Ignore Listrak query parameters by default

[mpchadwick]

Listrak appends:

• trk_contact (Definitely unique)
• trk_sid (Definitely unique)

They also append:

• trk_msg
• trk_module

This change strips them out by default

[vvuksan]

These are unlikely to ever be used as real query arguments ?

[mpchadwick]

Correct, they consume it in their JavaScript, but the server response won't vary:

https://urlscan.io/responses/e6fe309bf1beb62b5544591eaab3fa3f8286aeab99265855b9ae7ec0d607ab3b/

$ grep -ri trk vendor/listrak/
$

[vvuksan]

I am more concerned about Magento components using it for something legitimate.

[mpchadwick]

There is no access to query parameters with trk_ in Magento core that I am aware of.

There's some noise in the output below but I can see they're all due to a variable being set with name attrKey, not actually accessing a trk_ query parameter:

$ grep -ri trk vendor/magento/ | grep '.php'
vendor/magento/module-catalog/Controller/Adminhtml/Category.php:        foreach ($attributes as $attrKey => $attribute) {
vendor/magento/module-catalog/Controller/Adminhtml/Category.php:                if (array_key_exists($attrKey, $postData) && $postData[$attrKey] != '') {
vendor/magento/module-catalog/Controller/Adminhtml/Category.php:                    $dateFieldFilters[$attrKey] = $this->dateFilter;
vendor/magento/module-catalog/Controller/Adminhtml/Product/Initialization/Helper.php:        foreach ($attributes as $attrKey => $attribute) {
vendor/magento/module-catalog/Controller/Adminhtml/Product/Initialization/Helper.php:                if (array_key_exists($attrKey, $productData) && $productData[$attrKey] != '') {
vendor/magento/module-catalog/Controller/Adminhtml/Product/Initialization/Helper.php:                    $dateFieldFilters[$attrKey] = $this->getDateTimeFilter();
vendor/magento/module-catalog-import-export/Model/Export/Product.php:            foreach (array_keys($this->collectedMultiselectsData[$storeId][$productId]) as $attrKey) {
vendor/magento/module-catalog-import-export/Model/Export/Product.php:                if (!empty($this->collectedMultiselectsData[$storeId][$productId][$attrKey])) {
vendor/magento/module-catalog-import-export/Model/Export/Product.php:                    $dataRow[$attrKey] = implode(
vendor/magento/module-catalog-import-export/Model/Export/Product.php:                        $this->collectedMultiselectsData[$storeId][$productId][$attrKey]

If Fastly would like a more official confirmation of this perhaps it could be checked directly with Magento?