Breaks Salesforce "Lightning" UI

[CAfromCA]

When Privacy Badger is enabled in Firefox Developer Edition (60.0b6), any page in Salesforce where the new "Lightning" UI attempts to load part of the classic "Aloha" UI in an iframe causes a new tab to open instead where the content of the iframe attempts to load.

Whitelisting "salesforce.com" and "force.com" does not have any effect. As long as Privacy Badger is enabled the issue will occur.

I'm not sure what other information would be helpful so please let me know what else you need to troubleshoot.

[ghostwords]

Hello!

Have you tried whitelisting by clicking the "Disable Privacy Badger for This Site" button inside Privacy Badger's popup on the broken page?

It sounds like we should teach Privacy Badger that some of these domains belong to the same entity.

Could you run the following script in your Badger's background page console and share what it prints out? You could also send the output to alexei at eff dot org if you'd rather not post it here.

(function () {
  const STR = "force";
  console.log("**** ACTION_MAP for", STR);
  _.each(badger.storage.getBadgerStorageObject('action_map').getItemClones(), (obj, domain) => {
    if (domain.indexOf(STR) != -1) console.log(domain, JSON.stringify(obj, null, 2));
  });
  console.log("**** SNITCH_MAP for", STR);
  _.each(badger.storage.getBadgerStorageObject('snitch_map').getItemClones(), (sites, domain) => {
    if (domain.indexOf(STR) != -1) console.log(domain, JSON.stringify(sites, null, 2));
  });
}());

To get to the background page console in Chrome, visit chrome://extensions, make sure "Developer mode" is checked, click on the "background page" link in Privacy Badger's row, and select the Console tab.

In Firefox, visit about:debugging, enable add-on debugging, click Debug next to Privacy Badger, click the OK button on the popup warning about remote debugging, and enter the above script into the console after the >>.

[CAfromCA]

You nailed it. I'd manually whitelisted "salesforce.com" and "force.com", but not "*.salesforce.com" and "*.force.com" so Privacy Badger was still active on "na50.lightning.force.com".

Just for some background, Salesforce serves most of its classic UI from subdomains of salesforce.com (like na50.salesforce.com) but serves the new Lightning UI from subdomains of force.com, or more specifically subdomains of lightning.force.com. They also serve custom UI from subdomains of visual.force.com and I'm sure there are (or will be) more.

The output from your script was:

**** ACTION_MAP for force 
service.force.com {
  "userAction": "",
  "dnt": false,
  "heuristicAction": "allow",
  "nextUpdateTime": 1521086818507
} 
force.com {
  "userAction": "",
  "dnt": false,
  "heuristicAction": "allow",
  "nextUpdateTime": 0
} 
na64.salesforce.com {
  "userAction": "",
  "dnt": false,
  "heuristicAction": "allow",
  "nextUpdateTime": 1521146260582
} 
salesforce.com {
  "userAction": "",
  "dnt": false,
  "heuristicAction": "cookieblock",
  "nextUpdateTime": 0
} 
la1-c2cs-dfw.salesforceliveagent.com {
  "userAction": "",
  "dnt": false,
  "heuristicAction": "allow",
  "nextUpdateTime": 1521430600012
} 
salesforceliveagent.com {
  "userAction": "",
  "dnt": false,
  "heuristicAction": "allow",
  "nextUpdateTime": 0
} 
www.salesforce.com {
  "userAction": "",
  "dnt": false,
  "heuristicAction": "allow",
  "nextUpdateTime": 1521529172472
} 
trailhead.salesforce.com {
  "userAction": "",
  "dnt": false,
  "heuristicAction": "cookieblock",
  "nextUpdateTime": 1521835190490
} 
help.salesforce.com {
  "userAction": "",
  "dnt": false,
  "heuristicAction": "cookieblock",
  "nextUpdateTime": 1521996775331
} 
partners.salesforce.com {
  "userAction": "",
  "dnt": false,
  "heuristicAction": "cookieblock",
  "nextUpdateTime": 1522414250983
} 
**** SNITCH_MAP for force 
force.com [
  "salesforce.com"
] 
salesforce.com [
  "force.com",
  "google.com",
  "einstein.com",
  "getconga.com"
] 
salesforceliveagent.com [
  "salesforce.com"
]

Looking at that list, salesforceliveagent.com and einstein.com belong to Salesforce, getconga.com does not.