the Loading... banner is still present after adding the Page Rules on Cloudflare

[TehPeGaSuS]

Describe the problem/question

I've added the page rules to Cloudflare as suggested here, although I don't have Cloudflare proxying the subdomain:

I can't understand how to add the header thing since it is made for nginx and I use Apache (I don't seem to be able to convert it).

After a refresh the Loading... banner goes away.

Any help would be highly appreciated.

Did you use the FAQ section?

• Yes, I have read the FAQ and I found no solution/answer there.

What you did?

1. Added the page rules to Cloudflare as suggested here
2. Purged Cloudflare cache
3. Tried to connect to my instance and still got the Loading... banner

What happens

No response

What should happen

No response

Additional information

Output of nmap -p 443,80 --script http-security-headers pastebin.0bin.xyz

Starting Nmap 7.80 ( https://nmap.org ) at 2024-09-16 13:07 CEST
Nmap scan report for pastebin.0bin.xyz (37.187.138.180)
Host is up (0.017s latency).
rDNS record for 37.187.138.180: ns3092028.ip-37-187-138.eu

PORT    STATE SERVICE
80/tcp  open  http
| http-security-headers: 
|   X_Frame_Options: 
|     Header: X-Frame-Options: deny
|     Description: The browser must not display this content in any frame.
|   X_XSS_Protection: 
|     Header: X-XSS-Protection: 1; mode=block
|     Description: The browser will prevent the rendering of the page when XSS is detected.
|   X_Content_Type_Options: 
|     Header: X-Content-Type-Options: nosniff
|     Description: Will prevent the browser from MIME-sniffing a response away from the declared content-type. 
|   Content_Security_Policy: 
|     Header: Content-Security-Policy: default-src 'none'; base-uri 'self'; form-action 'none'; manifest-src 'self'; connect-src * blob:; script-src 'self' 'unsafe-eval'; style-src 'self'; font-src 'self'; frame-ancestors 'none'; img-src 'self' data: blob:; media-src blob:; object-src blob:; sandbox allow-same-origin allow-scripts allow-forms allow-popups allow-modals allow-downloads
|     Description: Define the base uri for relative uri.
|     Description: Define loading policy for all resources type in case of a resource type dedicated directive is not defined (fallback).
|     Description: Define which scripts the protected resource can execute.
|     Description: Define from where the protected resource can load plugins.
|     Description: Define which styles (CSS) the user applies to the protected resource.
|     Description: Define from where the protected resource can load images.
|     Description: Define from where the protected resource can load video and audio.
|     Description: Define from where the protected resource can be embedded in frames.
|     Description: Define from where the protected resource can load fonts.
|     Description: Define which URIs the protected resource can load using script interfaces.
|     Description: Define which URIs can be used as the action of HTML form elements.
|     Description: Specifies an HTML sandbox policy that the user agent applies to the protected resource.
|   Cache_Control: 
|     Header: Cache-Control: public, max-age=3600, no-store, no-cache, no-transform, must-revalidate
|   Pragma: 
|     Header: Pragma: no-cache
|   Expires: 
|_    Header: Expires: Mon, 16 Sep 2024 11:07:59 GMT
443/tcp open  https
| http-security-headers: 
|   Strict_Transport_Security: 
|     HSTS not configured in HTTPS Server
|   X_Frame_Options: 
|     Header: X-Frame-Options: deny
|     Description: The browser must not display this content in any frame.
|   X_XSS_Protection: 
|     Header: X-XSS-Protection: 1; mode=block
|     Description: The browser will prevent the rendering of the page when XSS is detected.
|   X_Content_Type_Options: 
|     Header: X-Content-Type-Options: nosniff
|     Description: Will prevent the browser from MIME-sniffing a response away from the declared content-type. 
|   Content_Security_Policy: 
|     Header: Content-Security-Policy: default-src 'none'; base-uri 'self'; form-action 'none'; manifest-src 'self'; connect-src * blob:; script-src 'self' 'unsafe-eval'; style-src 'self'; font-src 'self'; frame-ancestors 'none'; img-src 'self' data: blob:; media-src blob:; object-src blob:; sandbox allow-same-origin allow-scripts allow-forms allow-popups allow-modals allow-downloads
|     Description: Define the base uri for relative uri.
|     Description: Define loading policy for all resources type in case of a resource type dedicated directive is not defined (fallback).
|     Description: Define which scripts the protected resource can execute.
|     Description: Define from where the protected resource can load plugins.
|     Description: Define which styles (CSS) the user applies to the protected resource.
|     Description: Define from where the protected resource can load images.
|     Description: Define from where the protected resource can load video and audio.
|     Description: Define from where the protected resource can be embedded in frames.
|     Description: Define from where the protected resource can load fonts.
|     Description: Define which URIs the protected resource can load using script interfaces.
|     Description: Define which URIs can be used as the action of HTML form elements.
|     Description: Specifies an HTML sandbox policy that the user agent applies to the protected resource.
|   Cookie: 
|     Cookies are secured with Secure Flag in HTTPS Connection
|   Cache_Control: 
|     Header: Cache-Control: public, max-age=3600, no-store, no-cache, no-transform, must-revalidate
|   Pragma: 
|     Header: Pragma: no-cache
|   Expires: 
|_    Header: Expires: Mon, 16 Sep 2024 11:07:59 GMT

Nmap done: 1 IP address (1 host up) scanned in 0.36 seconds

As it can be seen, the Cache-Control header has the required values stated on the FAQ

The only errors I see on Chrome console are:

pastebin.0bin.xyz/:1 An iframe which has both allow-scripts and allow-same-origin for its sandbox attribute can escape its sandboxing.
bootstrap-3.4.1.js:6 Uncaught Error: Bootstrap's JavaScript requires jQuery
    at bootstrap-3.4.1.js:6:37
(anonymous) @ bootstrap-3.4.1.js:6
privatebin.js?1.7.4:15 Uncaught ReferenceError: jQuery is not defined
    at privatebin.js?1.7.4:15:1
(anonymous) @ privatebin.js?1.7.4:15

Server address

https://pastebin.0bin.xyz

Server OS

Ubuntu 22.04.4 LTS

Webserver

Apache

PrivateBin version

v1.7.4

Browser and version

Google Chrome Version 128.0.6613.137 (Official Build) (64-bit)

Local operating system and version

Xubuntu (Ubuntu 22.04.4 LTS)

Issue reproducibility

No, I cannot reproduce it on https://privatebin.net.

[elrido]

I see you resolved the issue and the instance linked to above now loads fine. Did you have to change anything else (which might benefit other CloudFlare victims to know) or was it your own browsers cache that caused the issue?

[TehPeGaSuS]

It doesn't load properly on Chrome. If I open a new tab it'll end up having the same issue after opening one or two tabs and writing the URL or even after clicking a few times on the URL provided above.

If I open Chrome DevTools > Network and enable Disable cache all seems to work (same with Incognito mode).

But with normal operation, even after I cleaned up the cache for the instance, the error appears again.

I'd expect this behaviour if I had CF proxying the subdomain (which I dont).

OTOH, on Firefox it seems to be working. I'm really stuck here.

[TehPeGaSuS]

For the sake of trying to understand this, Firefox is throwing the following on DevTools:

Content-Security-Policy: The page’s settings blocked an inline script (script-src-elem) from being executed because it violates the following directive: “script-src 'self' 'unsafe-eval'” post_api.js:1:6264
Content-Security-Policy: The page’s settings blocked an inline script (script-src-elem) from being executed because it violates the following directive: “script-src 'self' 'unsafe-eval'” location.js:1:1940
Layout was forced before the page was fully loaded. If stylesheets are not yet loaded this may cause a flash of unstyled content. markup.js:250:53
Content-Security-Policy: The page’s settings blocked an inline style (style-src-elem) from being applied because it violates the following directive: “style-src 'self'” content.js:78:24
Content-Security-Policy: The page’s settings blocked an inline script (script-src-elem) from being executed because it violates the following directive: “script-src 'self' 'unsafe-eval'” content.js:60:437
Content-Security-Policy: The page’s settings blocked an inline script (script-src-elem) from being executed because it violates the following directive: “script-src 'self' 'unsafe-eval'” content.js:60:437
Content-Security-Policy: The page’s settings blocked an inline script (script-src-elem) from being executed because it violates the following directive: “script-src 'self' 'unsafe-eval'” 2 index.js:7352:27
Content-Security-Policy: The page’s settings blocked an inline script (script-src-elem) from being executed because it violates the following directive: “script-src 'self' 'unsafe-eval'” 2 processor.js:1:3376
Content-Security-Policy: The page’s settings blocked an inline style (style-src-elem) from being applied because it violates the following directive: “style-src 'self'” index.js:5779:36
Content-Security-Policy: The page’s settings blocked an inline style (style-src-elem) from being applied because it violates the following directive: “style-src 'self'” index.js:5779:36
Content-Security-Policy: The page’s settings blocked an inline style (style-src-elem) from being applied because it violates the following directive: “style-src 'self'” index.js:5779:36
Content-Security-Policy: The page’s settings blocked an inline style (style-src-elem) from being applied because it violates the following directive: “style-src 'self'” index.js:5779:36
This page uses the non standard property “zoom”. Consider using calc() in the relevant property values, or using “transform” along with “transform-origin: 0 0”. pastebin.0bin.xyz
Content-Security-Policy: The page’s settings blocked an inline style (style-src-elem) from being applied because it violates the following directive: “style-src 'self'” 2 index.js:5779:36
Content-Security-Policy: The page’s settings blocked an inline style (style-src-elem) from being applied because it violates the following directive: “style-src 'self'” index.js:5779:36
Content-Security-Policy: The page’s settings blocked an inline style (style-src-elem) from being applied because it violates the following directive: “style-src 'self'” index.js:5779:36
Error: Promised response from onMessage listener went out of scope build.js:2:92650
Content-Security-Policy: The page’s settings blocked an inline style (style-src-elem) from being applied because it violates the following directive: “style-src 'self'” 2 index.js:5773:40
Source map error: Error: URL constructor:  is not a valid URL.
Resource URL: wasm:https://pastebin.0bin.xyz/js/zlib-1.3.1.js%20line%2034%20%3E%20WebAssembly.compile
Source Map URL: null

[elrido]

This clearly proves that Cloudflare is still injecting content into your HTML, which privatebins content security policy prevents from executing. Please raise these issues as a ticket with them, since you are a presumably paying customer of theirs.

This is their software breaking our software. We can't support this and I personally do not recommend using their services. You can full well run privatebin and other such simple services directly exposed to the internet without having to fear being DDoSed or such, even on very small pieces of hardware or small VMs.

[TehPeGaSuS]

I do use Cloudflare as my domain registrar but I'm not a paying customer and I do host PrivateBin on a VPS of mine.

Like I said, I don't have the subdomain being proxied.

I do, however, have the main domain (0bin.xyz) being proxied.

I wonder if that may be an issue.

[TehPeGaSuS]

So, to try to see if this was only a CF problem, I used https://freedns.afraid.org/ to setup another PrivateBin instance on my server, located at https://privatebin.mooo.com/.

Eventually I get the Loading... banner after trying to access the instance a few times, by closing the tab, opening a new tab, typing the URL or even by just clicking the URL, click back, click the URL again.

I wonder if it's something related to my Apache, but the Apache config is the standard.

Any folder permission, etc, is done inside each VirtualHost using Location tags.

[TehPeGaSuS]

Apparently the issue fixed itself