1488785 - The storage access permission doesn't honour private browsing

Status: VERIFIED FIXED

(Firefox :: Protections UI, defect, P1)

Description

[(no longer active)]

STR:

1. In a new profile, set network.cookie.cookieBehavior to 4.
2. Open a private window.
3. Go to https://de.ign.com/marvels-the-avengers-infinity-war-part-1/130638/news/thanos-sollte-in-avengers-infinity-war-ursprunglich-durch-ei.
4. Click on the Facebook like button.  A Facebook login window opens.  Click somewhere on that window.
5. Close Firefox, go to the console and run the following commands:

  $ sqlite3 path/to/firefox/permissions.sqlite
  > select * from moz_perms;
  1|https://de.ign.com|3rdPartyStorage^https://www.facebook.com|1|2|1538751487216|1536159487216

The permissions database shouldn't contain an entry revealing the domains visited in private mode.

Comment 1

[(no longer active)]

Attachment: Bug 1488785 - Part 1: Don't save persistent storage access permissions for private browsing contexts; r=baku

Comment 2

[(no longer active)]

Attachment: Bug 1488785 - Part 2: Add support for running tests in private windows to the antitracking mini-testsuite; r=baku

Depends on D5046

Comment 3

[(no longer active)]

Attachment: Bug 1488785 - Part 3: Add a test to ensure that setting a storage access permission in a private window won't leave a persistent trace in the permission manager; r=baku

Depends on D5047

Comment 4

[(no longer active)]

Comment on attachment 9006600 [details]
Bug 1488785 - Part 1: Don't save persistent storage access permissions for private browsing contexts; r=baku

Approval Request Comment
[Feature/Bug causing the regression]: Not a regression, private browsing violation in a new feature
[User impact if declined]: private browsing violation, quite serious.  Note that the feature isn't enabled by default, but is going to undergo a shield study in 63 beta.
[Is this code covered by automated tests?]: Yes
[Has the fix been verified in Nightly?]: Not yet.
[Needs manual test from QE? If yes, steps to reproduce]: No.
[List of other uplifts needed for the feature/fix]: None.
[Is the change risky?]: Not really.
[Why is the change risky/not risky?]: Because it's simple, localized, and the code in question is preffed off by default.
[String changes made/needed]: None.

Comment 5

[Andrea Marchesini [:baku]]

Comment on attachment 9006600 [details]
Bug 1488785 - Part 1: Don't save persistent storage access permissions for private browsing contexts; r=baku

Andrea Marchesini [:baku] has approved the revision.

Comment 6

[Andrea Marchesini [:baku]]

Comment on attachment 9006601 [details]
Bug 1488785 - Part 2: Add support for running tests in private windows to the antitracking mini-testsuite; r=baku

Andrea Marchesini [:baku] has approved the revision.

Comment 7

[Andrea Marchesini [:baku]]

Comment on attachment 9006602 [details]
Bug 1488785 - Part 3: Add a test to ensure that setting a storage access permission in a private window won't leave a persistent trace in the permission manager; r=baku

Andrea Marchesini [:baku] has approved the revision.

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/5cf5331348ef
Part 1: Don't save persistent storage access permissions for private browsing contexts; r=baku
https://hg.mozilla.org/integration/mozilla-inbound/rev/5ba2811bacfd
Part 2: Add support for running tests in private windows to the antitracking mini-testsuite; r=baku
https://hg.mozilla.org/integration/mozilla-inbound/rev/8ae26799f5fd
Part 3: Add a test to ensure that setting a storage access permission in a private window won't leave a persistent trace in the permission manager; r=baku

Comment 9

[Tiberius Oros[:tiberius_oros]]

https://hg.mozilla.org/mozilla-central/rev/5cf5331348ef
https://hg.mozilla.org/mozilla-central/rev/5ba2811bacfd
https://hg.mozilla.org/mozilla-central/rev/8ae26799f5fd

Comment 10

[Pascal Chevrel:pascalc]

Comment on attachment 9006600 [details]
Bug 1488785 - Part 1: Don't save persistent storage access permissions for private browsing contexts; r=baku

Approved for 63 beta 4

Comment 11

[Cristina Coroiu [:ccoroiu]]

https://hg.mozilla.org/releases/mozilla-beta/rev/36e1ad4e0057
https://hg.mozilla.org/releases/mozilla-beta/rev/053fbe0ad409
https://hg.mozilla.org/releases/mozilla-beta/rev/2509ea2ecfd6

Comment 12

[Cristian Craciun]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:64.0) Gecko/20100101 Firefox/64.0
Build ID: 20180907100116

Verified as fixed on the latest Nightly build (64.0a1) and on the latest Beta build (63b4).