site hack: xtcore.js on www.lesechos.fr is not blocked

[btlechowski]

Steps to Reproduce

1. Open www.lesechos.fr and check if xtcore.js is blocked

Actual result:

xtcore.js is not blocked

I checked through debugger that xtcore.js code is executed.
We have a site hack for blocking the script #84, but path to xtcore.js has changed
from: https://www.lesechos.fr/xtcore.js
to https://assets.lesechos.com/common/js/xtcore.js

Expected result:

Blocks https://assets.lesechos.com/common/js/xtcore.js

Reproduces how often:

always

Brave version (chrome://version info)

Brave	0.55.6 Chromium: 70.0.3538.16 (Official Build) dev (64-bit)
Revision	16ed95b41bb05e565b11fb66ac33c660b721f778-refs/branch-heads/3538@{#306}
OS	Windows 7

Reproducible on current release:

Brave	0.55.6 Chromium: 70.0.3538.16 (Official Build) dev (64-bit)
Revision	16ed95b41bb05e565b11fb66ac33c660b721f778-refs/branch-heads/3538@{#306}
OS	Windows 7

cc @bbondy @kjozwiak @LaurenWags @srirambv @GeetaSarvadnya

[LaurenWags]

reproduces on macOS

Brave	0.55.10 Chromium: 70.0.3538.22 (Official Build) beta(64-bit)
Revision	ac9418ba9c3bd7f6baaffa0b055dfe147e0f8364-refs/branch-heads/3538@{#468}
OS	Mac OS X

[kjozwiak]

Reproducible under Ubuntu 18.04 x64 using the following build:

Brave	0.55.10 Chromium: 70.0.3538.22 (Official Build) beta (64-bit)
Revision	ac9418ba9c3bd7f6baaffa0b055dfe147e0f8364-refs/branch-heads/3538@{#468}
OS	Linux

[tildelowengrimm]

Does the same thing happen with Shields down?

[kjozwiak]

Does the same thing happen with Shields down?

Yup, same results with Shields being disabled on all b-c channels. Example:

Checked on the following builds using macOS 10.14 x64:

• 0.56.12 release Chromium: 70.0.3538.77 - Reproduced with Shields down
• 0.57.6 beta Chromium: 71.0.3578.31 - Reproduced with Shields down
• 0.57.4 dev Chromium: 71.0.3578.31 - Reproduced with Shields down

[tildelowengrimm]

Just to make sure I understand the issue here: xtcore.js is a piece of tracking tech which we should block, but don't. This issue is a request to block it. Right?

[kjozwiak]

@tomlowenthal from my understanding, that's correct 👍 We have several site hacks for a few specific websites which includes www.lesechos.fr which is supposed to block xtcore.js which isn't happening as @btlechowski mentioned in the original issue. We had these site hacks in b-l [1] which were ported into b-c [2].

• [1] https://github.com/brave/browser-laptop/blob/master/js/data/siteHacks.js
• [2] Add site-hacks from browser-laptop #84

[tildelowengrimm]

I'm confused — why are these implemented as site-hacks rather than being part of the regular block lists. Is there an implementation detail I'm missing?

[bbondy]

This was just a port from browser-laptop. The real fix for this is to add a ad-blocking easylist rule and remove the site hack.

[bbondy]

Fixed by brave/adblock-lists@29671ed

[btlechowski]

Still reproducible on

Brave	0.63.14 Chromium: 73.0.3683.75 (Official Build) dev (64-bit)
Revision	909ee014fcea6828f9a610e6716145bc0b3ebf4a-refs/branch-heads/3683@{#803}
OS	Windows 10 OS Build 17134.523

The script is not listed in blocked ads and trackers:

https://assets.lesechos.com/lesechos/pics-news/js/pub/dfp.js?230
https://www.googletagmanager.com/gtm.js?id=GTM-MKQ9QG
https://script.ownpage.fr/v1/ownpage.js
https://logs1122.xiti.com/hit.xiti?s=542199&s2=1&p=home_page::accueil&ati=INT-27-Y||Z&ac=1&an=0&lng=en-US&idp=2032391282829&jv=0&re=767x336&vtag=4.7.0LesEchos&hl=20x32x39&r=1920x1080x24x24&rn=1553023959149&stc={%22decompte_paywall%22%3A%22%22,%22device%22%3A%22tablet%22,%22weborama%22%3A{%22info%22%3A{%22version%22%3A%222.0.0%22,%22accountid%22%3A2590,%22message%22%3A%22%22,%22errors%22%3A[%22timeout%22]}}}&ref=https://www.lesechos.fr/
https://static.chartbeat.com/js/chartbeat.js

@bbondy @pilgrim-brave Am I missing something?

[GeetaSarvadnya]

Still Reproducible on

Brave	0.63.15 Chromium: 73.0.3683.75 (Official Build) dev (64-bit)
Revision	909ee014fcea6828f9a610e6716145bc0b3ebf4a-refs/branch-heads/3683@{#803}
OS	Linux

[btlechowski]

The website in question changes so it no longer uses xtcore.js.
Setting the issue to invalid.