<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>245625</bug_id>
          
          <creation_ts>2022-09-24 10:45:34 -0700</creation_ts>
          <short_desc>[SOUP] Spammed by 0-byte downloads on imgur.com</short_desc>
          <delta_ts>2022-10-26 06:42:17 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>WebKitGTK</component>
          <version>WebKit Nightly Build</version>
          <rep_platform>PC</rep_platform>
          <op_sys>Linux</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          <see_also>https://bugs.webkit.org/show_bug.cgi?id=238378</see_also>
    
    <see_also>https://bugs.webkit.org/show_bug.cgi?id=238748</see_also>
    
    <see_also>https://bugs.webkit.org/show_bug.cgi?id=247059</see_also>
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords></keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Michael Catanzaro">mcatanzaro</reporter>
          <assigned_to name="Carlos Garcia Campos">cgarcia</assigned_to>
          <cc>bugs-noreply</cc>
    
    <cc>cgarcia</cc>
    
    <cc>karlcow</cc>
    
    <cc>mcatanzaro</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>1900911</commentid>
    <comment_count>0</comment_count>
    <who name="Michael Catanzaro">mcatanzaro</who>
    <bug_when>2022-09-24 10:45:34 -0700</bug_when>
    <thetext>Reproducer: visit https://imgur.com/

imgur will immediately download three 0-byte files: sync, pixelSync, and ingest. This does not happen in Firefox. All three files are downloaded again for every reload or navigation on imgur.com.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1901712</commentid>
    <comment_count>1</comment_count>
    <who name="Karl Dubost">karlcow</who>
    <bug_when>2022-09-28 00:58:02 -0700</bug_when>
    <thetext>Michael, 

I do not see the 0-byte downloads as you mentioned. 
Is this still happening?
Do you have more details about your setup?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1901769</commentid>
    <comment_count>2</comment_count>
    <who name="Michael Catanzaro">mcatanzaro</who>
    <bug_when>2022-09-28 06:51:11 -0700</bug_when>
    <thetext>(In reply to Karl Dubost from comment #1)
&gt; Michael, 
&gt; 
&gt; I do not see the 0-byte downloads as you mentioned. 

You need to use WebKitGTK or WPE WebKit, which use the libsoup network backend.

&gt; Is this still happening?

Yes.

&gt; Do you have more details about your setup?

I use Epiphany Tech Preview from https://webkit.org/downloads/</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1901970</commentid>
    <comment_count>3</comment_count>
    <who name="Carlos Garcia Campos">cgarcia</who>
    <bug_when>2022-09-29 00:33:48 -0700</bug_when>
    <thetext>I can&apos;t reproduce it either with epiphany.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1905664</commentid>
    <comment_count>4</comment_count>
    <who name="Michael Catanzaro">mcatanzaro</who>
    <bug_when>2022-10-14 10:08:56 -0700</bug_when>
    <thetext>Started looking into this. Epiphany&apos;s decide-policy callback uses webkit_response_policy_decision_is_mime_type_supported() and downloads anything not supported by WebKit, which is surely correct... at least, it seems like what we intend for browsers to do with the response policy decision; it doesn&apos;t make sense to have webkit_response_policy_decision_is_mime_type_supported() otherwise. When this happens, MIMETypeRegistry::canShowMIMEType returns &quot;application/octet-stream&quot;, which is of course not supported.

I&apos;m not sure what to do next. I don&apos;t think browsers should require special code to skip 0-byte resources, and I also don&apos;t we should skip the policy decision for 0-byte resources. I&apos;m not sure if it&apos;s safe for WebKit to block them; they&apos;re almost certainly tracking pixels, which users don&apos;t like, but I wouldn&apos;t be surprised if some websites break if we don&apos;t let them load.

I wonder why Carlos Garcia is not able to reproduce with Epiphany. I actually wind up with 6-9 new downloads for each visit to imgur.com, since it repeats the same three 0-byte downloads again and again.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1905867</commentid>
    <comment_count>5</comment_count>
    <who name="Michael Catanzaro">mcatanzaro</who>
    <bug_when>2022-10-15 09:12:54 -0700</bug_when>
    <thetext>(In reply to Michael Catanzaro from comment #4)
&gt; I wonder why Carlos Garcia is not able to reproduce with Epiphany. I
&gt; actually wind up with 6-9 new downloads for each visit to imgur.com, since
&gt; it repeats the same three 0-byte downloads again and again.

If you visit https://order.noodles.com/ do you see the 0-byte asyncPixelSync that gets downloaded?

Although unlikely, it&apos;s possible this could differ if you&apos;re using a different version of shared-mime-info.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1906426</commentid>
    <comment_count>6</comment_count>
    <who name="Carlos Garcia Campos">cgarcia</who>
    <bug_when>2022-10-18 03:18:21 -0700</bug_when>
    <thetext>I can reproduce with order.noodles.com. This needs 3 fixes in 3 different places:

1.- libsoup: sniffer is not run in http/2 for resources with no content. In http/1 the sniffer sets the content type as text/plain, we should do the same for http/2. This would fix the bug, because can show mime type will return true.

2.- Epiphany: should never try to download subresources that can&apos;t be handled by the web view.

3.- WebKit: should not ignore subresources with no content. After fixing libsoup this can only happen when the sniffer is disabled.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1906442</commentid>
    <comment_count>7</comment_count>
    <who name="Carlos Garcia Campos">cgarcia</who>
    <bug_when>2022-10-18 06:30:47 -0700</bug_when>
    <thetext>Pull request: https://github.com/WebKit/WebKit/pull/5489</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1906448</commentid>
    <comment_count>8</comment_count>
    <who name="Carlos Garcia Campos">cgarcia</who>
    <bug_when>2022-10-18 06:42:08 -0700</bug_when>
    <thetext>(In reply to Carlos Garcia Campos from comment #6)
&gt; I can reproduce with order.noodles.com. This needs 3 fixes in 3 different
&gt; places:
&gt; 
&gt; 1.- libsoup: sniffer is not run in http/2 for resources with no content. In
&gt; http/1 the sniffer sets the content type as text/plain, we should do the
&gt; same for http/2. This would fix the bug, because can show mime type will
&gt; return true.

https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/325

&gt; 2.- Epiphany: should never try to download subresources that can&apos;t be
&gt; handled by the web view.

https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/1205

&gt; 3.- WebKit: should not ignore subresources with no content. After fixing
&gt; libsoup this can only happen when the sniffer is disabled.

https://github.com/WebKit/WebKit/pull/5489</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1906723</commentid>
    <comment_count>9</comment_count>
    <who name="EWS">ews-feeder</who>
    <bug_when>2022-10-19 01:29:34 -0700</bug_when>
    <thetext>Committed 255721@main (16644424b977): &lt;https://commits.webkit.org/255721@main&gt;

Reviewed commits have been landed. Closing PR #5489 and removing active labels.</thetext>
  </long_desc>
      
      

    </bug>

</bugzilla>