jonathanKingston / jonathanKingston/fix-my-http
PII leaks to archive.org
- Dominant language
- JavaScript
- Stars
- 1
- Forks
- 0
- PR merge metrics
- No merged PRs in 30d
Description
To prevent personal info going over to archive.org I want to suggest stripping get params from going to archive.org
Such that:
- example.com?username=bob would go to https://archive.org/save/example.com
- Pages within archive.org/web/... could contain query strings and they wouldn't be stripped
- "HTTP Jail" option potentially could load with query string as archive loads could have querystring saved in storage perhaps
Example url:
https://web.archive.org/save/https://www.youtube.com/watch?v={video-link}&utm_source={source}&utm_campaign={campaign}&utm_medium=email&utm_term={thing}
The problem being is the stripping would also break the above URL.
The extension could have a filter list of known bad tracking query strings which could be auto filtered then ask the user for permission to use other query string params.
Such that:
- http://www.youtube.com/watch?v={video-link}&utm_source={source}&utm_campaign={campaign}&utm_medium=email&utm_term={thing} would become https://web.archive.org/save/https://www.youtube.com/watch?v={video-link}
- User would be prompted to approve v={video-link}
- Links without a query string wouldn't have a prompt
I would rather not have a whitelist per origin of "safe" query string keys, however that could be considered certainly.
Conversation with @bunnybooboo
*note:* HTTP jail functionality hasn't been uploaded yet but basically allows a page action to open the HTTP page unhindered in an iframe
Also this should probably be solved before fixing why https Youtube video links aren't working correctly :D.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by tracing how archive.org/save URLs are generated and how the proposed HTTP Jail option would load pages. Compare stripping all query parameters with filtering tracking keys and prompting for others, including the YouTube example where v= is needed. Done means personal query data is protected without breaking required archive URLs, and the behavior is covered for pages inside and outside archive.org/web/.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100