1459089 - Even when resistFingerprinting is enabled, FF leaks the OS locale in the accept headers

Status: RESOLVED FIXED

(Firefox for Android Graveyard :: General, defect)

Description

[Igor Oliveira]

User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:59.0) Gecko/20100101 Firefox/59.0
Build ID: 20180326160923

Steps to reproduce:

1. Go to about:config
2. Change the privacy.resistFingerprinting preference to true
3. Go to the android Input & Language settings
4. Change the language


Actual results:

The HTTP Accept-Language header adds the OS Language.


Expected results:

The HTTP Accept-Language header should not change based on OS values.

Comment 1

[Igor Oliveira]

Attachment: 0001-Bug-1459089-Don-t-use-OS-Locale-when-resistFingerpri.patch

Comment 2

[Michael Comella (:mcomella) [NI reported issues only: ex-Mozilla]]

I'll get to this as soon as I can but I'll be at Google IO this week: only a r? is necessary.

Comment 3

[Michael Comella (:mcomella) [NI reported issues only: ex-Mozilla]]

Comment on attachment 8973081 [details] [diff] [review]
0001-Bug-1459089-Don-t-use-OS-Locale-when-resistFingerpri.patch

Review of attachment 8973081 [details] [diff] [review]:
-----------------------------------------------------------------

When resistFingerprinting is set, this change prevents `osLocale` from being appended to `chosen` via `unshift`, which prevents it from getting set into the `intl.accept_languages` preference: this seems reasonable to me.

I don't know that it guarantees that it's not sent with the Accept header but if it works for you, it works for me! :)

I apologize for taking so long to get back to you, Igor. If this happens again (which I will try my best to avoid), please feel free to ping me on IRC to remind me to review it!

Comment 4

[Michael Comella (:mcomella) [NI reported issues only: ex-Mozilla]]

try push: https://treeherder.mozilla.org/#/jobs?repo=try&revision=2cbc02f6f27e90fc586f1d4b36bd06fa5693d212

Will land tomorrow, pending green.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/a25b2c7238f4
Don't use OS Locale when resistFingerprinting is enabled. When the OS Locale is used, it leaks the OS language in the HTTP Accept-Language header. r=mcomella

Comment 6

[Dorel Luca [:dluca]]

https://hg.mozilla.org/mozilla-central/rev/a25b2c7238f4