Add $cookie modifier support

[superlex]

Prerequisites

• I verified that this is not a filter list issue. Report any issues with filter lists or broken website functionality in the uAssets issue tracker.
• This is NOT an issue with YouTube, Facebook or Twitch.
• This is not a support issue or a question. For support, questions, or help, visit /r/uBlockOrigin.
• I performed a cursory search of the issue tracker to avoid opening a duplicate issue.
• The issue is not present after disabling uBO in the browser.
• I checked the documentation to understand that the issue I am reporting is not normal behavior.

I tried to reproduce the issue when...

• uBO is the only extension.
• uBO uses default lists and settings.
• using a new, unmodified browser profile.

Description

As of now uBO doesn't support $cookie modifier:
https://github.com/gorhill/uBlock/wiki/Static-filter-syntax#extended-syntax

It could be useful to prevent a cookie from being set:
AdguardTeam/AdguardFilters@236ee4d

According to AdGuard KB,

The $cookie modifier completely changes rule behavior. Instead of blocking a request, this modifier makes AdGuard suppress or modify the Cookie and Set-Cookie headers.

https://adguard.com/kb/it/general/ad-filtering/create-own-filters/#cookie-modifier

Original AG issue:
AdguardTeam/AdguardBrowserExtension#961

A specific URL where the issue occurs.

everywhere

Steps to Reproduce

Add to user filters list

example.org##+js(set-cookie, examplecookie , 1)
$cookie=examplecookie,domain=example.org

Expected behavior

examplecookie cookie isn't set.

Actual behavior

examplecookie cookie is set.

uBO version

1.53

Browser name and version

Firefox 119

Operating System and version

macOS 11

[gorhill]

I consider the best way to deal with such filter option is through the browser.cookies API, but adding such permissions would trigger a new extension permissions warning, leading to a lot of unhappy people. Implementing this through the webRequest API requires enabling a specific API capabilities, but it comes with a lot of warnings, including about performance concerns, see https://developer.chrome.com/docs/extensions/reference/webRequest/, search for opt_extraInfoSpec:

Specifying 'extraHeaders' in opt_extraInfoSpec may have a negative impact on performance, hence it should only be used when really necessary.

So I will keep the issue opened, but as of now it's unlikely I will go through with it.

Related issue: #2552

[iam-py-test]

I consider the best way to deal with such filter option is through the browser.cookies API, but adding such permissions would trigger a new extension permissions warning, leading to a lot of unhappy people.

What about an optional permission and a setting, ie

Thanks

[superlex]

Thanks anyway :)

[superlex]

@gorhill

Something like a scriptlet cookie-defuser / prevent-cookie ?

See mapx- workaround:
uBlockOrigin/uAssets@bc3b6b7

What about an optional permission and a setting, ie

The great majority of people would understand this as Allow uBlock Origin to block cookie notices/popups. The average user doesn't know what a cookie actually is.

[Procyon-b]

Here is a case where another method to access a cookie is useful.

https://www.reddit.com/r/uBlockOrigin/comments/1kfg38j/peculiar_annoyance/

On this site/page, clicking "Read full review" sometimes (1st click is ok, going back and clicking a second time usually triggers) redirects to a login page. After debugging ; out of all the session storage elements and all the cookies, only one cookie triggers the behaviour.
Blocking all cookies breaks the site.
Clearing site data, all the cookies, or only this cookie, solves the issue. Unfortunately the cookie is an "HTTP-only" cookie, which means that it is invisible to javascript.

Domain	        www.gartner.com
Name	        connect.sid
Value	        s%3AlzifINjID-vbCZjDqpy-2OXxnaE_1TJf.uOC8XD7wtTgueCZY4NKKrflY6K5WN9nkiX1OYloKu7Q
Host Only	true
Path	        /
Secure	        false
HTTP Only	true
Session     	false
Expiration Date	5/7/2025 3:58:20

[stephenhawk8054]

@gorhill I remember you mentioned about DNR's ModifyHeaderInfo here which could benefit both uBO and uBOL. Could this be supported, though I'm not sure if it could be used for $cookie concept or not?

[gorhill]

Is this about removing Cookie or Set-Cookie header? Currently there are no listener for request headers in uBO so to remove Cookie header would involve more than a few lines of codes, as opposed to Set-Cookie. Also, in Chromium modifying Set-Cookie header requires a special flag at listener registration time to allow modifying headers deemed sensitive, this could affect review -- though we are getting closer to the end of life for uBO in CWS.

[stephenhawk8054]

Is this about removing Cookie or Set-Cookie header?

Hmm... In the above case, it's Cookie.