1544131 - Ensure that the referrerPolicy API can be used to override the default referrer policy that we apply to third-party tracking resources

Status: RESOLVED FIXED

(Core :: Privacy: Anti-Tracking, defect)

Description

[(no longer active)]

The feature that I implemented in bug 1530076 was supposed to be a default referrer policy which could be overridden when the page specifies an explicit referrer policy. I got a little bit lazy and just assumed that I'm awesome and got everything correct and didn't write a test for ensuring that the page can indeed override the default... and guess what? the overriding part is broken.

The conclusion is that sometimes I have bugs in my code. That is highly surprising. ;-)

Here is why this happens. When we receive a referrer policy from JS/DOM here https://searchfox.org/mozilla-central/rev/6dab6dad9cc852011a14275a8b2c2c03ed7600a7/netwerk/protocol/http/HttpBaseChannel.cpp#1661 mReferrerPolicy will be a value other than REFERRER_POLICY_UNSET and we'll skip using the default. But then we'll get to https://searchfox.org/mozilla-central/rev/6dab6dad9cc852011a14275a8b2c2c03ed7600a7/netwerk/protocol/http/nsHttpChannel.cpp#10222 and here we've forgotten the original referrer policy that we had received from JS/DOM. We check the referrer policy that we have against the default and if it's not the default we call SetReferrer() which brings us back to https://searchfox.org/mozilla-central/rev/6dab6dad9cc852011a14275a8b2c2c03ed7600a7/netwerk/protocol/http/HttpBaseChannel.cpp# but this time mReferrerPolicy will be our default policy value (because https://searchfox.org/mozilla-central/rev/6dab6dad9cc852011a14275a8b2c2c03ed7600a7/netwerk/protocol/http/HttpBaseChannel.cpp#1603) and that's how we overwrite the JS/DOM provided policy value with the default policy value.

The solution is straightforward: similar to mOriginalReferrer also remember mOriginalReferrerPolicy being the original referrer policy that we received from JS/DOM, and inside ReEvaluateReferrerAfterTrackingStatusIsKnown() only set the referrer if the original policy value we had received was REFERRER_POLICY_UNSET.

Comment 1

[(no longer active)]

Attachment: Bug 1544131 - Part 1: Ensure that the referrer policy provided by JS/DOM will override the default referrer policy applied to third-party trackers;

Comment 2

[(no longer active)]

Attachment: Bug 1544131 - Part 2: Remove the script test from browser_referrerDefaultPolicy.js since the <script> element doesn't provide support for the referrerPolicy API;

Comment 3

[(no longer active)]

Attachment: Bug 1544131 - Part 3: Add tests for the interaction of JS provided referrer policies with each one of the default referrer policy values applied to third-party trackers;

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/2fcb6eeb5afd
Part 1: Ensure that the referrer policy provided by JS/DOM will override the default referrer policy applied to third-party trackers; r=michal
https://hg.mozilla.org/integration/autoland/rev/272dbcb4bc39
Part 2: Remove the script test from browser_referrerDefaultPolicy.js since the <script> element doesn't provide support for the referrerPolicy API; r=baku
https://hg.mozilla.org/integration/autoland/rev/66ca3efa1ac2
Part 3: Add tests for the interaction of JS provided referrer policies with each one of the default referrer policy values applied to third-party trackers; r=baku

Comment 5

[Noemi Erli[:noemi_erli]]

https://hg.mozilla.org/mozilla-central/rev/2fcb6eeb5afd
https://hg.mozilla.org/mozilla-central/rev/272dbcb4bc39
https://hg.mozilla.org/mozilla-central/rev/66ca3efa1ac2

Comment 6

[Thomas Nguyen (:tnguyen)]

Part 2: Remove the script test from browser_referrerDefaultPolicy.js since the <script> element doesn't provide support for the referrerPolicy API; r=baku
Hi Ehsan, could you please give me more details about the failure? I think we had referrerpolicy attribute supported in script element.

Comment 7

[(no longer active)]

(In reply to Thomas Nguyen from comment #6)

Part 2: Remove the script test from browser_referrerDefaultPolicy.js since the <script> element doesn't provide support for the referrerPolicy API; r=baku
Hi Ehsan, could you please give me more details about the failure? I think we had referrerpolicy attribute supported in script element.

Oh, is that right? I based that decision on https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy#Integration_with_HTML. Was I being mislead by our documentation?

Comment 8

[Thomas Nguyen (:tnguyen)]

Currently, this page is synced with:
https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-delivery-referrer-attribute
But I think it should be updated:
https://html.spec.whatwg.org/multipage/scripting.html#the-script-element
https://github.com/w3c/webappsec-referrer-policy/issues/96

Comment 9

[Thomas Nguyen (:tnguyen)]

And our implementation:
https://bugzilla.mozilla.org/show_bug.cgi?id=1460920

Comment 10

[(no longer active)]

Thank you, sorry, I should have checked what we actually support...