Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Privacy Badger not setting navigator.globalPrivacyControl before scripts in the head block execute #2948

Open
DrEnter opened this issue Feb 1, 2024 · 4 comments
Open

Privacy Badger not setting navigator.globalPrivacyControl before scripts in the head block execute #2948

DrEnter opened this issue Feb 1, 2024 · 4 comments
Labels
bug

Comments

@DrEnter
Copy link

DrEnter commented Feb 1, 2024

PrivacyBadger doesn't set navigator.globalPrivacyControl before scripts in the <head> block execute. This means that any scripts invoked in the <head> block, which is common for privacy control software like OneTrust, are not able to detect the signal. This is not a problem with other extensions, such as gpcEnabler.

I was able to replicate the issue by simply adding <script>window._isGpcSet = !!navigator.globalPrivacyControl;</script> immediately after the <head> tag in a web page. The value is ALWAYS false with PrivacyBadger, but true with native GPC support enabled in Firefox or Brave, and true with other extensions.

I did most of my testing with Chrome version 121.0.6167.85 using PrivacyBadger 2023.12.1 on MacOS.
@ghostwords
Copy link
Member

Hello and thanks for opening an issue!

Do you have any example links where we might see this bug in action?

@ghostwords ghostwords added the bug label Feb 2, 2024
@ghostwords ghostwords changed the title PrivacyBadger not setting navigator.globalPrivacyControl before scripts in the head block execute Privacy Badger not setting navigator.globalPrivacyControl before scripts in the head block execute Feb 2, 2024
@DrEnter
Copy link
Author

DrEnter commented Feb 2, 2024 •
edited

Nothing public, but I see it with something as simple as this:

<!DOCTYPE html><html>
<head><script>window._isGpcSet_head = !!window.navigator.globalPrivacyControl;</script></head>
<body>
<h2>Was GPC Detected?</h2>
<script>document.write('<p>GPC set in head block: ' + window._isGpcSet_head + '</p><p>GPC set in body block: ' + (!!window.navigator.globalPrivacyControl) + '</p><p>Typeof globalPrivacyControl: ' + typeof window.navigator.globalPrivacyControl + '</p>');</script>
</body>
</html>

I'll add that frequently the above shows false for the body as well. It appears the value being injected by PrivacyBadger may be delayed until after rendering?

@ghostwords
Copy link
Member

OK, thank you for the example. I'm trying to assess the real world impact.

This should get fixed as part of updating to Manifest V3.

@DrEnter
Copy link
Author

DrEnter commented Feb 2, 2024 •
edited

Just to add a bit more data, I built out the page above to add an interval timer to see how long it takes...

<!DOCTYPE html><html>
<head><script>window._isGpcSet_head = !!window.navigator.globalPrivacyControl;</script></head>
<body>
<h2>Was GPC Detected?</h2>
<script>document.write('<p>GPC set in head block: ' + window._isGpcSet_head + '</p><p>GPC set in body block: ' + (!!window.navigator.globalPrivacyControl) + '</p><p>Typeof globalPrivacyControl: ' + typeof window.navigator.globalPrivacyControl + '</p>');
document.write('<div id="gpcDiv"></div>');
window.inter = setInterval(function () {
    let gpc = !!window.navigator.globalPrivacyControl;
    let gd = document.getElementById('gpcDiv');
    gd.innerHTML += '<p>GPC = ' + gpc + ' at ' + new Date() + '</p>';
    if (gpc) { clearInterval(window.inter); }
}, 20);
</script>
</body>
</html>

For me, output like this is typical:

GPC = false at Fri Feb 02 2024 15:53:57 GMT-0500 (Eastern Standard Time)
GPC = false at Fri Feb 02 2024 15:53:57 GMT-0500 (Eastern Standard Time)
GPC = false at Fri Feb 02 2024 15:53:57 GMT-0500 (Eastern Standard Time)
GPC = false at Fri Feb 02 2024 15:53:57 GMT-0500 (Eastern Standard Time)
GPC = true at Fri Feb 02 2024 15:53:57 GMT-0500 (Eastern Standard Time)

So about 80-100 ms.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@ghostwords @DrEnter