Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Same site query filter #6609

Merged
merged 3 commits into from
Sep 23, 2020
Merged

Same site query filter #6609

merged 3 commits into from
Sep 23, 2020

Conversation

fmarier
Copy link
Member

@fmarier fmarier commented Sep 10, 2020

Resolves brave/brave-browser#9020

Submitter Checklist:

Test Plan:

All of the test cases on https://fmarier.github.io/brave-testing/query-filter.html should work as described on there.

Reviewer Checklist:

  • New files have MPL-2.0 license header.
  • Request a security/privacy review as needed.
  • Adequate test coverage exists to prevent regressions
  • Verify test plan is specified in PR before merging to source

After-merge Checklist:

  • The associated issue milestone is set to the smallest version that the
    changes has landed on.
  • All relevant documentation has been updated.

@fmarier fmarier added this to the 1.16.x - Nightly milestone Sep 10, 2020
@fmarier fmarier force-pushed the same-site-query-filter-9020 branch 2 times, most recently from df6c3a3 to 709d20b Compare September 12, 2020 00:42
browser/net/url_context.h Outdated Show resolved Hide resolved
@fmarier fmarier force-pushed the same-site-query-filter-9020 branch 2 times, most recently from 7ca8158 to e7ed618 Compare September 18, 2020 02:16
@fmarier fmarier marked this pull request as ready for review September 18, 2020 02:17
@fmarier fmarier self-assigned this Sep 18, 2020
}

if (ctx->redirect_source.is_valid()) {
if (ctx->internal_redirect) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

isn't ctx->internal_redirect always false if we have good redirect_source?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No, because we generate 307s as a result of the query filter for example. If we don't filter those out here, we end up looking at these requests twice.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I mean that redirect_source is set to a non-empty value only if ctx->internal_redirect is false, and it seems that ctx->internal_redirect cannot change to true afterwards without changing ctx->redirect_source. This way, if ctx->redirect_source is non-empty, ctx->internal_redirect should be false
Am I wrong?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I believe you're right, as long as we keep these in sync.

<body>
<p>Waiting for JS redirect...</p>
<script>
setTimeout(redirectToDestination, 100);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

curious why do we need this?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's to simulate a navigation, as opposed to a redirect. Another way I could have done this would have been to include a link and then inject JS to click the link programmatically.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

100ms is pretty noticeable dealy even for browsertests, so I'd suggest to change if we can avoid it

@iefremov
Copy link
Contributor

iefremov commented Sep 22, 2020

LGTM with small nits. I'll rebase my #6674 on top of this one after it gets merged

@fmarier fmarier removed the request for review from NejcZdovc September 22, 2020 18:30
// Same-site redirects are exempted.
return;
}
} else if (net::registry_controlled_domains::SameDomainOrHost(
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

maybe we also can shorten the code by chosing something like source_url conditionally?

if (...) {source_url = ctx->redirect_source;}
else if (...) {source_url = ctx->initiator_url;}

if (net::registry_controlled_domains::SameDomainOrHost(source_url, ctx->request_url, ...) {
  return;
}

@iefremov iefremov self-requested a review September 23, 2020 12:18
@fmarier fmarier merged commit 5a76d4f into master Sep 23, 2020
@fmarier fmarier deleted the same-site-query-filter-9020 branch September 23, 2020 17:16
@fmarier
Copy link
Member Author

fmarier commented Sep 23, 2020

@fmarier
Copy link
Member Author

fmarier commented Sep 23, 2020

For some reason, GitHub didn't show me your comments and only showed me your approval (I found out catching up on emails). Sorry for merging without addressing these first.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Exempt intra-site requests from the query string filter
2 participants