Version does not get set?

[espadrine]

Hi!

I think there is a bug in the following piece of code:

webrtc-protect/common.js

Lines 69 to 76 in ab08e47

	if (prefs.version ? (prefs.faqs && prefs.version !== version) : true) {
	chrome.storage.local.set({version}, () => {
	chrome.tabs.create({
	url: 'http://add0n.com/webrtc-protect.html?version=' + version +
	'&type=' + (prefs.version ? ('upgrade&p=' + prefs.version) : 'install')
	});
	});
	}

I maintain shields.io, and I noticed that I got a lot of hits from https://add0n.com/webrtc-protect.html?version=0.1.3&type=install. The kind of amount that only happens if your users call that endpoint a lot. North of 1000 hits every five minutes.

Could it be that the version does not get set properly in some version of Firefox? The MDN documentation does mention some incompatibilities: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/API/storage/StorageArea/get

[belaviyo]

Hello,

Are you sure the traffic is from this particular page or all the pages hosted on this domain? As far as I know, all the hosted open-source projects use shields.io. If this is causing issues, I can ask the support team to remove the shields.io entirely.

[belaviyo]

I just opened a new ticket for the issue. Will update when got a response.

[belaviyo]

Seems like this is a DOS attack not an issue with the extension. To confirm I updated the extension number to 0.1.4. Let's see if we get the traffic on 0.1.4 or not.

[espadrine]

The hits I see are specifically for the URL https://add0n.com/webrtc-protect.html?version=0.1.3&type=install. It is what I see from the Referer HTTP header. It also means that, if I read the code correctly, prefs.version is falsy, to generate specifically that URL.

There are indeed other add0n pages that use badges, but they incur nowhere near the number of hits.

There is no need to remove the shields badges, as you are not putting a significant strain at the moment. It was simply noticeable on my radar.

[belaviyo]

https://add0n.com/webrtc-protect.html?version=0.1.3&type=install

I requested to the admin to block this version code. So there is no more traffic from this version. Based on the report I got, the traffic is even from IE browser which we do not support so apparently it is not the extension traffic. I'll investigate more though.

if I read the code correctly, prefs.version is falsy, to generate specifically that URL

That is very unlikely. Anyhow, I'll keep an eye on this too. Thanks a lot for the heads up.

[espadrine]

I'll keep you in the loop, but since you updated to 0.1.4, I don't see anything anymore.