Opened 6 months ago

Closed 6 months ago

#24866 closed defect (duplicate)

Tor Browser remembering history for certain URLs even after restart

Reported by: dcf Owned by: tbb-team
Priority: Medium Milestone:
Component: Applications/Tor Browser Version:
Severity: Normal Keywords: tbb-disk-leak
Cc: Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

My Tor Browser has two entries in the moz_historyvisits table in places.sqlite. The two URLs can come up during URL bar autocompletion, and also appear in the ctrl+H history window.

I noticed it just now when I saw URL bar autocompletions for URLs that were not bookmarks and were not open tabs. Here is a screenshot. The first three matches are bookmarks, as you can tell by the star icon. The accounts.google.com one is not a bookmark, but is for some reason being remembered across restarts.


The two URLs that are being remembered are:

  • https://accounts.google.com/ServiceLogin?continue=https://www.blogger.com/comment-iframe.g?blogID%3D2266550428847361277%26postID%3D6186454555221678264%26blogspotRpcToken%3D3273703%26bpli%3D1&followup=https://www.blogger.com/comment-iframe.g?blogID%3D2266550428847361277%26postID%3D6186454555221678264%26blogspotRpcToken%3D3273703%26bpli%3D1&passive=true&go=true#%7B%22color%22%3A%22rgb(110%2C%20110%2C%20110)%22%2C%22backgroundColor%22%3A%22rgb(204%2C%20204%2C%20204)%22%2C%22unvisitedLinkColor%22%3A%22rgb(0%2C%200%2C%200)%22%2C%22fontFamily%22%3A%22Verdana%2CGeneva%2Csans-serif%22%7D
  • https://id.rlcdn.com/463496.gif?credir=https%3A%2F%2Fsimage4.pubmatic.com%2FAdServer%2FSPug%3Fo%3D3%26u%3D1292AC75-4860-4D0E-8AC2-F720B90009E0%26vcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMzkmdGw9MTI5NjAw%26piggybackCookie%3D&redirect=1

The first one kind of makes sense. If I click on it, it takes me to a comment field for the blog of BreakWa11, a circumvention developer whose blog I have visited in the past few months. It's not a top-level page though; seems like it belongs in an iframe. The other one looks like an advertising tracking pixel (hope it's nothing personal lol).

I found where the URLs are being stored: they are in the places.sqlite database, in the moz_places table:

$ sqlite3 tor-browser_en-US/Browser/TorBrowser/Data/Browser/profile.default/places.sqlite
SQLite version 3.21.0 2017-10-24 18:55:49
Enter ".help" for usage hints.
sqlite> select * from moz_places;
[elided other entries which are my bookmarks]
68|https://accounts.google.com/ServiceLogin?continue=https://www.blogger.com/comment-iframe.g?blogID%3D2266550428847361277%26postID%3D6186454555221678264%26blogspotRpcToken%3D3273703%26bpli%3D1&followup=https://www.blogger.com/comment-iframe.g?blogID%3D2266550428847361277%26postID%3D6186454555221678264%26blogspotRpcToken%3D3273703%26bpli%3D1&passive=true&go=true#%7B%22color%22%3A%22rgb(110%2C%20110%2C%20110)%22%2C%22backgroundColor%22%3A%22rgb(204%2C%20204%2C%20204)%22%2C%22unvisitedLinkColor%22%3A%22rgb(0%2C%200%2C%200)%22%2C%22fontFamily%22%3A%22Verdana%2CGeneva%2Csans-serif%22%7D||moc.elgoog.stnuocca.|1|1|0||-1|1510963636686206|jljYEjVwHSTz|0|47357881751906
[elided]
71|https://id.rlcdn.com/463496.gif?credir=https%3A%2F%2Fsimage4.pubmatic.com%2FAdServer%2FSPug%3Fo%3D3%26u%3D1292AC75-4860-4D0E-8AC2-F720B90009E0%26vcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMzkmdGw9MTI5NjAw%26piggybackCookie%3D&redirect=1||moc.ndclr.di.|1|1|0||-1|1513646987292092|AG--rmyoEVB2|0|47360465205581
[elided]

These two entries with id=68 and id=71 are referenced in the moz_historyvisits table. Here is the whole table:

sqlite> select * from moz_historyvisits;
1|0|68|1510963636686206|6|0
2|0|71|1513646987292092|6|0

The fourth column looks like a microsecond timestamp, and the one for BreakWa11's blog matches the time frame during which I would have visited the site.

$ date -u -d @1510963636.686206
Sat Nov 18 00:07:16 UTC 2017
$ date -u -d @1513646987.292092
Tue Dec 19 01:29:47 UTC 2017

The moz_historyvisits table seems to underlie the ctrl+H history window. When I open it, there are two entries corresponding to the months of the timestamps. However it doesn't list any URLs: if I click the expander arrows, the arrows just disappear without expanding anything. But if I search for a string like "http", I can make the URLs appear.


Ticket #23704 is potentially related; it's about the browser remembering tabs after upgrading. comment:3:ticket:23704 says "TBB 7.0.5/6 has places.history.enabled set to true by default. And now TBB 7.5a5 has it set to false as a non-default value for unknown reason!" For what it's worth, my about:config looks like this:

Preference Name Status Type Value
places.history.enabled default boolean true
places.history.expiration.transient_current_max_pages user set integer 122334

On another computer of mine, the moz_historyvisits table is empty and moz_places contains only bookmarks.

This is with Tor Browser 7.0.11 64-bit.

Child Tickets

Attachments (3)

blog-autocomplete.png (34.0 KB) - added by dcf 6 months ago.
history-default.png (5.6 KB) - added by dcf 6 months ago.
history-search.png (7.5 KB) - added by dcf 6 months ago.

Download all attachments as: .zip

Change History (6)

Changed 6 months ago by dcf

Attachment: blog-autocomplete.png added

Changed 6 months ago by dcf

Attachment: history-default.png added

Changed 6 months ago by dcf

Attachment: history-search.png added

comment:1 Changed 6 months ago by gk

Keywords: tbb-disk-leak added

comment:2 Changed 6 months ago by cypherpunks

Seems like a duplicate to me: #22867

Anyway, I have been for the past 4 months reporting URLs that get saved in my history https://trac.torproject.org/projects/tor/ticket/22867#comment:2 (comment 2-3-5-8) if you find that useful to reproduce this issue (mostly happens with a clean TB install (I only use alpha) and usually in websites that try to launch popups when you click on a link, and sometimes on very "innocent" websites like blogspot (comment3), washingtonpost (comment5), but it's really difficult to reproduce)

comment:3 in reply to:  2 Changed 6 months ago by dcf

Resolution: duplicate
Status: newclosed

Replying to cypherpunks:

Seems like a duplicate to me: #22867

You're right. I searched for duplicates but didn't find it.

Note: See TracTickets for help on using tickets.