Closed Bug 1541885 Opened 6 years ago Closed 3 years ago

In some cases, Forget About Site will not clear data across origin attributes

Categories

(Toolkit :: Data Sanitization, defect, P3)

defect

Tracking

()

RESOLVED FIXED
91 Branch
Tracking Status
firefox91 --- fixed

People

(Reporter: johannh, Unassigned)

References

(Blocks 2 open bugs)

Details

(Whiteboard: [fixed by Bug 1705028])

The "Forget about site" feature allows users to clear data by hostname, which is not fully supported by a couple of things, namely:

  • Quota Storage
  • Network Cache
  • Image Cache

These rely very much on principals with OAs to be specified when clearing data, hence the Quota Storage cleaner uses a hacky mechanism for cleaning both the http and https variant of the specified host like this: https://searchfox.org/mozilla-central/rev/44a212460990ffffecf50a8e972d3cbde2e7216b/toolkit/components/cleardata/ClearDataService.jsm#340-345

It's not great, but at least it covers basic cleaning that 99% of our users would find sufficient. I will adopt the same technique for cache cleaners in bug 1532203.

The use case where this really leaks data is containers, though, because this code does not consider containers at all when clearing.

We should update the cleaners and potentially the platform code for these components to make sure they properly clean all containers.

Blocks: 1691728

We're adding deleteByBaseDomain for all cleaners which should clear data across all origin attributes.

Blocks: 1646215
Depends on: 1705030, 1705036, 1705033

(In reply to Paul Zühlcke [:pbz] from comment #1)

We're adding deleteByBaseDomain for all cleaners which should clear data across all origin attributes.

All cleaners have been updated to support deleteByBaseDomain and the "Forget about this site feature" now calls this method so I'm marking this bug as fixed.

Status: NEW → RESOLVED
Closed: 3 years ago
Resolution: --- → FIXED
Whiteboard: [fixed by Bug 1705028]
Target Milestone: --- → 91 Branch
You need to log in before you can comment on or make changes to this bug.