Hide navigator.webdriver via [Pref] gate in WebIDL #605
Open
barbatus wants to merge 1 commit intodaijro:mainfrom
Open
Hide navigator.webdriver via [Pref] gate in WebIDL #605barbatus wants to merge 1 commit intodaijro:mainfrom
barbatus wants to merge 1 commit intodaijro:mainfrom
Conversation
Currently 1-leak-fixes.patch makes Navigator::Webdriver() return false at the C++ level, but the WebIDL attribute itself is still exposed — ``'webdriver' in navigator`` evaluates to ``true``. Anti-bot platforms (FingerprintJS, datadome, etc.) check the *presence* of the attribute, not just its value, so a false-but-present ``navigator.webdriver`` is itself a bot signal that vanilla Firefox doesn't have. Add two hunks: 1. ``modules/libpref/init/StaticPrefList.yaml`` — declare the static pref ``dom.webdriver.enabled`` (default false). Required for WebIDL ``[Pref="x.y.z"]`` to compile (resolves to ``mozilla::StaticPrefs::x_y_z``). 2. ``dom/webidl/Navigator.webidl`` — add ``Pref="dom.webdriver.enabled"`` to the existing ``[Constant, Cached]`` extended-attribute bracket on the ``webdriver`` attribute. When the pref is false, the attribute is hidden entirely; ``'webdriver' in navigator`` returns false, matching vanilla Firefox. The existing C++ revert (``Navigator::Webdriver() => false``) stays as defense-in-depth in case anyone flips the pref at runtime.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
patches/playwright/1-leak-fixes.patchalready dropsNavigator::Webdriver()toreturn falseat the C++ level — but thewebdriverattribute onNavigatoris still exposed by WebIDL. Anti-bot platforms like FingerprintJS, DataDome and PerimeterX check the presence ofnavigator.webdriverDescription
Two new hunks added to
1-leak-fixes.patch:modules/libpref/init/StaticPrefList.yaml— declare a new static prefdom.webdriver.enabled(defaultfalse). Required because WebIDL[Pref="x.y.z"]resolves at build time tomozilla::StaticPrefs::x_y_z;dom/webidl/Navigator.webidl— addPref="dom.webdriver.enabled"to the existing[Constant, Cached]extended-attribute bracket on thewebdriverattribute. When the pref isfalse, the WebIDL binding code generator omits the attribute from the prototype entirely;'webdriver' in navigatorreturnsfalse, matching vanilla Firefox.Testing
Quick local repro:
Fingerprint Report
This PR specifically targets a fingerprint surface (
navigator.webdriverexposure). Build-tester run pending — happy to attach if a maintainer requests it. Expected delta on the score: positive (one fewer detectable signal).Fingerprint report
(to be attached after build-tester run; happy to coordinate)
Checklist
Service tests pass— temporarily out of service per template