Blocked requests inside nested "about:blank" iFrames are not counted properly

[alisha]

We found a minor bug in the DuckDuckGo macOS browser (version 1.102.0) where some requests are blocked, but are not counted in DuckDuckGo's count of how many trackers have been blocked. This occurs when requests are made inside nested "about:blank" iFrames.

Reproducing

1. Visit a website; we test on rocketnews24.com
2. Open a new tab, and observe how many things are blocked (see screenshot below)

3. Create a pair of nested frames with source "about:blank." We do this by entering the following code in the JavaScript console.

const [pframe, cframe] = (_ => {const parentFrame = document.createElement('iframe');const childFrame = document.createElement('iframe');parentFrame.name = "/parent-frame";parentFrame.id = "parent-frame";childFrame.name = "/child-frame";childFrame.id = "child-frame";document.body.appendChild(parentFrame);parentFrame.contentDocument.body.appendChild(childFrame);return  [parentFrame, childFrame];})()

4. Add a script that DDG will block to the parent frame. We do this by entering the following code in the JavaScript console.

((aSrc, frameElm) => {const scriptElm = document.createElement('script'); scriptElm.src = aSrc; frameElm.contentDocument.body.appendChild(scriptElm);})('https://rtb.openx.net/openrtbb/prebidjs', pframe);

5. Open a new tab, and observe how many things are blocked (see screenshot below). We find that the count increases by one, which is the expected behavior.

6. Add the same script to the child frame. We do this by entering the following code in the JavaScript console.

((aSrc, frameElm) => {const scriptElm = document.createElement('script'); scriptElm.src = aSrc; frameElm.contentDocument.body.appendChild(scriptElm);})('https://rtb.openx.net/openrtbb/prebidjs', cframe);

7. Open a new tab, and observe how many things are blocked (see screenshot below). The count has not increased, but we expect the count to increase.

Impact

Users will not understand the privacy-harming behaviors of the websites they visit, or the privacy benefits they receive through using DuckDuckGo.

Fix

We will submit a PR shortly that fixes this issue by modifying Sources/BrowserServicesKit/ContentBlocking/UserScripts/contentblockerrules.js

[jonathanKingston]

These code snippets were really great in illustrating the problem, thank you for that!