diff --git a/patches/privacy/dont-track-me.patch b/patches/privacy/dont-track-me.patch new file mode 100644 index 00000000..a08125ab --- /dev/null +++ b/patches/privacy/dont-track-me.patch @@ -0,0 +1,86 @@ +commit 431f63c24d7ab7bf5aeb4594b1b2f4ebc5c6fef9 +Author: csagan5 <32685696+csagan5@users.noreply.github.com> +Date: Thu Oct 26 13:39:30 2017 +0200 + + Add don't track me extension (baked-in) + +diff --git a/third_party/WebKit/Source/core/dom/BUILD.gn b/third_party/WebKit/Source/core/dom/BUILD.gn +index 93f080f..2df8d30 100644 +--- a/third_party/WebKit/Source/core/dom/BUILD.gn ++++ b/third_party/WebKit/Source/core/dom/BUILD.gn +@@ -344,6 +344,7 @@ blink_core_sources("dom") { + "events/TreeScopeEventContext.h", + "events/WindowEventContext.cpp", + "events/WindowEventContext.h", ++ "extensions/dont-track-me.h", + "trustedtypes/TrustedHTML.cpp", + "trustedtypes/TrustedHTML.h", + "trustedtypes/TrustedScriptURL.cpp", +diff --git a/third_party/WebKit/Source/core/dom/Document.cpp b/third_party/WebKit/Source/core/dom/Document.cpp +index b7c5748..54e3c7a 100644 +--- a/third_party/WebKit/Source/core/dom/Document.cpp ++++ b/third_party/WebKit/Source/core/dom/Document.cpp +@@ -218,6 +218,7 @@ + #include "core/xml/parser/XMLDocumentParser.h" + #include "core/xml_names.h" + #include "core/xmlns_names.h" ++#include "extensions/dont-track-me.h" + #include "platform/CrossThreadFunctional.h" + #include "platform/DateComponents.h" + #include "platform/EventDispatchForbiddenScope.h" +@@ -5825,8 +5826,29 @@ void Document::FinishedParsing() { + fetcher_->ClearResourcesFromPreviousFetcher(); + } + +- if (IsPrefetchOnly()) ++ if (IsPrefetchOnly()) { + WebPrerenderingSupport::Current()->PrefetchFinished(); ++ return; ++ } ++ ++ // determine whether this is a Google search results page ++ SecurityOrigin *origin = GetSecurityOrigin(); ++ if (origin) { ++ WTF::String domain = origin->Domain(); ++ size_t pos = domain.Find(".google."); ++ IsGoogle = (pos != WTF::kNotFound) && (domain.length() - pos - 8 < 4); ++ LOG(INFO) << "BRM: is this is a google page " << domain << " " << IsGoogle; ++ } ++ ++ auto* bodyElement = body(); ++ if (IsGoogle && bodyElement) { ++ LOG(INFO) << "BRM: appending google page payload in head"; ++ HTMLScriptElement* e = HTMLScriptElement::Create(*this, false); ++ e->setText(DONT_TRACK_ME_JS); ++ bodyElement->AppendChild(e); ++ } else { ++ LOG(INFO) << "BRM: ignoring page"; ++ } + } + + void Document::ElementDataCacheClearTimerFired(TimerBase*) { +diff --git a/third_party/WebKit/Source/core/dom/Document.h b/third_party/WebKit/Source/core/dom/Document.h +index f2f8fc2..755826f 100644 +--- a/third_party/WebKit/Source/core/dom/Document.h ++++ b/third_party/WebKit/Source/core/dom/Document.h +@@ -1392,6 +1392,8 @@ class CORE_EXPORT Document : public ContainerNode, + ukm::UkmRecorder* UkmRecorder(); + int64_t UkmSourceID() const; + ++ bool IsGoogle; ++ + protected: + Document(const DocumentInit&, DocumentClassFlags = kDefaultDocumentClass); + +diff --git a/third_party/WebKit/Source/core/dom/extensions/dont-track-me.h b/third_party/WebKit/Source/core/dom/extensions/dont-track-me.h +new file mode 100644 +index 0000000..11abff3 +--- /dev/null ++++ b/third_party/WebKit/Source/core/dom/extensions/dont-track-me.h +@@ -0,0 +1,6 @@ ++#ifndef dont_track_me_h ++#define dont_track_me_h ++ ++#define DONT_TRACK_ME_JS "/* click-tracking removal */\n\nfunction getReferrerPolicy() {\n return 'origin';\n}\n\nfunction handlePointerPress(e) {\n var a = e.target;\n while (a && !a.href) {\n a = a.parentElement;\n }\n if (!a) {\n return;\n }\n var inlineMousedown = a.getAttribute('onmousedown');\n // return rwt(....); // E.g Google search results.\n // return google.rwt(...); // E.g. sponsored search results\n // return google.arwt(this); // E.g. sponsored search results (dec 2016).\n if (inlineMousedown && /\\ba?rwt\\(/.test(inlineMousedown)) {\n a.removeAttribute('onmousedown'); a.removeAttribute('oncontextmenu');\n // Just in case:\n a.removeAttribute('ping');\n // In Chrome, removing onmousedown during event dispatch does not\n // prevent the inline listener from running... So we have to cancel\n // event propagation just in case.\n e.stopImmediatePropagation();\n }\n var realLink = getRealLinkFromGoogleUrl(a);\n if (realLink) {\n a.href = realLink;\n }\n a.referrerPolicy = getReferrerPolicy();\n}\n\n// This is specifically designed for catching clicks in Gmail.\n// Gmail binds a click handler to a
and cancels the event after opening\n// a window with an ugly URL. It uses a blank window + meta refresh in Firefox,\n// which is too crazy to patch. So we just make sure that the browser's default\n// click handler is activated (=open link in new tab).\n// The entry point for this crazy stuff is shown in my comment at\n// https://github.com/Rob--W/dont-track-me-google/issues/2\nfunction handleClick(e) {\n if (e.button !== 0) {\n return;\n }\n var a = e.target;\n while (a && !a.href) {\n a = a.parentElement;\n }\n if (!a) {\n return;\n }\n if (a.origin === location.origin && (\n // Same URL except for query string and/or reference fragment.\n // E.g. an in-page navigation at Google Docs (#...)\n // or an attachment at Gmail (?ui=2&...)\n a.pathname === location.pathname ||\n // When the \"Open each selected result in a new browser window\" option\n // is selected, then target=\"_blank\" is added, even though the link\n // should be opened in the same page. So do not block the propagation\n // of clicks. https://github.com/Rob--W/dont-track-me-google/issues/6\n a.pathname === '/imgres' && /[?&]imgurl=/.test(a.search) ||\n a.pathname === '/search' && /[?&]q=/.test(a.search)\n )) {\n return;\n }\n if (a.protocol !== 'http:' &&\n a.protocol !== 'https:' &&\n a.protocol !== 'ftp:') {\n // Be conservative and don't block too much. E.g. Gmail has special\n // handling for mailto:-URLs, and using stopPropagation now would\n // cause mailto:-links to be opened by the platform's default mailto\n // handler instead of Gmail's handler (=open in new window).\n return;\n }\n if (a.target === '_blank') {\n e.stopPropagation();\n a.referrerPolicy = getReferrerPolicy();\n }\n}\n\n/**\n * @returns {String} the real URL if the given link is a Google redirect URL.\n */\nfunction getRealLinkFromGoogleUrl(a) {\n if ((a.hostname === location.hostname || a.hostname === 'www.google.com') &&\n /^\\/(local_)?url$/.test(a.pathname)) {\n // Google Maps / Dito (/local_url?q=)\n // Mobile (/url?q=)\n var url = /[?&](?:q|url)=((?:https?|ftp)[%:][^&]+)/.exec(a.search);\n if (url) {\n return decodeURIComponent(url[1]);\n }\n // Help pages, e.g. safe browsing (/url?...&q=%2Fsupport%2Fanswer...)\n url = /[?&](?:q|url)=((?:%2[Ff]|\\/)[^&]+)/.exec(a.search);\n if (url) {\n return a.origin + decodeURIComponent(url[1]);\n }\n }\n}\n\n/**\n * Intercept the .href setter in the page so that the page can never change the\n * URL to a tracking URL. Just intercepting mousedown/touchstart is not enough\n * because e.g. on Google Maps, the page rewrites the URL in the contextmenu\n * event at the bubbling event stage and then stops the event propagation. So\n * there is no event-driven way to fix the URL. The DOMAttrModified event could\n * be used, but the event is deprecated, so not a viable long-term solution.\n */\nfunction setupAggresiveUglyLinkPreventer() {\n // This content script runs as document_start, so we can have some assurance\n // that the methods in the page are reliable.\n var s = document.createElement('script');\n s.textContent = '(' + function(getRealLinkFromGoogleUrl) {\n var proto = HTMLAnchorElement.prototype;\n // The link target can be changed in many ways, but let's only consider\n // the .href attribute since it's probably the only used setter.\n var hrefProp = Object.getOwnPropertyDescriptor(proto, 'href');\n var hrefGet = Function.prototype.call.bind(hrefProp.get);\n var hrefSet = Function.prototype.call.bind(hrefProp.set);\n\n Object.defineProperty(proto, 'href', {\n configurable: true,\n enumerable: true,\n get() {\n return hrefGet(this);\n },\n set(v) {\n hrefSet(this, v);\n try {\n v = getRealLinkFromGoogleUrl(this);\n if (v) {\n hrefSet(this, v);\n }\n } catch (e) {\n // Not expected to happen, but don't break the setter if for\n // some reason the (hostile) page broke the link APIs.\n }\n updateReferrerPolicy(this);\n },\n });\n var setAttribute = Function.prototype.call.bind(proto.setAttribute);\n proto.setAttribute = function(name, value) {\n // Attribute names are not case-sensitive, but weird capitalizations\n // are unlikely, so only check all-lowercase and all-uppercase.\n if (name === 'href' || name === 'HREF') {\n this.href = value;\n } else {\n setAttribute(this, name, value);\n }\n };\n\n var aDispatchEvent = Function.prototype.apply.bind(proto.dispatchEvent);\n proto.dispatchEvent = function() {\n updateReferrerPolicy(this);\n return aDispatchEvent(this, arguments);\n };\n\n var aClick = Function.prototype.apply.bind(proto.click);\n proto.click = function() {\n updateReferrerPolicy(this);\n return aClick(this, arguments);\n };\n\n var CustomEvent = window.CustomEvent;\n var currentScript = document.currentScript;\n var dispatchEvent = currentScript.dispatchEvent.bind(currentScript);\n var getScriptAttribute = currentScript.getAttribute.bind(currentScript);\n\n function updateReferrerPolicy(a) {\n try {\n dispatchEvent(new CustomEvent('dtmg-get-referrer-policy'));\n var referrerPolicy = getScriptAttribute('referrerPolicy');\n if (typeof referrerPolicy === 'string' && referrerPolicy) {\n setAttribute(a, 'referrerPolicy', referrerPolicy);\n }\n } catch (e) {\n // Not expected to happen, but don't break callers if it happens\n // anyway.\n }\n }\n } + ')(' + getRealLinkFromGoogleUrl + ');';\n s.addEventListener('dtmg-get-referrer-policy', function(event) {\n s.setAttribute('referrerPolicy', getReferrerPolicy());\n });\n (document.head || document.documentElement).appendChild(s);\n s.remove();\n}\n\ndocument.addEventListener('mousedown', handlePointerPress, true);\ndocument.addEventListener('touchstart', handlePointerPress, true);\ndocument.addEventListener('click', handleClick, true);\nsetupAggresiveUglyLinkPreventer();\n" ++ ++#endif // dont_track_me_h