DNR priority not respected between session and static rules

[lenacohen]

DNR redirect session rules with a lower priority are applied before / instead of static redirect rules with a higher priority. The only way to get the static rule to apply is to remove the session rule, even though the static rule has a higher priority number.

I encountered this bug after updating my Safari version from 17.5 to 18.3

Demo Xcode extension: https://github.com/lenacohen/Safari-Test-Extensions/tree/main/dnr-session-vs-static-redirects

• Visit eff.org and test whether it is redirected to newyorktimes.com (lower priority session rule) or washingtonpost.com (higher priority static rule)

Session rule that overrides a static rule of higher priority:

let updateRules = await chrome.declarativeNetRequest.updateSessionRules({addRules: [
    {
        id: 2,
        priority: 1,
        action: {
          type: "redirect",
          redirect: {
            url: "http://newyorktimes.com/"
          }
        },
        condition: {
            urlFilter: "||eff.org^",
            resourceTypes: [
                "main_frame"
            ]
        }
      }
]});

Static rule that is overridden by a session rule of lower priority:

    {
      "id": 1,
      "priority": 2,
      "action": {
        "type": "redirect",
        "redirect": {
          "url": "http://washingtonpost.com/"
        }
      },
      "condition": {
        "urlFilter": "||eff.org^",
        "resourceTypes": [
          "main_frame"
        ]
      }
    }

Apple Feedback Assistant Bug Report: FB16607998
Safari version 18.3
MacOS Sequoia 15.3.1

[lenacohen]

Still an issue when I tested on Safari Technology Preview Release 215

[ghostwords]

This breaks our "surrogate" scripts and advanced surrogate API click-to-activate widget replacements.

This also breaks our link tracking removal workaround.