This has probably occurred on Mac for a long time, and will have started occurring in Windows 10 builds last summer with changes to the format of the Zone.Identifier file. I believe the Linux marker also stores the origin Url. 

On Windows, we /could/ choose to replace the URL with "about:internet" but this will make SmartScreen less effective and could result in extra security prompts. 

I'd lean toward "WontFix" on this. 

I was curious to see what happens with other browsers, so I tested a few:
1. Firefox 59+ does not save the files downloaded in private mode in the database.
2. Safari also does not save the files downloaded in private mode in the database.
3. Tor browser does not save the files downloaded in private mode in the database.

On Windows 10 1709, Firefox isn't using the IAttachmentExecute API to write the Zone.Identifier, so it doesn't record the origin URL. Interestingly, however, Edge behavior changes in its InPrivate mode.

When a download takes place in regular mode, the HostUrl value is set and leaks the original download URL. When the same download takes place in InPrivate mode, the HostUrl value is omitted from the Zone.Identifier file.

It might be interesting to see whether Safari does anything special here like Edge does.

+qinmin@ to see what Safari does.  I'm tempted to mark as Won'tFix because downloads inherently leave some state behind on disk even in incognito mode, which is expected behavior.

elawrence@ what's the security benefit to adding HostUrl?  Would there be any downside to omitting it?

Really add +qinmin :)

RE #4: I assume the idea Microsoft had when writing the HostUrl to the file is that it enables later dynamic checks of the reputation of a site. Consider, e.g. the user downloads an executable from https://newdodgysite.com. Windows SmartScreen doesn't know this is a dodgy site and will allow the user to execute the file immediately. However, the next day, Windows catches up and starts blocking that site as malicious. By recording the HostUrl in the MotW, Windows can apply that later knowledge to a prior download. I allude to this in https://textslashplain.com/2016/04/04/downloads-and-the-mark-of-the-web/ (It's probably also useful for threat-intelligence and other purposes.) 

It sounds like this is working as intended and is probably what we want from a security standpoint (although from privacy I see the downside)?  Will wait for qinmin@ to confirm what Safari does.

+dtrainor@

From privacy standpoint, this is a leak as there would be a trace of what user has done in incognito after the incognito window is closed.

I think as the regular mode is already fully considering security, when user goes to incognito, it can be considered as more leaning towards privacy, and we should respect it if we can, or state it clearly to the user.

Is there any plan for it now?

Both firefox and safari don't report the URL/referrer in quanrantine db when in private mode, but do report them in normal mode.

I think I can fix this by annotating the file with empty URL.

or simply skip the file annotation in incognito mode

For Windows, it's important to annotate the download with a web-based URL in order to ensure that the platform security features (AV, SmartScreen) recognize that the file is untrusted content from the Internet. If omitting the URL is desireable for Windows, use "about:internet" as the URL.

https://cs.chromium.org/chromium/src/components/download/quarantine/quarantine_win.cc?l=231&rcl=fe4e0d4b82813da20a8be333719f22c7c6c1c9ca

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/63034d6e4ccf75bd6cafaf735ded740af6579644

commit 63034d6e4ccf75bd6cafaf735ded740af6579644
Author: Min Qin <qinmin@chromium.org>
Date: Wed Apr 25 21:45:01 2018

Use Empty URL for download annotation in Incognito mode

Chrome annotates downloads with the source URL to allow platform
security features to treat downloads with appropriate suspicion.
If the download was conducted in off-the-record mode, we should not
annotate the download with the real URL to avoid a privacy leak.
On Windows, using an empty URL results in marking the download
as originating from "about:internet", a generic Internet-zone
URL.

BUG= 813764 

Change-Id: I1dfe652051d43a0c4f3ee2742882b1affa946c57
Reviewed-on: https://chromium-review.googlesource.com/1026455
Reviewed-by: Ramin Halavati <rhalavati@chromium.org>
Reviewed-by: David Trainor <dtrainor@chromium.org>
Reviewed-by: Eric Lawrence <elawrence@chromium.org>
Commit-Queue: Min Qin <qinmin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#553764}
[modify] https://crrev.com/63034d6e4ccf75bd6cafaf735ded740af6579644/components/download/internal/common/download_item_impl.cc
[modify] https://crrev.com/63034d6e4ccf75bd6cafaf735ded740af6579644/components/download/internal/common/download_item_impl_unittest.cc
[modify] https://crrev.com/63034d6e4ccf75bd6cafaf735ded740af6579644/components/download/quarantine/quarantine.h
[modify] https://crrev.com/63034d6e4ccf75bd6cafaf735ded740af6579644/components/download/quarantine/quarantine_win.cc