5 ms·

Tell HN: Toptal's HTML minification API occasionally injects tracking JavaScript

97 points by cududa 4y ago

Just a heads up for anyone using their API - about 1 in 5 requests will return with Cloudflare Insights tracking JS. It's not mentioned anywhere in the API documentation, Privacy Policy, or ToS. Fairly certain this is the package they based their service on https://github.com/tdewolff/minify Edit: Here's a tweet I posted with a screenshot of the code: https://twitter.com/cullend/status/1575243757624360960?s=20&t=JVhqXDJExBnrEVOXeFH4Jg

Nicksil 4y ago
Good lookin out. Appreciate the heads-up.
Bilal_io 4y ago
Are you sure that's not Cloudflare injecting the JS it on behalf of TopTal because they have CF analytics enabled? But I agree with your point, this should have been mentioned in their ToS and/or Privacy Policy.
- cududa 4y ago
  Can't be sure, but that would be rather frightening if cloudflare is just injecting JS willynilly
  - joshmn 4y ago
    If CF is acting as a reverse proxy as it so often does — it's one of their core features — it's not exactly willynilly.
    - zo1 4y ago
      This is 90% in similarity to one of the top reasons we are pushing for HTTPS and DoH! The supposed "ISP" inserting "stuff" into our requests. Would be 100% except it's 5% less because the server "agreed" to it, and another 5% because it's not ads, just "tracking js". Maybe knock off an extra 80% because it's "Cloudflare" and they're the new "do no harm" giant like Google.
    - tyingq 4y ago
      "about 1 in 5 requests" maybe makes it a little willy-nilly. It's not yet clear what's happening.
      - joshmn 4y ago
        I wasn’t able to reproduce. The error pages do return the code, though, but I was expecting that. I’m hoping that OP can provide a request that does reproduce it.
        cududa 4y ago
        Sure thing - there's a link at the top of the post with an example of code. HTML is about 200 lines, each one slightly different, did a 3 second wait before each post request (25 posts, 5 with the offending tracking code), used their python API
        joshmn 4y ago
        Tried with all my might and no dice: https://gist.github.com/joshmn/c87a52b5328aa4f452be7970af4ba407 https://gist.github.com/joshmn/c87a52b5328aa4f452be7970af4ba... Now, are _you_ serving from Cloudflare and you're seeing this in production? Or is this coming from the output?
        cududa 4y ago
        Ah - guess I can reply now here, but HN seems to be rate limiting me - lets perhaps DM on twitter to find repro steps? But to your main question - the resultant HTML is occurring after running a python script fully locally, no hosting, prod, dev server, or anything related to Cloudflare coming into play.
        joshmn 4y ago
        My email's in my profile :)
        deleted 4y ago
  - Alupis 4y ago
  - jffry 4y ago
    If you proxy your site through Cloudflare and turn on Cloudflare analytics, its default behavior appears to be to automatically add the JS tag for you in HTML responses [1] (you can also disable that and manually add the tag to your HTML) They provide a lot of this type of thing - rewriting HTML responses with optimizations "at the edge" instead of you doing it at your origin. [1] https://developers.cloudflare.com/analytics/web-analytics/getting-started/ https://developers.cloudflare.com/analytics/web-analytics/ge...
Alupis 4y ago
I really would like to know why anyone would use an API to minify javascript/css/html instead of using a local library, built-in webserver features, or relying on some front-end service like Cloudflare. Feels like we've jumped the shark if you need to send un-minified stuff to another server to get minified, sort of defeating the point in the first place...
- simlevesque 4y ago
  Closure compiler has been a thing since forever. Some people don't want to fiddle and don't care about owning their tools.
- bagels 4y ago
  Using some node library you pull down is still vulnerable to exactly this same kind of injection attack vector.
  - Alupis 4y ago
    Except you're not then pounding on some pet side-project "API" stood up by a poaching agency... Seems insane anyone would even entertain the thought... it's trivially easy to minify whatever you want right within your app. And now here's OP bagging on this company for not disclosing this in some ToS or whatever, even though OP is the one abusing a free, obviously not-serious service.
    - cududa 4y ago
      Well when you google "CSS Minify" or "JS Minify" it's the top result - so it clearly isn't some low use tool. I just decided to use it for HTML as well. Wasn't "pounding it". The API limits to 30 requests per minute. I made around 50 requests in 3 minutes. Most local minification packages I tried spit out garbage, so just went with their API. Took a few hours to get a proper package stood up (the one I mentioned above). I'd generally just assume that if you're injecting tracking/ analytics into an output you'd tell folks. As they didn't mention it, thought I'd just alert folks. Not sure why you're so outraged I mentioned this is happening.
joshmn 4y ago
My guess as to what is happening: 1. Toptal uses Cloudflare for DNS 2. Toptal uses Cloudflare Insights, which automagically inserts the tracking snippet of `https://static.cloudflareinsights.com/beacon.min.js/\\ https://static.cloudflareinsights.com/beacon.min.js/\\*` 3. You send the request to Toptal and somewhere along the line, Cloudflare misinterprets the request and injects the tracking code It's not anything nefarious by Toptal. It's not their minify script. It's a misconfigured page rule, or similar. It's a bug.
- cududa 4y ago
  Sounds pretty accurate! Hopefully they get it configured properly!
codegeek 4y ago
I think it is part of cloudflare's browser insights which is now part of their "Web Analytics". You will see this almost with any site using cloudflare that has web analytics enabled. https://community.cloudflare.com/t/beacon-min-js-as-malware/117552 https://community.cloudflare.com/t/beacon-min-js-as-malware/... https://developers.cloudflare.com/analytics/web-analytics/ https://developers.cloudflare.com/analytics/web-analytics/ The site owner needs to configure cloudflare correctly to add analytics on certain pages only otherwise cloudflare injects it by default.

97 points by cududa 4y ago

Nicksil 4y ago

Good lookin out. Appreciate the heads-up.

Bilal_io 4y ago

Are you sure that's not Cloudflare injecting the JS it on behalf of TopTal because they have CF analytics enabled? But I agree with your point, this should have been mentioned in their ToS and/or Privacy Policy.

cududa 4y ago
Can't be sure, but that would be rather frightening if cloudflare is just injecting JS willynilly
- joshmn 4y ago
  If CF is acting as a reverse proxy as it so often does — it's one of their core features — it's not exactly willynilly.
  - zo1 4y ago
    This is 90% in similarity to one of the top reasons we are pushing for HTTPS and DoH! The supposed "ISP" inserting "stuff" into our requests. Would be 100% except it's 5% less because the server "agreed" to it, and another 5% because it's not ads, just "tracking js". Maybe knock off an extra 80% because it's "Cloudflare" and they're the new "do no harm" giant like Google.
  - tyingq 4y ago
    "about 1 in 5 requests" maybe makes it a little willy-nilly. It's not yet clear what's happening.
    - joshmn 4y ago
      I wasn’t able to reproduce. The error pages do return the code, though, but I was expecting that. I’m hoping that OP can provide a request that does reproduce it.
      - cududa 4y ago
        Sure thing - there's a link at the top of the post with an example of code. HTML is about 200 lines, each one slightly different, did a 3 second wait before each post request (25 posts, 5 with the offending tracking code), used their python API
        joshmn 4y ago
        Tried with all my might and no dice: https://gist.github.com/joshmn/c87a52b5328aa4f452be7970af4ba407 https://gist.github.com/joshmn/c87a52b5328aa4f452be7970af4ba... Now, are _you_ serving from Cloudflare and you're seeing this in production? Or is this coming from the output?
        cududa 4y ago
        Ah - guess I can reply now here, but HN seems to be rate limiting me - lets perhaps DM on twitter to find repro steps? But to your main question - the resultant HTML is occurring after running a python script fully locally, no hosting, prod, dev server, or anything related to Cloudflare coming into play.
        joshmn 4y ago
        My email's in my profile :)
      - deleted 4y ago
- Alupis 4y ago
- jffry 4y ago
  If you proxy your site through Cloudflare and turn on Cloudflare analytics, its default behavior appears to be to automatically add the JS tag for you in HTML responses [1] (you can also disable that and manually add the tag to your HTML) They provide a lot of this type of thing - rewriting HTML responses with optimizations "at the edge" instead of you doing it at your origin. [1] https://developers.cloudflare.com/analytics/web-analytics/getting-started/ https://developers.cloudflare.com/analytics/web-analytics/ge...

Alupis 4y ago

I really would like to know why anyone would use an API to minify javascript/css/html instead of using a local library, built-in webserver features, or relying on some front-end service like Cloudflare. Feels like we've jumped the shark if you need to send un-minified stuff to another server to get minified, sort of defeating the point in the first place...

simlevesque 4y ago
Closure compiler has been a thing since forever. Some people don't want to fiddle and don't care about owning their tools.
bagels 4y ago
Using some node library you pull down is still vulnerable to exactly this same kind of injection attack vector.
- Alupis 4y ago
  Except you're not then pounding on some pet side-project "API" stood up by a poaching agency... Seems insane anyone would even entertain the thought... it's trivially easy to minify whatever you want right within your app. And now here's OP bagging on this company for not disclosing this in some ToS or whatever, even though OP is the one abusing a free, obviously not-serious service.
  - cududa 4y ago
    Well when you google "CSS Minify" or "JS Minify" it's the top result - so it clearly isn't some low use tool. I just decided to use it for HTML as well. Wasn't "pounding it". The API limits to 30 requests per minute. I made around 50 requests in 3 minutes. Most local minification packages I tried spit out garbage, so just went with their API. Took a few hours to get a proper package stood up (the one I mentioned above). I'd generally just assume that if you're injecting tracking/ analytics into an output you'd tell folks. As they didn't mention it, thought I'd just alert folks. Not sure why you're so outraged I mentioned this is happening.

joshmn 4y ago

My guess as to what is happening: 1. Toptal uses Cloudflare for DNS 2. Toptal uses Cloudflare Insights, which automagically inserts the tracking snippet of `https://static.cloudflareinsights.com/beacon.min.js/\\ https://static.cloudflareinsights.com/beacon.min.js/\\*` 3. You send the request to Toptal and somewhere along the line, Cloudflare misinterprets the request and injects the tracking code It's not anything nefarious by Toptal. It's not their minify script. It's a misconfigured page rule, or similar. It's a bug.

cududa 4y ago
Sounds pretty accurate! Hopefully they get it configured properly!

codegeek 4y ago

I think it is part of cloudflare's browser insights which is now part of their "Web Analytics". You will see this almost with any site using cloudflare that has web analytics enabled. https://community.cloudflare.com/t/beacon-min-js-as-malware/117552 https://community.cloudflare.com/t/beacon-min-js-as-malware/... https://developers.cloudflare.com/analytics/web-analytics/ https://developers.cloudflare.com/analytics/web-analytics/ The site owner needs to configure cloudflare correctly to add analytics on certain pages only otherwise cloudflare injects it by default.