webRequest leak

[laniakea64]

Waterfox 56.0.3
new profile

Steps to reproduce

1. go to about:debugging, make sure "Enable add-on debugging" is checked

2. install the example user-agent rewriter WebExtension - https://github.com/mdn/webextensions-examples/tree/master/user-agent-rewriter

3. go to Tools > Web Developer > Browser Toolbox > Network

4. visit https://httpbin.org/html

5. look at User-Agent header of all network requests

Expected results: all requests to httpbin.org should show Firefox 41 user-agent

Actual results:
httpbin.org favicon is requested twice, and the first request - which hits the network - shows the real user-agent.

This leak also means that content blockers like uMatrix can't fully do their job - gorhill/uMatrix#925

Related Mozilla bug - https://bugzilla.mozilla.org/show_bug.cgi?id=1433700

[Atavic]

favicon.ico Is a Privacy Leak

See: https://robinlinus.github.io/socialmedia-leak/

[laniakea64]

The Mozilla bug has now been marked RESOLVED FIXED, with reference to https://bugzilla.mozilla.org/show_bug.cgi?id=1453751#c45

[laniakea64]

This is only partially fixed in Waterfox 68.0a2.

The exact STR from the description produces the expected results. However, replacing step 4 with "visit #414, right-click the httpbin link in the description > Save Link As...", the real user-agent is still shown.

[laniakea64]

Scratch that last comment - that case works fine in Waterfox 68.0a2 if I change the manifest.json host permission to <all_urls>.

[Atavic]

I use privoxy for changing the UA String. I witnessed myself many bugs with internal browser solutions for changing it.