ghostery/adblocker

[adblocker-electron] fails to inject scriptlet due to CSP issue

spikecodes opened this issue · 10 comments

spikecodes commented

Reddit doesn't load in Electron when either the ElectronBlocker.fromPrebuiltAdsAndTracking or ElectronBlocker.fromPrebuiltFull method is used on the session.

Code to reproduce is attached below. Here's a repo I made to test it.

const { app, BrowserWindow } = require("electron");
const { ElectronBlocker } = require("@cliqz/adblocker-electron");

let mainWindow;

function createWindow() {
  mainWindow = new BrowserWindow({
    width: 800,
    height: 600,
    titleBarStyle: "hidden",
  });

  mainWindow.loadURL("https://reddit.com");

  mainWindow.webContents.openDevTools();

  ElectronBlocker.fromPrebuiltAdsAndTracking(fetch).then((blocker) => {
    blocker.enableBlockingInSession(mainWindow.webContents.session);
  });
}

app.on("ready", createWindow);

app.on("window-all-closed", () => {
  app.quit();
});

image

Some other websites I tested that seem to be broken from loading by either one or both of these blocking options:

Both do work, though, when using fromPrebuiltAdsOnly.

remusao commented

Hey, did you try creating the browser window using the settings shown in the example here? https://github.com/ghostery/adblocker/blob/master/packages/adblocker-electron-example/index.ts#L20

I know there are some isolation settings which can prevent the adblocker from working properly in Electron.

spikecodes commented

Thanks for the quick response. Even with those settings, x.com and reddit.com don't load with fromPrebuiltFull (although they used to a couple months ago).
image

spikecodes commented

Any updates with this? Still experiencing on x.com

seia-soto commented

Hi @spikecodes ,

Thanks for reporting the problem. I was able to find the problem by referencing your repository. I'm really appreciate of it. I also found that the root cause of the problem is coming from the CSP conflict on the website. Therefore, fixing the issue will introduce a huge change in the internal apis since there's no way to bypass CSP in the main world.

We'll try to fix the issue but our team is facing some issues important for our product at the moment. At the time, I suggest you to update the issue title to: adblocker-electron fails to inject scriptlet due to CSP issue.

Sorry for the inconvenient and thank you again for your contribution. I hope you have a wonderful upcoming week. I'll look into this.

spikecodes commented

Great, thanks! Just renamed the issue.

  • 👍1
seia-soto commented

Hi @spikecodes ,

Sorry about being late. I'd like to know if you're still able to reproduce the issue. I tried to reproduce the issue in multiple environments after making a simple patch but I wasn't able to reproduce.

Thanks

spikecodes commented

Hey @seia-soto thanks! I tried it out with my test repo and the two sites that were broken before (Reddit and X) seem to be fixed now so I'll close this issue.

seia-soto commented

Sorry for being late, I assume this was a filter-side issue.

  • 👍1
seia-soto commented

Thanks for the confirmation!

PascalPixel commented
  • This has started failing again around August 10, it effects Reddit, X, YouTube, and Instagram
  • You can still use the original example repo to reproduce it
  • You must reload a few seconds after initial boot to ensure lists are loaded
  • You can upgrade the packages to the latest and it still seems to fail
  • Could we prioritize gracefully failing vs. fixing this bug? A white-out screen is pretty alarming to my users 😄
// @cliqz/adblocker-electron-preload/index.js
function insertNode(node, document) {
  const parent = document.head || document.documentElement || document;
  if (parent !== null) {
    parent.appendChild(node); // this is the problem and try / catch doesn't work it seems; blank page
  }
}
  • 👍1