Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

rel="noreferrer" leaks referer on links with target="_blank" when e10s is enabled #839

Closed
laniakea64 opened this issue Jan 9, 2019 · 2 comments
Closed

rel="noreferrer" leaks referer on links with target="_blank" when e10s is enabled #839

laniakea64 opened this issue Jan 9, 2019 · 2 comments

Comments

@laniakea64
Copy link

Waterfox 56.2.6
new profile

Steps to reproduce

  1. put these pages up on a server -

noreferer-test.html

<!doctype html>
<a rel="noopener noreferrer" href="referer.php">Left Click Me (same window)</a>
<br/>
<a rel="noopener noreferrer" target="_blank" href="referer.php">Left Click Me (new window)</a>

referer.php

<!doctype html>
<div>
<?php
if (isset($_SERVER['HTTP_REFERER'])) {
  echo 'You came from <span>' . $_SERVER['HTTP_REFERER'] . '</span>';
}
else {
  echo 'I dont know where you came from.';
}
?>
</div>

  1. visit the noreferer-test.html

  2. Left-click each of the two links in turn, and compare the results.

Expected results

Both links should result in 'I dont know where you came from'

Actual results

The link with target="_blank" leaks the referer when e10s is enabled.

@MrAlex94 This can be fixed by porting the patches from Mozilla bug 1420702 . I have tried to do it on top of patches from #832 , and so far it seems to be working, so when/if that pull request gets merged I can open a pull request for this.
@grahamperrin
Copy link

Thanks

Mozilla bug 1420702 - Referrer policy ignored in pinned tabs

RESOLVED FIXED in Firefox 59

… patches from Mozilla bug 1420702 …

Towards a PR/merge:

@laniakea64 laniakea64 mentioned this issue Mar 4, 2019
Closed
@laniakea64
Copy link
Author

Fixed by 1aed850 , thanks! 😃

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@grahamperrin @laniakea64