-
-
Notifications
You must be signed in to change notification settings - Fork 2.7k
Description
NOTE: This is a living document, it does not contain every difference currently and will be added to.
Neat site for checking the connection side of things (not sure of trustworthiness, take it with a grain of salt): https://cloudflare.manfredi.io/en/tools/connection/
- navigator.plugins is empty (presumably because we report no PDF support, see
navigator.pdfViewerEnabled)navigator.mimeTypes is empty (presumably because we report no PDF support, seenavigator.pdfViewerEnabled)Missingfirst-inputperformance entry typeMissingpaintperformance entry type (includingfirst-paintandfirst-contentful-paint)Missingnavigationperformance entry typeMissingresourceperformance entry type (definitely needs implementing, disablingdom.enable_resource_timingin Firefox makes it never pass)Missingvisibility-stateperformance entry typeMissinglong-animation-frameperformance entry typeMissing WEBGL_debug_renderer_info extension for unmasked vendor/renderer infoBlob URLs for workers don't work, reportingDedicatedWorkerHost: Unable to fetch script blob:https://localhost:8080/c838e9e6-b238-4210-a349-9c909821d0a5 because script was nullnavigator.hardwareConcurrency always reports 1window.outerWidth and window.outerHeight report 0 (used in zoom calculation if it thinks we're chromium: Math.round((window.outerWidth / window.innerWidth) * 100) / 100)Thinks we're Firefox due to missing window.chrome and window.webkitRequestAnimationFrame, which makes it resort to probingmin--moz-device-pixel-ratioviawindow.matchMediafor zoom calculation, and reporting "ff" in the same testtypeofdocument.allis not"undefined"Missing screen.availTopMissing screen.availLeftMissing screen.orientation (angle, onchange, lock, unlock, type, inherits EventTarget)Missing screen.onchangeMissing screen.isExtendedScreen does not inherit EventTargetMissing OfflineAudioContext (random fingerprint challenge, see LibWeb: Implement OfflineAudioContext #224)This spec issue for WWW-Authenticate needs resolving:
ladybird/Userland/Libraries/LibWeb/Fetch/Fetching/Fetching.cpp
Lines 1582 to 1583 in e800605
// 1. Needs testing: multiple `WWW-Authenticate` headers, missing, parsing issues. // (Red box in the spec, no-op) This spin in execute_script causes the SubtleCrypto::digest task to run out of order in the layout fingerprint challenge, effectively causing an assertion failure in the Turnstile VM:
ladybird/Userland/Libraries/LibWeb/HTML/HTMLScriptElement.cpp
Lines 73 to 74 in e800605
if (!m_document->ready_to_run_scripts()) main_thread_event_loop().spin_until([&] { return m_document->ready_to_run_scripts(); }); Canvas issues in fingerprinting: LibWeb: Discrepancies between Turnstile and other engines in canvas fingerprinting #225Assuming it scans all HTTP headers sent, we likely need to implement this:
// FIXME: 13. Append the Fetch metadata headers for httpRequest. Additionally, the priority header, shipped in Firefox and Safari and soon for Chrome: https://chromestatus.com/feature/5109106573049856Missing HTMLScriptElement#async (7f0920b)Missing Document#lastModifiedMissing navigator.maxTouchPointsMissing AnalyserNode#getFloatTimeDomainDataMissing AudioBuffer#copyFromChannelMissing HTMLCanvasElement#captureStreamMissing AnalyserNode#maxDecibelsMissing AnalyserNode#getByteTimeDomainDataMissing CanvasRenderingContext2D#getLineDashMissing BiquadFilterNode#getFrequencyResponseMissing SVGTextContentElement#getExtentOfCharMissing OffscreenCanvasRenderingContext2D#isPointInStrokeMissing Window.closedUIEvent.detail always reports 0 instead of the current click countMouseEvent.movementX and MouseEvent.movementY always reports 0Missing MouseEvent.relatedTargetMissing MouseEvent.layerX and MouseEvent.layerYclick event doesn't dispatch a PointerEvent, but instead a MouseEvent, including synthetic clicks via Element#click (likely an issue for other events too)Missing PointerEvent and all of it's attributes and functionsWe don't set Event#timestamp, defaulted to 0 (at least for click event)<link rel="preload" as="...">doesn't follow the spec at all, using ResourceLoader directly (missing fetch headers, missing window load event delay, etc.)Missing console.dirxmlMissing console.tableJSON.stringify(window.getComputedStyle(document.body))returns{}instead of the serialization of all the properties and their valuesMissing WebGLRenderingContextBase.getParameterMissing WebGLRenderingContext2#bufferData()Missing WebGLRenderingContext2#readPixels()Content Security PolicyTo pick up a draggable item, press the space bar. While dragging, use the arrow keys to move the item. Press space again to drop the item in its new position, or press escape to cancel.
CSS and serialization via cssText:
- url() function serialize with the base URL of the origin, when it shouldn't, e.g. hosted on
https://localhost:8080, this:To pick up a draggable item, press the space bar. While dragging, use the arrow keys to move the item. Press space again to drop the item in its new position, or press escape to cancel.
.OwaTZc4{background-image:url('/cdn-cgi/challenge-platform/h/b/cmg/1/hV7fTYrIy7e%2FC5FuCgYHr5Utjf5x6tY32TUpCSZd1P8%3D'); background-position: -1px -1px; background-repeat:no-repeat;}Serializes as:
.OwaTZc4 { background-image: url(\"https://localhost:8080/cdn-cgi/challenge-platform/h/b/cmg/1/hV7fTYrIy7e%2FC5FuCgYHr5Utjf5x6tY32TUpCSZd1P8%3D\"); background-position: left -1px top -1px; background-repeat: no-repeat no-repeat; }- Combined percentages in
@keyframeare serialized separately instead of together, e.g.:To pick up a draggable item, press the space bar. While dragging, use the arrow keys to move the item. Press space again to drop the item in its new position, or press escape to cancel.
@keyframes scale {
0%, 100% {
transform: none;
}
50% {
transform: scale3d(1, 1, 1);
}
}Should serialize as:
@keyframes scale {
0%, 100% { transform: none; }
50% { transform: scale3d(1, 1, 1); }
}But we serialize it as:
@keyframes "scale" {
0% {
transform: none;
}
100% {
transform: none;
}
50% {
transform: scale3d(1, 1, 1);
}
}Fail to parse and serialize multiple animations declared in one animation property, e.g.
animation: fillfail 0.4s ease-in-out 0.4s forwards, scale 0.3s ease-in-out 0.9s both;Some properties are serialized as full form when they shouldn't:
text-decoration: underline;->text-decoration: underline auto solid currentcolor;border-radius: 50%;->border-radius: 50% 50% 50% 50% / 50% 50% 50% 50%;animation: scale-up-center 0.6s cubic-bezier(0.55, 0.085, 0.68, 0.53) both;->animation: cubic-bezier(0.55, 0.085, 0.68, 0.53) normal scale-up-center running 0s 0.6s both 1;(note that this is also serialized out of order)background: #fff;->background: rgb(255, 255, 255) none left 0% top 0% auto auto repeat repeat scroll padding-box border-box;- Weird one:
flex-flow: column nowrap;(as specified in the actual style sheet) should serialize asflex-flow: column, but we keep it as is - Same with
flex-flow: row nowrap;andflex-flow: row-reverse nowrap;
To pick up a draggable item, press the space bar. While dragging, use the arrow keys to move the item. Press space again to drop the item in its new position, or press escape to cancel.
Missing stroke-dashoffset and it's serialization
Missing stroke-linecap and it's serialization
Missing stroke-miterlimit and it's serialization
Missing stroke-dasharray and it's serialization
Missing stroke-linejoin and it's serialization
This:
margin: 0;
margin-top: 6px;
margin-left: 16px;Should serialize as:
margin: 6px 0px 0px 16px;- This:To pick up a draggable item, press the space bar. While dragging, use the arrow keys to move the item. Press space again to drop the item in its new position, or press escape to cancel.
background-color: white;Should stay as is, but we serialize it as:
background-color: rgb(255, 255, 255);
Activity
shlyakpavel commentedon Dec 7, 2024
As far as I understand, we have
Lubrsi commentedon Dec 28, 2024
I cloned WebKit locally and it passes Turnstile. As an experiment to find what changes we can potentially get away with, I modified it until it stopped passing, then undid that change. From that, I found:
<link>elements to work (I added a return to HTMLLinkElement::process, so it wouldn't even load stylesheets, let alone preloads)This isn't to say that it doesn't dock points from the bot score however, though we don't have any insight into that.