Ghostery breaking signed imgix images

[danieltott]

Please read the CONTRIBUTING guide before submitting an issue.

Description

Imgix has a GET param called auto that ghostery is changing the value of to auto=ghostery, which breaks the image in our case since we're pre-signing the images.

Example actual image:
https://ralstoninstcms.imgix.net/slideshow/RI-hero-DCAP-PV.jpg?auto=compress%2Cformat%2Cenhance&w=2000&s=0f37d2e8687b2d6199c84fb2077fd238

Ghostery-ed image:
https://ralstoninstcms.imgix.net/slideshow/RI-hero-DCAP-PV.jpg?auto=ghostery&w=2000&s=0f37d2e8687b2d6199c84fb2077fd238

Expected Behavior

Ghostery leaves these images alone.

Actual Behavior

Ghostery rewrites auto GET parameter

Steps to Reproduce

1. Create pre-signed image on imgix
2. Load image on site in browser with ghostery enabled

Versions

• Browser: Chrome 73.0.3683.86
• OS: MacOS 10.14.3 (18D109)
• Ghostery 8.3.1

Notably this is not happening on Firefox

[christophertino]

Looks like an anti-tracking false positive. @sammacbeth can you take a look?

[danieltott]

OK - looking at this more it appears it's only happening with the images in the /slideshow/ directory. Is that just something that ghostery always blocks? These aren't tracking images or ads, they're just marketing images. But we can probably rename that directory if that's just what it is.

[sammacbeth]

This is from the anti-tracking module. The value is being rewritten because:

• The value compress%2Cformat%2Cenhance was not seen by enough users to mark it as safe.
• The value was used for this domain imgix.net in a third-party context on multiple different sites.

As this value is obviously not a tracking identifier I'd like to debug why we did not whitelist it. Is this value fairly unique? If it is not used very often it may be that too few users saw it for us to mark it as safe.

[danieltott]

I would guess it'd be fairly unique - the enhance keyword is one we don't even use every time we use imgix.

[homburg]

Seeing this with a custom blend64=... parameter as well

[Haraldson]

Any progress here? Still seeing this behavior regularly—although not with the auto GET parameter, but for imgix hosted images in general.

[christophertino]

@Haraldson Is the entire image being blocked or are parameters being changed to ghostery?