1487274 - Devtools incorrectly suggests that www.reddit.com is a tracking URL on reddit.com

Status: VERIFIED FIXED

(DevTools :: Netmonitor, defect, P1)

Description

[(no longer active)]

Attachment: Screenshot

STR: Go to www.reddit.com, wait for the page to load and open devtools, the network tab.  See the screenshot.

Comment 1

[Julian Descottes [:jdescottes]]

Honza: could you triage this one since it affects a feature that recently landed in 63? 
Maybe we are setting the flag too early, before the connection was established?

Comment 2

[François Marier [:francois]]

I believe the problem is that this code:

  https://hg.mozilla.org/mozilla-central/rev/8221a40c73b0#l13.31

Should be using channel.isThirdPartyTrackingResource:

  https://searchfox.org/mozilla-central/rev/2fe43133dbc774dda668d4597174d73e3969181a/netwerk/protocol/http/nsIHttpChannel.idl#496

instead of channel.isTrackingResource.

Comment 3

[(no longer active)]

(In reply to François Marier [:francois] from comment #2)
> I believe the problem is that this code:
> 
>   https://hg.mozilla.org/mozilla-central/rev/8221a40c73b0#l13.31
> 
> Should be using channel.isThirdPartyTrackingResource:
> 
>  
> https://searchfox.org/mozilla-central/rev/
> 2fe43133dbc774dda668d4597174d73e3969181a/netwerk/protocol/http/
> nsIHttpChannel.idl#496
> 
> instead of channel.isTrackingResource.

That would be it!

I really wish we called that attribute something else, that would make it clear to people that this is the wrong attribute for most consumers...

Comment 4

[Jan Honza Odvarko [:Honza] (always need-info? me)]

Thanks for the report!
I'll fix it.
Honza

Comment 5

[Jan Honza Odvarko [:Honza] (always need-info? me)]

What URL should I use to test third party trackers?

I am currently using the following test (for channel.isTrackingResource) calling `UrlClassifierTestUtils.addTestTrackers();` to add some tracking URLs into the database:
https://searchfox.org/mozilla-central/rev/05d91d3e02a0780f44599371005591d7988e2809/devtools/client/netmonitor/test/browser_net_tracking-resources.js#20

And I am using `http://tracking.example.com/` to make sure the Network panel shows a tracker:
https://searchfox.org/mozilla-central/rev/05d91d3e02a0780f44599371005591d7988e2809/devtools/client/netmonitor/test/html_tracking-protection.html#10

It works for channel.isTrackingResource, but not for channel.isThirdPartyTrackingResource.
Should I use different URL?

Honza

Comment 6

[(no longer active)]

tracking.example.com is blocked by tracking protection, so you are using the correct URL.  The reason isThirdPartyTrackingResource is returning false is that the URL you are loading is loaded in the first-party context (e.g. a top-level window) not a third-party context (e.g. a subresource).

What you want to do is to setup a page loaded from example.com which includes a subresource from tracking.example.com.

BTW note that if you turn on the TP pref in such a test, that subresource will be *blocked*.  If you just want the subresource to be annotated to come from a tracker, use tracking.example.org instead.

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/6f8b3a09e8d9
Use nsIHttpChannel.isThirdPartyTrackingResource to identify trackers; r=nchevobbe

Comment 8

[Dorel Luca [:dluca]]

https://hg.mozilla.org/mozilla-central/rev/6f8b3a09e8d9

Comment 9

[Jan Honza Odvarko [:Honza] (always need-info? me)]

Attachment: Bug 1487274 - Use nsIHttpChannel.isThirdPartyTrackingResource to identify trackers; r=nchevobbe

Comment 10

[Nicolas Chevobbe [:nchevobbe]]

Comment on attachment 9007705 [details]
Bug 1487274 - Use nsIHttpChannel.isThirdPartyTrackingResource to identify trackers; r=nchevobbe

Nicolas Chevobbe [:nchevobbe] has approved the revision.

Comment 11

[Jan Honza Odvarko [:Honza] (always need-info? me)]

Comment on attachment 9007705 [details]
Bug 1487274 - Use nsIHttpChannel.isThirdPartyTrackingResource to identify trackers; r=nchevobbe

Approval Request Comment
[Feature/Bug causing the regression]: Bug 1485416
[User impact if declined]: Incorrect marking of trackers in the Network panel in Developer Tools.
[Is this code covered by automated tests?]: yes
[Has the fix been verified in Nightly?]: yes
[Needs manual test from QE? If yes, steps to reproduce]:  no
[List of other uplifts needed for the feature/fix]: n/a
[Is the change risky?]: low risk
[Why is the change risky/not risky?]: Only developers, simple change.
[String changes made/needed]: n/a

Comment 12

[Pascal Chevrel:pascalc (PTO until April 26)]

Comment on attachment 9007705 [details]
Bug 1487274 - Use nsIHttpChannel.isThirdPartyTrackingResource to identify trackers; r=nchevobbe

Low-risk patch for a bug in a 63 devtools feature, uplift approved for 63 beta 5.

Comment 13

[Daniel Varga [:dvarga]]

https://hg.mozilla.org/releases/mozilla-beta/rev/1deae1b8cd1d

Comment 14

[Daniel Bodea [:danibodea]]

Hello,

In order for me to confirm the fixes in Nightly and Beta, I need some explanations of the original actual and expected results for this issue. 

From what I understand, after the page is (fully) loaded and the Developer Tools - Network tab is opened, no events should be displayed. So the issue is the fact that the POST event shown in the screenshot is displayed when opening the Network Dev Tools.
Is this right? Please confirm or correct me.

Thank you!

P.S. if I am correct, then the issue does not appear as fixed in the latest Nightly v64.0a1 (2018-09-10).

Comment 15

[(no longer active)]

No the STR in comment 0 is a bit misleading, sorry about that.

You can open the network tab and then reload the page.  The goal is to get every resource that gets loaded during page load listed in the network tab...

Comment 16

[Daniel Bodea [:danibodea]]

Hello,

Can I please have some clear steps to reproduce? :)
It may be my low technical knowledge that is the bottleneck, but I don't seem to really understand what the actual an expected results should be.

Thank you!

Comment 17

[(no longer active)]

No worries.  Let me try again:

1. In a new profile, go to www.reddit.com.
2. Open the network panel, click the trash icon to ensure everything is cleared and press the Reload button.
3. Wait for the page to finish loading.
4. Look for a request with domain www.reddit.com.  For example, the one with File "/" (most likely the top-most entry in the network panel).

The expected results is that entry shouldn't have a shield icon next to it.

The actual results at the time I filed the bug was that entry used to have a shield icon next to it, as can be seen in the attached screenshot.

Comment 18

[Daniel Bodea [:danibodea]]

Hi again,

I can now confirm the reproduction of the issue on Nightly v64.0a1 (2018-09-05) and Beta v63.0b3 on Windows 10.
I can also confirm the fix in Nightly v64.0a1 (2018-09-13) and Beta v6.0ab5 on Windows 10; The events having the domain "www.reddit.com" are not blocked with Content Blocking enabled.

Uplift successful. Thank you!