Force the referrer to always be 'no-referrer' while in speedreader mo…

…de. (uplift to 1.62.x) (#21497) Uplift of #21481 (squashed) to beta
brave · Jan 7, 2024 · 9e6c425 · 9e6c425
1 parent 1b43e56
commit 9e6c425
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 0 deletions.
diff --git a/browser/speedreader/speedreader_browsertest.cc b/browser/speedreader/speedreader_browsertest.cc
@@ -317,6 +317,9 @@ IN_PROC_BROWSER_TEST_F(SpeedReaderBrowserTest, SmokeTest) {
   const std::string kGetFontsExists =
       "!!(document.getElementById('atkinson_hyperligible_font') && "
       "document.getElementById('open_dyslexic_font'))";
+  const std::string kCheckReferrer =
+      R"js(document.querySelector('meta[name="referrer"]')
+             .getAttribute('content') === 'no-referrer')js";
 
   // Check that the document became much smaller and that non-empty speedreader
   // style is injected.
@@ -328,6 +331,11 @@ IN_PROC_BROWSER_TEST_F(SpeedReaderBrowserTest, SmokeTest) {
                               content::EXECUTE_SCRIPT_DEFAULT_OPTIONS,
                               ISOLATED_WORLD_ID_BRAVE_INTERNAL)
                   .ExtractBool());
+  EXPECT_TRUE(content::EvalJs(ActiveWebContents(), kCheckReferrer,
+                              content::EXECUTE_SCRIPT_DEFAULT_OPTIONS,
+                              ISOLATED_WORLD_ID_BRAVE_INTERNAL)
+                  .ExtractBool());
+
   const auto speedreaded_length =
       content::EvalJs(ActiveWebContents(), kGetContentLength,
                       content::EXECUTE_SCRIPT_DEFAULT_OPTIONS,

diff --git a/components/speedreader/speedreader_rewriter_service.cc b/components/speedreader/speedreader_rewriter_service.cc
@@ -44,6 +44,7 @@ std::string WrapStylesheetWithCSP(const std::string& stylesheet,
   };
 
   constexpr const char kCSP[] = R"html(
+    <meta name="referrer" content="no-referrer">
     <meta http-equiv="Content-Security-Policy"
       content="script-src 'none';
                style-src-elem 'sha256-%s' 'sha256-%s' 'sha256-%s'"