google / detangle

Apache License 2.0
171 stars 16 forks source link

Blacklist checks are only done if targetProfile == thisProfile #5

Closed therealmik closed 6 years ago

therealmik commented 6 years ago

The blacklist checks are only done if the browser decides it's responsible for handling the request. The result is that globally blacklisted sites get handed off then blocked in the target browser.

The fix might be to either: 1) Split the global blacklist check and per-profile blacklist check 2) Perform both checks before checking whether the request is handled by thisProfile

I think 2 is better, but changes semantics a bit.

therealmik commented 6 years ago

Settling on performing both checks before deciding whether to handoff.

Old semantics: If the URL was handled by thisProfile, check against the blacklists. Otherwise hand off. New semantics: If the URL is either in the global blacklist, or the blacklist for thisProfile, it is always blocked by the current profile.

Change only applies to main_frame requests (sub_frame requests never hand off, so always applied blacklist)

therealmik commented 6 years ago

Change committed in 44d1d6c42f31026374ee2e478710a31d7be41c97