Tor browser wrecks images because of local optimization

RGJ · February 17, 2022, 12:25pm

Uploading an image using the Windows Tor browser wrecks JPG uploads.

Setting composer media optimization image bytes optimization threshold to something ridiculously high circumvents the problem. This is very likely an issue with the Tor browser but so far it seems only to be happening in Discourse so I thought I’d post it here anyway, even if it’s only to share the workaround trick.

Falco · February 17, 2022, 1:25pm

On my test the Tor browser blocked this call here:

github.com

discourse/discourse/blob/1c73b97d508fd79e6c8eff0cc8a44bdc5084f4a7/app/assets/javascripts/discourse/app/lib/media-optimization-utils.js#L52


      
            const canvas = document.createElement("canvas");
            canvas.width = width;
            canvas.height = height;
          
            // Draw image onto canvas
            const ctx = canvas.getContext("2d");
            if (!ctx) {
              throw "Could not create canvas context";
            }
            ctx.drawImage(drawable, sx, sy, sw, sh, 0, 0, width, height);
            const imageData = ctx.getImageData(0, 0, width, height);
            canvas.remove();
            return imageData;
          }
          
          function isTransparent(type, imageData) {
            if (!/(\.|\/)(png|webp)$/i.test(type)) {
              return false;
            }
          
            for (let i = 0; i < imageData.data.length; i += 4) {

with

Blocked https://try.discourse.org/ from extracting canvas data because no user input was detected.

which is obviously a lie, since the File Picker is user input.

That was detect by our failsafe mechanism:

Resize failed: Image corrupted during resize. Falling back to the original for encode

Which prompts Discourse to only re-encode the file, which appears to be successful, but then fails with a 422 when finishing the multi-part upload…

Tor Browser should block the canvas creation API instead of silently corrupting return values

Anyway, looks like users can disable the silently failure of canvas operations by toggling privacy.resistFingerprinting.autoDeclineNoUserInputCanvasPrompts on about:config which will allow users to see this prompt:

I just tested and that fixes the upload.

RGJ · February 17, 2022, 3:51pm

Impressive. Thank you @falco!!!

Decorbuz · February 17, 2022, 4:25pm

In my experience, the same issue also occurs with some favicons (presumably uploaded as JPG files). Does toggling privacy.resistFingerprinting.autoDeclineNoUserInputCanvasPrompts also fix that issue?

Topic		Replies	Views
Image upload size/resize question Support	24	5148	April 4, 2021
Discourse loses the top/bottom pixels when generating thumbnails Feature	4	618	January 29, 2021
Testing composer image optimization Feature	33	4198	September 28, 2021
PNG's a no show Support	31	4213	September 4, 2023
Link image resizing issue (setting) Support	7	611	July 3, 2021

Tor browser wrecks images because of local optimization

Related topics