[tor-bugs] #6873 [EFF-HTTPS Everywhere]: [CHROME] Resource from https://s2.wp.com fails to load for websites

[Tor Bug Tracker & Wiki]

#6873: [CHROME] Resource from https://s2.wp.com fails to load for websites
----------------------------------+-----------------------------------------
 Reporter:  dtauerbach            |          Owner:  dtauerbach@…        
     Type:  defect                |         Status:  new                 
 Priority:  normal                |      Milestone:                      
Component:  EFF-HTTPS Everywhere  |        Version:                      
 Keywords:                        |         Parent:                      
   Points:                        |   Actualpoints:                      
----------------------------------+-----------------------------------------
 Chrome Version: 23.0.1262.0

 Example: http://venturebeat.com/2012/09/13/how-do-not-track-could-destroy-
 the-internet-as-you-know-it/

 What happens: Website appears to have broken css/js.

 Disabling WordPress rule fixes the problem. After a bit of investigation
 it appears different resources are loading in Chrome vs Firefox from
 wp.com; FF's resource works and Chrome's returns 404:

 [FF - success] https://s2.wp.com/_static/??/wp-
 content/themes/vip/venturebeat2/styles/vb-profile.css,/wp-content/mu-
 plugins/post-flair/style.css,/wp-
 content/themes/vip/venturebeat2/style.css?m=1346967037j

 [Chrome - 404] https://s2.wp.com/_static/?/wp-
 content/themes/vip/venturebeat2/styles/vb-profile.css,/wp-content/mu-
 plugins/post-flair/style.css,/wp-
 content/themes/vip/venturebeat2/style.css?m=1346967037j

 So it appears that the WordPress rule is broken for Chrome. Looking at the
 relevant WordPress rule:

 <rule from="^http://s(\d*)\.wp\.com/"
        to="https://s$1.wp.com/" />

 The rule seems fine, but is misapplied by HTTPS Everywhere in Chrome.
 After some investigation, this is based on a bug in the underlying URL
 parsing javascript library jsURI (https://github.com/derek-watson/jsUri)
 which hasn't been under active development since February. It's not clear
 to me how to build the current version of this library, and the author
 seems to be unresponsive. We could fix the bug ourselves or move to
 another library. If the former, we should keep an eye for these sorts of
 issues in the future.

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/6873>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online