{"action":"created","issue":{"url":"https://api.github.com/repos/gorhill/uBlock/issues/852","labels_url":"https://api.github.com/repos/gorhill/uBlock/issues/852/labels{/name}","comments_url":"https://api.github.com/repos/gorhill/uBlock/issues/852/comments","events_url":"https://api.github.com/repos/gorhill/uBlock/issues/852/events","html_url":"https://github.com/gorhill/uBlock/issues/852","id":112706065,"number":852,"title":"Clicking URLs in Chrome Full History bypasses uBlock Origin","user":{"login":"ghost","id":10137,"avatar_url":"https://avatars.githubusercontent.com/u/10137?v=3","gravatar_id":"","url":"https://api.github.com/users/ghost","html_url":"https://github.com/ghost","followers_url":"https://api.github.com/users/ghost/followers","following_url":"https://api.github.com/users/ghost/following{/other_user}","gists_url":"https://api.github.com/users/ghost/gists{/gist_id}","starred_url":"https://api.github.com/users/ghost/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ghost/subscriptions","organizations_url":"https://api.github.com/users/ghost/orgs","repos_url":"https://api.github.com/users/ghost/repos","events_url":"https://api.github.com/users/ghost/events{/privacy}","received_events_url":"https://api.github.com/users/ghost/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-10-22T00:33:12Z","updated_at":"2015-10-22T12:12:16Z","closed_at":null,"body":"I have discovered what is potentially a major flaw in uBlock Origin.\r\n\r\n**If a user clicks on a link from the Full Chrome History page of Google Chrome, most if not all uBlock Origin filters are automatically bypassed.**\r\n\r\n**Steps to Reproduce:**\r\n\r\n(1). Enable \"Nightmare Mode\":\r\n\r\n`* * 1p-script block`\r\n`* * 3p block`\r\n`* * 3p-frame block`\r\n`* * 3p-script block`\r\n`* * inline-script block`\r\n\r\n(2). Open a new tab in Chrome and set the network request log to monitor it\r\n\r\n![screen shot 2015-10-21 at 17 25 58](https://cloud.githubusercontent.com/assets/15240200/10653930/2d904d72-7819-11e5-9be7-6b340d055bf8.png)\r\n\r\n(3). Visit a website. Let's go with [kottke.org](http://kottke.org)\r\n\r\n![screen shot 2015-10-21 at 17 26 26](https://cloud.githubusercontent.com/assets/15240200/10653933/3533a308-7819-11e5-89be-fed5123f0f45.png)\r\n\r\n(4). Note that the network request log only shows that the document and first-party images/stylesheets have loaded\r\n\r\n![screen shot 2015-10-21 at 17 26 08](https://cloud.githubusercontent.com/assets/15240200/10653935/3b77057a-7819-11e5-89cd-f3b60c27b3eb.png)\r\n\r\n(5). View Chrome's \"[Full Chrome History](chrome://history/)\" page (Cmd + Y on a Mac)\r\n\r\n![screen shot 2015-10-21 at 17 26 38](https://cloud.githubusercontent.com/assets/15240200/10653941/425dd44a-7819-11e5-8049-e2f6069f504b.png)\r\n\r\n(6). Click on [kottke.org](http://kottke.org)\r\n\r\n(7). Observe that the network request log allows connections the following:\r\n\t- Document and first-party images/stylesheets\r\n\t- Inline and first-party scripts\r\n\t- Images from subdomain also.kottke.org\r\n\t- Scripts from jquery.com, pinterest.com, weworkremotely.com\r\n\t- Stylesheets from typography.com, bootstrapcdn.com\r\n\t- And, possibly, fronts via stylesheets (look closely at the screenshots)\r\n\r\n![screen shot 2015-10-21 at 17 27 10](https://cloud.githubusercontent.com/assets/15240200/10653948/4cd22ec6-7819-11e5-9924-87a3adce6208.png)\r\n\r\n![screen shot 2015-10-21 at 17 27 13](https://cloud.githubusercontent.com/assets/15240200/10653949/51b3a1a4-7819-11e5-8660-56a73cdcc6c2.png)\r\n\r\n(8). Hit refresh, and note that the connection logger reports the items listed as approved in Step 6 are now blocked, with only the document and first-party images/stylesheets having been loaded.\r\n\r\nI am running the latest version of uBlock Origin in with the latest public versions of Chrome and OS X."},"comment":{"url":"https://api.github.com/repos/gorhill/uBlock/issues/comments/150202344","html_url":"https://github.com/gorhill/uBlock/issues/852#issuecomment-150202344","issue_url":"https://api.github.com/repos/gorhill/uBlock/issues/852","id":150202344,"user":{"login":"gorhill","id":585534,"avatar_url":"https://avatars.githubusercontent.com/u/585534?v=3","gravatar_id":"","url":"https://api.github.com/users/gorhill","html_url":"https://github.com/gorhill","followers_url":"https://api.github.com/users/gorhill/followers","following_url":"https://api.github.com/users/gorhill/following{/other_user}","gists_url":"https://api.github.com/users/gorhill/gists{/gist_id}","starred_url":"https://api.github.com/users/gorhill/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gorhill/subscriptions","organizations_url":"https://api.github.com/users/gorhill/orgs","repos_url":"https://api.github.com/users/gorhill/repos","events_url":"https://api.github.com/users/gorhill/events{/privacy}","received_events_url":"https://api.github.com/users/gorhill/received_events","type":"User","site_admin":false},"created_at":"2015-10-22T12:12:16Z","updated_at":"2015-10-22T12:12:16Z","body":"> Only in-line scripts were let through\r\n\r\nYes, this I can reproduce. I believe this is a Chromium corner case, happening because the document is loaded from the memory-based cache (very short term cache). If you try with an older history entry, inline script will be blocked (because disk-based cache or not in cache)."}}