extract canvas data - firefox permissions

[dajohi]

https://riot.im/app causes Firefox 66.0.2 to prompt for permission to allow 'extract canvas data'.

Do you know the cause?

[jryans]

Do you have privacy.resistFingerprinting set to true in about:config?

Do you see this prompt immediately on loading Riot?

[dajohi]

Yes to both questions.

[jryans]

We do use a <canvas> and read data out of it when creating image thumbnails for uploading images and videos...

But I guess it's unlikely that happens on load. Do you see any error in the Console if you deny the permission?

[jryans]

I am able to replicate the behaviour you mention by setting privacy.resistFingerprinting. I'm not quite sure what's trigger this on load. My first guess is some library is eagerly testing for canvas support by calling one of the blocked methods.

Unfortunately, there's no logging of what code triggered, so it may take some digging to find why this is happening. 😖

Anyway, it's certainly not intentional for this to happen on load.

[jryans]

We're investigating the trigger, and I hope to have more details soon.

[jryans]

This is being triggered by the favico.js library that we use to apply a badge to favicon when notifications come in.

We could try to delay this at least until you are logged in, but it would likely still be surprising...

We'll have to think about the best way to proceed here.

[jryans]

Firefox's existing logs weren't very helpful in diagnosing this issue, so I filed a Firefox bug with patches to improve this for the next person.