Skip to content

uBO options may fail to sync due to a Chrome bug #3283

@xmcp

Description

@xmcp

Prerequisites

  • I verified that this is not a filter list issue. Report any issues with filter lists or broken website functionality in the uAssets issue tracker.
  • This is NOT a YouTube, Facebook or Twitch report. These sites MUST be reported by clicking their respective links.
  • This is not a support issue or a question. For support, questions, or help, visit /r/uBlockOrigin.
  • I performed a cursory search of the issue tracker to avoid opening a duplicate issue.
  • The issue is not present after disabling uBO in the browser.
  • I checked the documentation to understand that the issue I am reporting is not normal behavior.

I tried to reproduce the issue when...

  • uBO is the only extension.
  • uBO uses default lists and settings.
  • using a new, unmodified browser profile.

Description

uBO can synchronize options to chrome.storage.sync when "Enable cloud storage support" is turned on. Internally, uBO serializes the options, compresses it via lz4, makes it ASCII via base88, and then splits it into several 6KB chunks because each storage item cannot be larger than 8KB.

The issue lies in the base88 part. The base88 charset used by uBO unfortunately includes the < character. By chance, I found that each < character will use six bytes in the storage quota, probably due to some escaping under the hood. I reported this observation to bugs.chromium.org so you can track their attitude here.

So, if a 6KB chunk coincidentally contains more than $(8K - 6K) / (6 - 1) = 400$ < characters, the chunk will exceed the 8KB quota and it cannot be saved to chrome.storage.sync.

A specific URL where the issue occurs.

Not applicable.

Steps to Reproduce

  1. Install uBO and turn on "Enable cloud storage support" in the settings
  2. Go to "My filters" page
  3. Paste the below string into the beginning of the textbox.
  4. Click the upload button

Here is the string:

!A/-OgaLO&mPPKMTQfxIsTMTQ&<*Q&XTQP5_/&-aO&p1Ov.iQRWPPf&1R'5_/^_TQ:-aOfF<A&73QnC-OO5_/~;1P&|CZ75_/n.1P&EWWf/-O.A_/VHTQK-aOV0_/CeIsv-ePfjf/f7iQ.aLO>'iQN:_/D/-OUeIs&}.Q9-aOv*9(fT[PSaLO<5_/aWPPNRTQJeIsL5_/@/-OM5_/f95QFMTQ4eIsN'aO&yC=n,eP&(IZfr3OfTHZ&NHP6aLOfgQPf8kOdMTQ:MTQ7aLO.11Pf*aO&hzP&KULfyoOfeIs_eIsbWPPHaLO6/aOGaLON*1PfY6RNgPPdWPP&<FOB-aOEMTQTeIs.6_/&7*If]CAv/1P&d[Q~+jaf;zQJ5_/R-aO6'1PF41P/WPP`eIs>aLOv9-Of6&O_aLOT/-O2aLOV]PPMMTQ8WPPv,aO,WPPX/-O`WPPJaLOD5_/(eIs~eIsc/-O&3>O&aLO5aLO;aLO9/-ON{?Q&o=Pf4LP&qz.&GX(fAvzv7aOF~>A/MTQ6YPPf/Osv?_/fODA&2XO6WPPOWPP*aLO@-aO'MTQ]5_/v05Q>)5Q&:^QfAsO,-aO>;aO&WOjfbLQfJTQ&1VQ&swg&aM5&2<Q~01P&9xQ&sDbD-aOSWPP--aO@WPP67_/VhPPZ/-OvBaO=MTQ3aLOFQTQf8]P^}?Q&QsP~.ePfd4O&7OOn)ja0WPP[WPPnyIs&'/o2MTQH5_/Z5_/[aLO^A-OfZ8P&?qOV@-O:eIsVSTQ&-/0&}B-f(9(&nIQfG&RfoeQ&DGZV5_/+/-O>2-ON[LOKeIsn>_/+aLOK/-OfAWQf>,Q*-aO~5_/g-aO2/-O-WPPEeIs?-aOFz?Q&MbPYWPPReIsQ-aOY/-On-iQKWPPMWPPDeIs;/-O^)aO[MTQv*jaf52P6&iQffoa>(1P&sy3f+6Qf~EZVrLOU5_/:WPPCMTQ^,1P6gIsv8ePZWPP>C_/~@_/PMTQ=-aOMeIsf'3P4WPP~lLO&[NZ&e~D&yBW&?tzV/-O=eIs(WPP.cPP&cJnfyrz&}<P45_/N(eP&,{O&1ha&IVGg5_/..aO&uCg&6iO&YNoc-aO.&1P&:zOf.}O&_K~&'`/GWPPeeIsOMTQ+eIsZMTQFpLOfpFZf81PPWPP1-aORMTQN_IsfySQB/-OV3aOfOVQ&QQu&wpz:/-OWWPP3eIs*5_/daLO,MTQV4eP&JEO8/-O)5_/HWPP9MTQ9WPP<MTQZ-aO=WPP4/-OCWPPY-aO0aLOQMTQIWPPV)ePN?-ORaLO~E-O&,@(C-aOXWPP=aLO+WPP5WPP//-O~/-O0eIs^-5Qn/5Q^ITQ&~0ON]TQF1aO&sEHO/-OL/-OFWPPLMTQOaLO8-aOGMTQJWPPSeIs6(5Q&30P~bPPK5_/V>aO&SRFfh7P]-aO*MTQC/-OQ/-OX-aO,eIsFeLOf+ePf]cPfU3Q>/-O_MTQQaLOUMTQB5_/b-aOA-aO-aLOLaLOnAaOd-aO?MTQcWPP:5_/U-aO`5_/_5_/P-aOT-aO]/-O1eIs<eIsX5_/L-aOC5_/F)1P^*eP_WPP^<_/8MTQG/-OTaLOMaLOBaLOP/-OaaLOAeIse/-O;MTQb5_/WMTQeMTQ@eIs/eIs)/-Oxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
WTF is this string?

First, I enumerated all four-octets that will contain more than three < characters after base88. There are 1533 such four-octets within the SAFECHARS charset.

Then, I concatenated 410 four-octets in that list. They are carefully chosen such at LZ4 has no chance to compress them. The concatenated string should take $410*(3*6 + 2)=9000$ bytes of quota after base88, violating the storage quota.

Then I concatenated lots of x characters at the end. This is necessary to pass the shouldCompress check.

Expected behavior

The text should upload to the cloud

Actual behavior

It shows "QUOTA_BYTES_PER_ITEM quota exceeded"

image

uBO version

1.58.0

Browser name and version

Chromium 120.0.6099.180

Operating System and version

Not applicable

Metadata

Metadata

Assignees

No one assigned

    Labels

    Chromiumspecific to Chromium/ChromebugSomething isn't workingexternalissue involving an external factorfixedissue has been addressed

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions