fixing some navigator object values

Talk about code development, features, specific bugs, enhancements, patches, and similar things.
Forum rules
Please keep everything here strictly on-topic.
This board is meant for Pale Moon source code development related subjects only like code snippets, patches, specific bugs, git, the repositories, etc.

This is not for tech support! Please do not post tech support questions in the "Development" board!
Please make sure not to use this board for support questions. Please post issues with specific websites, extensions, etc. in the relevant boards for those topics.

Please keep things on-topic as this forum will be used for reference for Pale Moon development. Expect topics that aren't relevant as such to be moved or deleted.
User avatar
noellarkin
Fanatic
Fanatic
Posts: 110
Joined: 2021-07-27, 04:20

fixing some navigator object values

Unread post by noellarkin » 2024-06-16, 17:13

the value of the navigator object "webdriver" is supposed to be one of the indicators of whether a browser is a real user or being controlled by some kind of bot automation.
In Firefox, the value of navigator.webdriver is "false", whereas in Pale Moon, the value is "undefined".
Given that most feature detection algorithms try to block automated bots, perhaps it would be a good idea to set Pale Moon's `navigator.webdriver` value to "false" as well? AFAIK there aren't any automation frameworks that are compatible with it anyway.

User avatar
Moonchild
Pale Moon guru
Pale Moon guru
Posts: 36020
Joined: 2011-08-28, 17:27
Location: Motala, SE
Contact:

Re: fixing some navigator object values

Unread post by Moonchild » 2024-06-16, 18:56

I'm sorry but I don't see why "undefined" would be problematic. We don't support WebDriver and will not support it. Indicating a value would suggest we do support it.

In addition, note the following quote:
Mozilla wrote:The navigator.webdriver attribute is meant as an indication to web authors that a document is visited by WebDriver. It is important to stress that it is not meant as a fool-proof way to detect that a website is being visited by a browser automation tool, but as a tool for web documents to take alternate code paths.
It's not there to detect browser automation tools; it's only there to provide differing results; not unlike the way this forum behaves differently when visited by known bots.
"Just because you are offended doesn't mean you are right." -- unknown
"Seek wisdom, not knowledge. Knowledge is of the past; wisdom is of the future." -- Native American proverb
"Linux makes everything difficult." -- Lyceus Anubite

User avatar
noellarkin
Fanatic
Fanatic
Posts: 110
Joined: 2021-07-27, 04:20

Re: fixing some navigator object values

Unread post by noellarkin » 2024-06-17, 05:41

I agree, perhaps the webdriver property wasn't originally intended to detect automation, however there's abundant evidence of it being used to do so in the wild. Some examples around the web:

Here's an article from Datadome (a feature detection algorithm):
https://datadome.co/threat-research/det ... um-chrome/
A straightforward and well-known approach to detecting Selenium is to test if navigator.webdriver is equal to true.
A guide by fingerprintJS (a popular browser fingerprinting library) on how to DIY a bot detection script:
https://fingerprint.com/blog/build-your ... on-script/
One of the simplest places to find signals for bot detection is to look at the Navigator object. This object is a part of the Window interface and represents the state and identity of the user's browser. It has information about the browser itself, including its version, the operating system it's running on, and various capabilities of the browser environment.
Within the navigator object, the webdriver property is especially useful as it indicates whether the browser is being controlled by automation tools such as Selenium, Puppeteer, or other automated testing frameworks. Unlike many other indicators that require interpretation or analysis, these tools typically set the navigator.webdriver property to true to indicate automation control. Add this property to the detectors object.
And pretty much every single article on bot detection
https://medium.com/@browserscan/browser ... 2ac81156ae
When Selenium or Puppeteer controls the browser, it sets the window.navigator.webdriver property to true. This is a standard way to let websites know that the browser is being controlled by automation tools. However, this also means that any website that can execute JavaScript can detect this property.
It seems to me that - - especially since Pale Moon doesn't even work with Selenium webdriver, there's nothing lost by setting the property as "false" instead of undefined, especially when feature detection algos are specifically looking for webdriver values as an obvious indicator of automation.

User avatar
Moonchild
Pale Moon guru
Pale Moon guru
Posts: 36020
Joined: 2011-08-28, 17:27
Location: Motala, SE
Contact:

Re: fixing some navigator object values

Unread post by Moonchild » 2024-06-17, 06:42

Sure. This will take all but 5 minutes to implement and it's part of the web drafts anyway. Takes less time than continuing to discuss ;)

EDIT: https://repo.palemoon.org/MoonchildProductions/UXP/commit/0886ccfa955f5b24a5e63a310d9f543ab180049c
"Just because you are offended doesn't mean you are right." -- unknown
"Seek wisdom, not knowledge. Knowledge is of the past; wisdom is of the future." -- Native American proverb
"Linux makes everything difficult." -- Lyceus Anubite

User avatar
noellarkin
Fanatic
Fanatic
Posts: 110
Joined: 2021-07-27, 04:20

Re: fixing some navigator object values

Unread post by noellarkin » 2024-06-17, 08:41

that was FAST, thank you :)

User avatar
Moonchild
Pale Moon guru
Pale Moon guru
Posts: 36020
Joined: 2011-08-28, 17:27
Location: Motala, SE
Contact:

Re: fixing some navigator object values

Unread post by Moonchild » 2024-06-17, 08:46

noellarkin wrote:
2024-06-17, 08:41
that was FAST, thank you :)
Note that this missed the current dev cycle (there's a release tomorrow) so it won't be in release for a little while yet.
"Just because you are offended doesn't mean you are right." -- unknown
"Seek wisdom, not knowledge. Knowledge is of the past; wisdom is of the future." -- Native American proverb
"Linux makes everything difficult." -- Lyceus Anubite

User avatar
noellarkin
Fanatic
Fanatic
Posts: 110
Joined: 2021-07-27, 04:20

Re: fixing some navigator object values

Unread post by noellarkin » 2024-06-20, 11:20

Looking forward to it :)

Post Reply