Blocked cookies are leaked to sites when viewing page source
user234683 opened this issue · comments
When cookies are blocked for a site, if you right click and view page source, the site is not blocked from reading your cookies during the request that's made.
Browser: Firefox 58.01 64-bit, also tested on Waterfox 56.0.4.1 64-bit
uMatrix Version: 1.3.2
Steps to reproduce:
- Have a cookie in your browser that keeps you logged into github
- Block cookies for github
- Go to github.com
- The page should not have any indication of being logged in or what your username is, as expected.
- Right click and view source
- Do a ctrl+f search for your github username in the source code
- Observe that this source code is the source code for a logged-in page, and contains your username
Optional: Delete the cookies for github. Go to github.com and view page source. Do a ctrl+f for your username, observe that it is not found.
Optional: In the view-source page, open the network tab in the inspector and reload in order to gather the request activity. Observe in the request header that cookies are sent.
Doesn't happen on Chromium 66.
Browser issue: the view-source:-linked request does not go through uMatrix's webRequest listener. Report to browser devs: https://bugzilla.mozilla.org/.
Alright, I opened a bug report at https://bugzilla.mozilla.org/show_bug.cgi?id=1439163
I tried my best as I'm not familiar with extension internals