[tor-bugs] #5383 [HTTPS Everywhere: Chrome]: HTTPS Everywhere Chrome: NPR.org Slideshow Breaks

[Tor Bug Tracker & Wiki]

#5383: HTTPS Everywhere Chrome: NPR.org Slideshow Breaks
--------------------------------------+-------------------------------------
 Reporter:  dthvt                     |          Owner:  aaronsw
     Type:  defect                    |         Status:  new    
 Priority:  normal                    |      Milestone:         
Component:  HTTPS Everywhere: Chrome  |        Version:         
 Keywords:                            |         Parent:         
   Points:                            |   Actualpoints:         
--------------------------------------+-------------------------------------
 Using Google Chrome + HTTPS Everywhere, NPR.org articles featuring photo
 slide shows will not load the slide show.

 Example URL:

 https://www.npr.org/blogs/pictureshow/2012/03/13/148479994/car-pool-
 aerial-views-of-how-mexico-moves?sc=fb&cc=fp

 The actual code on the page appears to load a SWF object.  I'm not
 familiar with the security restrictions in flash, so maybe this is a SSL +
 Flash issue?

 Relevant snippet is:

                                                             <div
 class="bucket">
                                                                   <div
 class="graphicwrapper">
 <div id="slideshow148480157">
 <p><img
 src="http://media.npr.org/assets/multimedia/pictureshow/2012/03/carpool/fullscreen/10__alejan_tagena.jpg?t=1331593226&s=3"
 alt="Slideshow" /></p>                                       <p
 class="browser"><strong>This graphic requires version 9 or higher of the
 Adobe Flash Player.</strong><a
 href="http://www.adobe.com/products/flashplayer/" target="_blank">Get the
 latest Flash Player.</a></p>                                       <p
 class="iSomething"><strong>This interactive content is not supported by
 this device.</strong></p>
 <p>Carpools</p>
                                     </div>

 <!-- END ID="SLIDESHOW148480157" -->
                                     <script>
 var so = new SWFObject("/design/flash_templates/preloaderAS3.swf",
 "soundslider", "462", "380", "9", "#FFFFFF");
 so.addParam("allowScriptAccess", "always");
 so.addParam("quality", "high");
 so.addParam("wmode", "transparent");
 so.addParam("allowFullScreen", "true");
 so.addVariable("thexml",
 "http://media.npr.org/assets/multimedia/pictureshow/2012/03/carpool/");
 so.addVariable("theswf",
 "http://media.npr.org/design/flash_templates/nprgallery_embed.swf?path=http://media.npr.org/assets/multimedia/pictureshow/2012/03/carpool/");
 so.write("slideshow148480157");
                                     </script>
                                  </div>

 <!-- END CLASS="GRAPHICWRAPPER" -->
                                  <div class="footer">
 <p><span class="credit_label">Credit: </span>Alejandro Cartagena</p>
                                  </div>

 <!-- END CLASS="FOOTER" -->
                               </div>

 <!-- END CLASS="BUCKET" -->
                            </div>






 Google Chrome 17.0.963.78 m

 HTTPS Everywhere 2012.2.27_0

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/5383>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online