Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Spoof Referer header of third party requests #2155

Closed
wants to merge 4 commits into from
Closed

Spoof Referer header of third party requests #2155

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
d79bec6
spoof referer header of third party requests
troy-lamerton Sep 2, 2018
cced561
remove logs that were for debugging
troy-lamerton Sep 2, 2018
df0a7bb
Add checkbox to toggle Spoof referrer option
troy-lamerton Sep 4, 2018
2e66ed4
update spoof setting on checkbox click
troy-lamerton Sep 5, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion src/_locales/en_US/messages.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -135,6 +135,10 @@
"message": "Replace social widgets",
"description": "Checkbox label on the general settings page"
},
"options_spoof_referrer_checkbox": {
"message": "Spoof the Referrer header",
Copy link
Contributor

@bcyphers bcyphers Sep 6, 2018 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It would be useful to have this text link out to an explanation of what a "referer" header is. Also, should we spell it the English way, or the canonical way? https://en.wikipedia.org/wiki/HTTP_referer

"description": "Checkbox label for spoofing referrer on the general settings page"
},
"options_incognito_warning": {
"message": "** Enabling learning in Private/Incognito windows may leave traces of your private browsing history on your computer. By default, Privacy Badger will block trackers it already knows about in Private/Incognito windows, but it won't learn about new trackers. You might want to enable this option if a lot of your browsing happens in Private/Incognito windows.",
"description": "Detailed explanation shown under checkboxes on the general settings page"
Expand Down Expand Up @@ -509,4 +513,4 @@
}
}
}
}
}
7 changes: 6 additions & 1 deletion src/js/background.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -478,7 +478,8 @@ Badger.prototype = {
sendDNTSignal: true,
showCounter: true,
showTrackingDomains: false,
socialWidgetReplacementEnabled: true
socialWidgetReplacementEnabled: true,
spoofReferrerEnabled: true
},

/**
Expand Down Expand Up @@ -636,6 +637,10 @@ Badger.prototype = {
return this.getSettings().getItem("socialWidgetReplacementEnabled");
},

isSpoofReferrerEnabled: function() {
return this.getSettings().getItem("spoofReferrerEnabled");
},

isDNTSignalEnabled: function() {
return this.getSettings().getItem("sendDNTSignal");
},
Expand Down
16 changes: 16 additions & 0 deletions src/js/options.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -107,6 +107,8 @@ function loadOptions() {
$("#show_counter_checkbox").prop("checked", badger.showCounter());
$("#replace_social_widgets_checkbox").on("click", updateSocialWidgetReplacement);
$("#replace_social_widgets_checkbox").prop("checked", badger.isSocialWidgetReplacementEnabled());
$("#spoof_referrer_checkbox").on("click", updateSpoofReferrer);
$("#spoof_referrer_checkbox").prop("checked", badger.isSpoofReferrerEnabled());
$("#enable_dnt_checkbox").on("click", updateDNTCheckboxClicked);
$("#enable_dnt_checkbox").prop("checked", badger.isDNTSignalEnabled());
$("#check_dnt_policy_checkbox").on("click", updateCheckingDNTPolicy);
Expand Down Expand Up @@ -330,6 +332,20 @@ function updateSocialWidgetReplacement() {
});
}

/**
* Update setting for spoofing the referrer header of all 3rd party requests.
*/
function updateSpoofReferrer() {
const enabled = $("#spoof_referrer_checkbox").prop("checked");

chrome.runtime.sendMessage({
type: "updateSettings",
data: {
spoofReferrerEnabled: enabled
}
});
}

/**
* Update DNT checkbox clicked
*/
Expand Down
17 changes: 17 additions & 0 deletions src/js/webrequest.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -172,6 +172,23 @@ function onBeforeSendHeaders(details) {
} else {
return {};
}

} else if (badger.isSpoofReferrerEnabled()) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This shouldn't be an "else if", just an "if", since the "if this isn't a third-party request" block above always exits.

Copy link
Member

@ghostwords ghostwords Sep 12, 2018 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should move this entire referrer spoofing block down in onBeforeSendHeaders callback.

We don't want to do this when Badger is disabled, and we already have a check for this later on in the callback (if (!badger.isPrivacyBadgerEnabled(tabDomain)) ...). We don't want to do this when Badger "cookieblocks" a request (Refer gets stripped there already), or when Badger ends up blocking the request (when the request happens to register as third strike thanks to cookie headers).

We do want this to work in concert with DNT header injection though, so it makes sense for things that alter headers to live next to each other.

if (badger.isPrivacyBadgerEnabled(tabDomain) && badger.isPrivacyBadgerEnabled(requestDomain)) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We shouldn't check requestDomain here, right? Privacy Badger's site whitelist is for first-party (site) domains.

// spoof referer header for third party requests
const refererHeader = details.requestHeaders.find(header => header.name === "Referer");
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we do a case-insensitive check here? header.name.toLowerCase() == "referer"

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Style nit: refer_header (lowercase with underscores for for non-object/non-object-property variables).

if (refererHeader) {
if (details.method === "GET") {
// spoof referer value
const requestUrl = new URL(details.url);
refererHeader.value = requestUrl.origin;
Copy link
Member

@ghostwords ghostwords Sep 12, 2018 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we already have the origin in the requestDomain variable defined above.

} else {
// remove referer header from non-GET request
const refererHeaderIndex = details.requestHeaders.indexOf(refererHeader);
Copy link
Member

@ghostwords ghostwords Sep 12, 2018 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Style nit: referer_header_index

details.requestHeaders.splice(refererHeaderIndex, 1);
}
}
}
}

var requestAction = checkAction(tab_id, requestDomain, frame_id);
Expand Down
6 changes: 6 additions & 0 deletions src/skin/options.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -150,6 +150,12 @@ <h1><span class="i18n_options_title"></span></h1>
<span class="i18n_options_social_widgets_checkbox"></span>
</label>
</div>
<div class="checkbox">
<label>
<input type="checkbox" id="spoof_referrer_checkbox">
<span class="i18n_options_spoof_referrer_checkbox"></span>
</label>
</div>
<div class="checkbox">
<label>
<input type="checkbox" id="enable_dnt_checkbox">
Expand Down