Rewriting of local variable 'location' can incorrectly introduce a redirect

[ato]

Expected behavior

Replaying https://anzac100.initiatives.qld.gov.au/legacy-projects/bcc/index.aspx should not redirect to https://anzac100.initiatives.qld.gov.au/.

What actually happened

The script at https://anzac100.initiatives.qld.gov.au/assets/v3/script/qgov-environment.js contains the following code (reformatted for readability):

var productionSites = ['http://anzac100.initiatives.qld.gov.au','http://www.anzac100.initiatives.qld.gov.au'];
var swe = {isProduction: (function (location) {
    var i;
    location = location.protocol + '//' + location.hostname;
    for (i = 0; i < productionSites.length; i++) {
        if (productionSites[i] === location) {
            return true;
        }
    }
    return false;
}(window.location)}

Note that while the location parameter is a reference to window.location, the location = assignment to it is not a redirect, it just changes the value of the local variable.

Pywb however rewrites the location assignment line to this double assignment in which the .href assignment triggers a redirect to the base hostname:

location = ((self.__WB_check_loc && self.__WB_check_loc(location)) || {}).href = location.protocol + '//' + location.hostname;

We've worked around this by blocking access to the script in question as it's not needed for the site to function (it's just for analytics). I'm reporting this not because I expect we can fix it but as another interesting example we ran into in the wild that looks like it would be hard to rewrite correctly without a full JavaScript parser that can work out that 'location =' in this context is a local assignment.

Browser

• OS: Linux
• Browser Firefox
• Version 94.0.2

[ikreymer]

Thanks for sharing this. Yeah, this is a tricky edge case, luckily not something that happens very often. The location = assignment triggers an assignment only when the location is a global variable, even if the object is the same as the global one, and there's not really a definitive way to determine that.

Eg.

function no_reload (location) {
  location = location.href;
}
no_reload(location);

function reload() {
  location = location.href; // this will cause a reload
}
reload()

The best workaround I've found is to pass the arguments in to __WB_check_loc(location), and then skip the assignment if the one of the arguments matches the location. This will at least address this particular issue, but not generally, if the location is bound to a different closure, but hopefully that is less common..

[ikreymer]

This is now fixed in 2.6.3, as well as changes in wombat and also in wabac.js
It is not a general fix, but fixes this particular case, namely by passing arguments, eg. __WB_check_loc(location, arguments)`.

This way, that function can check if the location variable is a passed in argument, and in that case, no navigation happens. This is consistent with assigning to a local variable above.

Of course, this only works if the location is in the immediate function, but not if it is not part of a parent closure...
But, at least it addresses this particular issue.

This can be tested with loading localhost:8080/live/https://anzac100.initiatives.qld.gov.au/legacy-projects/bcc/index.aspx with pywb 2.6.3.