2043395 - Don't expose the Android Level in the User Agent

Status: NEW

(Core :: Privacy: Anti-Tracking, enhancement)

Description

[Tom Ritter [:tjr]]

In RFP we hardcode the Android level to 10 (which seems too old and we should update it to perhaps 14 or 15 or 16). However in regular Firefox we expose it here citing issues like Bug 1876742

I think in FPP we could just... hard-code it to the latest version perhaps.

What I can also say is that a minority of users are for some reason getting decimals in their user agents: Mozilla/5.0 (Android 14.0; Mobile; rv:149.0.1) Gecko/149.0.1 Firefox/149.0.1 instead of Mozilla/5.0 (Android 14; Mobile; rv:149.0.1) Gecko/149.0.1 Firefox/149.0.1 Edit I branched this in Bug 2043401

And for that matter, perhaps this should be a third separate bug, why is the minor version showing up there at all? Bug 728831 stopped that and said just last year that we didn't intend to do this. Edit: The best guess we have for this is people using UA overrides.

Comment 1

[Tom Ritter [:tjr]]

I don't know if we'll do or use this, but while I had the context window open, I'll attach a couple patches to fiddle with later.

Comment 2

[Tom Ritter [:tjr]]

Attachment: WIP: Bug 2043395 - Add AndroidVersionUserAgent RFPTarget that hardcodes Android UA version to 16.

Unlike the existing HttpUserAgent target
which spoofs the entire User-Agent to a fully generic "Android 10;
Mobile; ... Firefox/MAJOR.0" string, AndroidVersionUserAgent leaves
the real Firefox version, device model id, and Mobile/TV token
intact and only normalizes the Android OS version field, replacing
it with SPOOFED_ANDROID_VERSION_FOR_UA ("16").

Proxy/CONNECT user-agent paths (HttpConnectionUDP, nsHttpConnection)
intentionally do not query the new target; they use the
NS_HTTP_USE_RFP transaction-cap bit which corresponds only to the
full HttpUserAgent spoof. A follow-up could add a parallel cap if
parity is required, but for the FPP fingerprint-surface this gates
the user-visible browsing UA where it matters.

Comment 3

[Tom Ritter [:tjr]]

Attachment: WIP: Bug 2043395 - Add gtest for nsHttpHandler::UserAgent AndroidVersionUserAgent routing.

Direct unit-style coverage of the new (bool, bool) overload added in
the parent commit. Tests run unconditionally:

• NoSpoof: the (false, false) variant returns a non-empty UA
  containing "Mozilla/5.0", on every platform. Guards against the
  patch accidentally clobbering the real-UA path.

• FullRfpDominates: (true, true) returns the same string as
  (true, false). The HttpUserAgent RFP wins regardless of the
  AndroidVersionUserAgent arg. On Android, additionally checks the
  full spoof contains "Android 10" (the existing SPOOFED_UA_OS
  value).

Non-Android only:

• AndroidVersionSpoofNoopOnDesktop: (false, true) equals
  (false, false). The new arg is silently elided on platforms
  where mAndroidVersionSpoofedUserAgent isn't built.

Android only:

• AndroidVersionSpoofReplacesVersion: (false, true) returns a UA
  containing "Android <SPOOFED_ANDROID_VERSION_FOR_UA>". The
  Mobile/TV token and the rv:/Firefox version trail are byte-
  identical to the real UA (the rv: substring is compared
  explicitly).

• AndroidVersionSpoofIsDistinctFromFullSpoof: the partial spoof
  string is distinct from the full RFP spoof. Catches the
  regression case where the two cached UA strings accidentally
  point at the same buffer.

The tests instantiate gHttpHandler via the io-service protocol
handler lookup, matching the pattern used by
TestHttp3ConnectUDPStream.cpp.