WebGL is sometimes blocked outright instead of put behind a click-to-play placeholder

In legacy/trac#21805 (moved) we put WebGL behind a placeholder with the help of NoScript. This works well e.g. for http://webglsamples.org/aquarium/aquarium.html. However other sites report just that WebGL is not supported and it therefore gets blocked outright:

https://demo.marpi.pl/biomes/

Giorgio, you mentioned in comment:5:ticket:21805 that this worked correctly with NoScript 10.1.8.2. Is that a regression on NoScript's side or an issue with WebGL detection on the website?

added GeorgKoppen201903 in Legacy / Trac TorBrowserTeam201904 in Legacy / Trac component::applications/tor browser in Legacy / Trac noscript in Legacy / Trac owner::tbb-team in Legacy / Trac priority::medium in Legacy / Trac severity::normal in Legacy / Trac status::new in Legacy / Trac tbb-8.5 in Legacy / Trac tbb-usability-website in Legacy / Trac type::defect in Legacy / Trac labels

FWIW, to reproduce this bug you have to set webgl.disable-extensions to false. By default we disable those extensions and I guess in that case the behavior is okay-ish in the sense that the website is saying "Your browser does not support WebGL" and no click-to-play placeholder shows up.

However, this happens even if the necessary extensions are allowed and going in the NoScript menu and enabling WebGL there shows the demo in that scenario.

Let's use legacy/trac#15825 (moved) for the "let's make WebGL extensions usable without addding fingerprinting surface"-task.

Trac:
Keywords: N/A deleted, TorBrowserTeam201903, tbb-8.5 added

Marking blockers for Tor Browser 8.5.

Trac:
Keywords: tbb-8.5 deleted, tbb-8.5-must added

Tickets that block the next 8.5 alpha.

Trac:
Keywords: tbb-8.5-must deleted, tbb-8.5-must-alpha added

Trac:
Keywords: N/A deleted, GeorgKoppen201903 added

I think a similar thing happens with videos, at Safest security level if I visit a page that contains a video, it tells me no videos with supported format are found with no click-to-play option, if I copy the video link and visit it directly, then I can click-to-play as expected. When I visit the same page with an older Tor Browser (ESR52) I can click to play directly on the page.

Replying to gk:

FWIW, to reproduce this bug you have to set webgl.disable-extensions to false. By default we disable those extensions and I guess in that case the behavior is okay-ish in the sense that the website is saying "Your browser does not support WebGL" and no click-to-play placeholder shows up.

However, this happens even if the necessary extensions are allowed and going in the NoScript menu and enabling WebGL there shows the demo in that scenario.

Alright, I bisected the problem and the first bad version is 10.1.9, and more exactly 10.1.9rc1.

ma1: Can you please have a look? This reproduces easily in a vanilla Firefox 60 ESR with the following steps:

1. Create a clean, new profile and install NoScript 10.1.9rc1.
2. Make sure everything but WebGL is allowed in NoScript's settings menu
3. Go to https://demo.marpi.pl/biomes/
4. Expected outcome: Click-to-play placeholders (as in 10.1.8.23)
5. Actual outcome: No click-to-play placeholders

I guess we found out about that so late because we had WebGL not working at all in Tor Browser 8 at the beginning.

Replying to cypherpunks:

I think a similar thing happens with videos, at Safest security level if I visit a page that contains a video, it tells me no videos with supported format are found with no click-to-play option, if I copy the video link and visit it directly, then I can click-to-play as expected. When I visit the same page with an older Tor Browser (ESR52) I can click to play directly on the page.

I think that's a different bug. Not sure which videos you are talking about, but I've opened a ticket collecting a bunch of URLs where click-to-play for videos is (still) not working, see: legacy/trac#29904 (moved).

Moving tickets to April.

Trac:
Keywords: TorBrowserTeam201903 deleted, TorBrowserTeam201904 added

I guess ma1 is the best one to deal with this NoScript regression. We'd still be very happy to have this for 8.5, thus adjusting keyword.

Trac:
Keywords: tbb-8.5-must-alpha deleted, tbb-8.5 added

moved from legacy/trac#29246 (moved)

added Bug label and removed 1 deleted label

added NoScript UX labels and removed 1 deleted label

closed