On my instance only - upgrade to 2.0.1 (or to 1.7.6): Suddenly WebAssembly support is broken

[Sommerwiesel]

Describe the problem/question

When I try upgrading my instance to 2.0.1 (or 1.7.6), my instance always tells me that my browser suddenly doesn't support WebAssembly.
That's why my instance is still using 1.7.4 because I wasn't able to properly and successfully update it without that error appearing out of nowhere.

Did you use the FAQ section?

• Yes, I have read the FAQ and I found no solution/answer there.

What you did?

1. Download the latest release
2. Deploy it

What happens

Everything seems to work but all my browsers (including vanilla Chromium) suddenly get the "WebAssembly is not supported" error.
This error did not happen in 1.7.4 and does not happen on any other public instance that's already on 2.0.1

Additional information

Everything else seems to work perfectly fine, it's just the WebAssembly error that suddenly appears.

My instance is deployed via source code release and PHP-FPM 8.3

Server address

https://paste.nerdvpn.de/

(Still on 1.7.4 for now)

Server OS

Debian 12

Webserver

nginx

PrivateBin version

1.7.4

Browser and version

Librewolf 144
Chromium 141.0.7390.76

Local operating system and version

Manjaro Linux KDE

Issue reproducibility

No, I cannot reproduce it on https://privatebin.net.

Config files

php-fpm pool file for privatebin

[privatebin]
user = privatebin
group = www-data
listen = /run/php/php-fpm-privatebin.sock
listen.owner = www-data
listen.group = www-data
pm = dynamic
pm.max_children = 12
pm.start_servers = 3
pm.min_spare_servers = 2
pm.max_spare_servers = 4
clear_env = no

conf.php

;<?php http_response_code(403); /*
; config file for PrivateBin
;
; An explanation of each setting can be find online at https://github.com/PrivateBin/PrivateBin/wiki/Configuration.

[main]
name = "PrivateBin"
basepath = "https://paste.nerdvpn.de/"
discussion = true
opendiscussion = false
password = true
fileupload = true
burnafterreadingselected = false
defaultformatter = "plaintext"
sizelimit = 6291456
template = "bootstrap"
info = "<p class='text-center'>Powered by <a target='blank' href='https://nerdvpn.de'>NerdVPN.de</a> &nbsp; - &nbsp; <a target='blank' href='https://nerdvpn.de/terms'>Terms of Use</a></p>"
languageselection = true
languagedefault = "de"
qrcode = true

cspheader = "default-src 'none'; base-uri 'self'; form-action 'none'; manifest-src 'self'; connect-src * blob:; script-src 'self' 'unsafe-eval'; style-src 'self'; font-src 'self'; frame-ancestors 'none'; img-src 'self' data: blob:; media-src blob:; object-src blob:; sandbox allow-same-origin allow-scripts allow-forms allow-popups allow-modals allow-downloads"
httpwarning = true
compression = "zlib"

[expire]
default = "2week"

[expire_options]
15min = 900
1hour = 3600
6hour = 21600
1day = 86400
3day = 259200
1week = 604800
2week = 1209600
; Well this is not *exactly* one month, it's 30 days:
1month = 2592000
1year = 31536000
never = 0

[formatter_options]
plaintext = "Plain Text"
syntaxhighlighting = "Source Code"
markdown = "Markdown"

[traffic]
limit = 10
header = "X_FORWARDED_FOR"

[purge]
limit = 300
batchsize = 32

[model]
class = Database
[model_options]
dsn = "mysql:host=localhost;dbname=privatebin;charset=UTF8"
tbl = "privatebin_"
usr = "privatebin"
pwd = "REDACTED"
opt[12] = true

nginx

server {
    listen 443 ssl;
    listen [::]:443 ssl;

    http2 on;

    server_name paste.nerdvpn.de www.paste.nerdvpn.de;
    root /srv/privatebin/app;

    ssl_session_cache shared:nginx_TLS_paste:4m;

    add_header X-Robots-Tag "none";

    ssl_certificate /srv/letsencrypt/certs/paste.nerdvpn.de/fullchain.pem;
    ssl_certificate_key /srv/letsencrypt/certs/paste.nerdvpn.de/privkey.pem;
    include snippets/htst.conf;

    access_log off;
    error_log /dev/null emerg;

    include snippets/errorpages.conf;
    include snippets/malicious.conf;
    include /etc/nginx/bots.d/ddos.conf;

    include snippets/favicon.conf;
    include snippets/robots.conf;

    index index.php index.html index.htm;

    location / {
        add_header Cache-Control "public, max-age=3600, must-revalidate, no-transform";
        add_header Cross-Origin-Embedder-Policy require-corp;
        add_header Cross-Origin-Resource-Policy same-origin;
        add_header Referrer-Policy no-referrer;
        add_header X-Content-Type-Options nosniff;
        add_header X-Frame-Options deny;
        add_header X-XSS-Protection "1; mode=block";

        try_files $uri $uri/ /index.php$is_args$args;
    }

    location ~ \.php$ {
        fastcgi_pass php-fpm-privatebin;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;

        # Prevent exposing nginx + version to $_SERVER
        fastcgi_param SERVER_SOFTWARE "NerdVPN";
    }
}

[rugk]

You need to provide some frontend debugging information like browser version and what error message is shown in the console. Alos check of your server delivers the wasm file with the correct header, you should also see that in the developer (network) console. See also: https://github.com/orgs/PrivateBin/discussions/1543

[elrido]

The error from the browser console will tell - my bet is on the WASM streaming we introduced in 1.7.6, which requires a webserver with mime type support for application/wasm configured. This can be manually added to the webserver configuration, such as /etc/nginx/mime.types or the hosts /etc/mime.types file, if necessary.

From the change log for 1.7.6:

• CHANGED: Switched to WASM streaming and replace unsafe-eval with wasm-unsafe-eval CSP declaration (WASM streaming / eliminate unsafe-eval #1464), requires webserver to have application/wasm MIME type configured.

[tristanlatr]

I think this error will happen a lot since the WASM type is not configured by default with an up to date nginx from appstream repos on EL8.

[tristanlatr]

Changing the config file and reloading the nginx server will not fix the issue until user's cache has expired and they request a new version of the file.

[rugk]

In other words, this did fix the issue for you? I've marked the above as an answer then?

And yes, we've had that in mind that this may have been not the default and postponed this very long, see #814 (comment) for the long discussion.
Nginx upstream has fixed this in 2021 (!) though, so you should contact your distro to get updates here. IIRC EL8 is RedHat and yeah if it's too outdated, you may notice this issue.

[tristanlatr]

Not really, a lot of users still have the "octet-stream" version of the file instead of the "wasm" version in their cache. So if I update right away, privatebin will be broken for them (with an error message that doesn't help them resolve the situation). What if the error message proposed to clear the browser cache ?