background images bypass umatrix rules

[jrynd]

Prerequisites

• I performed a cursory search of the issue tracker to avoid opening a duplicate issue
  • Your issue may already be reported.
  • I also searched the existing issues at https://github.com/gorhill/uMatrix/issues
• This is not a support issue or a question
  • Support issues and questions are handled at /r/uMatrix
• I tried to reproduce the issue when...
  • uMatrix is the only extension
  • uMatrix with default lists/settings
  • using a new, unmodified browser profile
• I am running the latest version of uMatrix
• I checked the documentation to understand that the issue I report is not a normal behavior
• I used the logger to rule out that the issue is caused by my ruleset

Description

Taboola, an ad network, is blocked. Yet Taboola ads show up on the site. I don't think Taboola scripts are running, but Taboola images are definitely shown (and Taboola is able to start profiling me)

A specific URL where the issue occurs

https://slate.com/human-interest/2018/11/stop-drinking-friends-advice.html

Steps to Reproduce

1. Block Taboola.com
2. Go to https://slate.com/human-interest/2018/11/stop-drinking-friends-advice.html
3. See the Taboola images at bottom of page

Supporting evidence

Your environment

• uMatrix version: 1.3.14
• Browser Name and version: Chrome Version 71.0.3578.80 (Official Build) (64-bit)
• Operating System and version: Windows 10 Enterprise 10.0.15063 Build 15063
  
  
  
  

[jrynd]

Note that some Taboola requests are blocked but others are allowed.

[uBlock-user]

See the Taboola images at bottom of page

Not seeing any.

[uBlock-user]

The last image shows 3rd party tabless requests are not being blocked, that's where that content is being loaded.

Open chrome://serviceworker-internals/ and remove any and all service workers listed and block those tabless behind-the-scene requests and try again.

[gorhill]

I am unable to reproduce, the service worker fails to launch on my side, console:

ServiceWorker registration failed:  TypeError: Failed to register a ServiceWorker: ServiceWorker script evaluation failed

[gorhill]

Ok so if I soft-allow all for that site, the worker launched. But I don't see it pulling anything from taboola.com, only from storage.googleapis.com and itself.

[jrynd]

I do indeed have a service worker for slate.com. I tried both stopping the slate.com and removing the slate.com worker, but when I go back to the page and reload, the worker gets re-enabled and the images show.

[jrynd]

How do I get it to block 3rd party tabless requests?

[gorhill]

Without more details about your rules and how you configured uMatrix, not much we can do -- we can't reproduce.

[jrynd]

What more details do you need? Should I paste the rules here?

[gorhill]

You will need to install the dev build to get the appropiate UI from the logger to set rules for tabless requests.

[uBlock-user]

Take a backup and reset uMatrix to its default settings and try to reproduce again.

[gorhill]

We need to leave him time to report back before closing. I want to understand what is happening here.

[jrynd]

Here are the steps I took:

1. Disabled umatrix 1.3.14
2. Downloaded umatrix development build from link given, got 1.3.15.101 (the mouseover says "umatrix dev build")
3. Backed up settings and rules list
4. Reset to default settings
5. Visited the slate site. Taboola does not load, there's not even a request for it in the log
   
6. Restored settings
7. Visited the slate site. Taboola does not load, again no requests in the log.
8. Restored rules list
9. Visited the slate site. Taboola does not load, no requests for it in the log.

So whatever the bug is, it's not reproducible with 1.3.15.101

Should I repeat with 1.3.14?

[jrynd]

I just noticed that it wasn't only taboola, I'd also forbidden a bunch of other ad networks as you can see in the shot of the matrix, that all got to load according to the log, but that all seems to be fixed with 1.3.15

[uBlock-user]

Probably requires a combination of of Chrome version 71 and 1.13.14, I'm on the dev build of Chromium, so none of them could reproduce.

[jrynd]

Hi, this issue seems to be back.
Windows 10
Google Chrome Version 72.0.3626.109 (Official Build) (64-bit)
UMatrix Development Build 1.3.17.1

Images clearly are loading from images.taboola.com, but images.taboola.com does not show up in the umatrix as a host.

Do you want more logs? Screenshots?

[jrynd]

Also https://www.washingtonpost.com/politics/courts_law/supreme-court-says-constitutional-protection-against-excessive-fines-applies-to-state-actions/2019/02/20/204ce0d4-3522-11e9-af5b-b51b7ff322e9_story.html

I looked in the log and images.taboola.com is not shown. The image is being loaded without umatrix even knowing about it.

[gorhill]

See https://twitter.com/gorhill/status/1097481139294519297, this applies to all content blockers.

[jrynd]

Thanks!