Project

General

Profile

« Previous | Next » 

Revision 2875397f

Added by koszko about 2 years ago

improve signing\n\nSignature timestamp is now handled in a saner way. Sha256 implementation is no longer pulled in contexts that don't require it.

View differences:

background/policy_injector.js
16 16 
 * IMPORTS_END
17 17 
 */
18 18 

  		




  19
  
  
    
function inject_csp_headers(details, headers, policy)


  		




  
  19
  
    
function inject_csp_headers(headers, policy)


  		




  20
  20
  
    
{


  		




  21
  
  
    
    const url = details.url;


  		




  22
  
  
    

  		




  23
  
  
    
    let orig_csp_headers;


  		




  
  21
  
    
    let csp_headers;


  		




  24
  22
  
    
    let old_signature;


  		




  25
  23
  
    
    let hachette_header;


  		




  26
  24
  
    

  		




  27
  25
  
    
    for (const header of headers.filter(h => h.name === "x-hachette")) {


  		




  28
  
  
    
	const match = /^([^%])(%.*)$/.exec(header.value);


  		




  
  26
  
    
	/* x-hachette header has format: <signature>_0_<data> */


  		




  
  27
  
    
	const match = /^([^_]+)_(0_.*)$/.exec(header.value);


  		




  29
  28
  
    
	if (!match)


  		




  30
  29
  
    
	    continue;


  		




  31
  30
  
    

  		




  32
  
  
    
	const old_data = extract_signed(...match.splice(1, 2), [[0]]);


  		




  33
  
  
    
	if (!old_data || old_data.url !== url)


  		




  
  31
  
    
	const result = extract_signed(...match.slice(1, 3));


  		




  
  32
  
    
	if (result.fail)


  		




  34
  33
  
    
	    continue;


  		




  35
  34
  
    

  		




  
  35
  
    
	/* This should succeed - it's our self-produced valid JSON. */


  		




  
  36
  
    
	const old_data = JSON.parse(decodeURIComponent(result.data));


  		




  
  37
  
    

  		




  36
  38
  
    
	/* Confirmed- it's the originals, smuggled in! */


  		




  37
  
  
    
	orig_csp_headers = old_data.csp_headers;


  		




  
  39
  
    
	csp_headers = old_data.csp_headers;


  		




  38
  40
  
    
	old_signature = old_data.policy_sig;


  		




  39
  41
  
    

  		




  40
  42
  
    
	hachette_header = header;


  		




  ......




  46
  48
  
    
	headers.push(hachette_header);


  		




  47
  49
  
    
    }


  		




  48
  50
  
    

  		




  49
  
  
    
    orig_csp_headers = orig_csp_headers ||


  		




  
  51
  
    
    csp_headers = csp_headers ||


  		




  50
  52
  
    
	headers.filter(h => is_csp_header_name(h.name));


  		




  51
  53
  
    

  		




  52
  54
  
    
    /* When blocking remove report-only CSP headers that snitch on us. */


  		




  53
  55
  
    
    headers = headers.filter(h => !is_csp_header_name(h.name, !policy.allow));


  		




  54
  56
  
    

  		




  55
  57
  
    
    if (old_signature)


  		




  56
  
  
    
	headers = headers.filter(h => h.name.search(old_signature) === -1);


  		




  
  58
  
    
	headers = headers.filter(h => h.value.search(old_signature) === -1);


  		




  57
  59
  
    

  		




  58
  
  
    
    const sanitizer = h => sanitize_csp_header(h, policy);


  		




  59
  
  
    
    headers.push(...orig_csp_headers.map(sanitizer));


  		




  
  60
  
    
    headers.push(...csp_headers.map(h => sanitize_csp_header(h, policy)));


  		




  60
  61
  
    

  		




  61
  62
  
    
    const policy_str = encodeURIComponent(JSON.stringify(policy));


  		




  62
  
  
    
    const policy_sig = sign_data(policy_str, new Date());


  		




  
  63
  
    
    const signed_policy = sign_data(policy_str, new Date().getTime());


  		




  63
  64
  
    
    const later_30sec = new Date(new Date().getTime() + 30000).toGMTString();


  		




  64
  65
  
    
    headers.push({


  		




  65
  66
  
    
	name: "Set-Cookie",


  		




  66
  
  
    
	value: `hachette-${policy_sig}=${policy_str}; Expires=${later_30sec};`


  		




  
  67
  
    
	value: `hachette-${signed_policy.join("=")}; Expires=${later_30sec};`


  		




  67
  68
  
    
    });


  		




  68
  69
  
    

  		




  69
  70
  
    
    /*


  		




  ......




  71
  72
  
    
     * These are signed with a time of 0, as it's not clear there is a limit on


  		




  72
  73
  
    
     * how long Firefox might retain headers in the cache.


  		




  73
  74
  
    
     */


  		




  74
  
  
    
    let hachette_data = {csp_headers: orig_csp_headers, policy_sig, url};


  		




  
  75
  
    
    let hachette_data = {csp_headers, policy_sig: signed_policy[0]};


  		




  75
  76
  
    
    hachette_data = encodeURIComponent(JSON.stringify(hachette_data));


  		




  76
  
  
    
    hachette_header.value = sign_data(hachette_data, 0) + hachette_data;


  		




  
  77
  
    
    hachette_header.value = sign_data(hachette_data, 0).join("_");


  		




  77
  78
  
    

  		




  78
  79
  
    
    /* To ensure there is a CSP header if required */


  		




  79
  80
  
    
    if (!policy.allow)


  		












Also available in:  Unified diff