blocked cookies can be accessed through JavaScript and sent to a server

[baptx]

Prerequisites

• I performed a cursory search of the issue tracker to avoid opening a duplicate issue
  • Your issue may already be reported.
  • I also searched the existing issues at https://github.com/gorhill/uMatrix/issues
• This is not a support issue or a question
  • Support issues and questions are handled at /r/uMatrix
• I tried to reproduce the issue when...
  • uMatrix is the only extension
  • uMatrix with default lists/settings
  • using a new, unmodified browser profile
• I am running the latest version of uMatrix
• I checked the documentation to understand that the issue I report is not a normal behavior
• I used the logger to rule out that the issue is caused by my ruleset

Description

Blocked cookies can be accessed through JavaScript. If cookies are blocked, they should not be accessible by websites. The ability to block cookies sent to a server can be bypassed if the website is sending cookies through AJAX.
I noticed this problem when visiting the website https://www.jeanlouisdavid.com/ which only displayed a coronavirus popup notifier the first time you visit the website. After reloading the website, the popup was not displayed anymore because the website was able to read the cookie through JavaScript.

Related: gorhill/uMatrix#855

Steps to Reproduce

1. Allow JavaScript and block cookies on https://www.w3schools.com/js/js_cookies.asp
2. Click a button to set a cookie
3. Click a button to display cookies

Ruleset

https-strict: behind-the-scene false
matrix-off: about-scheme true
matrix-off: behind-the-scene true
matrix-off: chrome-extension-scheme true
matrix-off: chrome-scheme true
matrix-off: moz-extension-scheme true
matrix-off: opera-scheme true
matrix-off: vivaldi-scheme true
matrix-off: wyciwyg-scheme true
noscript-spoof: * true
referrer-spoof: * true
referrer-spoof: behind-the-scene false
* * * block
* * css allow
* * frame block
* * image allow
* 1st-party * allow
* 1st-party frame allow
w3schools.com * cookie block
w3schools.com * css inherit
w3schools.com * frame inherit
w3schools.com * image inherit
w3schools.com 1st-party frame inherit

Supporting evidence

https://www.w3schools.com/js/js_cookies.asp

Your environment

• uMatrix version: 1.4.0
• Browser Name and version: Firefox 74.0
• Operating System and version: Linux / Lubuntu 19.10

[uBlock-user]

Duplicate of #7