uBlock error when using a command line switch in Chromium

[ghost]

Prerequisites

• I verified that this is not a filter issue
  • Filter issues MUST be reported at filter issue tracker
• This is not a support issue or a question
  • Support issues and questions are handled at /r/uBlockOrigin
• I performed a cursory search of the issue tracker to avoid opening a duplicate issue
  • Your issue may already be reported.
• I tried to reproduce the issue when...
  • uBlock Origin is the only extension
  • uBlock Origin with default lists/settings
  • using a new, unmodified browser profile
• I am running the latest version of uBlock Origin
• I checked the documentation to understand that the issue I report is not a normal behavior

Description

When I start Chromium with the command Line switch "--disable-reading-from-canvas" I get an error.

Uncaught SecurityError: Failed to execute 'getImageData' on 'CanvasRenderingContext2D': The canvas has been tainted by cross-origin data.

js/vapi-background.js:705 (anonymous function)
let imgData = ctx.getImageData(0, 0, w, h);

A specific URL where the issue occurs

[A specific URL is MANDATORY for issue happening on a web page, even if it happens "everywhere" ]

Steps to Reproduce

1. Start Chromium with command line switch "chromium --disable-reading-from-canvas"
2. Go to extensions and enable developer mode
3. Load unpacked uBlock Origin
4. Click to open background.html page for uBlock Origin to see the errors.

Expected behavior:

Expected behavior is that uBlock Origin should not give an error on load.

Actual behavior:

An error on uBlock Origin load

Your environment

• uBlock Origin version: 1.17.2
• Browser Name and version: Chromium Version 70.0.3538.77 (Official Build)
• Operating System and version: Arch Linux (64-bit)

[uBlock-user]

uBO makes use of Canvas, you disabled Canvas reading functionality browser-wide, so it fails to read img data and browser spews Uncaught DomException

[gorhill]

Not just uBO, I think that error also existed before using Canvas for the toolbar icon, the extension API itself makes use of the Canvas API for the same purpose if I am not mistaken (just try with any other extension).

[uBlock-user]

Yes, happens with uMatrix and other VPN extensions too, where chromium fails to set icon.

[gorhill]

I can't find any such issue on Chromium issue tracker -- so I am not sure anymore where I saw this before.

[uBlock-user]

https://bugs.chromium.org/p/chromium/issues/detail?id=799477

That one ?

[gorhill]

No, that one is not related to the extension API.

I did add the code to catch and handle the exception, and now the extension API framework throws, I think this is what I must have seen before -- so even fixing uBO's code, there are still errors thrown from within the extension API framwork:

extensions::setIcon:20 Uncaught DOMException: Failed to execute 'getImageData' on 'CanvasRenderingContext2D': The canvas has been tainted by cross-origin data.
at Image.img.onload (extensions::setIcon:20:36)
extensions::setIcon:20 Uncaught DOMException: Failed to execute 'getImageData' on 'CanvasRenderingContext2D': The canvas has been tainted by cross-origin data.
at Image.img.onload (extensions::setIcon:20:36)

[gorhill]

I get the same errors with other extensions.

I will fix uBO handling the exception, but there will still be exceptions in the extension API framework, and these need to be reported to Chromium devs.

[uBlock-user]

so even fixing uBO's code, there are still errors thrown from within the extension API framwork:

Yes, they will remain as chromium also access for setting extension icon via Canvas API when an extension is enabled after being disabled

[gorhill]

This is where I saw this before: gorhill/uBlock#1509.

[uBlock-user]

Did you implement the fix suggested in gorhill/uBlock#1509 (comment) ?

[gorhill]

I disagree the workaround is sane -- it requires to hard-code the image data in the extension code.

[ghost]

I am getting the exact same error without using "--disable-reading-from-canvas" in ungoogled-chromium 70.0.3538.77 in Linux. It appears both in uBO 1.17.2 and uMatrix 1.3.14. I don't know if this is related but searching chrome://flags for "canvas" shows that I have #fingerprinting-canvas-measuretext-noise and #fingerprinting-canvas-image-data-noise enabled (flags which are custom to UGC).

[uBlock-user]

@AnChEv #296 (comment)

[ghost]

@uBlock-user yes, I saw that. Just wanted to mention that it happens even without the option reported by the OP.

[uBlock-user]

because you have two other flags enabled, disable them and it won't happen.