From 1e3c1342e301c05c6ba2ff3d84324876a13559ef Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C3=89mile=20R=C3=A9?= Date: Wed, 10 Jun 2026 15:59:38 +0200 Subject: [PATCH] Clear stale cookie-banner SDK initiator URLs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A pre-fix bug in the cookie-banner SDK walked its own bundle frame when computing a tracker's initiator, so cookies and storage written by third parties, malware, or browser extensions were attributed to cookie-banner.iife.js. The report upsert keeps the existing value on re-detection (initiator_url = COALESCE(new, old)), so rows whose corrected initiator is NULL would keep the stale bundle URL forever. Null initiator_url and initiator_domain on detected_trackers rows that point at the @probo/cookie-banner bundle. Genuine third-party rows repopulate the correct initiator on the next detection. Signed-off-by: Émile Ré --- pkg/coredata/migrations/20260610T135811Z.sql | 30 ++++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 pkg/coredata/migrations/20260610T135811Z.sql diff --git a/pkg/coredata/migrations/20260610T135811Z.sql b/pkg/coredata/migrations/20260610T135811Z.sql new file mode 100644 index 000000000..71e6f0eb3 --- /dev/null +++ b/pkg/coredata/migrations/20260610T135811Z.sql @@ -0,0 +1,30 @@ +-- Copyright (c) 2026 Probo Inc . +-- +-- Permission to use, copy, modify, and/or distribute this software for any +-- purpose with or without fee is hereby granted, provided that the above +-- copyright notice and this permission notice appear in all copies. +-- +-- THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH +-- REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY +-- AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, +-- INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM +-- LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR +-- OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR +-- PERFORMANCE OF THIS SOFTWARE. + +-- Clear stale tracker initiator attribution that wrongly pointed at the +-- @probo/cookie-banner SDK bundle. A pre-fix SDK bug walked its own bundle +-- frame when computing the initiator, so cookies/storage written by third +-- parties (or by malware / browser extensions) were attributed to +-- cookie-banner.iife.js. The SDK now excludes its own bundle, but the report +-- upsert keeps the existing value on re-detection +-- (initiator_url = COALESCE(new, old)), so rows whose corrected initiator is +-- NULL would otherwise keep the stale value forever. NULL them here; genuine +-- third-party rows repopulate with the correct initiator on next detection. +UPDATE detected_trackers +SET initiator_url = NULL, + initiator_domain = NULL, + updated_at = now() +WHERE initiator_url LIKE '%@probo/cookie-banner%' + OR initiator_url LIKE '%cookie-banner.iife.js' + OR initiator_url LIKE '%cookie-banner.mjs';