Repository: freedomofpress/securedrop

Issue:
Include external links again, but hide the referer
We removed external links in #206 because Tor Hidden Services leak referers (https://trac.torproject.org/projects/tor/ticket/9623). Obviously this isn't ideal because of the usability tradeoff.

One way to get around this without using Javascript is to replace all external links with a link to a blank SecureDrop page that does a meta refresh to the external link, since meta refreshes always clear referer. Here's a demo on the lame Halloween-themed SecureDrop page that I made a while ago: http://zyan.scripts.mit.edu/securedrop/

External links on SecureDrop static sites leak Referrer
The SecureDrop static pages contain links pointing to external HTTP websites. This can be considered an information leak as this might help de-anonymizing a user via the HTTP referrer and the DOM property `document.referer`.

Examples:
- http://[redacted].onion/tor2web-warning
- http://[redacted].onion/howto-disable-js

Clicking this link will open the tor2web website in the very same window. This will leak the referrer to this website and allow those parties having control over the log files and website markup to know, that the user visited the TOR hidden service right before visiting their website. Another link is pointing to the website of the TOP project - again as plain HTTP URL.

Using HTML links or any other external resources or pointers in the markup of the SecureDrop application should be avoided at any cost. Users should be encouraged to simply copy and paste a HTTP URL shown in plaintext. It could also be considered to use Data URI s to create a referrer-less link to avoid the data leakage to the outside world.

Note that the HTML specification also mentions the “noreferrer” attribute for links. This might be used as well to attempt provision of non-leaky links - yet not all modern browsers support this attribute fully yet. It is thus not recommended to fully rely on this attribute to work as expected.

**Reported as part of the cure53 audit of 0.2 as: SD-01-008**



Discussion:

The rel="noreferrer" attribute is not yet respected as of FF 25, which means that even the new TBB will not respect this, when released (it will be based on FF 24 ESR).  Removing the external links completely (https://github.com/pemulis/securedrop/commit/44a04a22a32cd5df84476dd6afdc7aa74464f730) seems like the way to go here.

Closed by @pemulis https://github.com/freedomofpress/securedrop/commit/896401b110b45352514557fbc3c2d6da7ab3cb54

This fix looks good. Re-opening so I can merge into master as well.


Resolving patch:
diff --git a/securedrop/source.py b/securedrop/source.py
--- a/securedrop/source.py
+++ b/securedrop/source.py
@@ -242,6 +242,26 @@ def why_download_journalist_pubkey():
     return render_template("why-journalist-key.html")
 
 
+_REDIRECT_URL_WHITELIST = ["http://tor2web.org/",
+        "https://www.torproject.org/download.html.en",
+        "https://tails.boum.org/",
+        "http://www.wired.com/threatlevel/2013/09/freedom-hosting-fbi/",
+        "http://www.theguardian.com/world/interactive/2013/oct/04/egotistical-giraffe-nsa-tor-document",
+        "https://addons.mozilla.org/en-US/firefox/addon/noscript/",
+        "http://noscript.net"]
+
+
+@app.route('/redirect/<path:redirect_url>')
+def redirect_hack(redirect_url):
+    # A hack to avoid referer leakage when a user clicks on an external link.
+    # TODO: Most likely will want to share this between source.py and
+    # journalist.py in the future.
+    if redirect_url not in _REDIRECT_URL_WHITELIST:
+        return 'Redirect not allowed'
+    else:
+        return render_template("redirect.html", redirect_url=redirect_url)
+
+
 @app.errorhandler(404)
 def page_not_found(error):
     return render_template('notfound.html'), 404


Test patch: