Francois Marier

Parsing of Onion-Location header is different from Tor Browser

2

### Description The [specification for the `Onion-Location` header](https://gitlab.torproject.org/tpo/applications/tor-browser-spec/-/blob/HEAD/proposals/100-onion-location-header.txt) is unclear about two points: - How to handle multiple copies of the `Onion-Location` header. - Whether the header or the ``...

I noticed a `_bhlid` parameter in the following link: https://techcrunch.com/2024/08/26/anthropic-publishes-the-system-prompt-that-makes-claude-tick/?_bhlid=0b2d1e067fdf041e2c1a357f8466ab8c3df13f76 and then from PublicWWW I found [another example](https://www.fortwhyte.org/events/month/?_bhlid=0e32c9e4e9dee4e476d613ed473c7ef67fd2dd03&pagename=visit%2Fcalendar&shortcode=550bcfbb&utm_campaign=hollywood-star-visits-winnipeg-goldeyes-game&utm_medium=newsletter&utm_source=winnipeg-digest.beehiiv.com) that pointed me in the direction of [beehiiv.com](https://www.beehiiv.com/). Given that they advertise...

### Description Change the order of the first two entries in the share menu on desktop. ### Steps to reproduce 1. Click on share button in the URL bar. ###...

Official Ubuntu 22.04 LTS desktop images don't have the `iw` package installed by default. Maybe the shell script should check for that first and/or install the package?

Sample URLs: - https://platform.billtobox.be/login2/users/registration?utm_internal=commercialsite&_ga=2.203742230.707792121.1633425719-1654755149.1633425719 - https://www.plex.tv/blog/plex-pro-week-24-does-your-server-suck-energy/?utm_internal=pro_week_tim_blog_24 Not a very common one, but it's also in https://github.com/jparise/chrome-utm-stripper/issues/65

Google CAPTCHA in searching from url bar without any preexisting cookies

3

Steps to reproduce: 1. Create a new profile. 2. Set default search engine to Google. 3. Type "new york" in URL bar Expected: search result page Actual: CAPTCHA Note that...

As a follow-up to #49, it looks like there are still files which are reported as missing: * Humble Bundle for Android: ``` Failed to download this 'file': {'asm_config': {'display_item':...

Here are examples: - https://click.convertkit-mail4.com/5qu6dog4e5c7hnn3g39c6h95x8444an/6qhehoulvp4vreuo/aHR0cHM6Ly9sYXJhdmVsLmNvbS9kb2NzLzEyLngvcmVsZWFzZXM= -> `https://laravel.com/docs/12.x/releases` - https://click.convertkit-mail2.com/27up752qpqboh8e7dokf8ug63w344hg/n2hohvhvg2olx9a6/aHR0cHM6Ly9kYWlseWRhZC5jb20vd2hlcmUtYXJlLXlvdS1ydXNoaW5nLXRvLw==` -> `https://dailydad.com/where-are-you-rushing-to/` The destination URL is contained in the last part of the URL path in base64. Our path regular expression...

Treat .onion as a secure context for insecure form warnings and autofill

5

Resolves brave/brave-browser#44802 Security review: https://github.com/brave/reviews/issues/1893 ## Submitter Checklist: - [x] I confirm that no [security/privacy review is needed](https://github.com/brave/brave-browser/wiki/Security-reviews) and no other type of reviews are needed, or that I have...