Filter out Marketo's email tracker from URLs

The Marketo mkt_tok query string parameter is for tracking users and can be disabled by campaign admins though apparently it’s also used in unsubscribe links.

Here is a longer description of how this parameter is used and what the security implications are: https://medium.com/@thezedwards/facebook-s-ongoing-vip-user-data-exfiltration-vulnerability-via-adobes-marketo-software-why-d8435a259b0

Need to find a real example and test the unsubscribe link before we can strip out in our query string filter.

[LaurenWags]

@arthuredelstein this issue is missing some key labels, can we get this reviewed please?

If manual QA is required let’s get QA/Yes and a test plan added. If not, QA/No can be added.

Does this apply to Desktop, Android, or both? Please add the appropriate OS/Desktop and/or OS/Android labels.

Does this need to be included in the release notes or no? Please add the appropriate release-notes/exclude or release-notes/include label.

cc @fmarier @pes10k in case either of you have insight as well.

cc @brave/qa-team @rebron

[arthuredelstein]

After a series of online searches, I am convinced that all (or nearly all) of unsubscribe links for Marketo emails contain the parameter mkt_unsubscribe=1 in the query string. So my approach to fixing this bug is to filter out the mkt_tok query parameter EXCEPT where mkt_unsubscribe=1 is also present in the query string.