data-saferedirecturl defeats URL stripping

I see that Gmail are doing something really evil with hyperlinks within emails:

<a href="https://link.to.other.site" target="_blank" data-saferedirecturl="https://www.google.com/url?q=link.to.other.site&amp;source=gmail&amp;ust=1534942837200000&amp;usg=AFQjCNH3Pzb1Mq6zL847zzh6iqd4g1B3IA">here</a>

This is also described here:

• Rob–W/dont-track-me-google#2
• security - Why do links in gmail redirect? - Stack Overflow

I really don’t want google tracking which links I click on. I’m sure Google would claim that they’re doing the user a favour by hiding referrer data from the target web server, but only because they’re stealing that data for themselves!

So I think it would be great if this project stripped these data-saferedirecturl links.

[aspiers]

Also worth noting that this creates the exact opposite effect of the problem described in #68: the stripped URL is shown on mouse-over, but the hijacked URL is actually used on click.

[newhouse]

TLDR: It does skip Google and does not pass through its servers. Please let me know if you can show otherwise and how to reproduce it, and I will certainly investigate @YesThatAllen. This will be the last time I comment on this thread. If there still turns out to be some issue, please open another ticket as this one has gotten quite useless.

Details: Let me see if I can put this to bed once and for all:

• As mentioned several times now, I will not go into your webpages and manipulate links as this is very invasive. Because of this, the data-saferedirecturls all exist in Gmail and wherever you encounter them - I do not change them on the webpages and if you look at the HTML they will still be there. This extension is not intended to change the URLs on the page for you, so this is expected behavior. But it also doesn’t mean that it’s not going to skip those redirects for you…
• When you click on one of them with this extension installed, the extension will BLOCK that request and redirect you to the target page, skipping Google’s servers and having no cookies dropped or tracking occur. You may see the URL flash in your browser bar or network history, but it will have been stopped from loading via a 307 Internal Redirect.
• The following videos illustrate this behavior by navigating to a link pulled from a data-saferedirecturl first with the extension enabled, and second without it enabled:
  • With extension enabled
  • Without extension enabled

Here’s an image as well.