Thank you very much for reporting the issue.

I am going to rephrase the issue. Feel free to correct me if I understand something wrong or miss something,

The reported PoC code is at https://www.fit.vut.cz/person/polcak/public/jsr/pagureissue141.html (however, I modified the code a little bit, see below) Note that the PoC code does not itself call updateCount. It is JShelter that calls the page script function.

The report confused me because I did not understand what exactly are the network requests. So the deployed PoC only writes to the console every time the function is called. In my set up, it is twice (but this is not much releavant as a single call should not happen). First call is before the id is initialized, the other after the ID is initiallized.

I think that the PoC tries to show a way how a page can identify the user but a very similar code works even without JShelter being the caller:

        var id = JSON.parse(localStorage.getItem('id')) || parseInt(Math.random() * 1000000000, 10)
        localStorage.setItem('id', JSON.stringify(id))
        function uploadId(...args) {
            fetch(location + '?id=' + id)
        }
        uploadId();

So the issue is not that a page can identify a user. But the issue is that the page can easily identify that a user is using JShelter.

It seems that the bug was in JShelter in 0.12 and likely appeared with 0.6 when FPD was added to JShelter. Unfortunately, old builds are broken due to history changes in NSCL git repository.

I am not sure what exactly means "both the website and the extension act broken". So far, I only found that the information that an API was called does not reach FPD with all the consequences like the API calls are not counted and FPD does not detect fingerpritning.

Hey polcak, thank you for the additional explanation.

I am not quite sure about the implications of this problem, sorry. Maybe some clever person finds a better way to exploit it though ;)
You are correct, it is easy to simply fetch some url with an id, but I think it is quite intimidating that one can make the extension do just that by doing anything localStorage related.

The page is broken, because the actual function that is "updateCount" breaks or is called too often. In my case updateCount should have done just that and updated some value, but the value was always out of bounds because of the additional calls. The result was of course that my page crashed.
The extension is then broken for obvious reasons mentioned.

Please note that I am using version 0.18, so the most recent version is affected.

Preliminary fix https://pagure.io/JShelter/webextension/c/b6e482f14aea312ffbdfb410c750917604b0cdd7?branch=issue141

It passed testing and should be fine to be used. But integrations tests needs to be run properly before publicly releasing 0.18.1.

This seems to do the job! Thank you :)

0.18.1 released. @arionymousse: Thanks again for reporting.