Strip xorigin navigation referrers instead of spoofing #1767

fmarier · 2019-02-22T22:55:08Z

Fixes brave/brave-browser#3422.

Submitter Checklist:

Test Plan:

This can be manually tested using https://fmarier.github.io/brave-testing/referrer-spoofing.html.

Reviewer Checklist:

New files have MPL-2.0 license header.
Request a security/privacy review as needed.
Adequate test coverage exists to prevent regressions
Verify test plan is specified in PR before merging to source

diracdeltas · 2019-02-23T00:59:28Z

currently building on MacOS. thanks for making a test page. adding @bridiver for review

diracdeltas · 2019-02-25T22:20:52Z

on https://fmarier.github.io/brave-testing/referrer-spoofing.html:

subresource referrer can't be checked using devtools since it only shows provisional headers. does anyone know of another way? (other than using a MITM proxy). EDIT: no longer needed, i made a jsfiddle for this
on same origin navigation to https://fmarier.github.io/brave-testing/blank.html, referer header shows up as https://fmarier.github.io/brave-testing/referrer-spoofing.html. same with document.referrer. 👍
on cross-origin navigation to https://www.whatismyreferer.com/, referer header is blank and so is document.referrer. 👍

diracdeltas · 2019-02-25T22:30:26Z

i made a test page for subresource referer: https://jsfiddle.net/r4ygLsup/

expected result with spoofing:

the result iframe shows https://fiddle.jshell.net/ (instead of something from jsfiddle.net)
the iframe within the result iframe shows https://www.whatismyreferer.com/

I got the expected results on current stable release. with this PR:

shows the full URL, https://fiddle.jshell.net/r4ygLsup/show/, instead of just the origin
shows 'no referrer / hidden'

not sure if the difference is due to this PR or changed sometime before

EDIT: tried this with cf71d56 reverted and got the same result as on stable

fmarier · 2019-02-26T01:03:14Z

subresource referrer can't be checked using devtools since it only shows provisional headers. does anyone know of another way? (other than using a MITM proxy). EDIT: no longer needed, i made a jsfiddle for this

I was cheating for that one since I looked at the Apache access log :)

a.b.c.d - - [26/Feb/2019:01:31:27 +0000] "GET /img/francois_marier.jpg HTTP/2.0" 200 6385 "https://fmarier.org/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.39 Safari/537.36"

but your idea of looking at document.referrer is much better.

I updated my test page to include that and also the iframe trick for sub-resources.

fmarier · 2019-02-26T01:13:13Z

Using my updated test page, the three test cases are as expected in my branch:

same-origin navigations are still untouched,
cross-origin navigations are now truncated, and
cross-origin resources are still spoofed.

and as expected on current release, beta and dev:

same-origin navigations are untouched,
cross-origin navigations are spoofed, and
cross-origin resources are spoofed.

fmarier · 2019-02-26T01:29:34Z

I added two more test cases to my test page to cover same-origin iframes and cross-origin iframes, as leaked via document.referer and the results are:

referrers are spoofed on release, and
they are truncated with my patch.

Now that I think of it, should cross-origin iframes be spoofed or truncated? They're not top-level navigations, but aren't navigations too?

fmarier · 2019-02-26T01:39:48Z

In other words, do we agree that the expected values I put down on https://fmarier.github.io/brave-testing/referrer-spoofing.html are correct after this patch is applied?

The only difference with current release is that anything that's expected to be blank on the test page is currently spoofed without my patch.

diracdeltas · 2019-02-26T18:52:53Z

@fmarier i agree https://fmarier.github.io/brave-testing/referrer-spoofing.html shows the correct values with this patch. however the first test case in https://jsfiddle.net/yg29vnLt/ is still confusing me (i updated the jsfiddle to have better labels); instead of showing no referrer, it shows https://fiddle.jshell.net/yg29vnLt/show/

fmarier · 2019-02-26T19:28:53Z

however the first test case in https://jsfiddle.net/yg29vnLt/ is still confusing me (i updated the jsfiddle to have better labels); instead of showing no referrer, it shows https://fiddle.jshell.net/yg29vnLt/show/

You're right, that makes no sense. I will dig into that test case.

fmarier · 2019-03-02T04:03:10Z

@diracdeltas I made a simplified version of your jsfiddle which still exhibits the same issue: https://jsfiddle.net/06oh25xy/

As far as I can tell, the problem is that the test case in jsfiddle is different when we spoof v. strip. When we strip the referrer, it's no longer not a single iframe, but rather an iframe within a same-origin iframe.

On release (spoofing), when loading https://jsfiddle.net/06oh25xy/ I see this in the devtools:

https://jsfiddle.net/06oh25xy/ -> https://fiddle.jshell.net/06oh25xy/show/

With my patch (stripping), I see the following instead:

https://jsfiddle.net/06oh25xy/ -> https://fiddle.jshell.net/06oh25xy/show/ -> https://fiddle.jshell.net/06oh25xy/show/light/

In fact, we can tell visually that we're not getting the same payload. This is the result iframe without my patch:

and this is the same result iframe with my patch:

(notice the extra "tab" bar)

diracdeltas · 2019-03-02T04:27:33Z

@fmarier interesting! are you saying the site inserts an extra iframe when the referer is stripped out?

that's definitely not a bug with this patch then

fmarier · 2019-03-02T04:46:02Z

are you saying the site inserts an extra iframe when the referer is stripped out?

Indeed. This is what it looks like on the jsfiddle site,

$ curl -H "Referer: https://jsfiddle.net/" https://fiddle.jshell.net/06oh25xy/show/ 
<!DOCTYPE html>
<html>
<head>
  <meta http-equiv="content-type" content="text/html; charset=UTF-8">
  <title></title>
  <meta http-equiv="content-type" content="text/html; charset=UTF-8">
  <meta name="robots" content="noindex, nofollow">
  <meta name="googlebot" content="noindex, nofollow">
  <meta name="viewport" content="width=device-width, initial-scale=1">


  <script
    type="text/javascript"
    src="/js/lib/dummy.js"
    
  ></script>

    <link rel="stylesheet" type="text/css" href="/css/result-light.css">


  <style id="compiled-css" type="text/css">
      
  </style>


  <!-- TODO: Missing CoffeeScript 2 -->

  <script type="text/javascript">


    window.onload=function(){
      
referer.innerText = document.referrer || 'None / hidden'

    }

</script>

</head>
<body>
    <div>
1. referrer of cross-origin iframe (jsfiddle.net -> fiddle.jshell.net): 
</div>
<div id='referer'>
</div>


  
  <script>
    // tell the embed parent frame the height of the content
    if (window.parent && window.parent.parent){
      window.parent.parent.postMessage(["resultsFrame", {
        height: document.body.getBoundingClientRect().height,
        slug: "06oh25xy"
      }], "*")
    }

    // always overwrite window.name, in case users try to set it manually
    window.name = "result"
  </script>
</body>
</html>

and this is what it looks like without a referrer:

$ curl https://fiddle.jshell.net/06oh25xy/show/
<!DOCTYPE HTML>
<html>
  <head>
    <meta charset="utf-8">
    <meta http-equiv="content-type" content="text/html; charset=UTF-8">
    <meta http-equiv="edit-Type" edit="text/html; charset=utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <title>JSFiddle</title>

      <meta name="robots" content="index, follow">
      <meta name="googlebot" content="index, follow">

      <script src="/js/embed/highlight.pack.js"></script>
      <script src="/js/embed/embed.js"></script>
      <link rel="stylesheet" media="screen" href="/css/embed/embed-light.css" />

      <script type="text/javascript">
        var height;
        var force_height = null;
        var slug = "06oh25xy";
        var show_src = "//fiddle.jshell.net/06oh25xy/show/light/";
        var resize_element_counter = 0;
        var shell_edit_url = "/06oh25xy/light/";

      </script>

    <link rel="stylesheet" media="screen" href="//fonts.googleapis.com/css?family=Inconsolata" />

    <style type="text/css" media="screen">
    </style>

  </head>
  <body>
    <div id="wrapper">
        <header>
          <h1><a href="//jsfiddle.net/06oh25xy/?utm_source=website&amp;utm_medium=embed&amp;utm_campaign=06oh25xy" target="_blank">Edit in JSFiddle</a></h1>
          <div id="actions">
            <ul class="normalRes">
                <li class=&quot;active&quot;>
                  <a data-trigger-type="result" href="#Result">Result</a>
                </li>
            </ul>
            <div class="hl"></div>
          </div>
        </header>

        <div id="tabs">
              <div class="tCont result active" id="result"></div>
                <script type="text/javascript">
                  window.addEventListener('load', function(){
                    if (typeof(EmbedManager) === undefined){
                        EmbedManager.loadResult();
                    }
                  }, false);
                </script>
        </div>
    </div>
  </body>
</html>

browser/brave_content_browser_client.cc