Workers test throwing unsupported on Safari 17.3

[Joe12387]

Hi there.

I noticed that your service worker test does not seem to work properly on Safari as of 17.3 on both macOS and iOS, and it says that all service worker types are unsupported. Correct me if I'm wrong, but I do believe service workers are still a supported feature in Safari and, if my memory serves me, versions of Safari prior to 17.3 worked as expected on this page.

Thanks!

[abrahamjuliot]

Good catch. It's likely connected with the use of inline workers and modifications implemented here. I will investigate.

• Workers Leaks Patch Works on CreepJS #207

[abrahamjuliot]

I'm pondering on whether it is worth changing to support Safari. For now, the single file test page works on safari here.
https://abrahamjuliot.github.io/fpworker/

[Joe12387]

Interesting. DedicatedWorkerGlobalScope in Safari 17.4 on both macOS and iOS is consistent with Window when it comes to canvas, but ServiceWorkerGlobalScope and SharedWorkerGlobalScope do not appear to be applying canvas fingerprinting protections and the hashes remain the same even in a private window. Maybe it's just a bug in your code, but have we found ourselves a fingerprinting vulnerability in Safari?

[abrahamjuliot]

A vulnerability seems to be the case. Possibly connected with https://bugs.webkit.org/show_bug.cgi?id=243555.

[Joe12387]

Apple seems to disagree.

[abrahamjuliot]

It's likely determined low based on the severity of canvas entropy derived from Apple GPUs. Canvas protections, at best, probably only neutralize annoying cross site trackers.

WebKit hardware acceleration entropy seems fairly uniform within the same OS/browser version. ¯\_(ツ)_/¯

I imagine, they will consider and fix if feasible. I recall Brave had a similar issue and patched.

[Joe12387]

You made me do this, Apple.

[Joe12387]

As it turns out, I just discovered that this affects Firefox as well. Service Workers don't apply canvas protections.

[Joe12387]

Apple assigned this vulnerability as CVE-2024-27830 and resolved the issue in Safari 17.5. Firefox's issues should be resolved in 127.

[abrahamjuliot]

Nice. Thanks for the update @Joe12387