1888500 - Bounce Tracking Protection should only apply to http/https scheme

Status: RESOLVED FIXED

(Core :: Privacy: Anti-Tracking, defect, P2)

Description

[Paul Zühlcke [:pbz]]

We currently record site hosts for any content principal. We should restrict it to only http/https schemes to avoid adding e.g. about: pages. That's both for user activation and bounce tracker candidates and BounceTrackingRecord.

Comment 1

[Paul Zühlcke [:pbz]]

Attachment: Bug 1888500 - Don't record bounce tracking data for non http(s) schemes or non content principals. r=bvandersloot!

Comment 2

[Paul Zühlcke [:pbz]]

Attachment: Bug 1888500 - Add a test to ensure we only record user activation for http(s) schemes. r=bvandersloot!

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/02d68d4511c7
Don't record bounce tracking data for non http(s) schemes or non content principals. r=bvandersloot,anti-tracking-reviewers
https://hg.mozilla.org/integration/autoland/rev/b85173dc6c16
Add a test to ensure we only record user activation for http(s) schemes. r=bvandersloot,anti-tracking-reviewers

Comment 4

[Sandor Molnar[:smolnar]]

Backed out for causing AddressSanitizer @ xpcom/base/nsISupportsImpl.cpp & bc failures @ toolkit/components/antitracking/bouncetrackingprotection/test/browser/<...>

Backout link: https://hg.mozilla.org/integration/autoland/rev/c80113ab4162029cc65655161b3466ba25380dea

Push with failures

Failure log -> SUMMARY: AddressSanitizer: access-violation /builds/worker/checkouts/gecko/xpcom/base/nsISupportsImpl.cpp:41 in nsAutoOwningThread::AssertCurrentThreadOwnsMe

Failure log -> TEST-UNEXPECTED-FAIL | toolkit/components/antitracking/bouncetrackingprotection/test/browser/browser_bouncetracking_stateful_cookies.js | Test timed out

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/336738f93085
Don't record bounce tracking data for non http(s) schemes or non content principals. r=bvandersloot,anti-tracking-reviewers
https://hg.mozilla.org/integration/autoland/rev/e400fe8e13ac
Add a test to ensure we only record user activation for http(s) schemes. r=bvandersloot,anti-tracking-reviewers

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/94a18c3b1eb4
Don't record bounce tracking data for non http(s) schemes or non content principals. r=bvandersloot,anti-tracking-reviewers
https://hg.mozilla.org/integration/autoland/rev/33ce1467f37a
Add a test to ensure we only record user activation for http(s) schemes. r=bvandersloot,anti-tracking-reviewers

Comment 7

[Aron Cseh]

https://hg.mozilla.org/mozilla-central/rev/94a18c3b1eb4
https://hg.mozilla.org/mozilla-central/rev/33ce1467f37a