Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Prevent 1p requests from being CNAME uncloaked in standard shields mode #9784

Merged
merged 1 commit into from
Aug 19, 2021

Conversation

antonok-edm
Copy link
Collaborator

Followup to #9673
Resolves brave/brave-browser#17366

#9673 worked in some cases, but doesn't cover the case where the 1p domain has a CNAME record. This is a small tweak to disable CNAME uncloaking when:

  • The new default-1p-blocking feature is disabled
  • The request was made from a context where "Trackers & Ads blocked" was set to "Aggressive" mode
  • The request URL is first party to the initiator (using the same logic as the rest of the adblocking code)

Submitter Checklist:

  • I confirm that no security/privacy review is needed, or that I have requested one
  • There is a ticket for my issue
  • Used Github auto-closing keywords in the PR description above
  • Wrote a good PR/commit description
  • Added appropriate labels (QA/Yes or QA/No; release-notes/include or release-notes/exclude; OS/...) to the associated issue
  • Checked the PR locally: npm run test -- brave_browser_tests, npm run test -- brave_unit_tests, npm run lint, npm run gn_check, npm run tslint
  • Ran git rebase master (if needed)

Reviewer Checklist:

  • A security review is not needed, or a link to one is included in the PR description
  • New files have MPL-2.0 license header
  • Adequate test coverage exists to prevent regressions
  • Major classes, functions and non-trivial code blocks are well-commented
  • Changes in component dependencies are properly reflected in gn
  • Code follows the style guide
  • Test plan is specified in PR before merging

After-merge Checklist:

Test Plan:

Copied from #9673

Disable the new #brave-adblock-default-1p-blocking flag, then visit https://dev-pages.bravesoftware.com/filtering/network-requests.html and follow the directions, ensuring that the images are shown as described.

should_check_uncloaked && !ctx->aggressive_blocking &&
SameDomainOrHost(
ctx->request_url,
url::Origin::CreateFromNormalizedTuple("https",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ctx->initiator_url.GetOrigin() ?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wanted to use the same logic here as we do in the rest of the adblock engines. We should investigate whether or not that change is appropriate in the other places too - although it'll probably happen with the larger restructuring ahead.

@iefremov
Copy link
Contributor

we will need a test for this

@antonok-edm
Copy link
Collaborator Author

Agreed on the tests, but sadly there's no way to produce a unittest for this at the moment because of ctx->browser_context not being mockable. Let's look into it as a followup.

Not sure if I mentioned, but I already added some tests for the original PR as well.

@antonok-edm antonok-edm merged commit c26c3a7 into master Aug 19, 2021
@antonok-edm antonok-edm deleted the default-1p-blocking-flag-fixup branch August 19, 2021 14:49
@antonok-edm antonok-edm added this to the 1.30.x - Nightly milestone Aug 19, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Change default (standard) network blocking policy to always allow 1p requests
2 participants