Skip to content

fix(security): Stop leaking urls on browser navigation - #148

Open
dot-mike wants to merge 1 commit into
linkwarden:mainfrom
dot-mike:fix/no-background-url-search
Open

fix(security): Stop leaking urls on browser navigation#148
dot-mike wants to merge 1 commit into
linkwarden:mainfrom
dot-mike:fix/no-background-url-search

Conversation

@dot-mike

Copy link
Copy Markdown

Regards linkwarden/linkwarden#1643 - [Browser Extension] Extension attempts to search every single visited website

This security-bug fix prevents the extension from leaking browser history to the self-hosted linkwarden instance. I'm sure the bug also affects the paid cloud instance of linkwarden, which makes this a serious violation of privacy for users.

I would also take the time to mention that browser extension is not mentioned in the privacy policy https://linkwarden.app/privacy-policy - which is linked from google extension page

before the fix, all URL navigation

19:22:12.472  200  /api/v1/search?sort=0&searchQueryString=url:https://news.ycombinator.com/
19:22:12.519  304  /api/v1/search?sort=0&searchQueryString=url:https://news.ycombinator.com/
19:22:12.546  304  /api/v1/search?sort=0&searchQueryString=url:https://news.ycombinator.com/

After the fix, only URLs I explicitly saved

19:40:24.682  200  /api/v1/search?...url:https://playaphone.com/
19:40:43.818  200  /api/v1/collections
19:40:45.603  200  /api/v1/search?...url:https://playaphone.com/
19:40:48.772  200  /api/v1/links

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant