573150 - crash reporter inadvertently sends IE cookies to crash submission URL

Status: RESOLVED FIXED

(Toolkit :: Crash Reporting, defect)

Description

[Robert Sayre]

If a user has browser to *.mozilla.com sites, the crash reporter sends those cookies to mozilla.com. we don't want this data.

Comment 1

[(not currently active) Ted Mielczarek]

Why does it matter?

(FWIW, we're just using WinHttp directly, so I guess you must have to opt-out of cookies.)

Comment 2

[Robert Sayre]

It sends tracking cookies that would allow us correlate crashes with website users. we don't want that data.

Comment 3

[(not currently active) Ted Mielczarek]

Attachment: Don't send cookies

This got r=nealsid and landed upstream:
http://code.google.com/p/google-breakpad/source/detail?r=661

However, I can't actually reproduce the problem as stated on my Windows 7 machine. I wrote a small CGI that sets a cookie and returns a fake CrashID:

#!/usr/bin/env python

import uuid

print "Content-Type: text/plain"
print "Set-Cookie: mycookie=awesome"
print
print "CrashID=bp-" + str(uuid.uuid4())

Loading this (twice) in IE8 and packet sniffing, I can see the cookie being set and sent back with the second request. If I set MOZ_CRASHREPORTER_URL to this same URL, and then crash my Firefox nightly build and submit a crash to this same URL, I do not see the cookie being sent in the POST request.

sayrer: can you give me more info on how you discovered this? (Maybe it's fixed in Windows 7?)

Comment 4

[(not currently active) Ted Mielczarek]

Pushed to m-c anyway (can't hurt):
http://hg.mozilla.org/mozilla-central/rev/844996318d23