Repository: gorhill/uMatrix

Issue #912: uMatrix is causing iframe data to be mangled in the latest version of chrome
Created: 2018-01-09T22:52:07Z
Chrome Version 63.0.3239.132 (Windows 10, latest creators update)
uMatrix Version 1.2.0
I have an internal webpage for my company that uses many iframes to display content (even iframes within iframes). After allowing chrome to install the latest version, this website no longer works properly. When using the developer console, I can see the page requests for the iframe data is mangled. A small snippet of some of the data:
�‹��í½�`�I–%&/mÊ{�JõJ×àt¡�€`�$Ø�@�ìÁˆÍæ’ì�iG#)«*�ÊeVe]f�@Ìí�¼÷Þ{ï½÷Þ{ï½÷º;�N'÷ßÿ?\fd�löÎJÚÉž!€ªÈ�?~|�?"�ÿ®O¿šÎëj‘�¶û‘ôÃ�–�}òÑe‘_­ªºõ^º*fíü³Y~YLómþc”�Ë¢-²r»™f%Á�ï($�Ó÷Šóôì4=ø>�òc�›i]¬Ú´½^�ø6�×Þýéì2“Oå­�»*–³êj\VSÂ¸ZŽçu~ž~–~Ô.Ú:›¾�ÏÊò÷hæyY~Fôú…M;{™]ä¿°Í�«2kóÏòº^/›õ xç³_¸È›†¾ÿlï£C†þø®tÆ}=þ]¿—/gÅù÷ �å»�ôÒ¦ž~ö‘ûàîÞ½ÝÝ½�ÝOïß»�÷^=[eu{}·¬.ö]›ñO7��y}r/La�ŽN„ºÛo¨_�ÖŒ±@y˜NçYÝäíg_½y¶}ðQz—@õÁ¼ÇT��Aëë—FyAüÙ�Ýf�Ôä|½œbZÓf²x^]¼n×“­;¿ø—üÆ‰û{¼ª«¶��šö_ü�'iŠ‰Ï�¥æ]¼0Âç³|

Under normal circumstances this would be HTML. I narrowed down the issue to uMatrix by disabling a single plugin at a time. With uMatrix enabled, I see the problem consistently on with my internal website (note: I do have other sites that use far fewer iframes that do not show the problem). With uMatrix disabled, I see the problem with one or more iframes for this particular site. I do not believe it is necessarily related what rules are enabled as my first attempt at resolving the problem was simply to disable uMatrix for the base level domain. That seems to have had no impact on the issue.
I believe it is directly related to iframe processing as I can capture the URL that would be displayed in the iframe, load it as an individual tab, and the data loads completely normally, even with uMatrix enabled for the domain.
Something about this issues seems to be transient as well. As noted above, it doesn't happen to all pages with iframes, only on a particular page that has many iframes. If I refresh the page multiple times, some of the iframes will sometimes load correctly. More curiously, which iframes load correctly seems to change from refresh to refresh.

Duplicate issue #965: prevents proper handling of 302 by Chrome
Created: 2018-03-06T22:46:20Z
Trying to access a company intranet website (not publicly available). It uses a 302 redirect to bounce the client after authentication. With uMatrix enabled, regardless of rules or even if it is enabled for the site, the browser receives the 302 and does not redirect. When I disable the uMatrix extension, it loads properly.
The redirect location takes the form of https://a.b.com/login/?next=https://a.b.com/something/, which I can see in Developer Tools; the browser simply fails to handle the 302 by making a second request to the new location.
Two cookies are employed, csrftoken and sessionid, but as mentioned, the issue is exhibited regardless of rules. I have eliminated the possibility of the issue being as an interaction with another extension by disabling all other extensions.
This seems to be a recent development - this behavior did not present in Oct 2017
OS: Windows 7 Pro SP1
Browser: Chrome v64.0.3282.186
uMatrix v1.3.2

Closing comment (2018-03-06T23:15:29Z): This does not appear to be related to #912: there is no garbling and there are no iframes. I am using HTTPS though can't test whether it occurs with HTTP, since I am using the SPNEGO plugin for nginx, and it only functions with SSL on. Request and response data below.
General
Request URL:https://auth.xxx.com/
Request Method:GET
Status Code:302 FOUND
Remote Address:209.86.xxx.xxx:443
Referrer Policy:no-referrer-when-downgrade
Response Headers
Connection:keep-alive
Content-Type:text/html; charset=utf-8
Date:Tue, 06 Mar 2018 23:02:24 GMT
Location:https://auth.xxx.com/user/login?next=https://auth.xxx.com/
Server:nginx/1.12.2
Set-Cookie:sessionid=; expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Path=/
Transfer-Encoding:chunked
WWW-Authenticate:Negotiate oYGxMIGuoAMKAQChCwYJKoZIgvcSAQICooGZBIGWYIGTBgkqhkiG9xIBAgICAG+BgzCBgKADAgEFoQMCAQ+idDByoAMCAReiawRpDl1tK8FGwCM8h/bYFMkr10BVaiss3uOI7Ty2ArOmi/9CAKtRZ3gT5P1NnhSxPFn0pZBFQSXm1I96hNGdLlcvVepxrZcvMj6wutPJrksiNUfSRKWTVddKL4JhTTGTe7I0FslBHT3+o94=
X-Frame-Options:SAMEORIGIN
Request Headers
Accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8
Accept-Encoding:gzip, deflate, br
Accept-Language:en-US,en;q=0.9
Cache-Control:no-cache
Connection:keep-alive
Cookie:csrftoken=K8arK0kKyMEQCWEUFeq2AftL4og2jC5G; sessionid=2jsiguxaiewwz84tks3m7153h8d40gj2
DNT:1
Host:auth.xxx.com
Pragma:no-cache
Upgrade-Insecure-Requests:1
User-Agent:Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.186 Safari/537.36