Filter user-tracking parameters from query string #3239

fmarier · 2019-08-22T20:20:06Z

If a URL's query string includes one of the parameter names known
to track individual users, we remove them.

https://support.google.com/analytics/answer/7519794
https://stackoverflow.com/questions/52847475/what-is-fbclid-the-new-facebook-parameter
https://about.ads.microsoft.com/en-us/blog/post/january-2018/conversion-tracking-update-on-bing-ads
https://developer.mailchimp.com/documentation/mailchimp/guides/getting-started-with-ecommerce/#e-commerce-tracking-and-reports

Submitter Checklist:

Test Plan:

Visit the following URLs:

and verify that the query string is removed and that the URL bar only shows https://brave.com/.

Reviewer Checklist:

New files have MPL-2.0 license header.
Request a security/privacy review as needed.
Adequate test coverage exists to prevent regressions
Verify test plan is specified in PR before merging to source

After-merge Checklist:

The associated issue milestone is set to the smallest version that the
changes has landed on.
All relevant documentation has been updated.

fmarier · 2019-08-22T20:56:02Z

Note to reviewers: while the custom query string parsing code is unfortunate, Chromium's url::ExtractQueryKeyValue() (which actually comes from Mozilla) makes a lot of assumptions about how the query string is supposed to be structured and cannot distinguish between these:

?foo
?foo=
?foo&

Given that the format of the query string is not specified in RFC 3986, some frameworks don't agree with the way that the Mozilla parser interprets the query string and instead considers ?foo an empty key with a value of foo.

My parser aims at keeping to a minimum the changes we make to the query string and handles seemingly invalid query strings just fine. I have tried to optimize for the cases where (1) there is no query string and (2) the query string doesn't include any of the trackers.

browser/net/brave_site_hacks_network_delegate_helper.cc

browser/net/brave_site_hacks_network_delegate_helper_unittest.cc

browser/net/brave_site_hacks_network_delegate_helper.cc

browser/net/brave_site_hacks_network_delegate_helper_unittest.cc

iefremov

Besides minors and nits, I think we should try to simplify the parsing part.

#3239 (review) #3239 (review) #3239 (review) #3239 (review) #3239 (review) #3239 (review) #3239 (review) #3239 (review) #3239 (review) #3239 (review)

fmarier · 2019-08-23T22:08:41Z

After a discussion on Slack with @iefremov and @bridiver , we came to the conclusion that we should replace the string manipulation code with regular expressions:

s/&(fbclid|gclid|msclkid|mc_eid)=[^&]+//g
s/^(fbclid|gclid|msclkid|mc_eid)=[^&]+&//g
s/^(fbclid|gclid|msclkid|mc_eid)=[^&]+$//g

All review comments addressed in latest revision.

browser/net/brave_site_hacks_network_delegate_helper.cc

…browser#4239) If a URL's query string includes one of the parameter names known to track individual users, we remove them. We essentially apply the following to the query string: s/&(fbclid|gclid|msclkid|mc_eid)=[^&]+//g s/^(fbclid|gclid|msclkid|mc_eid)=[^&]+&//g s/^(fbclid|gclid|msclkid|mc_eid)=[^&]+$//g https://support.google.com/analytics/answer/7519794 https://stackoverflow.com/questions/52847475/what-is-fbclid-the-new-facebook-parameter https://about.ads.microsoft.com/en-us/blog/post/january-2018/conversion-tracking-update-on-bing-ads https://developer.mailchimp.com/documentation/mailchimp/guides/getting-started-with-ecommerce/#e-commerce-tracking-and-reports

fmarier added this to the 0.71.x - Nightly milestone Aug 22, 2019

fmarier self-assigned this Aug 22, 2019

fmarier force-pushed the francois-filter-query-string-4239 branch from 4dd3953 to 57a3a42 Compare August 22, 2019 20:32

fmarier requested review from iefremov and jumde August 22, 2019 20:32

fmarier requested a review from bridiver August 22, 2019 21:00

fmarier force-pushed the francois-filter-query-string-4239 branch from 57a3a42 to 8045692 Compare August 23, 2019 00:54