Fixes #12223: Mitigate HSTS Fingerprinting

app/filtering.js

@@ -364,6 +364,18 @@ function registerForHeadersReceived (session, partition) {
       muonCb({ cancel: true })
       return
     }
+
+    let parsedTargetUrl = urlParse(details.url || '')
+    let parsedFirstPartyUrl = urlParse(firstPartyUrl)
+    const trackableSecurityHeaders = ['Strict-Transport-Security', 'Expect-CT',
+      'Public-Key-Pins', 'Public-Key-Pins-Report-Only']
+    if (isThirdPartyHost(parsedFirstPartyUrl.hostname, parsedTargetUrl.hostname)) {
+      trackableSecurityHeaders.forEach(function (header) {
+        delete details.responseHeaders[header]
+        delete details.responseHeaders[header.toLowerCase()]
+      })
+    }
+
     for (let i = 0; i < headersReceivedFilteringFns.length; i++) {
       let results = headersReceivedFilteringFns[i](details, isPrivate)
       if (!module.exports.isResourceEnabled(results.resourceName, firstPartyUrl, isPrivate)) {
@@ -381,7 +393,10 @@ function registerForHeadersReceived (session, partition) {
         return
       }
     }
-    muonCb({})
+    muonCb({
+      responseHeaders: details.responseHeaders,
+      statusLine: details.statusLine
+    })
   })
 }
 
@@ -837,6 +852,15 @@ module.exports.clearStorageData = () => {
   }
 }
 
+module.exports.clearHSTSData = () => {
+  for (let partition in registeredSessions) {
+    let ses = registeredSessions[partition]
+    setImmediate(() => {
+      ses.clearHSTSData.bind(ses)(() => {})
+    })
+  }
+}
+
 /**
  * Clears all session caches.
  */

app/sessionStore.js

@@ -823,9 +823,15 @@ module.exports.runPreMigrations = (data) => {
   }
 
   if (data.lastAppVersion) {
+    let runHSTSCleanup = false
+    try { runHSTSCleanup = compareVersions(data.lastAppVersion, '0.22.00') < 1 } catch (e) {}
+
+    if (runHSTSCleanup) {
+      filtering.clearHSTSData()
+    }
+
     // Force WidevineCdm to be upgraded when last app version <= 0.18.25
     let runWidevineCleanup = false
-
     try { runWidevineCleanup = compareVersions(data.lastAppVersion, '0.18.25') < 1 } catch (e) {}
 
     if (runWidevineCleanup) {

test/unit/app/sessionStoreTest.js

@@ -12,7 +12,9 @@ const compareVersions = require('compare-versions')
 require('../braveUnit')
 
 describe('sessionStore unit tests', function () {
+  let filtering
   let sessionStore
+
   let shutdownClearHistory = false
   let shutdownClearAutocompleteData = false
   let shutdownClearAutofillData = false
@@ -38,6 +40,7 @@ describe('sessionStore unit tests', function () {
     }
   }
   const fakeFiltering = {
+    clearHSTSData: () => {},
     clearStorageData: () => {},
     clearCache: () => {},
     clearHistory: () => {}
@@ -90,6 +93,7 @@ describe('sessionStore unit tests', function () {
       }
     })
     mockery.registerMock('./filtering', fakeFiltering)
+    filtering = require('./filtering')
     sessionStore = require('../../../app/sessionStore')
   })
 
@@ -789,6 +793,7 @@ describe('sessionStore unit tests', function () {
     let localeInitSpy
     let backupSessionStub
     let runImportDefaultSettings
+    let clearHSTSDataSpy
 
     before(function () {
       runPreMigrationsSpy = sinon.spy(sessionStore, 'runPreMigrations')
@@ -798,6 +803,7 @@ describe('sessionStore unit tests', function () {
       localeInitSpy = sinon.spy(fakeLocale, 'init')
       backupSessionStub = sinon.stub(sessionStore, 'backupSession')
       runImportDefaultSettings = sinon.spy(sessionStore, 'runImportDefaultSettings')
+      clearHSTSDataSpy = sinon.spy(filtering, 'clearHSTSData')
     })
 
     after(function () {
@@ -807,6 +813,27 @@ describe('sessionStore unit tests', function () {
       runPostMigrationsSpy.restore()
       localeInitSpy.restore()
       backupSessionStub.restore()
+      clearHSTSDataSpy.restore()
+    })
+
+    describe('check clearHSTSData invocations', function () {
+      describe('if lastAppVersion is 0.23', function () {
+        it('clearHSTSData is not invoked', function () {
+          let exampleState = sessionStore.defaultAppState()
+          exampleState.lastAppVersion = '0.23'
+          sessionStore.runPreMigrations(exampleState)
+          assert.equal(clearHSTSDataSpy.notCalled, true)
+        })
+      })
+
+      describe('if lastAppVersion is 0.21', function () {
+        it('clearHSTSData is calledOnce', function () {
+          let exampleState = sessionStore.defaultAppState()
+          exampleState.lastAppVersion = '0.21'
+          sessionStore.runPreMigrations(exampleState)
+          assert.equal(clearHSTSDataSpy.calledOnce, true)
+        })
+      })
     })
 
     describe('when reading the session file', function () {