Exempt Proofpoint's redirector from query string modifications (fixes b…

…rave/brave-browser#41134)

components/query_filter/utils.cc

@@ -149,6 +149,17 @@ static const auto kScopedQueryStringTrackers =
         {"si", {"youtube.com", "youtu.be"}},
     });
 
+// URLs with these hostnames will not be modified by the query filter.
+// These are exact match comparisons. Sub-domains are not
+// automatically included.
+static constexpr auto kExemptedHostnames =
+    base::MakeFixedFlatSet<std::string_view>(
+        base::sorted_unique,
+        {
+            // https://github.com/brave/brave-browser/issues/41134
+            "urldefense.com",
+        });
+
 bool IsScopedTracker(
     const std::string_view param_name,
     const std::string& spec,
@@ -245,6 +256,11 @@ std::optional<GURL> MaybeApplyQueryStringFilter(
     return std::nullopt;
   }
 
+  if (request_url.has_host() &&
+      kExemptedHostnames.count(request_url.host()) == 1) {
+    return std::nullopt;
+  }
+
   if (redirect_source_url.is_valid()) {
     if (internal_redirect) {
       // Ignore internal redirects since we trigger them.

components/query_filter/utils_unittest.cc

@@ -99,6 +99,14 @@ TEST(BraveQueryFilter, FilterQueryTrackers) {
   EXPECT_FALSE(query_filter::MaybeApplyQueryStringFilter(
       GURL("https://brave.com"), GURL("https://brave.com"),
       GURL("https://test.com/?gclid=123"), "GET", true));
+  // Don't filter exempted hostnames
+  EXPECT_FALSE(query_filter::MaybeApplyQueryStringFilter(
+      GURL("https://brave.com"), GURL(),
+      GURL("https://urldefense.com/v3/__https://www.portainer.io/hs/"
+           "preferences-center/en/"
+           "direct?utm_campaign=XNF&utm_source=hs_automation&_hsenc=p2&_hsmi="
+           "26__;!!MlclJBHn!0eDf-z$"),
+      "GET", false));
 }
 
 TEST(BraveQueryFilter, IsScopedTracker) {