{"action":"created","issue":{"url":"https://api.github.com/repos/EFForg/privacybadger/issues/2167","repository_url":"https://api.github.com/repos/EFForg/privacybadger","labels_url":"https://api.github.com/repos/EFForg/privacybadger/issues/2167/labels{/name}","comments_url":"https://api.github.com/repos/EFForg/privacybadger/issues/2167/comments","events_url":"https://api.github.com/repos/EFForg/privacybadger/issues/2167/events","html_url":"https://github.com/EFForg/privacybadger/pull/2167","id":361928574,"node_id":"MDExOlB1bGxSZXF1ZXN0MjE2Nzc3MjQ4","number":2167,"title":"Use parent host for about:blank frames","user":{"login":"Jsnhlbr5","id":4733108,"node_id":"MDQ6VXNlcjQ3MzMxMDg=","avatar_url":"https://avatars3.githubusercontent.com/u/4733108?v=4","gravatar_id":"","url":"https://api.github.com/users/Jsnhlbr5","html_url":"https://github.com/Jsnhlbr5","followers_url":"https://api.github.com/users/Jsnhlbr5/followers","following_url":"https://api.github.com/users/Jsnhlbr5/following{/other_user}","gists_url":"https://api.github.com/users/Jsnhlbr5/gists{/gist_id}","starred_url":"https://api.github.com/users/Jsnhlbr5/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Jsnhlbr5/subscriptions","organizations_url":"https://api.github.com/users/Jsnhlbr5/orgs","repos_url":"https://api.github.com/users/Jsnhlbr5/repos","events_url":"https://api.github.com/users/Jsnhlbr5/events{/privacy}","received_events_url":"https://api.github.com/users/Jsnhlbr5/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":7,"created_at":"2018-09-19T21:08:58Z","updated_at":"2018-10-26T18:29:48Z","closed_at":"2018-09-27T22:16:29Z","author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/EFForg/privacybadger/pulls/2167","html_url":"https://github.com/EFForg/privacybadger/pull/2167","diff_url":"https://github.com/EFForg/privacybadger/pull/2167.diff","patch_url":"https://github.com/EFForg/privacybadger/pull/2167.patch"},"body":"When recording frames into badger's frame data, use the parent frame's\r\nhost for frames with a URL of 'about:blank', and then use the frame data\r\nfor sender.frameId instead of sender.url when dealing with subframes.\r\nThis records a useful entry for supercookies (and possibly others),\r\ninstead of '' caused by a failure to parse 'about:blank' as a URL.\r\n\r\nFixes #1447 "},"comment":{"url":"https://api.github.com/repos/EFForg/privacybadger/issues/comments/433502287","html_url":"https://github.com/EFForg/privacybadger/pull/2167#issuecomment-433502287","issue_url":"https://api.github.com/repos/EFForg/privacybadger/issues/2167","id":433502287,"node_id":"MDEyOklzc3VlQ29tbWVudDQzMzUwMjI4Nw==","user":{"login":"ghostwords","id":794578,"node_id":"MDQ6VXNlcjc5NDU3OA==","avatar_url":"https://avatars1.githubusercontent.com/u/794578?v=4","gravatar_id":"","url":"https://api.github.com/users/ghostwords","html_url":"https://github.com/ghostwords","followers_url":"https://api.github.com/users/ghostwords/followers","following_url":"https://api.github.com/users/ghostwords/following{/other_user}","gists_url":"https://api.github.com/users/ghostwords/gists{/gist_id}","starred_url":"https://api.github.com/users/ghostwords/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ghostwords/subscriptions","organizations_url":"https://api.github.com/users/ghostwords/orgs","repos_url":"https://api.github.com/users/ghostwords/repos","events_url":"https://api.github.com/users/ghostwords/events{/privacy}","received_events_url":"https://api.github.com/users/ghostwords/received_events","type":"User","site_admin":false},"created_at":"2018-10-26T18:29:48Z","updated_at":"2018-10-26T18:29:48Z","author_association":"MEMBER","body":"@Jsnhlbr5 I have some in-progress \"about:blank\"-related fixes in ffd4474a674a6da791ed05eeea37169f4ff65d55.\r\n\r\nThe big idea is that when we need the frame URL from a content script, we replace `sender.url` from `chrome.runtime.onMessage` (which gives us values like `about:blank` or `about:srcdoc` which we can't do much with) with a frame URL determined actively by our content scripts.\r\n\r\nEach content script starts with `document.location.href` and then sees if it's not an http(s) URL and if so tries to get the URL of the parent frame. This keeps going until we find an http(s) URL or we can't access the parent URL anymore (no longer same-origin, no access to parent URL). Content scripts run in their own isolated JavaScript environment, so we should be able to trust them to retrieve frame URLs."}}
{"actor":{"display_login":"ghostwords"}}