/ - Diff - Haketilo - Hydrilla issue tracker

      * IMPORTS_START
      * IMPORT sign_data
      * IMPORT extract_signed
      * IMPORT sanitize_csp_header
      * IMPORT csp_rule
      * IMPORT is_csp_header_name
      * IMPORT make_csp_rule
      * IMPORT csp_header_regex
      * IMPORTS_END
      */
-...
     	break;
+        }
         if (policy.has_payload) {
     	csp_headers = [];
     	const non_csp_headers = [];
     	const header_list =
     	      h => csp_header_regex.test(h) ? csp_headers : non_csp_headers;
     	headers.forEach(h => header_list(h.name).push(h));
     	headers = non_csp_headers;
         } else {
     	headers.push(...csp_headers || []);
+        }
         if (!hachette_header) {
     	hachette_header = {name: "x-hachette"};
     	headers.push(hachette_header);
+        }
         csp_headers = csp_headers ||
     	headers.filter(h => is_csp_header_name(h.name));
         /* When blocking remove report-only CSP headers that snitch on us. */
         headers = headers.filter(h => !is_csp_header_name(h.name, !policy.allow));
         if (old_signature)
     	headers = headers.filter(h => h.value.search(old_signature) === -1);
         headers.push(...csp_headers.map(h => sanitize_csp_header(h, policy)));
         const policy_str = encodeURIComponent(JSON.stringify(policy));
         const signed_policy = sign_data(policy_str, new Date().getTime());
         const later_30sec = new Date(new Date().getTime() + 30000).toGMTString();
-...
         hachette_data = encodeURIComponent(JSON.stringify(hachette_data));
         hachette_header.value = sign_data(hachette_data, 0).join("_");
         /* To ensure there is a CSP header if required */
         if (!policy.allow)
         if (!policy.allow) {
     	headers.push({
     	    name: "content-security-policy",
     	    value: csp_rule(policy.nonce)
     	    value: make_csp_rule(policy)
     	});
+        }
         return headers;
+    }

     /*
      * IMPORTS_START
      * IMPORT browser
      * IMPORT is_csp_header_name
      * IMPORT csp_header_regex
      * IMPORTS_END
      */
-...
         const doc = new DOMParser().parseFromString(html, "text/html");
         for (const meta of doc.querySelectorAll("head>meta[http-equiv]")) {
     	if (is_csp_header_name(meta.getAttribute("http-equiv"), true) &&
     	    meta.content)
     	if (csp_header_regex.test(meta.httpEquiv) && meta.content)
     	    return true;
+        }

         return Uint8toHex(randomData);
+    }
     /* csp rule that blocks all scripts except for those injected by us */
     function csp_rule(nonce)
     /* CSP rule that blocks scripts according to policy's needs. */
     function make_csp_rule(policy)
+    {
         const rule = `'nonce-${nonce}'`;
         return `script-src ${rule}; script-src-elem ${rule}; script-src-attr 'none'; prefetch-src 'none';`;
         let rule = "prefetch-src 'none'; script-src-attr 'none';";
         const script_src = policy.has_payload ?
     	  `'nonce-${policy.nonce}'` : "'none'";
         rule += ` script-src ${script_src}; script-src-elem ${script_src};`;
         return rule;
+    }
     /* Check if some HTTP header might define CSP rules. */
     const csp_header_names = new Set([
         "content-security-policy",
         "x-webkit-csp",
         "x-content-security-policy"
     ]);
     const report_only_header_name = "content-security-policy-report-only";
     function is_csp_header_name(string, include_report_only)
+    {
         string = string && string.toLowerCase().trim() || "";
         return (include_report_only && string === report_only_header_name) ||
     	csp_header_names.has(string);
+    }
     const csp_header_regex =
           /^\s*(content-security-policy|x-webkit-csp|x-content-security-policy)/i;
     /*
      * Print item together with type, e.g.
-...
         return directives;
+    }
     /* Make CSP headers do our bidding, not interfere */
     function sanitize_csp_header(header, policy)
+    {
         const rule = `'nonce-${policy.nonce}'`;
         const csp = parse_csp(header.value);
         if (!policy.allow) {
     	/* No snitching */
     	delete csp['report-to'];
     	delete csp['report-uri'];
     	delete csp['script-src'];
     	delete csp['script-src-elem'];
     	csp['script-src-attr'] = ["'none'"];
     	csp['prefetch-src'] = ["'none'"];
+        }
         if ('script-src' in csp)
     	csp['script-src'].push(rule);
         else
     	csp['script-src'] = [rule];
         if ('script-src-elem' in csp)
     	csp['script-src-elem'].push(rule);
         else
     	csp['script-src-elem'] = [rule];
         const new_csp = Object.entries(csp).map(
     	i => `${i[0]} ${i[1].join(' ')};`
         );
         return {name: header.name, value: new_csp.join('')};
+    }
     /* Regexes and objects to use as/in schemas for parse_json_with_schema(). */
     const nonempty_string_matcher = /.+/;
-...
     /*
      * EXPORTS_START
      * EXPORT gen_nonce
      * EXPORT csp_rule
      * EXPORT is_csp_header_name
      * EXPORT make_csp_rule
      * EXPORT csp_header_regex
      * EXPORT nice_name
      * EXPORT open_in_settings
      * EXPORT is_privileged_url
      * EXPORT sanitize_csp_header
      * EXPORT matchers
      * EXPORTS_END
      */

      * IMPORT is_chrome
      * IMPORT is_mozilla
      * IMPORT start_activity_info_server
      * IMPORT csp_rule
      * IMPORT is_csp_header_name
      * IMPORT sanitize_csp_header
      * IMPORT make_csp_rule
      * IMPORT csp_header_regex
      * IMPORTS_END
      */
-...
     	const name = construct_name.join("");
     	seta(node, `${blocked_str}-${name}`, geta(node, name));
+        }
+    }
     function sanitize_meta(meta, policy)
+    {
         const value = meta.content || "";
         if (!value || !is_csp_header_name(meta.httpEquiv || "", true))
     	return;
         block_attribute(meta, "content");
         rema(node, attr);
+    }
     /*
      * Used to disable <script> that has not yet been added to live DOM (doesn't
      * work for those already added).
      * Used to disable `<script>'s and `<meta>'s that have not yet been added to
      * live DOM (doesn't work for those already added).
      */
     function sanitize_meta(meta)
+    {
         if (csp_header_regex.test(meta.httpEquiv) && meta.content)
     	block_attribute(meta, "content");
+    }
     function sanitize_script(script)
+    {
         script.hachette_blocked_type = script.getAttribute("type");
-...
+    }
     /*
      * Executed after script has been connected to the DOM, when it is no longer
      * eligible for being executed by the browser
      * Executed after `<script>' has been connected to the DOM, when it is no longer
      * eligible for being executed by the browser.
      */
     function desanitize_script(script, policy)
     function desanitize_script(script)
+    {
         script.setAttribute("type", script.hachette_blocked_type);
         if (script.hachette_blocked_type === null)
         if ([null, undefined].includes(script.hachette_blocked_type))
     	script.removeAttribute("type");
         delete script.hachette_blocked_type;
-...
      * cause part of the DOM to be loaded when our content scripts get to run. Thus,
      * before the CSP rules we inject (for non-HTTP pages) become effective, we need
      * to somehow block the execution of `<script>'s and intrinsics that were
      * already there.
      * already there. Additionally, some browsers (IceCat 60) seem to have problems
      * applying this CSP to non-inline `<scripts>' in certain scenarios.
      */
     function prevent_script_execution(event)
+    {
         if (!event.target._hachette_payload)
     	event.preventDefault();
+    }
     function mozilla_initial_block(doc)
+    {
         const blocker = e => e.preventDefault();
         doc.addEventListener("beforescriptexecute", blocker);
         setTimeout(() => doc.removeEventListener("beforescriptexecute", blocker));
         doc.addEventListener("beforescriptexecute", prevent_script_execution);
         [...doc.all].flatMap(ele => [...ele.attributes].map(attr => [ele, attr]))
     	.map(([ele, attr]) => [ele, attr.localName])
-...
          * non-HTML documents.
          */
         const html = new DOMParser().parseFromString(`<html><head><meta \
     http-equiv="Content-Security-Policy" content="${csp_rule(policy.nonce)}"\
     http-equiv="Content-Security-Policy" content="${make_csp_rule(policy)}"\
     /></head><body>Loading...</body></html>`, "text/html").documentElement;
         /*
-...
         root.replaceWith(html);
         /*
          * For XML documents, we don't intend to inject payload, so we neither block
          * document's CSP `<meta>' tags nor wait for `<head>' to be parsed.
          * When we don't inject payload, we neither block document's CSP `<meta>'
          * tags nor wait for `<head>' to be parsed.
          */
         if (document instanceof HTMLDocument) {
         if (policy.has_payload) {
     	await wait_for_head(doc, root);
     	root.querySelectorAll("head meta")
-...
     	policy = {allow: false, nonce: gen_nonce()};
+        }
         if (!(document instanceof HTMLDocument))
     	policy.has_payload = false;
         console.debug("current policy", policy);
         const doc_ready = Promise.all([

Project

General

Profile

Haketilo

Revision 44e89d8e

Added by koszko almost 2 years ago