Add basic link-tracking protections to Google sites, update Facebook content script, and factor out common code. #2016

bcyphers · 2018-05-11T19:31:24Z

This pull request will add basic anti-link-tracking measures for Google searches (www.google.com) as well as to links pasted into Google Hangouts (hangouts.google.com).

The search script removes click and mousedown event listeners from vanilla search links on www.google.com. It doesn't apply to localized domains, or to any google sites other than web search. For some reason, link tracking happens differently in Firefox and Chrome. In Firefox, there is an event listener for mousedown that sneaks in and replaces the actual url with a www.google.com/url? redirect link. In Chrome, Google uses the new HTML5 ping attribute, which I just learned about. As an aside, it might be worth blocking this attribute everywhere -- I can't think of a valid non-tracking use case.

The hangouts script is simpler because the tracking mechanism is simpler. It uses setInterval to rewrite all hrefs that start with google.com/url? in hangouts.google.com iframes.

I also used this as an opportunity to abstract out the common functions that we use for link unwrapping into a lib/ file, to DRY out the code and make it easier to add anti-link-tracking scripts for other sites in the future.

Follows up on #1993 and #1392. Closes #85.

Closes #2012, closes #2014, closes #2018.

ghostwords

Thank you! Got some feedback.

Could do YouTube next (href=https://www.youtube.com/redirect?...).

ghostwords · 2018-05-21T17:26:01Z

src/manifest.json

@@ -10,8 +10,7 @@
  "incognito": "spanning",
  "permissions": [
    "tabs",
-    "http://*/*",
-    "https://*/*",
+    "*://*/*",


This adds WebSocket URLs (#1010). Let's hold off making this change here.

ghostwords · 2018-05-21T17:49:48Z

src/lib/firstparty.js

+    }
+  }
+
+  // unwrap wrapped links in a Hangouts iframe


This comment should get updated now that it's not in Hangouts-specific code.

ghostwords · 2018-05-21T17:53:08Z

src/lib/firstparty.js

+      return;
+    }
+    for (let node of mutation.addedNodes) {
+      node.querySelectorAll(selector).forEach((element) => {


Should fix exceptions with non-Element nodes (#2018).

ghostwords · 2018-05-21T18:28:21Z

src/js/firstparties/hangouts.js

+    return;
+  }
+
+  // remove all attributes from a link except for href


Except for "target"?

ghostwords · 2018-05-21T18:33:43Z

src/js/firstparties/google.js

+      a.removeAttribute(attr.name);
+    }
+  }
+  a.rel = "noreferrer";


Should we do "noreferrer noopener" here since there is no target=_blank?

My takeaway from https://mathiasbynens.github.io/rel-noopener/ was that noreferrer makes noopener unnecessary, but on second glace I'm not sure. I'll add both for now.

ghostwords · 2018-05-21T18:36:42Z

src/js/firstparties/google.js

+  a.rel = "noreferrer";
+
+  // block event listeners on the link
+  a.addEventListener("click", function (e) { e.stopImmediatePropagation(); }, true);


Should we also call e.stopPropagation?

I think stopImmediatePropagation is a strict superset: https://dom.spec.whatwg.org/#dom-event-stopimmediatepropagation

ghostwords · 2018-05-21T19:04:43Z

src/js/firstparties/facebook.js

@@ -35,8 +19,7 @@ function cleanLink(a) {
  let href = new URL(a.href).searchParams.get('u');

  // from https://stackoverflow.com/questions/3809401/what-is-a-good-regular-expression-to-match-a-url


Should move the comment too.

ghostwords · 2018-05-21T19:09:05Z

src/js/firstparties/facebook.js

@@ -51,29 +34,11 @@ function cleanLink(a) {
  a.addEventListener("mouseover", function (e) { e.stopPropagation(); }, true);


Should we also call e.stopImmediatePropagation?

Yes, definitely. See #2033

ghostwords · 2018-05-21T19:16:34Z

Re blocking pings everywhere: related to but not the same as #2024.

ghostwords

Move the shared content script to something like src/js/firstparties/lib/utils.js?

ghostwords · 2018-05-21T19:31:16Z

src/js/firstparties/google.js

@@ -0,0 +1,26 @@
+/* globals findInAllFrames:false */
+(function() {


We don't need to wrap our content scripts in self-executing functions (since content scripts operate in their own JavaScript context), right?

Ah, didn't realize they had their own contexts. Thanks for the heads up.

ghostwords · 2018-05-21T20:19:08Z

Related projects to glance over:

ghostwords · 2018-05-22T22:06:26Z

src/js/firstparties/google.js

+
+  // block event listeners on the link
+  a.addEventListener("click", function (e) { e.stopImmediatePropagation(); }, true);
+  a.addEventListener("mousedown", function (e) { e.stopImmediatePropagation(); }, true);


I still see a gen_204 request go out with a plain click on a search result link, at least in Chrome.

bcyphers · 2018-05-23T23:45:14Z

Re: google.com in Chrome still sending out gen_204 requests (I can't find the comment anymore)

I can reproduce this, but I think it triggers whenever the user navigates away from the page, not just when they click on a link. I have a dev tools network tab open for google.com in Chrome, and every time I switch from Google to a different tab, a gen_204 POST request fires off, even if I haven't clicked any links on the page. I think it's outside the scope of this PR to stop those.

bcyphers · 2018-06-05T18:38:53Z

I replaced the last "address PR comments" commit with a few more descriptive ones. Also, I believe this closes #85, at least for everything described in the original issue.

bcyphers · 2018-06-05T19:00:54Z

@ghostwords I moved the first party util file like you suggested, and incorporated the changes from #2033 into this branch. Can you give this another look when you get a chance? Thanks!

ghostwords

Please merge or rebase on master.

Remove click and mousedown event listeners from vanilla search links on google.com. Does not apply to localized domains, or to any google sites other than web search.

Add lib/firstparty.js for commonly-used first-party script methods. Update the google.com first-party script to use lib functions.

Create firstparties/hangouts.js, which unwraps shim links in google hangouts chat windows at hangouts.google.com and mail.google.com.

Use lib/firstparty.js common functions in the facebook link-unwrapping script. Update manifest.json to include the hangouts script, and change "(http|https)://" url matches in the manifest to "*://" matches.

Google Hangouts content script now works correctly. Make some changes to lib/firstparty.js, and change manifest to include hangouts script in all hangouts.google.com iframes.

Since www.google.com uses the `ping` attribute for tracking instead of the instrumentation in firefox, add that to the content script's querySelector. Tested to work in both Firefox and Chrome.

Replace '*://*/*' permission with 'http://' and 'https://' permissions again to avoid including WebSocket URLs for now.

Check whether a node is an element node before trying to call querySelectorAll on it. This avoids throwing confusing errors.

Add noopener tag to unwrapped google links since there is no target=_blank. Move content script code out of anonymous self-executing functions because they do not run in the global scope.

Move lib/firstparty.js to js/firstparties/lib/utils.js and change references in manifest.json.

Add support for facebookcorewwwi.onion to facbook content script. Remove unnecessary anonymous self-calling function from the script.

Remove URL_REGEX checks that were vulnerable to javascript injection and replace with calls to isURL, which checks that a string starts with http:// or https://.

Load the first-party util script into the unittest page before executing the facebook script.

Conflicts: src/js/firstparties/facebook.js

ghostwords

Some manifest comments for now.

Is either test failure related to changes in this PR? I might have seen the cookie tracking failure before, but the QUnit failure seems new.

ghostwords · 2018-09-17T16:30:59Z

src/manifest.json

    "https://*/*",
+    "http://*/*",


Let's avoid making any unnecessary manifest changes. This seems trivial, but who knows what buggy logic this array reordering may trigger.

ghostwords · 2018-09-17T16:32:29Z

src/manifest.json

@@ -49,22 +49,42 @@
        "js/firstparties/twitter.js"
      ],
      "matches": [
-        "https://twitter.com/*",
-        "http://twitter.com/*"
+        "*://twitter.com/*"


Let's revert and go back to explicitly listing out https and http. "*://" is confusing as it includes ws(s) in some browsers but not others.

ghostwords · 2018-09-17T16:32:46Z

src/manifest.json

        "js/firstparties/facebook.js"
      ],
      "matches": [
-        "https://*.facebook.com/*",
-        "http://*.facebook.com/*",
+        "*://*.facebook.com/*",


Same as above; revert please.

ghostwords · 2018-09-17T16:33:05Z

src/manifest.json

+        "js/firstparties/google.js"
+      ],
+      "matches": [
+        "*://www.google.com/*"


http/https instead

ghostwords · 2018-09-17T16:33:12Z

src/manifest.json

+        "js/firstparties/hangouts.js"
+      ],
+      "matches": [
+        "*://hangouts.google.com/*"


http/https instead

ghostwords · 2018-09-17T16:56:13Z

Also, I merged in master, resolving conflicts with/applying the changes from #2163.

Rename the hangouts.js first party script to google-static.js and use it to unwrap links on docs.google.com. Rename the web search unwrap script from google.js to google-search.js.

Add tests for static google shim unwrapping and "trap link" de-instrumentation. Update variable names in google scripts to avoid conflicts.

Sometimes a content script would load before the utility script had finished executing, which led to it trying to access undefined functions. Now the tests load content scripts after utility scripts are finished.

ghostwords

One possibly unintended change this PR introduces is that now Google search result destinations will no longer receive any referrer information. When Privacy Badger is disabled, destination pages receive the origin (https://www.google.com/) as the referrer (in document.referrer and the referer header).

Add protection against outgoing link click tracking on Google Search, Google Docs and Google Hangouts.

bcyphers changed the title ~~Add basic anti-tracking to google.com~~ Add basic link-tracking protections to Google sites May 17, 2018

bcyphers requested a review from ghostwords May 18, 2018 21:07

ghostwords requested changes May 21, 2018

View reviewed changes

ghostwords reviewed May 21, 2018

View reviewed changes

ghostwords mentioned this pull request May 21, 2018

Remove outbound link tracking on Google, Facebook, Twitter, and other major origins #85

Closed

ghostwords reviewed May 22, 2018

View reviewed changes

bcyphers mentioned this pull request May 23, 2018

Improve Facebook link unwrapping #2033

Closed

ghostwords force-pushed the master branch from de95135 to efdd168 Compare May 29, 2018 20:17

njourdane mentioned this pull request May 31, 2018

Option to remove metadata from URL #681

Open

bcyphers force-pushed the google.com-link-unwrapping branch from 8d826f5 to a0304e3 Compare June 5, 2018 18:36

bcyphers changed the title ~~Add basic link-tracking protections to Google sites~~ Add basic link-tracking protections to Google sites, update Facebook content script, and factor out common code. Jun 5, 2018

bcyphers requested a review from ghostwords June 5, 2018 19:02

bcyphers mentioned this pull request Jun 5, 2018

block *.facebookcorewwwi.onion link click tracking #2014

Closed

ghostwords force-pushed the master branch from 7504cc7 to 92c8d1c Compare June 7, 2018 20:41

bcyphers mentioned this pull request Jul 19, 2018

Improve Facebook link unwrapping #2106

Merged

ghostwords reviewed Jul 23, 2018

View reviewed changes

bcyphers added 8 commits July 23, 2018 17:01

Add basic anti-tracking to google.com

693b537

Remove click and mousedown event listeners from vanilla search links on google.com. Does not apply to localized domains, or to any google sites other than web search.

Add first-party lib file

50f8754

Add lib/firstparty.js for commonly-used first-party script methods. Update the google.com first-party script to use lib functions.

Add Google Hangouts link unwrapping

c5e44c4

Create firstparties/hangouts.js, which unwraps shim links in google hangouts chat windows at hangouts.google.com and mail.google.com.

Use lib functions in Facebook script

2cdd85e

Use lib/firstparty.js common functions in the facebook link-unwrapping script. Update manifest.json to include the hangouts script, and change "(http|https)://" url matches in the manifest to "*://" matches.

Refactor and fix hangouts content script

a5f7ea1

Google Hangouts content script now works correctly. Make some changes to lib/firstparty.js, and change manifest to include hangouts script in all hangouts.google.com iframes.

Add link tracking removal for google.com in Chrome

e8287f4

Since www.google.com uses the `ping` attribute for tracking instead of the instrumentation in firefox, add that to the content script's querySelector. Tested to work in both Firefox and Chrome.

Fix lint issues

4bdc7f8

Revert manifest URL permissions

697f1dc

Replace '*://*/*' permission with 'http://' and 'https://' permissions again to avoid including WebSocket URLs for now.

bcyphers added 6 commits July 23, 2018 17:03

Update comments to match current code state

39e6037

Add check for element node to MutationObserver

1275144

Check whether a node is an element node before trying to call querySelectorAll on it. This avoids throwing confusing errors.

Use noopener tag and remove closures

bcbf7df

Add noopener tag to unwrapped google links since there is no target=_blank. Move content script code out of anonymous self-executing functions because they do not run in the global scope.

Move lib/firstparty.js

5759206

Move lib/firstparty.js to js/firstparties/lib/utils.js and change references in manifest.json.

Add support for Facebook onion URL

0f4eab4

Add support for facebookcorewwwi.onion to facbook content script. Remove unnecessary anonymous self-calling function from the script.

Replace URL regex matching with http(s):// check

e03f5eb

Remove URL_REGEX checks that were vulnerable to javascript injection and replace with calls to isURL, which checks that a string starts with http:// or https://.

bcyphers force-pushed the google.com-link-unwrapping branch from c6a7e55 to e03f5eb Compare July 24, 2018 00:17

bcyphers mentioned this pull request Aug 8, 2018

Unwrap t.co links on tweetdeck #1652

Closed

bcyphers added 3 commits August 24, 2018 12:38

Merge branch 'master' into google.com-link-unwrapping

a6e7594

Fix lint issues and add more comments

1bdd77e

Update Facebook firstparty script unit test

c8235b3

Load the first-party util script into the unittest page before executing the facebook script.

Jsnhlbr5 mentioned this pull request Sep 7, 2018

First-party scripts should not run when privacy badger is disabled #2025

Closed

Merge branch 'master'

60b6a4a

Conflicts: src/js/firstparties/facebook.js

ghostwords requested changes Sep 17, 2018

View reviewed changes

Revert *:// in manifest to http(s)://

2487d7d

ghostwords force-pushed the master branch from 5afce52 to 257be9c Compare September 18, 2018 15:19

bcyphers added 5 commits September 26, 2018 16:31

Unwrap links in google docs comments

08a117e

Rename the hangouts.js first party script to google-static.js and use it to unwrap links on docs.google.com. Rename the web search unwrap script from google.js to google-search.js.

Add unittests for google unwrapping

bba3242

Add tests for static google shim unwrapping and "trap link" de-instrumentation. Update variable names in google scripts to avoid conflicts.

fix lint errors

cdeee02

Revert unnecessary setTimeout change to unittests

3073f39

Fix race condition in first party unit test

c059a55

Sometimes a content script would load before the utility script had finished executing, which led to it trying to access undefined functions. Now the tests load content scripts after utility scripts are finished.

ghostwords reviewed Oct 3, 2018

View reviewed changes

ghostwords merged commit c059a55 into master Oct 3, 2018

ghostwords added a commit that referenced this pull request Oct 3, 2018

Merge pull request #2016.

7d1468a

Add protection against outgoing link click tracking on Google Search, Google Docs and Google Hangouts.

ghostwords deleted the google.com-link-unwrapping branch October 3, 2018 18:24

This was referenced Oct 4, 2018

breaks google search setting to open new tab immediately on click of search result link #2181

Closed

Apply google link unwrapping in firefox android #2184

Closed

bcyphers mentioned this pull request Oct 18, 2018

Suggestion: Strip tracking from out.reddit.com #2194

Open

ghostwords added the first-party relating to first-party scripts label Nov 14, 2019

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add basic link-tracking protections to Google sites, update Facebook content script, and factor out common code. #2016

Add basic link-tracking protections to Google sites, update Facebook content script, and factor out common code. #2016

bcyphers commented May 11, 2018 •

edited by ghostwords

Loading

ghostwords left a comment

ghostwords May 21, 2018

ghostwords May 21, 2018

ghostwords May 21, 2018

ghostwords May 21, 2018

ghostwords May 21, 2018

bcyphers May 23, 2018

ghostwords May 21, 2018

bcyphers May 23, 2018

ghostwords May 21, 2018

ghostwords May 21, 2018

bcyphers May 23, 2018 •

edited

Loading

ghostwords commented May 21, 2018

ghostwords left a comment

ghostwords May 21, 2018

bcyphers May 23, 2018

ghostwords commented May 21, 2018

ghostwords May 22, 2018

bcyphers commented May 23, 2018 •

edited

Loading

bcyphers commented Jun 5, 2018

bcyphers commented Jun 5, 2018 •

edited

Loading

ghostwords left a comment

ghostwords left a comment

ghostwords Sep 17, 2018

ghostwords Sep 17, 2018 •

edited

Loading

ghostwords Sep 17, 2018

ghostwords Sep 17, 2018

ghostwords Sep 17, 2018

ghostwords commented Sep 17, 2018

ghostwords left a comment

		@@ -35,8 +19,7 @@ function cleanLink(a) {
		let href = new URL(a.href).searchParams.get('u');

		// from https://stackoverflow.com/questions/3809401/what-is-a-good-regular-expression-to-match-a-url

		@@ -51,29 +34,11 @@ function cleanLink(a) {
		a.addEventListener("mouseover", function (e) { e.stopPropagation(); }, true);

		@@ -0,0 +1,26 @@
		/* globals findInAllFrames:false */
		(function() {

Add basic link-tracking protections to Google sites, update Facebook content script, and factor out common code. #2016

Add basic link-tracking protections to Google sites, update Facebook content script, and factor out common code. #2016

Conversation

bcyphers commented May 11, 2018 • edited by ghostwords Loading

ghostwords left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

bcyphers May 23, 2018 • edited Loading

Choose a reason for hiding this comment

ghostwords commented May 21, 2018

ghostwords left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ghostwords commented May 21, 2018

Choose a reason for hiding this comment

bcyphers commented May 23, 2018 • edited Loading

bcyphers commented Jun 5, 2018

bcyphers commented Jun 5, 2018 • edited Loading

ghostwords left a comment

Choose a reason for hiding this comment

ghostwords left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ghostwords Sep 17, 2018 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ghostwords commented Sep 17, 2018

ghostwords left a comment

Choose a reason for hiding this comment

bcyphers commented May 11, 2018 •

edited by ghostwords

Loading

bcyphers May 23, 2018 •

edited

Loading

bcyphers commented May 23, 2018 •

edited

Loading

bcyphers commented Jun 5, 2018 •

edited

Loading

ghostwords Sep 17, 2018 •

edited

Loading