     [file version.texi not included]

This manual is for GNU LibreJS (version VERSION, UPDATED), a GNU IceCat extension to detect and block nonfree nontrivial JavaScript on webpages.

Copyright © 2011 2012 2014 2015 Loic J. Duros

     Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.3 or any later version published by the Free Software Foundation; with no Invariant Sections, with no Front-Cover Texts, and with no Back-Cover Texts.  A copy of the license is included in the section entitled ``GNU Free Documentation License''.

LibreJS
*******

This manual is for GNU LibreJS (version VERSION, UPDATED).

Overview
********

GNU LibreJS ---an add-on for GNU IceCat and Mozilla Firefox--- detects and blocks nonfree nontrivial JavaScript while allowing its execution on pages containing code that is either trivial and/or free.

Many websites run nontrivial JavaScript on your computer. Some use it for complex tasks; many use it gratuitously for minor jobs that could be done easily with plain HTML.  Sometimes this JavaScript code is malicious.  Either way, the JavaScript code is often nonfree.  For explanation of the issue, see "The JavaScript Trap"(http://www.gnu.org/philosophy/javascript-trap.html).

If you care about freedom in your computing, and don't wish to let all and sundry make you run nonfree programs, now you can prevent it by using LibreJS.

Disclaimer
**********

  * LibreJS is not a security tool. Its goal is to detect nonfree nontrivial JavaScript, and it currently does not detect whether free or trivial code is malicious or not. Other free Mozilla extensions and add-ons may be available for this purpose.

  * LibreJS is always a work in progress. If you find a bug, please report it to bug-librejs@gnu.org.

Installation
************

You can install LibreJS directly using a generated librejs.xpi file, or by building it from source.

Building the Package
====================

After enabling the Add-on SDK, you should be able to use the make command to build LibreJS from source.

After running make, a new file, librejs.xpi should be generated. This is the file that can be installed in a Mozilla browser.

Installing LibreJS
==================

To install the add-on for all users, run:

     sudo make install

or as root:

     make install

Next time you open a Mozilla-browser as a user of your system, you should be notified that a new add-on (in this case, LibreJS) as been installed and whether to allow it to run or not.

How to Use
**********

LibreJS in action
=================

After installing the add-on, you will see the LibreJS widget in the add-on bar at the bottom of the browser window.  After loading a page, left-click on the widget to view the deactivated JavaScript code from the page (both on page and external) and, if applicable, the scripts that were accepted.

Complaint Feature
=================

It is very important to complain when a site has nonfree JavaScript code, especially if it won't work without that code.  LibreJS makes it easy to complain by heuristically finding where to send the complaint.

When nonfree/nontrivial code is detected in a page, LibreJS attempts to find a relevant contact link or email for the website you are visiting. In order to do so, it will attempt to visit a few links from the current page (for instance, a link labeled ``contact'' on the same domain as the current page, ...)

LibreJS detects contact pages, email addresses that are likely to be owned by the maintainer of the site, Twitter and identi.ca links, and phone numbers.

After LibreJS detects any of the above, a ``Complain'' tab will appear on the right of your web browser. When you click on this tab, a large panel will appear with contact information. Ideally, at the top you will find the email address of the maintainer, labeled as the ``Email you should use''.

When you complain to the website for their nonfree nontrivial JavaScript, provide them with the link to the JavaScript Trap essay so that they can get more information on what the issue is and how they can solve it on their own site.

LibreJS includes a default subject line and body for the complaint email, with a link to the JavaScript Trap essay. This can be configured in the LibreJS add-on preferences in your web browser.

Options
=======

Whitelist
     LibreJS lets you whitelist domain names and subdomains to bypass the regular JavaScript check. This might be useful, for example, if you are running your own code in a local web server. In order to add a whitelisted domain or url, go to Tools >> Add-ons, or press Control + Shift + A. Inside the add-on window, click on Extensions, and in the list, where you see LibreJS, click on the Preferences button. You will see an input field labeled Whitelist. In the field, enter comma-separated domain names. Do not enter the protocol. For instance to whitelist all the pages of http://www.gnu.org and https://gnu.org, enter gnu.org. To allow all subdomains from gnu.org, enter: *.gnu.org. This will match such sites as http://savannah.gnu.org and http://audio-video.gnu.org.

Complaint tab
     This specifies whether the complaint tab appears when a site is running nonfree JavaScript.

Display notifications of JavaScript analysis
     This option enables an info bar of realtime JavaScript analysis.

Complaint email subject
     Configure the default subject used in complaint emails.

Complaint email body
     Configure the default body used in complaint emails.

JavaScript Detection
********************

     LibreJS considers JavaScript on a page nontrivial if any of the following are true:

  * It makes an AJAX request or is loaded along with scripts that make an AJAX request,

  * It loads external scripts dynamically or is loaded along with scripts that do,

  * It defines functions or methods and either loads an external script (from HTML) or is loaded as one,

  * It uses dynamic JavaScript constructs that are difficult to analyze without interpreting the program or is loaded along with scripts that use such constructs. These constructs are:

       * Using the eval function

       * Calling methods with the square bracket notation

       * Using any other construct than a string literal with certain methods (Obj.write, Obj.createElement, ...).

In practice, the JavaScript code in your page may be found trivial by LibreJS if, as a whole:

  * It does not define functions and it does not load external scripts (with the HTML src attribute in a <script> tag).

  * It does not make AJAX calls.

  * It does not load external scripts with dynamic constructs.

  * It does not use constructs that may be used to do any of the above in a non-obvious way (use of the eval() method, use of square bracket method calls, use of concatenation with certain constructs or method calls, ...).

However, in some instances, you may be required by LibreJS to add a stylized comment to JavaScript code that may be otherwise trivial.

When an external file defines a function, it becomes available to all other external scripts. That is the case if another script defines a function that makes AJAX calls, when an external script loads other scripts dynamically (which in turn could also make AJAX calls, ...), or when a script is written with constructs that may do any of these.

For instance, if your page contains the following:

     <script src="jquery.js"></script>
     <script>
     $.doSomething();
     </script>

While $.doSomething(); may seem trivial, you will nevertheless have to add a stylized license comment on your main HTML page because the external script (in this case jQuery) has been found to define methods that make AJAX calls. $.doSomething() might make an AJAX call, and LibreJS does not check for that.  The rule of thumb is that when you use a library or code that handles AJAX, JSON, JSONP, the loading of scripts dynamically, you should have license mentions for all your JavaScript files and for your main page regardless. In practice this is a case that happens very often with code that uses libraries.

In practice also, the JavaScript code in an external file (an external .js file loaded on your page) may be found trivial if it does not define functions/methods.

And in the same manner it will be considered nontrivial if AJAX calls, dynamic script loading, or non-obvious dynamic JavaScript constructs are used in another script.

If your JavaScript code makes AJAX requests, it's important to get an accurate Content-Type in the response from the server. For example, if you're using JSON, set it to application/json. This is because LibreJS alters the content of text/html responses.

Free Licenses Detection
***********************

Detected Free Licenses
======================

In order for a file to be detected as free, the license notice should appear in a JavaScript file above all code, at the very top of the file.

For inline JavaScript code inside <script> tags in HTML pages, the license notice should appear once per page as a comment inside a <script> tag, before all the code in that script. When the only inline JavaScript code is within element attributes (onload, onclick), place the license notice in an otherwise empty <script> at the top of the page. This is sometimes needed when an external script performs AJAX calls or embeds scripts dynamically, and the only inline JavaScript is an event attribute making a method call, e.g.: <body onload="methodCall('remote-data.xml');">

When people speak of the ``MIT license'' they mean either the X11 license or the Expat license.  Please see which license the code uses, and label it accordingly.

Currently LibreJS checks for the following licenses:

  * Apache License, Version 2.0

       * Identifier: Apache-2.0

       * URL: http://www.apache.org/licenses/LICENSE-2.0

       * Magnet link: magnet:?xt=urn:btih:8e4f440f4c65981c5bf93c76d35135ba5064d8b7&dn=apache-2.0.txt

  * Artistic License 2.0

       * URL: http://www.perlfoundation.org/artistic_license_2_0

       * Magnet link: magnet:?xt=urn:btih:54fd2283f9dbdf29466d2df1a98bf8f65cafe314&dn=artistic-2.0.txt

  * Boost Software License

       * URL: http://www.boost.org/LICENSE_1_0.txt

       * Magnet link: magnet:?xt=urn:btih:89a97c535628232f2f3888c2b7b8ffd4c078cec0&dn=Boost-1.0.txt

  * BSD 3-Clause License

       * URL: http://opensource.org/licenses/BSD-3-Clause

       * Magnet link: magnet:?xt=urn:btih:c80d50af7d3db9be66a4d0a86db0286e4fd33292&dn=bsd-3-clause.txt

  * CPAL 1.0

       * Identifier: CPAL-1.0

       * URL: http://opensource.org/licenses/cpal_1.0

       * Magnet link: magnet:?xt=urn:btih:84143bc45939fc8fa42921d619a95462c2031c5c&dn=cpal-1.0.txt

  * Creative Commons CC0 1.0 Universal

       * Identifier: CC0-1.0

       * URL: http://creativecommons.org/publicdomain/zero/1.0/legalcode

       * Magnet link: magnet:?xt=urn:btih:90dc5c0be029de84e523b9b3922520e79e0e6f08&dn=cc0.txt

  * Eclipse Public License 1.0

       * Identifier: EPL-1.0

       * URL: http://www.eclipse.org/legal/epl-v10.html

       * Magnet link: magnet:?xt=urn:btih:4c6a2ad0018cd461e9b0fc44e1b340d2c1828b22&dn=epl-1.0.txt

  * Expat License (sometimes called the MIT license)

       * Identifier: Expat

       * URL: http://www.jclark.com/xml/copying.txt

       * Magnet link: magnet:?xt=urn:btih:d3d9a9a6595521f9666a5e94cc830dab83b65699&dn=expat.txt

  * FreeBSD License

       * URL: http://www.freebsd.org/copyright/freebsd-license.html

       * Magnet link: magnet:?xt=urn:btih:87f119ba0b429ba17a44b4bffcab33165ebdacc0&dn=freebsd.txt

  * GNU General Public License (GPL) version 2

       * Identifier: GPL-2.0

       * URL: http://www.gnu.org/licenses/gpl-2.0.html

       * Magnet link: magnet:?xt=urn:btih:cf05388f2679ee054f2beb29a391d25f4e673ac3&dn=gpl-2.0.txt

  * GNU General Public License (GPL) version 3

       * Identifier: GPL-3.0

       * URL: http://www.gnu.org/licenses/gpl-3.0.html

       * Magnet link: magnet:?xt=urn:btih:1f739d935676111cfff4b4693e3816e664797050&dn=gpl-3.0.txt

  * GNU Lesser General Public License, version 2.1

       * Identifier: LGPL-2.1

       * URL: http://www.gnu.org/licenses/lgpl-2.1.html

       * Magnet link: magnet:?xt=urn:btih:5de60da917303dbfad4f93fb1b985ced5a89eac2&dn=lgpl-2.1.txt

  * GNU Lesser General Public License, version 3

       * Identifier: LGPL-3.0

       * URL: http://www.gnu.org/licenses/lgpl-3.0.html

       * Magnet link: magnet:?xt=urn:btih:0ef1b8170b3b615170ff270def6427c317705f85&dn=lgpl-3.0.txt

  * GNU Affero General Public License, version 3

       * Identifier: AGPL-3.0

       * URL: http://www.gnu.org/licenses/agpl-3.0.html

       * Magnet link: magnet:?xt=urn:btih:0b31508aeb0634b347b8270c7bee4d411b5d4109&dn=agpl-3.0.txt

  * The ISC License

       * URL: https://www.isc.org/downloads/software-support-policy/isc-license/

       * Magnet link: magnet:?xt=urn:btih:b8999bbaf509c08d127678643c515b9ab0836bae&dn=ISC.txt

  * Mozilla Public License 2.0

       * Identifier: MPL-2.0

       * URL: http://www.mozilla.org/MPL/2.0

       * Magnet link: magnet:?xt=urn:btih:3877d6d54b3accd4bc32f8a48bf32ebc0901502a&dn=mpl-2.0.txt

  * Public Domain

       * Public domain is not a license (see https://www.gnu.org/licenses/license-list.html#PublicDomain). If you want to release your work to the public domain, the FSF recommends using CC0.

       * Magnet Link: magnet:?xt=urn:btih:e95b018ef3580986a04669f1b5879592219e2a7a&dn=public-domain.txt

  * WTFPL

       * Identifier: WTFPL

       * URL: http://www.wtfpl.net/txt/copying/

       * Magnet link: magnet:?xt=urn:btih:723febf9f6185544f57f0660a41489c7d6b4931b&dn=wtfpl.txt

  * X11 License

       * URL: http://www.xfree86.org/3.3.6/COPYRIGHT2.html#3

       * Magnet link: magnet:?xt=urn:btih:5305d91886084f776adcf57509a648432709a7c7&dn=x11.txt

  * XFree86 License

       * Identifier: Modified-BSD

       * URLs: http://www.xfree86.org/3.3.6/COPYRIGHT2.html#3 http://www.xfree86.org/current/LICENSE4.html

       * Magnet link: magnet:?xt=urn:btih:12f2ec9e8de2a3b0002a33d518d6010cc8ab2ae9&dn=xfree86.txt

Undetected Free Licenses
========================

If you are using a free license that isn't detected by LibreJS and isn't listed in the previous section, please send a message to bug-librejs@gnu.org regarding this license, where code released under this license can be found, and where to find the license text and information.

Many free licenses are listed in this page: http://www.gnu.org/licenses/license-list.html

Setting Your JavaScript Free
****************************

The first step is releasing your JavaScript under a free license. If you are already using a free library, or you're not using any third-party libraries, it might only take a few minutes.

All JavaScript code on a web page (inline, on-page, and external) shares a common scope. Thus, code is generally either rejected or accepted as a whole by LibreJS. If some JavaScript code is found to be nontrivial and nonfree, then most of the time, all the the rest is discarded as well.

On your website, take a look at your HTML source. You can identify distinct pieces of JavaScript that might be free and some other that are nonfree.

Tip: By running LibreJS on your page, you will get a list of all the JavaScript that was blocked. This gives you an overview of the JavaScript in your page.

Imagine a page that contains several pieces of JavaScript from various sources:

  * On top, within the <head> tag, it includes jQuery

  * Then, some JavaScript code that you have written

  * At the bottom, a JavaScript-based Facebook widget

  * Also, there's some analytics tracking code

JavaScript that is already free
     First, you must ensure that the library is free. If the file contains a copyright and a license notice, you won't need to look any further. But if there's no mention of the license, or if it's too brief, you'll have to look for a COPYING or LICENSE file within the original library's source package, or on the library's official website.

Your own JavaScript
     The free license given to your code should be compatible with the rest of the JavaScript on a page. A good way to check is to read up on them: http://www.gnu.org/licenses/license-list.html

Nonfree JavaScript
     This might be the case with an analytics tracker, social media widgets, and code that runs ads. Removing these pieces of code from your site is required to have the rest accepted as free. There are often alternatives to nonfree libraries or to third-party services:

       * If you have used nonfree third-party code as the base to write your own code, try to find a free alternative.

       * If you're using a third-party service such as an analytics service, replace it with a free alternative like Piwik.

       * If you can't find free JavaScript that has already been developed, write it yourself! Who knows, your own solution might be the start of a brilliant project!

JavaScript Web Labels
=====================

One way to make your website work with LibreJS is by defining a JavaScript Web Labels table.

A JavaScript Web Labels table is informative to both site visitors and the LibreJS program. You make a Web Labels table on a new HTML page that's linked to from your main page. The table lists each of your site's JavaScript files, that file's corresponding human-readable source file, and the canonical url of its free license.

When using a JavaScript Web Labels table for your own files, it's important to put a copying permission statement at the top of each source file listed in right-most column of the Web Labels table. For info on how properly release your code as free software, see https://www.gnu.org/licenses/gpl-howto.html. Future versions of LibreJS will require a copying permission statement or other license notice for source files listed in a Web Labels table.

More information on JavaScript Web Labels is detailed here: https://www.gnu.org/software/librejs/free-your-javascript.html#step3 and here: https://www.gnu.org/licenses/javascript-labels.html.

Specifying multiple licenses for a single JavaScript file
---------------------------------------------------------

If you compile or concatenate your JavaScript into a single file, the source files you're combining may be released under different licenses. You can specify multiple licenses for the file in a JavaScript Web Labels table, like this:

<table id="jslicense-labels1">
    <tr>
        <td><a href="all.min.js">all.min.js</a></td>
        <td>
            <a href="http://www.gnu.org/licenses/gpl-3.0.html"
                >GPL-3.0+</a>
            <br />
            <a href="http://www.apache.org/licenses/LICENSE-2.0"
                >Apache-2.0</a>
        </td>
        <td>
            <a href="gpl-script.js">gpl-script.js</a>
            <br />
            <a href="apache-script.js">apache-script.js</a>
        </td>
    </tr>
</table>

The <br /> tags just make the table more understandable when looking at the rendered version of it on the license page. They aren't required by LibreJS.

If all the licenses contained in the second column are recognized by LibreJS to be free licenses, then LibreJS will allow the file in the first column to be run.

Adding a stylized comment in your JavaScript files and on your page
===================================================================

See a ``Convention for releasing free JavaScript programs'' in the JavaScript Trap http://www.gnu.org/philosophy/javascript-trap.html

Adding this notice will ensure LibreJS will find the JavaScript file to be free. The @licstart and @licend lines at the beginning and end of the stylized comment are necessary to make a clear statement that the _entire code_ in the file is free. This means that you must ensure that no nonfree code was carelessly appended at the end of the file.

In the main HTML page, the license notice covers JavaScript contained in all <script> tags with on-page code and the inline JavaScript (in event attributes such as onload, onclick, etc, ...). Since external files have their own stylized comment, they are not covered by the notice in the main HTML page. Make sure to identify all the licenses available. LibreJS will only ensure it matches a notice of an allowed license once, so the order does not matter, but the responsibility is on you to make sure all code is under the free licenses mentioned between @licstart and @licend.

You should make only one @licstart @licend comment in your page, since it pertains to the entire code on page across all <script> tags and inline html attributes.

When you use the JavaScript Web Labels method, you should still include a license notice at the top of each of your source files. This ensures that if someone copies the file and uses it for something else, the license remains intact.

For more info on making your JavaScript LibreJS-compliant, see this web page: https://www.gnu.org/software/librejs/free-your-javascript.html

Installation Requirements
*************************

Mozilla Browser
===============

You will need one of the many flavors of the Mozilla browser to use LibreJS. It can be installed on the following:

GNU IceCat,  Mozilla Firefox, Trisquel Abrowser, Debian Iceweasel.

LibreJS works on these browsers starting from version 29. We recommend that you use the latest version of your Mozilla browser. LibreJS has been tested extensively on multiple GNU/Linux distributions, but it is compatible any operating system as long as you're using a compatible Mozilla browser.

Mozilla's Add-on SDK
====================

LibreJS uses the Mozilla Add-on SDK (Software Development Kit), a set of APIs and tools to create add-ons for Mozilla browsers.

You do not need the Add-on SDK to use LibreJS xpi file or to install it using the packaged version, but it is required in order to package the LibreJS source code into an xpi file using make. If you would like to run the tests for LibreJS or make changes to the source files, you will need the Add-on SDK as well. For the ``make'' command to work properly, you must have the cfx command available on your system from the command line.

The latest tarball for the Add-on SDK is available at:

https://ftp.mozilla.org/pub/mozilla.org/labs/jetpack/jetpack-sdk-latest.tar.gz

Instructions on how to get it working are available here:

https://addons.mozilla.org/en-US/developers/docs/sdk/latest/dev-guide/tutorials/installation.html

In order to use make with LibreJS source, however, it is ideal to have cfx available at all times and for all users.

An easy way to do this is to extract the contents of the tarball and to place the files inside /usr/lib/addon-sdk and then creating a symbolic link in /usr/bin, as follows:

     sudo ln -s /usr/lib/addon-sdk/bin/cfx /usr/bin/cfx

The cfx command will then be available to all users.

The Add-on SDK is released under the Mozilla Public License 2.0.

LibreJS Internals
*****************

LibreJS intercepts HTTP responses and rewrites their contents after analyzing JavaScript within them. It does not remove script nodes and attributes from the page, but instead ``deactivates'' them by modifying the type and src attributes on script elements and by moving the contents of inline JavaScript attributes such as onClick into harmless attributes.

LibreJS detects the most common cases using the HTTP response method described above, but in extremely rare cases, or when running code locally, LibreJS cannot detect JavaScript during the response stage.

To remedy this issue, and as a final safeguard, LibreJS takes a look at the scripts that are about to be executed while the browser engine is parsing the page. If the script is not found in a list of accepted scripts populated earlier, the execution will be prevented. This is to ensure content types that are not regular HTML (binhex with HTML in it, ...) and JavaScript do not fall through the cracks and get executed.

Tests
*****

In order to better understand how LibreJS works, you can try to visit these pages with LibreJS installed and enabled and see how they are being processed:

  * http://lduros.net/assets/librejs/tests/trivial-inline-trivial-external/ This page contains trivial on-page JavaScript code, and an external script that contains trivial JavaScript code.  Therefore, all JavaScript is being executed.

  * http://lduros.net/assets/librejs/tests/trivial-inline-nontrivial-external/ The on-page script here is trivial and uses a built-in method, but the external script in this page is nontrivial (defines a function.)  The external script is blocked, the inline script is executed.

  * http://lduros.net/assets/librejs/tests/nontrivial-inline-trivial-external/ This page contains nontrivial code on page, and trivial code in its external page.  All JavaScript is removed from the page, and the external script is never analyzed, since the nontrivial conditions are already met in the page.

  * http://lduros.net/assets/librejs/tests/free-inline-free-external/ This page contains free on-page (GPL 3) JavaScript, and free external Javascript. Therefore all JavaScript is being executed.

  * http://lduros.net/assets/librejs/tests/free-inline-nonfree-nontrivial-external/ This page contains free on-page JavaScript. The external script contains nonfree nontrivial JavaScript (AJAX request). The free code that is inline is executed, but the external file is blocked.

  * http://lduros.net/assets/librejs/tests/intrinsec-event/ This page contains trivial on-page code, with an intrinsic event in an html attribute (onload).  All JavaScript is being executed.

  * http://lduros.net/assets/librejs/tests/trivial-inline-free-external-defines-function/ This page contains on-page trivial JavaScript (only makes a window alert and loads an external script using the html <script> tag with the src attribute. The external script is free (GPL v3), and since it is only nontrivial because it defines a function, the on-page trivial code is allowed to use it.  All JavaScript is being executed.

  * http://lduros.net/assets/librejs/tests/trivial-inline-free-external-writes-script/ This page contains trivial on-page JavaScript code, and loads an external script that is free. Since no function is defined, the external script is being analyzed. The external script is free. Trivial here is not allowed because the external script, although free, writes a script. The inline trivial script should also have a free license notice for it to be interpreted.

  * http://lduros.net/assets/librejs/tests/shelltypist/demo/real-life-example-with-jquery-free.html This is a real-life example of a small jQuery plugin. The on-page JavaScript code has a free license. The jQuery external file has a free licensed. The shelltypist.js file has a free license as well. All licenses are defined between @licstart and @licend. All JavaScript is executed.

  * http://lduros.net/assets/librejs/tests/shelltypist/demo/same-page-without-free-license.html This is the same page than the previous example, except it does not have a free license for the main HTML page on-page script. While the actual code there is trivial, since jQuery defines methods that make use of AJAX, trivial code is not allowed, and no JavaScript is executed.

  * http://lduros.net/assets/librejs/tests/test-labels/ This page contains JavaScript (jQuery minified) that does not have proper license information in the file, as it has no @licstart @licend comment. It would be considered nonfree, however, the page itself uses the JavaScript Web Labels method. On the page itself, you will find a link labeled ``JavaScript License Information'', which leads to a page that contains a properly formatted table with the required data on the external JavaScript file. LibreJS visits this link and determines the version of jQuery linked from the original page is the one listed there, and flags it as free. All JavaScript is executed (and the title should turn green.)

GNU Free Documentation License
******************************

     [file fdl.texi not included]