Haketilo

 * IMPORT TYPE_PREFIX

 * IMPORT is_mozilla

 * IMPORT gen_unique

 * IMPORT url_item

 * IMPORT url_extract_target

 * IMPORT sign_policy

/* TODO: variable no longer in use; remove if not needed */

const unwanted_csp_directives = new Set([

    "report-to",

    "report-uri",

    "script-src",

    "script-src-elem",

    "prefetch-src"

]);

function url_inject(details)

    if (is_privileged_url(details.url))

    const targets = url_extract_target(details.url);

    if (targets.current)

	return;

    /* Redirect; update policy */

    if (targets.policy)

	targets.target = "";

    let [pattern, settings] = query_best(storage, targets.base_url);

    /* Defaults */

    if (!pattern)

	settings = {};

    const policy = encodeURIComponent(

	JSON.stringify({

	    allow: settings.allow,

	    nonce: gen_nonce(),

	    base_url: targets.base_url

	})

    );

    return {

	redirectUrl: [

	    targets.base_url,

	    '#', sign_policy(policy, new Date()), policy,

	    targets.target,

	    targets.target2

	].join("")

    };

}

function headers_inject(details)

{

    const targets = url_extract_target(details.url);

    /* Block mis-/unsigned requests */

    if (!targets.current)

	return {cancel: true};

    let orig_csp_headers = is_chrome ? null : [];

    let headers = [];

    let csp_headers = is_chrome ? headers : [];

    const rule = `'nonce-${targets.policy.nonce}'`;

    const block = !targets.policy.allow;

    for (const header of details.responseHeaders) {

	if (!csp_header_names.has(header)) {

	    /* Remove headers that only snitch on us */

	    if (header.name.toLowerCase() === report_only && block)

		continue;

	    headers.push(header);

	    /* If these are the original CSP headers, use them instead */

	    /* Test based on url_extract_target() in misc.js */

	    if (is_mozilla && header.name === "x-orig-csp") {

		let index = header.value.indexOf('%5B');

		if (index === -1)

		    continue;

		let sig = header.value.substring(0, index);

		let data = header.value.substring(index);

		if (sig !== sign_policy(data, 0))

		    continue;

		/* Confirmed- it's the originals, smuggled in! */

		try {

		    data = JSON.parse(decodeURIComponent(data));

		} catch (e) {

		    /* This should not be reached -

			it's our self-produced valid JSON. */

		    console.log("Unexpected internal error - invalid JSON smuggled!", e);

		}

		orig_csp_headers = csp_headers = null;

		for (const header of data)

		    headers.push(sanitize_csp_header(header, rule, block));

	    }

	} else if (is_chrome || !orig_csp_headers) {

	    csp_headers.push(sanitize_csp_header(header, rule, block));

	    if (is_mozilla)

		orig_csp_headers.push(header);

	}

    if (orig_csp_headers) {

	/** Smuggle in the original CSP headers for future use.

	  * These are signed with a time of 0, as it's not clear there

	  * is a limit on how long Firefox might retain these headers in

	  * the cache.

	  */

	orig_csp_headers = encodeURIComponent(JSON.stringify(orig_csp_headers));

	headers.push({

	    name: "x-orig-csp",

	    value: sign_policy(orig_csp_headers, 0) + orig_csp_headers

	});

	headers = headers.concat(csp_headers);

    if (block) {

	headers.push({

	    name: "content-security-policy",

	    value: `script-src ${rule}; script-src-elem ${rule}; ` +

		"script-src-attr 'none'; prefetch-src 'none';"

	});

    }

    browser.webRequest.onBeforeRequest.addListener(

	url_inject,

	{

	    urls: ["<all_urls>"],

	    types: ["main_frame", "sub_frame"]

	},

	["blocking"]

    );

function gen_unique(url)

{

    return sha256(get_secure_salt() + url);

}

/*

 * stripping url from query and target (everything after `#' or `?'

 * gets removed)

 */

function url_item(url)

{

    let url_re = /^([^?#]*).*$/;

    let match = url_re.exec(url);

    return match[1];

}

/*

 * Assume a url like:

 *     https://example.com/green?illuminati=confirmed#<injected-policy>#winky

 * This function will make it into an object like:

 * {

 *     "base_url": "https://example.com/green?illuminati=confirmed",

 *     "target":   "#<injected-policy>",

 *     "target2":  "#winky",

 *     "policy":   <injected-policy-as-js-object>,

 *     "current":  <boolean-indicating-whether-policy-url-matches>

 * }

 * In case url doesn't have 2 #'s, target2 and target can be set to undefined.

 */

function url_extract_target(url)

    const url_re = /^([^#]*)((#[^#]*)(#.*)?)?$/;

    const match = url_re.exec(url);

    const targets  = {

	base_url: match[1],

	target:   match[3] || "",

	target2:  match[4] || ""

    };

    if (!targets.target)

	return targets;

    /* %7B -> { */

    const index = targets.target.indexOf('%7B');

    if (index === -1)

	return targets;

    const sig = targets.target.substring(1, index);

    const policy = targets.target.substring(index);

    if (sig !== sign_policy(policy, now) &&

	sig !== sign_policy(policy, now, -1))

	return targets;

	targets.policy = JSON.parse(decodeURIComponent(policy));

	targets.current = targets.policy.base_url === targets.base_url;

    return targets;

    let rule = `script-src 'nonce-${nonce}';`;

    if (is_chrome)

	rule += `script-src-elem 'nonce-${nonce}';`;

    return rule;

/* Sign a given policy for a given time */

function sign_policy(policy, now, hours_offset) {

    return gen_unique(time + policy);

function sanitize_csp_header(header, rule, block)

    if (block) {

 * EXPORT gen_unique

 * EXPORT url_item

 * EXPORT url_extract_target

 * EXPORT sign_policy

 * IMPORT url_extract_target

 * IMPORT gen_unique

    const targets = url_extract_target(document.URL);

    if (targets.policy) {

	if (targets.target2)

	    window.location.href = targets.base_url + targets.target2;

	else

	    history.replaceState(null, "", targets.base_url);

    const policy = targets.current ? targets.policy : {};

    nonce = policy.nonce || gen_nonce();

    handle_page_actions(nonce);

 * IMPORT url_item

    tab_url = url_item(tab.url);