Fix pad URL leaks through HTTP referer header in HTML5-compatible browsers #2498
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…wsers Added `rel="noreferrer"` to automatically generated links in the main pad window as well as the chat window. `rel="noreferrer"` is part of the HTML5 standard. While browser support isn't 100%, it's better than nothing. Future alternative solutions with wider browser support, such as intermediary redirect pages, are unaffected by this change. http://www.w3.org/TR/html5/links.html#link-type-noreferrer
…TML5-compatible browsers Exported HTML can, when loaded from disk or an online server, also leak the location. Applying the `rel="noreferrer"` HTML5 standard mitigate the problem for compatible browsers. http://www.w3.org/TR/html5/links.html#link-type-noreferrer
|
This should be a plugin |
hmdne
added a commit
to hmdne/etherpad-lite
that referenced
this pull request
Aug 25, 2019
Before this patch I managed to send a bunch of referrers to third party websites with Firefox. Unfortunately, meta name="referrer" isn't enough. I added "noopener" because that's also what Nextcloud does. One may want to check another pull request from 2015 which may be more complete, but it was denied with a plugin proposal: ether#2498 References to earlier issues: ether#1603, ether#3043
This was referenced Aug 25, 2019
|
Isn't that what this plugin is for: https://github.com/ether/ep_hide_referrer |
hmdne
added a commit
to hmdne/etherpad-lite
that referenced
this pull request
Nov 23, 2019
Pull request with discussion: ether#3636 What's already there: * meta name=referrer: already done in 1.6.1: ether#3044 https://caniuse.com/#feat=referrer-policy https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-delivery-meta (Chrome>=78, Firefox>=70, Safari>=13, Opera>=64, ~IE[1], ~Edge[1]) The previous two commits I backported in this batch: * a rel=noreferrer: a pull request denied before: ether#2498 https://html.spec.whatwg.org/multipage/links.html#link-type-noreferrer https://developer.mozilla.org/en-US/docs/Web/HTML/Link_types (Firefox>=37, I can't find more info about support) This commit adds the following: * a rel=noopener: fixing a not-so-well-known way to extract referer https://html.spec.whatwg.org/multipage/links.html#link-type-noopener (Chrome>=49, Firefox>=52, Safari>=10.1, Opera>=36, !IE, !Edge) * Referrer-Policy: same-origin: the last bastion of referrer security https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy (Chrome>=61, Firefox>=52, Safari>=11.1, Opera>=48, !IE, !Edge) meta name=referrer wasn't enough. I happened to leak a few referrers with my Firefox browser, though for some browsers it could have been enough. [1] IE>=11, Edge>=18 use a different syntax for meta name=referrer, making it most probably incompatible (but I may be wrong on that, they may support both, but I have no way to test it currently). The next Edge release will be based on Chromium, so for that the Chrome version applies.
hmdne
added a commit
to hmdne/etherpad-lite
that referenced
this pull request
Nov 23, 2019
Pull request with discussion: ether#3636 What's already there: * meta name=referrer: already done in 1.6.1: ether#3044 https://caniuse.com/#feat=referrer-policy https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-delivery-meta (Chrome>=78, Firefox>=70, Safari>=13, Opera>=64, ~IE[1], ~Edge[1]) The previous two commits (by @joelpurra) I backported in this batch: * a rel=noreferrer: a pull request denied before: ether#2498 https://html.spec.whatwg.org/multipage/links.html#link-type-noreferrer https://developer.mozilla.org/en-US/docs/Web/HTML/Link_types (Firefox>=37, I can't find more info about support) This commit adds the following: * a rel=noopener: fixing a not-so-well-known way to extract referer https://html.spec.whatwg.org/multipage/links.html#link-type-noopener (Chrome>=49, Firefox>=52, Safari>=10.1, Opera>=36, !IE, !Edge) * Referrer-Policy: same-origin: the last bastion of referrer security https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy (Chrome>=61, Firefox>=52, Safari>=11.1, Opera>=48, !IE, !Edge) meta name=referrer wasn't enough. I happened to leak a few referrers with my Firefox browser, though for some browsers it could have been enough. [1] IE>=11, Edge>=18 use a different syntax for meta name=referrer, making it most probably incompatible (but I may be wrong on that, they may support both, but I have no way to test it currently). The next Edge release will be based on Chromium, so for that the Chrome version applies.
muxator
pushed a commit
to hmdne/etherpad-lite
that referenced
this pull request
Nov 24, 2019
Pull request with discussion: ether#3636 What's already there: * `meta name=referrer`: already done in 1.6.1: ether#3044 https://caniuse.com/#feat=referrer-policy https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-delivery-meta (Chrome>=78, Firefox>=70, Safari>=13, Opera>=64, ~IE[1], ~Edge[1]) The previous two commits (by @joelpurra) I backported in this batch: * `<a rel=noreferrer>`: a pull request denied before: ether#2498 https://html.spec.whatwg.org/multipage/links.html#link-type-noreferrer https://developer.mozilla.org/en-US/docs/Web/HTML/Link_types (Firefox>=37, I can't find more info about support) This commit adds the following: * `<a rel="noopener">`: fixing a not-so-well-known way to extract referer https://html.spec.whatwg.org/multipage/links.html#link-type-noopener (Chrome>=49, Firefox>=52, Safari>=10.1, Opera>=36, !IE, !Edge) * `Referrer-Policy: same-origin`: the last bastion of referrer security https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy (Chrome>=61, Firefox>=52, Safari>=11.1, Opera>=48, !IE, !Edge) meta name=referrer wasn't enough. I happened to leak a few referrers with my Firefox browser, though for some browsers it could have been enough. [1] IE>=11, Edge>=18 use a different syntax for meta name=referrer, making it most probably incompatible (but I may be wrong on that, they may support both, but I have no way to test it currently). The next Edge release will be based on Chromium, so for that the Chrome version applies.
muxator
pushed a commit
to hmdne/etherpad-lite
that referenced
this pull request
Nov 24, 2019
Pull request with discussion: ether#3636 What's already there: * `meta name=referrer`: already done in 1.6.1: ether#3044 https://caniuse.com/#feat=referrer-policy https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-delivery-meta (Chrome>=78, Firefox>=70, Safari>=13, Opera>=64, ~IE[1], ~Edge[1]) The previous two commits (by @joelpurra) I backported in this batch: * `<a rel=noreferrer>`: a pull request denied before: ether#2498 https://html.spec.whatwg.org/multipage/links.html#link-type-noreferrer https://developer.mozilla.org/en-US/docs/Web/HTML/Link_types (Firefox>=37, I can't find more info about support) This commit adds the following: * `<a rel="noopener">`: fixing a not-so-well-known way to extract referer https://html.spec.whatwg.org/multipage/links.html#link-type-noopener (Chrome>=49, Firefox>=52, Safari>=10.1, Opera>=36, !IE, !Edge) * `Referrer-Policy: same-origin`: the last bastion of referrer security https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy (Chrome>=61, Firefox>=52, Safari>=11.1, Opera>=48, !IE, !Edge) meta name=referrer wasn't enough. I happened to leak a few referrers with my Firefox browser, though for some browsers it could have been enough. [1] IE>=11, Edge>=18 use a different syntax for meta name=referrer, making it most probably incompatible (but I may be wrong on that, they may support both, but I have no way to test it currently). The next Edge release will be based on Chromium, so for that the Chrome version applies.
muxator
pushed a commit
to hmdne/etherpad-lite
that referenced
this pull request
Nov 24, 2019
…sible Pull request with discussion: ether#3636 What's already there: * `meta name=referrer`: already done in 1.6.1: ether#3044 https://caniuse.com/#feat=referrer-policy https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-delivery-meta (Chrome>=78, Firefox>=70, Safari>=13, Opera>=64, ~IE[1], ~Edge[1]) The previous two commits (by @joelpurra) I backported in this batch: * `<a rel=noreferrer>`: a pull request denied before: ether#2498 https://html.spec.whatwg.org/multipage/links.html#link-type-noreferrer https://developer.mozilla.org/en-US/docs/Web/HTML/Link_types (Firefox>=37, I can't find more info about support) This commit adds the following: * `<a rel="noopener">`: fixing a not-so-well-known way to extract referer https://html.spec.whatwg.org/multipage/links.html#link-type-noopener (Chrome>=49, Firefox>=52, Safari>=10.1, Opera>=36, !IE, !Edge) * `Referrer-Policy: same-origin`: the last bastion of referrer security https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy (Chrome>=61, Firefox>=52, Safari>=11.1, Opera>=48, !IE, !Edge) meta name=referrer wasn't enough. I happened to leak a few referrers with my Firefox browser, though for some browsers it could have been enough. [1] IE>=11, Edge>=18 use a different syntax for meta name=referrer, making it most probably incompatible (but I may be wrong on that, they may support both, but I have no way to test it currently). The next Edge release will be based on Chromium, so for that the Chrome version applies.
|
This PR was incorporated in #3636 and will be part of 1.8.0. #3044 (merged in 1.6.1) already started addressing this issue, and mentioned:
|
muxator
pushed a commit
to hmdne/etherpad-lite
that referenced
this pull request
Nov 24, 2019
Added `rel="noreferrer"` to automatically generated links in the main pad window as well as the chat window. `rel="noreferrer"` is part of the HTML5 standard. While browser support isn't 100%, it's better than nothing. Future alternative solutions with wider browser support, such as intermediary redirect pages, are unaffected by this change. https://html.spec.whatwg.org/multipage/links.html#link-type-noreferrer This commit was originally part of ether#2498
muxator
pushed a commit
to hmdne/etherpad-lite
that referenced
this pull request
Nov 24, 2019
…er header Exported HTML can, when loaded from disk or an online server, also leak the location. Applying the `rel="noreferrer"` HTML5 standard mitigate the problem for compatible browsers. https://html.spec.whatwg.org/multipage/links.html#link-type-noreferrer This commit was originally part of ether#2498
muxator
pushed a commit
to hmdne/etherpad-lite
that referenced
this pull request
Nov 24, 2019
…sible Pull request with discussion: ether#3636 What's already there: * `meta name=referrer`: already done in 1.6.1: ether#3044 https://caniuse.com/#feat=referrer-policy https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-delivery-meta (Chrome>=78, Firefox>=70, Safari>=13, Opera>=64, ~IE[1], ~Edge[1]) The previous two commits (by @joelpurra) I backported in this batch: * `<a rel=noreferrer>`: a pull request denied before: ether#2498 https://html.spec.whatwg.org/multipage/links.html#link-type-noreferrer https://developer.mozilla.org/en-US/docs/Web/HTML/Link_types (Firefox>=37, I can't find more info about support) This commit adds the following: * `<a rel="noopener">`: fixing a not-so-well-known way to extract referer https://html.spec.whatwg.org/multipage/links.html#link-type-noopener (Chrome>=49, Firefox>=52, Safari>=10.1, Opera>=36, !IE, !Edge) * `Referrer-Policy: same-origin`: the last bastion of referrer security https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy (Chrome>=61, Firefox>=52, Safari>=11.1, Opera>=48, !IE, !Edge) meta name=referrer wasn't enough. I happened to leak a few referrers with my Firefox browser, though for some browsers it could have been enough. [1] IE>=11, Edge>=18 use a different syntax for meta name=referrer, making it most probably incompatible (but I may be wrong on that, they may support both, but I have no way to test it currently). The next Edge release will be based on Chromium, so for that the Chrome version applies.
muxator
pushed a commit
that referenced
this pull request
Nov 24, 2019
Added `rel="noreferrer"` to automatically generated links in the main pad window as well as the chat window. `rel="noreferrer"` is part of the HTML5 standard. While browser support isn't 100%, it's better than nothing. Future alternative solutions with wider browser support, such as intermediary redirect pages, are unaffected by this change. https://html.spec.whatwg.org/multipage/links.html#link-type-noreferrer This commit was originally part of #2498
muxator
pushed a commit
that referenced
this pull request
Nov 24, 2019
…er header Exported HTML can, when loaded from disk or an online server, also leak the location. Applying the `rel="noreferrer"` HTML5 standard mitigate the problem for compatible browsers. https://html.spec.whatwg.org/multipage/links.html#link-type-noreferrer This commit was originally part of #2498
muxator
pushed a commit
that referenced
this pull request
Nov 24, 2019
…sible Pull request with discussion: #3636 What's already there: * `meta name=referrer`: already done in 1.6.1: #3044 https://caniuse.com/#feat=referrer-policy https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-delivery-meta (Chrome>=78, Firefox>=70, Safari>=13, Opera>=64, ~IE[1], ~Edge[1]) The previous two commits (by @joelpurra) I backported in this batch: * `<a rel=noreferrer>`: a pull request denied before: #2498 https://html.spec.whatwg.org/multipage/links.html#link-type-noreferrer https://developer.mozilla.org/en-US/docs/Web/HTML/Link_types (Firefox>=37, I can't find more info about support) This commit adds the following: * `<a rel="noopener">`: fixing a not-so-well-known way to extract referer https://html.spec.whatwg.org/multipage/links.html#link-type-noopener (Chrome>=49, Firefox>=52, Safari>=10.1, Opera>=36, !IE, !Edge) * `Referrer-Policy: same-origin`: the last bastion of referrer security https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy (Chrome>=61, Firefox>=52, Safari>=11.1, Opera>=48, !IE, !Edge) meta name=referrer wasn't enough. I happened to leak a few referrers with my Firefox browser, though for some browsers it could have been enough. [1] IE>=11, Edge>=18 use a different syntax for meta name=referrer, making it most probably incompatible (but I may be wrong on that, they may support both, but I have no way to test it currently). The next Edge release will be based on Chromium, so for that the Chrome version applies.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
See #1603.
Added
rel="noreferrer"to automatically generated links in the main padwindow as well as the chat window. Also applied the fix to exported HTML documents.
rel="noreferrer"is part of the HTML5 standard. While browser supportisn't 100%, it's better than nothing. Future alternative solutions with
wider browser support, such as intermediary redirect pages, are unaffected
by this change.