Disable FLoC

shared/js/background/chrome-events.es6.js

@@ -175,6 +175,24 @@ function blockingExperimentActive () {
     // return false
 }
 
+// we determine if FLoC is enabled by testing for availability of its JS API
+const isFlocEnabled = ('interestCohort' in document)
+
+// Overwrite FLoC JS API
+if (isFlocEnabled) {
+    chrome.webNavigation.onCommitted.addListener(details => {
+        const tab = tabManager.get({ tabId: details.tabId })
+        if (tab && tab.site.whitelisted) return
+
+        chrome.tabs.executeScript(details.tabId, {
+            file: 'public/js/content-scripts/floc.js',
+            allFrames: true,
+            matchAboutBlank: true,
+            runAt: 'document_start'
+        })
+    })
+}
+
 // Shallow copy of request types
 // And add beacon type based on browser, so we can block it
 chrome.webRequest.onBeforeRequest.addListener(
@@ -201,26 +219,32 @@ chrome.webRequest.onHeadersReceived.addListener(
             return ATB.updateSetAtb(request)
         }
 
+        let responseHeaders = request.responseHeaders
+
+        if (isFlocEnabled && (request.type === 'main_frame' || request.type === 'sub_frame')) {
+            // there can be multiple permissions-policy headers, so we are good always appending one
+            responseHeaders.push({ name: 'permissions-policy', value: 'interest-cohort=()' })
+        }
+
         if (blockingExperimentActive()) {
-            let responseHeaders = request.responseHeaders
             // Strip 3rd party response header
             const tab = tabManager.get({ tabId: request.tabId })
-            if (!request.responseHeaders) return
-            if (tab && tab.site.whitelisted) return
+            if (!request.responseHeaders) return { responseHeaders: responseHeaders }
+            if (tab && tab.site.whitelisted) return { responseHeaders: responseHeaders }
             if (!tab) {
                 const initiator = request.initiator || request.documentUrl
                 if (utils.isFirstParty(initiator, request.url)) {
-                    return
+                    return { responseHeaders: responseHeaders }
                 }
             } else if (tab && utils.isFirstParty(request.url, tab.url)) {
-                return
+                return { responseHeaders: responseHeaders }
             }
             if (!cookieConfig.isExcluded(request.url) && trackerutils.isTracker(request.url)) {
                 responseHeaders = responseHeaders.filter(header => header.name.toLowerCase() !== 'set-cookie')
             }
-
-            return { responseHeaders: responseHeaders }
         }
+
+        return { responseHeaders: responseHeaders }
     },
     {
         urls: ['<all_urls>']

shared/js/content-scripts/floc.js

@@ -0,0 +1,18 @@
+(function disableFlocAPI () {
+    // don't inject into non-HTML documents (such as XML documents)
+    // but do inject into XHTML documents
+    if (document instanceof HTMLDocument === false && (
+        document instanceof XMLDocument === false ||
+        document.createElement('div') instanceof HTMLDivElement === false
+    )) {
+        return
+    }
+
+    if ('interestCohort' in Document.prototype) {
+        const scriptElement = document.createElement('script')
+        scriptElement.innerHTML = 'delete Document.prototype.interestCohort'
+        document.documentElement.prepend(scriptElement)
+        // remove element immediately so it is not visible to scripts on the page
+        document.documentElement.removeChild(scriptElement)
+    }
+})()