1848022 - [css-values] Use a different library for calc() functions to avoid fingerprinting

Status: NEW

(Core :: CSS Parsing and Computation, defect)

Description

[Tiaan Louw [:tlouw]]

One method of fingerprinting a browser to detect which CPU, OS or other identifiable pieces of data is through math functions. The result of a sin() or cos() function with fixed values can yield specific results on different platforms, thus identifying it.

For our calc() functions, the suggestion is to use the fdlibm library that is already in use by spidermonkey.

Also see: https://github.com/fingerprintjs/fingerprintjs/blob/7096a5589af495f1f46067963e13ad27d887d185/src/sources/math.ts#L36
..for examples of how fingerprinting can be done using these functions.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:boris, could you have a look please?

For more information, please visit BugBot documentation.