Closed Bug 1628947 Opened 5 years ago Closed 5 years ago

YouTube shows white box over bottom half of video when privacy.resistFingerprinting is enabled

Categories

(Core :: DOM: Security, defect, P3)

defect

Tracking

()

RESOLVED WORKSFORME
Tracking Status
firefox-esr68 --- fixed
firefox75 --- fixed
firefox76 --- fixed
firefox77 --- fixed

People

(Reporter: yoasif, Unassigned)

References

(Blocks 1 open bug)

Details

(Whiteboard: [domsecurity-backlog1])

Attachments

(1 file)

Attached image Ls7A5xF.png (deleted) —

Reported by numerous users in: https://www.reddit.com/r/firefox/comments/fy6l1z/youtube_borked_with_new_firefox/

Steps to reprdoduce:

  1. Set privacy.resistFingerprinting to true
  2. Restart Firefox
  3. Navigate to any Youtube video
  4. Move mouse cursor over bottom half of video

What happens:

White box appears over the bottom half of the video.

Expected result:

As when privacy.resistFingerprinting is set to false - no white box.

Instead of the regular black gradient displayed at the bottom of YouTube videos that serves as the background for the player controls, YouTube is inserting a different background image. The background image is applied inline to the .ytp-gradient-bottom element on the YouTube page. It appears the correct data is being altered in some way.

This is what the specific HTML element I'm referring to looks like when the issue is occurring:

<div class="ytp-gradient-bottom" style="height: 146px; /*! background-image: url(&quot;data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAACSCAYAAACE56BkAAAAFElEQVQokWP4////f4ZRYpQYbgQAmsVF17cjH8gAAAAASUVORK5CYII=&quot;); */" data-layer="8"></div>

This is what the HTML element looks like when the issue is not occurring:

<div class="ytp-gradient-bottom" style="height: 146px; background-image: url(&quot;data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAACSCAYAAACE56BkAAAA9ElEQVQokWXE6UcYABwA0Fdb17rv+77bOrbu+75rxiSRzJiJJCMjyZgkkkQSiSSR/si+/b70PjzeSIBEeBe9hyRIjlIgFdLgQ5QOGZAZZUE25ES5kAf5UQEUQlFUDCVQGpVBOVRElVAF1VEN1EJdVA8N0Bg1QTO0RK3QBh+jT9AOHVEndMHn6At0Q0/UC33QHw3AIAxFwzACo9EYjMNENAlTMB3NwCzMRfOwAIvREizDCqzCV/gG32EN1mEDNmELfsBP+AW/YRt2YBf24A/sw184gEM4gn/wH47hBE7hDM7hAi7hCq7hBm7hDu7hAR7hCZ7h5RXn9CPSw0UnPQAAAABJRU5ErkJggg==&quot;);" data-layer="8"></div>

For some reason, the image data is the same up to here:
iVBORw0KGgoAAAANSUhEUgAAAAEAAACSCAYAAACE56BkAAAA

No idea why this is happening. Just figured I'd give some more insight into what exactly is going wrong. Hopefully it helps diagnose the issue.

Component: Privacy: Anti-Tracking → DOM: Security

There is a workaround to this bug, you can add "https://www.youtube.com/##.ytp-gradient-bottom" to your adblocker fliter list and the white box doesn't show anymore, no need to disable "privacy.resistFingerprinting" option.

(In reply to lnkl from comment #2)

There is a workaround to this bug, you can add "https://www.youtube.com/##.ytp-gradient-bottom" to your adblocker fliter list and the white box doesn't show anymore, no need to disable "privacy.resistFingerprinting" option.

I tried this with ublock origin and am still seeing the issue. I'm supposed to add it like this correct? https://imgur.com/a/g764d0V

(In reply to spencerlavalle95 from comment #5)

I tried this with ublock origin and am still seeing the issue. I'm supposed to add it like this correct? https://imgur.com/a/g764d0V

I think the filter in comment #2 should read "www.youtube.com##.ytp-gradient-bottom" (no protocol, no slash).

(In reply to jiri.pospisil from comment #6)

I think the filter in comment #2 should read "www.youtube.com##.ytp-gradient-bottom" (no protocol, no slash).

Thank you!!

If you don't know how to do that, you can check the following blog post or YouTube video that covers both methods:
https://geekermag.com/youtube-shows-white-box-over-bottom-half-of-video-in-firefox-75/
https://youtu.be/R6ODzrkhIYc

I hope you found it useful.

Crash Signature: [@ { "ns": "yt", "el": "detailpage", "cpn": "dD1vZuaaTYx_BDTQ", "docid": "MAmpBFA988k", "ver": 2, "cmt": "0", "ei": "bdeQXuq3HtnH7QSIkIzAAw", "fmt": "135", "fs": "0", "rt": "31.2", "of": "TdfurihXRDDrRsUOIAipdw", "euri"…
Crash Signature: [@ { "ns": "yt", "el": "detailpage", "cpn": "dD1vZuaaTYx_BDTQ", "docid": "MAmpBFA988k", "ver": 2, "cmt": "0", "ei": "bdeQXuq3HtnH7QSIkIzAAw", "fmt": "135", "fs": "0", "rt": "31.2", "of": "TdfurihXRDDrRsUOIAipdw", "euri"…
Priority: -- → P3
Whiteboard: [domsecurity-backlog1]

FYI that might be relevant: All SUMO questions about this bug are on Firefox 68. Is there something in 68 that makes it happen more often? <--- oops it's 68 because turning on resist fingerprinting results in firefox appearing as firefox 68

This is caused by a change of YouTube. I could reproduce it even with Firefox 66.

Because this bug's Severity has not been changed from the default since it was filed, and it's Priority is P3 (Backlog,) indicating it has been triaged, the bug's Severity is being updated to S3 (normal.)

Severity: normal → S3

This seems to be fixed. Can someone confirm?

It looks fixed to me - FF 76.0.1.
I always kept privacy.resistFingerprinting enabled but, when prompted, I manually allowed Youtube to extract the canvas data to bypass this issue.
Since seeing Jan's message about it being fixed, I removed the permission, blocked Youtube from extracting the canvas data and everything looks normal - no white box anymore.

This now works for me on stable and nightly.

Status: NEW → RESOLVED
Closed: 5 years ago
Resolution: --- → FIXED
Resolution: FIXED → WORKSFORME
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: