1815039 - The <meta name="referrer" content="no-referrer"> not inherited by javascript: URL documents

Status: RESOLVED DUPLICATE of bug 1794216

(Core :: DOM: Security, defect, P3)

Description

[Khiem Tran]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36

Steps to reproduce:

I re-tested a demo and found out this behavior still can be reproduced:

On Firefox desktop on macOS, load:

https://test.shhnjk.com/stop_url.html

Click go.

The website can get the referrer information.

Actual results:

The website can get the referrer information.

Expected results:

The website should not get the referrer information, because of the <meta name="referrer" content="no-referrer"> tag.

Comment 1

[:Gijs (he/him)]

Jun, I assume this is one of your testcases given it's on your domain. Can you link to where it was published? I found bug 1383729 which got resolved WFM by you because data: URIs don't inherit anymore - but javascript URLs still do, and I cannot find a link to this test anywhere on bugzilla. It's still not clear to me if/how where this would be exploitable.

Comment 2

[Jun (Request needinfo for comment, I ignore other updates)]

I think it's from here.
https://bugs.chromium.org/p/chromium/issues/detail?id=823241

Comment 3

[:Gijs (he/him)]

(In reply to Jun from comment #2)

I think it's from here.
https://bugs.chromium.org/p/chromium/issues/detail?id=823241

Thanks a lot Jun!

That shows that chromium added wpt tests for this, which indeed are failing on Firefox - https://searchfox.org/mozilla-central/source/testing/web-platform/tests/referrer-policy/generic/inheritance/iframe-inheritance-javascript.html .

I'm told Freddy knows more about the state of things here.

Comment 4

[Frederik Braun [:freddy]]

If we were to fix this, looking at Document::InitReferrerInfo and the call to ReferrerInfo::ShouldResponseInheritReferrerInfo(aChannel) therein could be a good start.

Rating: I think that's sec-low..

Comment 5

[Daniel Veditz [:dveditz]]

The spec reference is now step 10 of https://html.spec.whatwg.org/#the-javascript:-url-special-case in the current version of the HTML spec

Comment 6

[Daniel Veditz [:dveditz]]

Unhiding since the Chrome bug is public and there's a known-failing WPT test for it

Comment 8

[Frederik Braun [:freddy]]

(In reply to Frederik Braun [:freddy] from comment #4)

If we were to fix this, looking at Document::InitReferrerInfo and the call to ReferrerInfo::ShouldResponseInheritReferrerInfo(aChannel) therein could be a good start.

Looking again, I think we want ReferrerInfo::ShouldResponseInheritReferrerInfo to return true for javascript schemes, just like we already do for about: schemes.
Not sure about the testing situation and if we have tests for this in our mochitests or if a wpt will flip to PASS when we fix this.

Malte, would you be interested in trying to fix this?

Comment 9

[Malte Jürgens [:maltejur]]

Sure, I'll take a look next week.

Comment 10

[Malte Jürgens [:maltejur]]

Attachment: WIP: Bug 1815039: Inherit referer info for `javascript:` urls r?freddyb

Comment 11

[Daniel Veditz [:dveditz]]

Sorry for the burst of bugspam: filter on tinkling-glitter-filtrate
Adding reporter-external keyword to security bugs found by non-employees for accounting reasons