diff --git a/build/patches/Remove-http-referrals-in-cross-origin-navigation.patch b/build/patches/Remove-http-referrals-in-cross-origin-navigation.patch new file mode 100644 index 00000000..c522f701 --- /dev/null +++ b/build/patches/Remove-http-referrals-in-cross-origin-navigation.patch @@ -0,0 +1,111 @@ +From: uazo +Date: Wed, 21 Sep 2022 12:28:17 +0000 +Subject: Remove http referrals in cross origin navigation + +The patch removes the referrals if the navigation is cross origin and occurs in the top frame. +We do not remove the value between the iframes because the referrals are statically defined +by the html and the javascript of the page, and therefore they do not say anything about the +user. Also, some services may not work, such as video iframes. +We also added a flag that completely removes referrals management, for users who know +what they are doing. + +Original License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html +License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html +--- + chrome/android/java/res/xml/privacy_preferences.xml | 4 ++++ + .../chrome/browser/privacy/settings/PrivacySettings.java | 8 ++++++++ + .../browser/ui/android/strings/android_chrome_strings.grd | 3 +++ + content/browser/renderer_host/navigation_request.cc | 7 +++++++ + services/network/public/cpp/resource_request.h | 2 +- + 5 files changed, 23 insertions(+), 1 deletion(-) + +diff --git a/chrome/android/java/res/xml/privacy_preferences.xml b/chrome/android/java/res/xml/privacy_preferences.xml +--- a/chrome/android/java/res/xml/privacy_preferences.xml ++++ b/chrome/android/java/res/xml/privacy_preferences.xml +@@ -57,6 +57,10 @@ + android:title="@string/close_tabs_on_exit_title" + android:summary="@string/close_tabs_on_exit_summary" + android:defaultValue="false" /> ++ + ++ ++ Enable HTTP Referer header ++ + + Access payment methods + +diff --git a/content/browser/renderer_host/navigation_request.cc b/content/browser/renderer_host/navigation_request.cc +--- a/content/browser/renderer_host/navigation_request.cc ++++ b/content/browser/renderer_host/navigation_request.cc +@@ -425,6 +425,13 @@ void AddAdditionalRequestHeaders( + blink::mojom::Referrer(GURL(), network::mojom::ReferrerPolicy::kNever); + } + ++ if (!url::IsSameOriginWith(referrer->url.GetAsReferrer(), url) && ++ frame_tree_node->IsOutermostMainFrame()) { ++ // remove referrer if the navigation is done on the top frame ++ *referrer = ++ blink::mojom::Referrer(GURL(), network::mojom::ReferrerPolicy::kNever); ++ } ++ + // Next, set the HTTP Origin if needed. + if (NeedsHTTPOrigin(headers, method)) { + url::Origin origin_header_value = initiator_origin.value_or(url::Origin()); +diff --git a/services/network/public/cpp/resource_request.h b/services/network/public/cpp/resource_request.h +--- a/services/network/public/cpp/resource_request.h ++++ b/services/network/public/cpp/resource_request.h +@@ -130,7 +130,7 @@ struct COMPONENT_EXPORT(NETWORK_CPP_BASE) ResourceRequest { + std::vector navigation_redirect_chain; + + GURL referrer; +- net::ReferrerPolicy referrer_policy = net::ReferrerPolicy::NEVER_CLEAR; ++ net::ReferrerPolicy referrer_policy = net::ReferrerPolicy::REDUCE_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN; + net::HttpRequestHeaders headers; + net::HttpRequestHeaders cors_exempt_headers; + int load_flags = 0; +-- +2.25.1