraant Thanks that rules out the OS as the cause.

ff44 ff45

All other script injection options no longer work on firefox >= 45

dillbyrne avatar Feb 10 '16 17:02 dillbyrne

I can confirm this, on firefox 45.0

OdinGitDat avatar Feb 14 '16 17:02 OdinGitDat

I have tested it with multiprocess enabled and disabled and it does not make a difference. I can also confirm the the injection process still works as I am able to display a test alert using the injection script. The correct params are being passed to the script.

I think the problem is the Object.defineproperty calls which is essentially the core of the injection script.

I will keep at it to see if I can find a solution.

dillbyrne avatar Feb 23 '16 19:02 dillbyrne

What is Modzilla saying? Is this a deliberate change upon the WebExtensions path?

sueridgepipe avatar Feb 26 '16 09:02 sueridgepipe

I don't know for sure what the root cause of the problem is as it is difficult to debug. I have only talked with one person from Mozilla so far and they said they can't see anything wrong and to re check my code.

I can confirm the injection script is still creating and adding the dynamic ras_script to each page as I tested it by modifying the bgcolor of a page.

I can also confirm that object.defineproperty is working, at least within the context of the dynamic ras_script being run in the page as I can alert back the expected spoofed values.

I have also tried different page mod options in case it was a timing issue of the ras_script being added by the injection script after the page has loaded but it already runs before the page loads.

I have also tried changing where the ras_script is injected in the DOM and that has made no difference.

:computer: :hammer:

dillbyrne avatar Mar 04 '16 17:03 dillbyrne

Wow, window.name as well... phew, thought I did something on my end! Fingers crossed @ dev to figure this one out...

marzametal avatar Mar 20 '16 09:03 marzametal

Hi,

I just downloaded a portable version of FF ESR 38.7.1, and tested RAS 0.9.5.5 concerning window.name protection and date+ screen size spoofing. With this browser, no problem happened, spoofing was correct.

I hope it will help...

Kraxys avatar Mar 30 '16 03:03 Kraxys

Just a quick update on this. I should hopefully be able to fix this by rewriting all the script injection code to use frame scripts.

I won't be able to say for sure how it will effect the addon and what features will change until I get a chance to try implement it.

I'll update when I have had a chance to try it out

dillbyrne avatar Mar 30 '16 11:03 dillbyrne

Confirming Timezone spoofing is not working on FF 45.0.1. OS Windows 10, 64 bit. This is actually first time I am using this addon. Specially for Timezone spoofing. Waiting for a fix.

prionkor avatar Apr 02 '16 20:04 prionkor

I've got the basic mechanism in place for frame scripts to work. Now all that is left is to write modified API calls for every thing we need to spoof and then when that is done rework the whitelist to work with frame scripts.

dillbyrne avatar May 01 '16 13:05 dillbyrne

Most of the previous spoofing code will work with the frame scripts and it appears to be more robust as it correctly handles iFrames . There is one roadblock holding me back at the minute and that is for methods that operate directly on the window, such as window.name.

dillbyrne avatar May 02 '16 16:05 dillbyrne

Hi,

I tested JonDoFox Browser (wich currently use FF 45) on ip-check.info: with this browser, window.name is anonymized. So maybe ypu could see into the JonDoBrowser code how they have solved the issue. The problem being that JDF browser is much more than a simple xpi, so they may not have solved the issue on a xpi level.

JonDoFox Browser http://anonymous-proxy-servers.net/en/jondofox.html

JonDoFox Browser sources https://anonymous-proxy-servers.net/wiki/index.php/JonDoFox_sources

Kraxys avatar May 20 '16 20:05 Kraxys

Hi @Kraxys I managed to find a way to fix it within the context of a frame script. Thanks all the same :+1:

dillbyrne avatar May 22 '16 09:05 dillbyrne

@dillbyrne - how is the new coding coming along for script injection? Just curious :)

I have a small fear that getting this to work for v45, will be borked by whatever is introduced in v46 and v47!

marzametal avatar Jun 24 '16 02:06 marzametal

@marzametal Getting the new whitelist code to work was tricky but I have it working now. No need to worry about compatibility as I develop on the nightly branch which updates daily, Currently on ff49 and everything I have at the minute seems to be working as expected. I still have to redo the date code though.

I'll update the profiles next and ship a new release and then in the release after that I'll handle the canvas improvements and try to get the date and window code working again

dillbyrne avatar Jul 16 '16 16:07 dillbyrne

@dillbyrne This might sound stupid so I'm apologetic in advance, but why is limiting the tab history a script injection option when you can set the value in about:config using browser.sessionhistory.max_entries to 2

ghost avatar Aug 03 '16 04:08 ghost

@dillbyrne I'm sorry for a bit of off-topic, but could you, please, push the changes resolving the whitelist issues to AMO as a new version? I suffer hard without whitelist, since UA spoofing breaks a lot of sites, but I don't want to live completely without UA spoofing.

Drugoy avatar Sep 01 '16 15:09 Drugoy

@Drugoy I'm currently updating the ios profiles and I'll test it and upload a new version once that is done.

Has anyone got an iphone 6 s/p/e or any ipad with the latest updates ? if so reply below

I need the latest chrome on iphone too.

dillbyrne avatar Sep 03 '16 14:09 dillbyrne

@Wannabe-Programmer limiting tab history is in script injection as it is allows the user to whitelist it. Not all options can be whitelisted as many are global preferences so anything that can be script injected provides greater flexibility.

dillbyrne avatar Sep 03 '16 14:09 dillbyrne

@dillbyrne - I see now....thanks for the explanation :smile:

ghost avatar Sep 07 '16 10:09 ghost

Please see #544

dillbyrne avatar Mar 26 '17 18:03 dillbyrne