Fallback behavior for referrer truncation results in an invalid value

The fallback behavior for referrer truncation in the fingerprint-protection.js content script looks as follows:

https://github.com/duckduckgo/duckduckgo-privacy-extension/blob/e15a3fba9fc46bca8f38114c574207e68b0446d6/shared/data/fingerprint-protection.js#L111-L114

This sets the referrer to hostname only which isn’t a valid URL. I guess that the idea here was to use new URL(document.referrer).origin instead which makes more sense.

[Charlie-belmer]

Thanks for mentioning this @kberridge. It’s a slightly different issue, but I’ll take a look!

[weaversam8]

What would be the expected flow to override this in this example? If an embedded domain is whitelisted to only be embedded on a subdomain, it won’t load in this case. For context, Cloudflare Stream is the service that broke in this example, with their allowed origin domains security feature blocking access since the subdomain was permitted but only the root domain was passed in the referrer.

Can’t this protection be routed around by malicious actors by constructing an iframe using Javascript that embeds the true origin as a query string parameter?