search

disconnectme / disconnect

Disconnect is a browser extension that makes the web faster, more private, and more secure.
https://disconnect.me/
GNU General Public License v3.0
777 stars 137 forks source link

"Visualize page" makes many unencrypted requests to wrong sites #392

Open 123quhiwiwk opened 6 months ago

123quhiwiwk commented 6 months ago

When using the visualize page feature the addon tries to download the favicons of the sites. But requests are sent to non-existent/other sites. And it tries to load the icon unencrypted via HTTP. For example to http://www.com/favicon.ico and https://com/favicon.ico, see the following image: Requests to www.com and com using HTTP

The problem seems to be this line, as it does not work as expected when the site uses no subdomain or with TLDs like ".co.uk". https://github.com/disconnectme/disconnect/blob/0482e3acef3ed67866406ac3fb6eeb60a313937a/firefox/content/disconnect.safariextension/opera/chrome/scripts/vendor/favicon/favicon.js#L56

The cause for HTTP loading and both requests to www.com and com are these lines: https://github.com/disconnectme/disconnect/blob/0482e3acef3ed67866406ac3fb6eeb60a313937a/firefox/content/disconnect.safariextension/opera/chrome/scripts/vendor/favicon/favicon.js#L84-L85