jonathanKingston / jonathanKingston/fix-my-http

PII leaks to archive.org

Open
#8 1 comment 1 reaction 0 assignees View on GitHub
Dominant language
JavaScript
Stars
1
Forks
0
PR merge metrics
No merged PRs in 30d

Description

To prevent personal info going over to archive.org I want to suggest stripping get params from going to archive.org

Such that:

- example.com?username=bob would go to https://archive.org/save/example.com
- Pages within archive.org/web/... could contain query strings and they wouldn't be stripped
- "HTTP Jail" option potentially could load with query string as archive loads could have querystring saved in storage perhaps

Example url:
https://web.archive.org/save/https://www.youtube.com/watch?v={video-link}&utm_source={source}&utm_campaign={campaign}&utm_medium=email&utm_term={thing}

The problem being is the stripping would also break the above URL.

The extension could have a filter list of known bad tracking query strings which could be auto filtered then ask the user for permission to use other query string params.

Such that:

- http://www.youtube.com/watch?v={video-link}&utm_source={source}&utm_campaign={campaign}&utm_medium=email&utm_term={thing} would become https://web.archive.org/save/https://www.youtube.com/watch?v={video-link}
- User would be prompted to approve v={video-link}
- Links without a query string wouldn't have a prompt

I would rather not have a whitelist per origin of "safe" query string keys, however that could be considered certainly.

Conversation with @bunnybooboo
*note:* HTTP jail functionality hasn't been uploaded yet but basically allows a page action to open the HTTP page unhindered in an iframe

Also this should probably be solved before fixing why https Youtube video links aren't working correctly :D.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by tracing how archive.org/save URLs are generated and how the proposed HTTP Jail option would load pages. Compare stripping all query parameters with filtering tracking keys and prompting for others, including the YouTube example where v= is needed. Done means personal query data is protected without breaking required archive URLs, and the behavior is covered for pages inside and outside archive.org/web/.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.