nobody/LocalCDN
25
630
Fork
You've already forked LocalCDN
20

Rewrite for more accurate resource matching + add match warnings #68

Closed
opened 2020年07月29日 20:22:55 +02:00 by Kein · 10 comments

Consider the following:

https://ezchan.org/

This site uses resources that are not a part of localCDN, which is fine. What isnt fine is that it still serves other versions as if they are interchangeable. Sure, sometimes they are, but only sometimes As you can see serving higher versions of these frameworks break the site.

Now, I'm not expecting to support every single frameklwork verison, however, I think localCDN should have an optiopn for verbose mode where it reports on the pop-up dashboard that there is version mismatch and instead of a green counter make it yellow (orange?) so I can see at a glance what can be the issue.

I spent about 30 minuets trying to understand what exactly broke the site despite localCDN happily reporting that it served all resources locally.

Additional request:
Please add an option to add obscure framework versions esily. I went and collected all the required frameworks only to realize that the helper just fetches pre-defined version instead of what is available in resources:

 } else if (type.includes('/bootstrap.css/4.')) {
 return '4.4.1';
**Consider the following:** https://ezchan.org/ This site uses resources that are not a part of localCDN, which is fine. What isnt fine is that it still serves other versions as if they are interchangeable. Sure, sometimes they are, but only sometimes As you can see serving higher versions of these frameworks break the site. Now, I'm not expecting to support every single frameklwork verison, however, I think localCDN should have an optiopn for `verbose` mode where it reports on the pop-up dashboard that there is version mismatch and instead of a green counter make it yellow (orange?) so I can see at a glance what can be the issue. I spent about 30 minuets trying to understand what exactly broke the site despite localCDN happily reporting that it served all resources locally. **Additional request:** Please add an option to add obscure framework versions esily. I went and collected all the required frameworks only to realize that the helper just fetches pre-defined version instead of what is available in resources: ```js } else if (type.includes('/bootstrap.css/4.')) { return '4.4.1'; ```

Thank you very much for your report and suggestion.

Normally I monitor the most popular frameworks for new updates. If there is an update, I will implement it as soon as possible.

https://ezchan.org/

The website uses the integrity and crossorigin attributes to include the framework. If I activate the HTML filter, everything is displayed correctly.

The HTML filter is not always possible, e.g. if the website uses a strict same-origin policy. In other cases it isn't recommended to use it, if the website is going to handle user input (e.g. databases) and does not use UTF-8 as charset. More information can be found in the Wiki: Broken JavaScript or CSS on some websites

Please try the HTML filter and then let me know if the website works as expected.

Thank you very much for your report and suggestion. Normally I monitor the most popular frameworks for new updates. If there is an update, I will implement it as soon as possible. > https://ezchan.org/ The website uses the integrity and crossorigin attributes to include the framework. If I activate the HTML filter, everything is displayed correctly. The HTML filter is not always possible, e.g. if the website uses a strict [same-origin policy](https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy). In other cases it isn't recommended to use it, if the website is going to handle user input (e.g. databases) and does not use UTF-8 as charset. More information can be found in the Wiki: [Broken JavaScript or CSS on some websites](https://codeberg.org/nobody/LocalCDN/wiki/Broken-JavaScript-or-CSS-on-some-websites) Please try the HTML filter and then let me know if the website works as expected.
Author
Copy link

If I activate the HTML filter, everything is displayed correctly.

There are obvious reasons I dont want to do that and they are related to security.
Skipping the rest of the issue I think:

I think localCDN should have an optiopn for verbose mode where it reports on the pop-up dashboard that there is version mismatch and instead of a green counter make it yellow (orange?) so I can see at a glance what can be the issue.

still would be useful.

> If I activate the HTML filter, everything is displayed correctly. There are obvious reasons I dont want to do that and they are related to security. Skipping the rest of the issue I think: > I think localCDN should have an optiopn for verbose mode where it reports on the pop-up dashboard that there is version mismatch and instead of a green counter make it yellow (orange?) so I can see at a glance what can be the issue. still would be useful.

There are obvious reasons I dont want to do that and they are related to security.

Hmm, I don't get it. These attributes force you to load the framework from a CDN. The integrity (the hash value of the file) is related to the file content. If the file changes (this happens when replacing versions), the check fails and the browser does not load the framework. The same applies to the crossorigin attribute. You can download the extension as an XPI file, unzip it and check the resources manually if you like. 😉

still would be useful.

Yes, think about that. The counter would then probably very often be orange instead green. A framework would be enough to change the color. Alternatively, in the popup but the user would have to open it to see it. 🤔

> There are obvious reasons I dont want to do that and they are related to security. Hmm, I don't get it. These attributes force you to load the framework from a CDN. The [integrity](https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity) (the hash value of the file) is related to the file content. If the file changes (this happens when replacing versions), the check fails and the browser does not load the framework. The same applies to the [crossorigin](https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/crossorigin) attribute. You can download the extension as an XPI file, unzip it and check the resources manually if you like. :wink: > still would be useful. Yes, think about that. The counter would then probably very often be orange instead green. A framework would be enough to change the color. Alternatively, in the popup but the user would have to open it to see it. 🤔
Author
Copy link

The counter would then probably very often be orange instead green.

Make it only work if said "verbose" mode is enabled to avoid it being an new annoyance for existing users?

> The counter would then probably very often be orange instead green. Make it only work if said "verbose" mode is enabled to avoid it being an new annoyance for existing users?

What do you think about this:

Enable Dark Mode

What do you think about this: [<img src="https://www.localcdn.org/img/screenshots/screenshot9894.png" alt="Enable Dark Mode" width="200"/>](https://www.localcdn.org/img/screenshots/screenshot9894.png)
Author
Copy link

Looks good, so if there is a version match it will display it as it is?

Looks good, so if there is a version match it will display it as it is?

@Kein

Looks good, so if there is a version match it will display it as it is?

The arrow stands for Upgrade. In the screenshot: WOW v1.1.2 has no arrow, so no upgrade.

Also, looking at your helper - have you tested how is Map performance? On Chromium 80+ it always faster to me.

The performance depends on many factors. Internet connection*, CPU, RAM, etc. The difference is minimal and hardly measurable. In the Helper class I have given a short comparison. It also depends on which and how many frameworks are included from a website. Of course there are also differences between the browsers, which does not necessarily have anything to do with an extension.

*) If you also compare CDN and Decentraleyes/LocalCDN

Chromium based browsers are normally not tested by me, because the browser doesn't support useful features, e.g. the replacement of Font Awesome or Google Material Icons.

@Kein >Looks good, so if there is a version match it will display it as it is? The arrow stands for Upgrade. In the screenshot: WOW v1.1.2 has no arrow, so no upgrade. >Also, looking at your `helper` - [have you tested how is Map performance](https://jsben.ch/o0UDx)? On Chromium 80+ it always faster to me. The performance depends on many factors. Internet connection*, CPU, RAM, etc. The difference is minimal and hardly measurable. In the Helper class I have given a short comparison. It also depends on which and how many frameworks are included from a website. Of course there are also differences between the browsers, which does not necessarily have anything to do with an extension. *) If you also compare CDN and Decentraleyes/LocalCDN Chromium based browsers are normally not tested by me, because the browser doesn't support useful features, e.g. the replacement of Font Awesome or Google Material Icons.
Author
Copy link

Fair enough.

Fair enough.

Implemented in v2.2.17

Implemented in v2.2.17
Author
Copy link

image

This is not a big deal but an you use some common unicode or ANSI special chars here instead of some late additions?

![image](/attachments/d6b296bb-0c4e-40b6-bb14-be3f2f0dcbd0) This is not a big deal but an you use some common unicode or ANSI special chars here instead of some late additions?
Sign in to join this conversation.
No Branch/Tag specified
main
develop
experimental
v2.6.85
v2.6.84
v2.6.83
v2.6.82
v2.6.81
v2.6.80
v2.6.79
v2.6.78
v2.6.77
v2.6.76
v2.6.75
v2.6.74
v2.6.73
v2.6.72
v2.6.71
v2.6.70
v2.6.69
v2.6.68
v2.6.67
v2.6.66
v2.6.65
v2.6.64
v2.6.63
v2.6.62
v2.6.61
v2.6.60
v2.6.59
v2.6.58
v2.6.57
v2.6.56
v2.6.55
v2.6.54
v2.6.53
v2.6.52
v2.6.51
v2.6.50
v2.6.49
v2.6.48
v2.6.47
3.0.0beta2
3.0.0beta1
v2.6.46
v2.6.45
v2.6.44
v2.6.43
v2.6.42
v2.6.41
v2.6.40
v2.6.39
v2.6.38
v2.6.37
v2.6.36
v2.6.35
v2.6.34
v2.6.33
v2.6.32
v2.6.31
v2.6.30
v2.6.29
v2.6.28
v2.6.27
v2.6.26
v2.6.25
v2.6.24
v2.6.23
v2.6.22
v2.6.21
v2.6.20
v2.6.19
v2.6.18
v2.6.17
v2.6.16
v2.6.15
v2.6.14
v2.6.13
v2.6.12
v2.6.10
v2.6.9
v2.6.8
v2.6.7
v2.6.6
v2.6.5
v2.6.4
v2.6.3
v2.6.2
v2.6.1
v2.6.1beta1
v2.6.0
v2.6.0beta5
v2.6.0beta4
v2.6.0beta2
v2.5.13
v2.5.12
v2.5.11
v2.5.10
v2.5.9
v2.5.8
v2.5.7
v2.5.6
v2.5.5
v2.5.4
v2.5.3
v2.5.2
v2.5.1
v2.5.0
v2.4.0
v2.3.1.10
v2.3.1
v2.3.0
v2.2.18.3
v2.2.17.2
v2.2.17
v2.2.16.1
v2.2.16
v2.2.15
v2.2.14.2
v2.2.14
v2.2.13
v2.2.12
v2.2.10
v2.2.9
v2.2.8
v2.2.7.5
v2.2.7
v2.2.6
v2.2.5
v2.2.4
v2.2.3
v2.2.2
v2.2.1
v2.2.0
v2.1.14
v2.1.13
v2.1.12
v2.1.11
v2.1.10
v2.1.9
v2.1.8
v2.1.7
v2.1.6
v2.1.5
v2.1.4.3
v2.1.4
v2.1.3
v2.1.2
v2.1.1
v2.1.0
v2.0.24
v2.0.23
v2.0.22
v2.0.21
v2.0.20
v2.0.19
v2.0.18
v2.0.17
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
nobody/LocalCDN#68
Reference in a new issue
nobody/LocalCDN
No description provided.
Delete branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?