Protect from Link Tracking on Tumblr

src/js/firstparties/tumblr.js

@@ -0,0 +1,36 @@
+// only observed links with this format out in the wild
+let tumblr_links = "a[href^='https://t.umblr.com/redirect?']";
+
+// reassigns the href and scrubs link of all unnecessary attributes
+function unwrapLink(a) {
+  let href = new URL(a.href).searchParams.get('z');
+  if (!window.isURL(href)) {
+    return;
+  }
+
+  for (let attr of a.attributes) {
+    if (!['target', 'class', 'style'].includes(attr.name)) {
+      a.removeAttribute(attr.name);
+    }
+  }
+
+  a.rel = "noreferrer";
+  a.href = href;
+}
+
+// main handler to target each link on page and launder them through the unwrapLink func
+function unwrapAll() {
+  document.querySelectorAll(tumblr_links).forEach((a) => {
+    unwrapLink(a);
+  });
+}
+
+chrome.runtime.sendMessage({
+  type: "checkEnabled"
+}, function (enabled) {
+  if (!enabled) {
+    return;
+  }
+  unwrapAll();
+  setInterval(unwrapAll, 2000);
+});

src/manifest.json

@@ -461,6 +461,20 @@
       "all_frames": true,
       "run_at": "document_idle"
     },
+    {
+      "js": [
+        "js/firstparties/lib/utils.js",
+        "js/firstparties/tumblr.js"
+      ],
+      "matches": [
+        "https://tumblr.com/*",
+        "http://tumblr.com/*",
+        "https://*.tumblr.com/*",
+        "http://*.tumblr.com/*"
+      ],
+      "all_frames": true,
+      "run_at": "document_idle"
+    },
     {
       "js": [
         "js/contentscripts/utils.js",

src/tests/tests/firstparties.js

@@ -5,6 +5,7 @@ let fb_wrap = 'https://facebook.com/l.php?u=' + destination;
 let fb_xss = 'https://facebook.com/l.php?u=javascript://bad.site/%250Aalert(1)';
 let g_wrap = 'https://www.google.com/url?q=' + destination;
 let g_ping = '/url?url=' + destination;
+let tumblr_wrap = 'https://t.umblr.com/redirect?z=' + destination;
 
 function makeLink(href) {
   let element = document.createElement('a');
@@ -164,4 +165,38 @@ QUnit.test('google search de-instrumentation', (assert) => {
   fixture.appendChild(util_script);
 });
 
+QUnit.test('tumblr link unwrapping', (assert) => {
+  const NUM_CHECKS = 2,
+    done = assert.async();
+  assert.expect(NUM_CHECKS);
+
+  let fixture = document.getElementById('qunit-fixture');
+  let tumblr_link = makeLink(tumblr_wrap);
+
+  // create first-party utility script
+  let util_script = document.createElement('script');
+  util_script.src = '../js/firstparties/lib/utils.js';
+
+  // create the content script
+  let tumblr_script = document.createElement('script');
+  tumblr_script.src = '../js/firstparties/tumblr.js';
+  tumblr_script.onload = function() {
+    assert.equal(tumblr_link.href, destination, 'unwrapped tumblr link');
+    assert.ok(tumblr_link.rel.includes('noreferrer'),
+      'added noreferrer to tumblr link');
+
+    unstub();
+    done();
+  };
+
+  // after the utility script has finished loading, add the content script
+  util_script.onload = function() {
+    fixture.append(tumblr_script);
+  };
+
+  stub([tumblr_link], '/url?');
+  fixture.appendChild(tumblr_link);
+  fixture.appendChild(util_script);
+});
+
 }());