make Haketilo buildable again (for Mozilla)
How cool it is to throw away 5755 lines of code...
add new root content script
add a mapping/resources installation dialog
fix license promise typo
utilize Pattern Tree to decide the policy to use and modify HTTP response headers according to that policy
This commit also enhances the build script so that preprocessor conditionals can now use operators '&&' and '||'. The features being developed are not yet included in the actual Haketilo build....
reworked build system; added missing license notices
add is_object_empty utility function
is_object_empty
merge master (license notices) and koszko (v1.0 development)
master
koszko
replace cookies with synchronous XmlHttpRequest as policy smuggling method.
Note: this breaks Mozilla port of Haketilo. Synchronous XmlHttpRequest doesn't work as well there. This will be fixed with dynamically-registered content scripts later.
Fix license notices on JS and SH files
Other files have been left, as no model notice is available
rename the extension to "Haketilo"
simplify CSP handling
All page's CSP rules are now removed when a payload is to be injected. When there is no payload, CSP rules are not modified but only supplemented with Hachette's own.
Fix sanitizing of non-HTML XMLDocument's
merge changes before version 0.1
implement rethinked tags sanitizing approach
This has not been tested yet. Additionally, functionality for blocking of `data:' urls needs to be re-enabled.
enable whitelisting of `file://' protocol\n\nThis commit additionally also changes the semantics of triple asterisk wildcard in URL path.
improve signing\n\nSignature timestamp is now handled in a saner way. Sha256 implementation is no longer pulled in contexts that don't require it.
sanitize `' tags containing CSP rules under Chromium
This commit adds a mechanism of hijacking document when it loads and injecting sanitized nodes to the DOM from the level of content script.
remove unneeded policy-related cosole messages; restore IceCat 60 compatibility
implement smuggling via cookies instead of URL
merge facility to install from Hydrilla
merge csp-PoC
Facilitate installation of scripts from the repository
This commit includes:
[UNTESTED- will test] Add filtering for http-equiv CSP headers
Fix some bugs in the refined CSP handling
Remove unnecessary imports of url_item and add a CSP header-parsing function
The parsing function isn't used yet; however, it will eventually be as a less destructive alternative to handling headers as indivisible units.
Merge rebranding to "Hachette"
Merge commit 'ecb787046271de708b94da70240713e725299d86'
Refer to the extension consistently as "Hachette" and remove TODOS.org from the copyright file
Streamline and harden unique values/settings
The base URL is now included in the settings. The unique value no longer uses it directly, as it is included by virtue of the settings; however, the number of full hours since the epoch (UTC) is now incorporated.
Revamp signatures and break header caching on FF
Signatures, instead of consisting of the secure salt followed by the unique value generated from the URL, are now the unique value generated from the policy value (which will follow them) succeeded by the URL....
Use URL-based policy smuggling
Increase the power of URL-based smuggling by making it (effectively) compulsory in all cases and adapting a structure. While the details still need to be worked out, the potential for future expansion is there.
Stop using the nonce consistently for a URL
Nonces are now randomly generated, either in the page (for non-HTTP(S) pages) or by a background module which stores them by tab and frame IDs. In order to support the increased variance in nonce-generating methods and allow them to...
show some settings of the current page in the popup
move parsing of url with targets to misc.js
refactor 3 miscellaneous fnctionalities to a their single own file