LibreJS 1 Overview 2 Disclaimer 3 Installation 3.1 Building the Package 3.2 Installing LibreJS 4 How to Use 4.1 LibreJS in action 4.2 Complaint Feature 4.3 Options 5 JavaScript Detection 6 Free Licenses Detection 6.1 Detected Free Licenses 6.2 Undetected Free Licenses 7 Setting Your JavaScript Free 7.1 JavaScript Web Labels 7.1.1 Specifying multiple licenses for a single JavaScript file 7.2 Adding a stylized comment in your JavaScript files and on your page 8 LibreJS Development Notes 8.1 Running LibreJS from the source directory 8.2 Debugging 8.3 Adding new whitelisted libraries 8.4 Releasing a new version Appendix A Installation Requirements A.1 Mozilla Browser A.2 Mozilla's Jetpack Manager for Node.js Appendix B LibreJS Internals Appendix C Tests Appendix D GNU Free Documentation License LibreJS ******* This manual is for GNU LibreJS (version 6.0.10, 25 October 2015). 1 Overview ********** GNU LibreJS --an add-on for GNU IceCat and Mozilla Firefox-- detects and blocks nonfree nontrivial JavaScript while allowing its execution on pages containing code that is either trivial and/or free. Many websites run nontrivial JavaScript on your computer. Some use it for complex tasks; many use it gratuitously for minor jobs that could be done easily with plain HTML. Sometimes this JavaScript code is malicious. Either way, the JavaScript code is often nonfree. For explanation of the issue, see "The JavaScript Trap"(). If you care about freedom in your computing, and don't wish to let all and sundry make you run nonfree programs, now you can prevent it by using LibreJS. 2 Disclaimer ************ * LibreJS is not a security tool. Its goal is to detect nonfree nontrivial JavaScript, and it currently does not detect whether free or trivial code is malicious or not. Other free Mozilla extensions and add-ons may be available for this purpose. * LibreJS is always a work in progress. If you find a bug, please report it to . 3 Installation ************** You can install LibreJS directly using a generated 'librejs.xpi' file, or by building it from source. 3.1 Building the Package ======================== After installing 'jpm', you should be able to use the 'make' command to build LibreJS from source. After running 'make', a new file, 'librejs.xpi' should be generated. This is the file that can be installed in a Mozilla browser. 3.2 Installing LibreJS ====================== To install the add-on for all users, run: sudo make install or as root: make install Next time you open a Mozilla-browser as a user of your system, you should be notified that a new add-on (in this case, LibreJS) as been installed and whether to allow it to run or not. 4 How to Use ************ 4.1 LibreJS in action ===================== After installing the add-on, you will see the LibreJS widget in the add-on bar at the bottom of the browser window. After loading a page, left-click on the widget to view the deactivated JavaScript code from the page (both on page and external) and, if applicable, the scripts that were accepted. 4.2 Complaint Feature ===================== It is very important to complain when a site has nonfree JavaScript code, especially if it won't work without that code. LibreJS makes it easy to complain by heuristically finding where to send the complaint. When nonfree/nontrivial code is detected in a page, LibreJS attempts to find a relevant contact link or email for the website you are visiting. In order to do so, it will attempt to visit a few links from the current page (for instance, a link labeled "contact" on the same domain as the current page, ...) LibreJS detects contact pages, email addresses that are likely to be owned by the maintainer of the site, Twitter and identi.ca links, and phone numbers. After LibreJS detects any of the above, a "Complain" tab will appear on the right of your web browser. When you click on this tab, a large panel will appear with contact information. Ideally, at the top you will find the email address of the maintainer, labeled as the "Email you should use". When you complain to the website for their nonfree nontrivial JavaScript, provide them with the link to the JavaScript Trap essay so that they can get more information on what the issue is and how they can solve it on their own site. LibreJS includes a default subject line and body for the complaint email, with a link to the JavaScript Trap essay. This can be configured in the LibreJS add-on preferences in your web browser. 4.3 Options =========== "Whitelist" LibreJS lets you whitelist domain names and subdomains to bypass the regular JavaScript check. This might be useful, for example, if you are running your own code in a local web server. In order to add a whitelisted domain or url, go to Tools >> Add-ons, or press 'Control + Shift + A'. Inside the add-on window, click on "Extensions", and in the list, where you see LibreJS, click on the "Preferences" button. You will see an input field labeled "Whitelist". In the field, enter comma-separated domain names. Do not enter the protocol. For instance to whitelist all the pages of and , enter 'gnu.org'. To allow all subdomains from gnu.org, enter: '*.gnu.org'. This will match such sites as and . "Complaint tab" This specifies whether the complaint tab appears when a site is running nonfree JavaScript. "Display notifications of JavaScript analysis" This option enables an info bar of realtime JavaScript analysis. "Complaint email subject" Configure the default subject used in complaint emails. "Complaint email body" Configure the default body used in complaint emails. 5 JavaScript Detection ********************** LibreJS considers JavaScript on a page nontrivial if any of the following are true: * It makes an AJAX request or is loaded along with scripts that make an AJAX request, * It loads external scripts dynamically or is loaded along with scripts that do, * It defines functions or methods and either loads an external script (from HTML) or is loaded as one, * It uses dynamic JavaScript constructs that are difficult to analyze without interpreting the program or is loaded along with scripts that use such constructs. These constructs are: * Using the eval function * Calling methods with the square bracket notation * Using any other construct than a string literal with certain methods ('Obj.write', 'Obj.createElement', ...). In practice, the JavaScript code in your page may be found trivial by LibreJS if, as a whole: * It does not define functions and it does not load external scripts (with the HTML src attribute in a ' While '$.doSomething();' may seem trivial, you will nevertheless have to add a stylized license comment on your main HTML page because the external script (in this case jQuery) has been found to define methods that make AJAX calls. '$.doSomething()' might make an AJAX call, and LibreJS does not check for that. The rule of thumb is that when you use a library or code that handles AJAX, JSON, JSONP, the loading of scripts dynamically, you should have license mentions for all your JavaScript files and for your main page regardless. In practice this is a case that happens very often with code that uses libraries. In practice also, the JavaScript code in an external file (an external '.js' file loaded on your page) may be found trivial if it does not define functions/methods. And in the same manner it will be considered nontrivial if AJAX calls, dynamic script loading, or non-obvious dynamic JavaScript constructs are used in another script. If your JavaScript code makes AJAX requests, it's important to get an accurate "Content-Type" in the response from the server. For example, if you're using JSON, set it to 'application/json'. This is because LibreJS alters the content of 'text/html' responses. 6 Free Licenses Detection ************************* 6.1 Detected Free Licenses ========================== In order for a file to be detected as free, the license notice should appear in a JavaScript file above all code, at the very top of the file. For inline JavaScript code inside '