Skip to content

Fix DOM storage cleaning in Chromium/Firefox (fixes #2049)#2068

Open
chidoziemanagwu wants to merge 1 commit intobleachbit:masterfrom
chidoziemanagwu:fix-issue-2049-chrome-dom-storage
Open

Fix DOM storage cleaning in Chromium/Firefox (fixes #2049)#2068
chidoziemanagwu wants to merge 1 commit intobleachbit:masterfrom
chidoziemanagwu:fix-issue-2049-chrome-dom-storage

Conversation

@chidoziemanagwu
Copy link
Contributor

@chidoziemanagwu chidoziemanagwu commented Mar 21, 2026

Fix Issue #2049: Persistent HTML5 cookies not cleared

Context

This Pull Request resolves Issue #2049 where persistent HTML5 cookies and offline storage (such as IndexedDB and Service Workers) survive cleaning when the "DOM storage" option is checked in Chromium-based browsers.

Modern browsers have heavily migrated to new subdirectories for partitioned DOM storage which were completely ignored by the existing "DOM Storage" configurations in BleachBit's cleaners. Furthermore, Chrome's QuotaManager was not being purged, causing the browser UI to constantly display "ghost" tracking data in chrome://settings/content/all even when the underlying cache data was wiped.

The Approach

I thoroughly patched the dom storage definition in all Chromium-based cleaner files (as well as the equivalent storage/default/ structure in firefox.xml) to comprehensively eradicate modern persistent site data.

1. Added Modern DOM Storage Paths
I injected IndexedDB, Service Worker, and Session Storage paths to the <option id="dom"> blocks for google_chrome.xml, chromium.xml, brave.xml, microsoft_edge.xml, and opera.xml.
Example implementation added to cleaners:

    <action command="delete" search="walk.all" path="$$profile$$/IndexedDB/"/>
    <action command="delete" search="walk.all" path="$$profile$$/Service Worker/"/>
    <action command="delete" search="walk.files" path="$$profile$$/Session Storage/"/>

2. Purged QuotaManager Registration
To prevent the "ghost cookie" issue, I added QuotaManager and the modern WebStorage/QuotaManager paths to the dom options for all Chromium cleaners so the internal registry is safely wiped alongside the data. (Also added WebStorage/QuotaManager explicitly to Google Chrome's history option to maintain parity).
Example implementation:

    <action command="delete" search="file" path="$$profile$$/QuotaManager"/>
    <action command="delete" search="file" path="$$profile$$/QuotaManager-journal"/>
    <action command="delete" search="file" path="$$profile$$/WebStorage/QuotaManager"/>
    <action command="delete" search="file" path="$$profile$$/WebStorage/QuotaManager-journal"/>

3. Firefox Parity
Added the modern storage/default/http* architecture to firefox.xml's dom option so Firefox users can also effectively delete DOM storage without needing to fully wipe standard "Cookies".

    <action command="delete" search="walk.all" path="$$profile$$/storage/default/http*"/>
    <action command="delete" search="glob" path="$$profile$$/storage/default/http*"/>

Testing & Verification

All changes were thoroughly verified via BleachBit's regression test suite and CLI preview utilities:

# 1. Strict XML schema syntax validation passed gracefully
python -m pytest tests/TestCleanerML.py -v

# 2. Simulated targeted wiping locally (verified accurate LevelDB targeting)
python bleachbit.py --preset --preview google_chrome.dom
python bleachbit.py --preset --preview firefox.dom

Additionally, a manual Ghost Cookie reproduction was simulated: Toggling DOM Storage and previewing operations now permanently drops the QuotaManager database, ensuring that navigating to chrome://settings/content/all successfully reflects the erased site origins.

Impact

This brings BleachBit's "DOM Storage" capabilities up to parity with the modern HTML5 persistence architecture utilized by Chrome and Firefox. By expanding these capabilities across Chromium derivatives (Brave, Edge, Opera), users are guaranteed that malicious offline-workers, IndexedDB super-cookies, and tracking registries are completely obliterated when utilizing the DOM Storage cleaner toggle.

@chidoziemanagwu
Copy link
Contributor Author

Hi @azieman,

I am following up on this pull request. Please let me know if you have any feedback or if further changes are required for it to be merged.

Best regards,

@az0
Copy link
Member

az0 commented Mar 25, 2026

At high level, there are many good things here. I will take a close look as get back to you if any changes are needed.

It so happens I was editing some of the same code for different reasons. I haven't published them yet, and I'll plan to merge this first.

@az0 az0 added this to the 6.0.0 milestone Mar 25, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Some persistent HTML5 cookies are not cleared even when DOM storage option is toggled on.

2 participants