Tor browser wrecks images because of local optimization

Falco · February 17, 2022, 1:25pm

On my test the Tor browser blocked this call here:

app/assets/javascripts/discourse/app/lib/media-optimization-utils.js

1c73b97d5


      
            const canvas = document.createElement("canvas");
            canvas.width = width;
            canvas.height = height;
          
            // Draw image onto canvas
            const ctx = canvas.getContext("2d");
            if (!ctx) {
              throw "Could not create canvas context";
            }
            ctx.drawImage(drawable, sx, sy, sw, sh, 0, 0, width, height);
            const imageData = ctx.getImageData(0, 0, width, height);
            canvas.remove();
            return imageData;
          }
          
          function isTransparent(type, imageData) {
            if (!/(\.|\/)(png|webp)$/i.test(type)) {
              return false;
            }
          
            for (let i = 0; i < imageData.data.length; i += 4) {

with

Blocked https://try.discourse.org/ from extracting canvas data because no user input was detected.

which is obviously a lie, since the File Picker is user input.

That was detect by our failsafe mechanism:

Resize failed: Image corrupted during resize. Falling back to the original for encode

Which prompts Discourse to only re-encode the file, which appears to be successful, but then fails with a 422 when finishing the multi-part upload…

Tor Browser should block the canvas creation API instead of silently corrupting return values

Anyway, looks like users can disable the silently failure of canvas operations by toggling privacy.resistFingerprinting.autoDeclineNoUserInputCanvasPrompts on about:config which will allow users to see this prompt:

I just tested and that fixes the upload.

Topic		Replies	Views
How to disable use of HTML5 canvas image data? Product Support	7	2546	December 22, 2018
Client side image optimization enabled by default Announcements	3	1772	September 4, 2023
Testing composer image optimization Feature	31	5242	September 10, 2021
Image upload stuck with "Processing" message Product Support	10	2012	October 15, 2021
Faster (and smaller) uploads in Discourse with Rust, WebAssembly and MozJPEG \| Blog Blog	35	5844	May 13, 2025

Tor browser wrecks images because of local optimization

Related topics