Remove Twitter's t tracking parameter

[fmarier]

Twitter adds a t parameter to the query string which appears to be linked to the Twitter account. Since these could be found in links that people share outside of Twitter, they have the potential for cross-site tracking of users. We should remove them on *.twitter.com.

This will require adding support for scoping our existing rules to a specific origin/hostname (or just a URL pattern).

Once we have this support in place, we should scope the Instagram share ID to *.instagram.com as well.

[fmarier]

Note that there is also an s parameter, but that's not a unique ID, it appears for tracking the source of the share action (i.e. mobile app, desktop, etc.).

Both s and t are removed when using the "copy clean link" feature.

[fmarier]

While the parameter is now filtered out, #23742 remains and so a complete fix for Twitter depends on that issue getting fixed.

[stephendonner]

Verified PASSED using

Brave	1.47.110 Chromium: 108.0.5359.71 (Official Build) beta (x86_64)
Revision	1e0e3868ee06e91ad636a874420e3ca3ae3756ac-refs/branch-heads/5359@{#1016}
OS	macOS Version 13.1 (Build 22C5059b)

Steps:

1. opened https://www.instagram.com/desusbloodyshoes/?igshid=abcdef and confirm that the igshid` parameter is missing from the query string.
2. opened https://brave.com/?igshid=abcdef and confirmed that the igshid parameter is present in the query string.
3. opened https://twitter.com/fmarier/status/1574869891978784769?s=21&t=lkfjeslkfjes&fbclid=1234 and confirmed that neither the t nor the fbclid parameters were in the URL (but s=21 was still there).

step 1	step 2	step 3

[GeetaSarvadnya]

Verification PASSED on Vivo X70 Pro version 12 running Bravemonoarmx64.apk_1.47.165

Steps:

1. opened https://www.instagram.com/desusbloodyshoes/?igshid=abcdef and confirm that the igshid` parameter is missing from the query string.
2. opened https://brave.com/?igshid=abcdef and confirmed that the igshid parameter is present in the query string.
3. opened https://twitter.com/fmarier/status/1574869891978784769?s=21&t=lkfjeslkfjes&fbclid=1234 and confirmed that neither the t nor the fbclid parameters were in the URL (but s=21 was still there).

step 1	step 2	step 3

[issuant]

@fmarier Did this get reversed? I am looking at the code section linked in #41849 (comment) but I cannot find anything about the t or s parameter.

[bsclifton]

@issuant no, this should not be reversed. The actual list of params is configurable and is downloaded as part of Brave Local Data Updater in component updater, if I remember correctly. You can view the component registration and version in brave://components/

On desktop, you can go into your profile directory and find this component and open/inspect the clean-urls.json file. For example, on Windows, mine is located at %LOCALAPPDATA%\BraveSoftware\Brave-Browser-Nightly\User Data\afalakplffnnnlkncjhbmahjfjhmlkal\1.0.999\1\clean-urls.json

The section for Twitter/X looks like this:

{
        "include": [
            "*://*.twitter.com/*",
            "*://*.x.com/*"
        ],
        "exclude": [
            "*://*.twitter.com/i/redirect?*",
            "*://*.x.com/i/redirect?*"
        ],
        "params": [
            "cxt",
            "ref_src",
            "ref_url",
            "s",
            "t"
        ]
    },

[fmarier]

We had to remove it from the query filter list (brave/brave-core#16968) due to webcompat problems. But like @bsclifton said, it's still removed if you use the copy-clean-link feature: https://github.com/brave/adblock-lists/blob/88bc194fb88844712c4b2e068954befa9ae7f225/brave-lists/clean-urls.json#L265-L281

[issuant]

@bsclifton @fmarier I need this more on mobile than I do desktop. Are they auto-cleaned (#41849 (comment)) like the rest or do I have to use the manual copy clean link?

[fmarier]

It's the same on mobile and desktop: the t parameter is cleaned during copy clean link. Automatically removing it would break some pages on Twitter, which is why we stopped doing that.