Filter out mailerlite fields from the query string

[fmarier]

MailerLite is a newsletter service which adds the following fields to outgoing links:

• ml_subscriber
• ml_subscriber_hash

There are lots of examples in the wild:

• https://www.instagram.com/p/B6K3P0eJ8r7/?ml_subscriber=1319667952278050466&ml_subscriber_hash=i3g5&utm_source=newsletter&utm_medium=email&utm_campaign=boxing_day_sale_get_30_off&utm_term=2021-05-14
• https://www.tandfonline.com/doi/abs/10.1080/15368378.2021.1881866?ml_subscriber=1695975887331137303&ml_subscriber_hash=d1c0
• https://globalnews.ca/video/7593002/casual-and-formal-wear-for-your-next-virtual-chat?ml_subscriber=1609062412231645147&ml_subscriber_hash=p3q6&utm_source=newsletter&utm_medium=email&utm_campaign=free_roses_and_almost_free_clothes&utm_term=2021-07-03

They recommend adding their tracking script to all pages of a website. That script looks at these values and sends them to a backend using a tracking pixel, for example like this:

function g() {
    var c = n("ml_subscriber"),
        e = n("ml_subscriber_hash"),
        f = a.location.hostname;
    return a.mlsettings && a.mlsettings.shop && (f = a.mlsettings.shop), c && e && (new Image().src = B + "/api/v2/woocommerce/visitor/" + c + "/" + e + "/" + f), d(b);
}

From what I can see in a newsletter I'm subscribed to, the unsubscribe link is completely different and instead uses a base64 blob that's part of the path in order to recover the email address. Therefore, it should be safe to strip these parameters out.

[stephendonner]

Verified PASSED using the testplan in brave/brave-core#9761 and build

Brave	1.30.28 Chromium: 92.0.4515.159 (Official Build) nightly (x86_64)
Revision	0185b8a19c88c5dfd3e6c0da6686d799e9bc3b52-refs/branch-heads/4515@{#2052}
OS	macOS Version 12.0 (Build 21A5304g)

Steps:

1. new profile
2. launched Brave
3. opened Developer Tools from the "hamburger" menu, More Tools and chose the Network panel
4. loaded https://brave.com/?ml_subscriber=17517&ml_subscriber_hash=o3e1 and watched the network requests
5. confirmed that the ml_subscriber and ml_subscriber_hash parameters have been removed from the URL bar and an HTTP 307/internal redirect

[srirambv]

Verification passed on the following devices running 1.30.79 x64 build

• Verified ml_subscriber and ml_subscriber_hash are removed from URL when request is initiated

Oppo Reno 5 (Android 11)	Samsung Tab A (Android 10)