1 |
7bedbcbd
|
Wojtek Kosior
|
/**
|
2 |
|
|
* This file is part of Haketilo.
|
3 |
|
|
*
|
4 |
|
|
* Function: Enforcing script blocking rules on a given page, working from a
|
5 |
|
|
* content script.
|
6 |
|
|
*
|
7 |
|
|
* Copyright (C) 2021,2022 Wojtek Kosior
|
8 |
|
|
* Copyright (C) 2021 jahoti
|
9 |
|
|
*
|
10 |
|
|
* This program is free software: you can redistribute it and/or modify
|
11 |
|
|
* it under the terms of the GNU General Public License as published by
|
12 |
|
|
* the Free Software Foundation, either version 3 of the License, or
|
13 |
|
|
* (at your option) any later version.
|
14 |
|
|
*
|
15 |
|
|
* This program is distributed in the hope that it will be useful,
|
16 |
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
17 |
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
18 |
|
|
* GNU General Public License for more details.
|
19 |
|
|
*
|
20 |
|
|
* As additional permission under GNU GPL version 3 section 7, you
|
21 |
|
|
* may distribute forms of that code without the copy of the GNU
|
22 |
|
|
* GPL normally required by section 4, provided you include this
|
23 |
|
|
* license notice and, in case of non-source distribution, a URL
|
24 |
|
|
* through which recipients can access the Corresponding Source.
|
25 |
|
|
* If you modify file(s) with this exception, you may extend this
|
26 |
|
|
* exception to your version of the file(s), but you are not
|
27 |
|
|
* obligated to do so. If you do not wish to do so, delete this
|
28 |
|
|
* exception statement from your version.
|
29 |
|
|
*
|
30 |
|
|
* As a special exception to the GPL, any HTML file which merely
|
31 |
|
|
* makes function calls to this code, and for that purpose
|
32 |
|
|
* includes it by reference shall be deemed a separate work for
|
33 |
|
|
* copyright law purposes. If you modify this code, you may extend
|
34 |
|
|
* this exception to your version of the code, but you are not
|
35 |
|
|
* obligated to do so. If you do not wish to do so, delete this
|
36 |
|
|
* exception statement from your version.
|
37 |
|
|
*
|
38 |
|
|
* You should have received a copy of the GNU General Public License
|
39 |
|
|
* along with this program. If not, see <https://www.gnu.org/licenses/>.
|
40 |
|
|
*
|
41 |
|
|
* I, Wojtek Kosior, thereby promise not to sue for violation of this file's
|
42 |
|
|
* license. Although I request that you do not make use of this code in a
|
43 |
|
|
* proprietary program, I am not going to enforce this in court.
|
44 |
|
|
*/
|
45 |
|
|
|
46 |
4c6a2323
|
Wojtek Kosior
|
#FROM common/misc.js IMPORT gen_nonce, csp_header_regex
|
47 |
7bedbcbd
|
Wojtek Kosior
|
|
48 |
|
|
document.content_loaded = document.readyState === "complete";
|
49 |
|
|
const wait_loaded = e => e.content_loaded ? Promise.resolve() :
|
50 |
|
|
new Promise(c => e.addEventListener("DOMContentLoaded", c, {once: true}));
|
51 |
|
|
|
52 |
|
|
wait_loaded(document).then(() => document.content_loaded = true);
|
53 |
|
|
|
54 |
|
|
/*
|
55 |
|
|
* In the case of HTML documents:
|
56 |
|
|
* 1. When injecting some payload we need to sanitize <meta> CSP tags before
|
57 |
|
|
* they reach the document.
|
58 |
|
|
* 2. Only <meta> tags inside <head> are considered valid by the browser and
|
59 |
|
|
* need to be considered.
|
60 |
|
|
* 3. We want to detach <html> from document, wait until its <head> completes
|
61 |
|
|
* loading, sanitize it and re-attach <html>.
|
62 |
|
|
* 4. We shall wait for anything to appear in or after <body> and take that as
|
63 |
|
|
* a sign <head> has finished loading.
|
64 |
|
|
* 5. Otherwise, getting the `DOMContentLoaded' event on the document shall also
|
65 |
|
|
* be a sign that <head> is fully loaded.
|
66 |
|
|
*/
|
67 |
|
|
|
68 |
|
|
function make_body_start_observer(DOM_element, waiting) {
|
69 |
|
|
const observer = new MutationObserver(() => try_body_started(waiting));
|
70 |
|
|
observer.observe(DOM_element, {childList: true});
|
71 |
|
|
return observer;
|
72 |
|
|
}
|
73 |
|
|
|
74 |
|
|
function try_body_started(waiting) {
|
75 |
|
|
const body = waiting.detached_html.querySelector("body");
|
76 |
|
|
|
77 |
|
|
if ((body && (body.firstChild || body.nextSibling)) ||
|
78 |
|
|
waiting.doc.documentElement.nextSibling) {
|
79 |
|
|
finish_waiting(waiting);
|
80 |
|
|
return true;
|
81 |
|
|
}
|
82 |
|
|
|
83 |
|
|
if (body && waiting.observers.length < 2)
|
84 |
|
|
waiting.observers.push(make_body_start_observer(body, waiting));
|
85 |
|
|
}
|
86 |
|
|
|
87 |
|
|
function finish_waiting(waiting) {
|
88 |
|
|
if (waiting.finished)
|
89 |
|
|
return;
|
90 |
|
|
waiting.finished = true;
|
91 |
|
|
waiting.observers.forEach(observer => observer.disconnect());
|
92 |
|
|
setTimeout(waiting.callback, 0);
|
93 |
|
|
}
|
94 |
|
|
|
95 |
|
|
function _wait_for_head(doc, detached_html, callback) {
|
96 |
|
|
const waiting = {doc, detached_html, callback, observers: []};
|
97 |
|
|
|
98 |
|
|
if (try_body_started(waiting))
|
99 |
|
|
return;
|
100 |
|
|
|
101 |
|
|
waiting.observers = [make_body_start_observer(detached_html, waiting)];
|
102 |
|
|
|
103 |
|
|
wait_loaded(doc).then(() => finish_waiting(waiting));
|
104 |
|
|
}
|
105 |
|
|
|
106 |
|
|
function wait_for_head(doc, detached_html) {
|
107 |
|
|
return new Promise(cb => _wait_for_head(doc, detached_html, cb));
|
108 |
|
|
}
|
109 |
|
|
|
110 |
|
|
const blocked_str = "blocked";
|
111 |
|
|
|
112 |
31cc63c2
|
Wojtek Kosior
|
function block_attribute(node, attr, ns=null, replace_with=null) {
|
113 |
7bedbcbd
|
Wojtek Kosior
|
const [hasa, geta, seta, rema] = ["has", "get", "set", "remove"]
|
114 |
|
|
.map(m => (n, ...args) => typeof ns === "string" ?
|
115 |
|
|
n[`${m}AttributeNS`](ns, ...args) : n[`${m}Attribute`](...args));
|
116 |
|
|
/*
|
117 |
|
|
* Disabling attributes by prepending `blocked-' allows them to still be
|
118 |
|
|
* relatively easily accessed in case they contain some useful data.
|
119 |
|
|
*/
|
120 |
|
|
const construct_name = [attr];
|
121 |
|
|
while (hasa(node, construct_name.join("")))
|
122 |
|
|
construct_name.unshift(blocked_str);
|
123 |
|
|
|
124 |
|
|
while (construct_name.length > 1) {
|
125 |
|
|
construct_name.shift();
|
126 |
|
|
const name = construct_name.join("");
|
127 |
|
|
seta(node, `${blocked_str}-${name}`, geta(node, name));
|
128 |
|
|
}
|
129 |
|
|
|
130 |
|
|
rema(node, attr);
|
131 |
31cc63c2
|
Wojtek Kosior
|
if (replace_with !== null)
|
132 |
|
|
seta(node, attr, replace_with);
|
133 |
7bedbcbd
|
Wojtek Kosior
|
}
|
134 |
|
|
|
135 |
|
|
/*
|
136 |
|
|
* Used to disable `<script>'s and `<meta>'s that have not yet been added to
|
137 |
|
|
* live DOM (doesn't work for those already added).
|
138 |
|
|
*/
|
139 |
|
|
function sanitize_meta(meta) {
|
140 |
|
|
if (csp_header_regex.test(meta.httpEquiv) && meta.content)
|
141 |
|
|
block_attribute(meta, "content");
|
142 |
|
|
}
|
143 |
|
|
|
144 |
|
|
function sanitize_script(script) {
|
145 |
|
|
script.haketilo_blocked_type = script.getAttribute("type");
|
146 |
|
|
script.type = "text/plain";
|
147 |
|
|
}
|
148 |
|
|
|
149 |
|
|
/*
|
150 |
|
|
* Executed after `<script>' has been connected to the DOM, when it is no longer
|
151 |
|
|
* eligible for being executed by the browser.
|
152 |
|
|
*/
|
153 |
|
|
function desanitize_script(script) {
|
154 |
|
|
script.setAttribute("type", script.haketilo_blocked_type);
|
155 |
|
|
|
156 |
|
|
if ([null, undefined].includes(script.haketilo_blocked_type))
|
157 |
|
|
script.removeAttribute("type");
|
158 |
|
|
|
159 |
|
|
delete script.haketilo_blocked_type;
|
160 |
|
|
}
|
161 |
|
|
|
162 |
|
|
const bad_url_reg = /^data:([^,;]*ml|unknown-content-type)|^javascript:/i;
|
163 |
|
|
function sanitize_element_urls(element) {
|
164 |
|
|
if (element.haketilo_sanitized_urls)
|
165 |
|
|
return;
|
166 |
|
|
|
167 |
|
|
element.haketilo_sanitized_urls = true;
|
168 |
|
|
|
169 |
|
|
for (const attr of [...element.attributes || []]
|
170 |
|
|
.filter(attr => /^(href|src|data)$/i.test(attr.localName))
|
171 |
|
|
.filter(attr => bad_url_reg.test(attr.value))) {
|
172 |
|
|
const replacement_value = /^href$/i.test(attr.localName) ?
|
173 |
|
|
"javascript:void('blocked');" : "data:text/plain,blocked";
|
174 |
|
|
block_attribute(element, attr.localName, attr.namespaceURI,
|
175 |
|
|
replacement_value);
|
176 |
|
|
}
|
177 |
|
|
}
|
178 |
|
|
|
179 |
|
|
function sanitize_tree_urls(root) {
|
180 |
|
|
root.querySelectorAll("*[href], *[src], *[data]")
|
181 |
|
|
.forEach(sanitize_element_urls);
|
182 |
|
|
}
|
183 |
|
|
|
184 |
31cc63c2
|
Wojtek Kosior
|
#IF MOZILLA
|
185 |
|
|
function sanitize_element_onevent(element) {
|
186 |
|
|
for (const attribute_node of (element.attributes || [])) {
|
187 |
|
|
const attr = attribute_node.localName, attr_lo = attr.toLowerCase();;
|
188 |
|
|
if (!/^on/.test(attr_lo) || !(attr_lo in element.wrappedJSObject))
|
189 |
|
|
continue;
|
190 |
|
|
|
191 |
|
|
/*
|
192 |
|
|
* Guard against redefined getter on DOM object property. This should
|
193 |
|
|
* not be an issue */
|
194 |
|
|
if (Object.getOwnPropertyDescriptor(element.wrappedJSObject, attr)) {
|
195 |
|
|
console.error("Redefined property on a DOM object! The page might have bypassed our script blocking measures!");
|
196 |
|
|
continue;
|
197 |
|
|
}
|
198 |
|
|
element.wrappedJSObject[attr] = null;
|
199 |
|
|
block_attribute(element, attr, attribute_node.namespaceURI,
|
200 |
|
|
"javascript:void('blocked');");
|
201 |
|
|
}
|
202 |
|
|
}
|
203 |
|
|
|
204 |
|
|
function sanitize_tree_onevent(root) {
|
205 |
|
|
root.querySelectorAll("*")
|
206 |
|
|
.forEach(sanitize_element_onevent);
|
207 |
|
|
}
|
208 |
|
|
#ENDIF
|
209 |
|
|
|
210 |
|
|
function start_mo_sanitizing(doc) {
|
211 |
7bedbcbd
|
Wojtek Kosior
|
if (!doc.content_loaded) {
|
212 |
31cc63c2
|
Wojtek Kosior
|
function mutation_handler(mutation) {
|
213 |
|
|
mutation.addedNodes.forEach(sanitize_element_urls);
|
214 |
|
|
#IF MOZILLA
|
215 |
|
|
mutation.addedNodes.forEach(sanitize_element_onevent);
|
216 |
|
|
#ENDIF
|
217 |
|
|
}
|
218 |
7bedbcbd
|
Wojtek Kosior
|
const mo = new MutationObserver(ms => ms.forEach(mutation_handler));
|
219 |
|
|
mo.observe(doc, {childList: true, subtree: true});
|
220 |
|
|
wait_loaded(doc).then(() => mo.disconnect());
|
221 |
|
|
}
|
222 |
|
|
}
|
223 |
|
|
|
224 |
|
|
#IF MOZILLA
|
225 |
|
|
/*
|
226 |
|
|
* Normally, we block scripts with CSP. However, Mozilla does optimizations that
|
227 |
|
|
* cause part of the DOM to be loaded when our content scripts get to run. Thus,
|
228 |
|
|
* before the CSP rules we inject (for non-HTTP pages) become effective, we need
|
229 |
|
|
* to somehow block the execution of `<script>'s and intrinsics that were
|
230 |
|
|
* already there. Additionally, some browsers (IceCat 60) seem to have problems
|
231 |
|
|
* applying this CSP to non-inline `<scripts>' in certain scenarios.
|
232 |
|
|
*/
|
233 |
|
|
function prevent_script_execution(event) {
|
234 |
|
|
if (!event.target.haketilo_payload)
|
235 |
|
|
event.preventDefault();
|
236 |
|
|
}
|
237 |
|
|
#ENDIF
|
238 |
|
|
|
239 |
|
|
/*
|
240 |
4c6a2323
|
Wojtek Kosior
|
* Here we block all scripts of a document which might be either an
|
241 |
7bedbcbd
|
Wojtek Kosior
|
* HTMLDocument or an XMLDocument. Modifying an XML document might disrupt
|
242 |
|
|
* Mozilla's XML preview. This is an unfortunate thing we have to accept for
|
243 |
|
|
* now. XML documents *have to* be sanitized as well because they might
|
244 |
|
|
* contain `<script>' tags (or on* attributes) with namespace declared as
|
245 |
|
|
* "http://www.w3.org/1999/xhtml" or "http://www.w3.org/2000/svg" which allows
|
246 |
|
|
* javascript execution.
|
247 |
|
|
*/
|
248 |
|
|
async function sanitize_document(doc, policy) {
|
249 |
|
|
#IF MOZILLA
|
250 |
|
|
/*
|
251 |
|
|
* Blocking of scripts that are in the DOM from the beginning. Needed for
|
252 |
|
|
* Mozilla.
|
253 |
|
|
*/
|
254 |
|
|
const listener_args = ["beforescriptexecute", prevent_script_execution];
|
255 |
|
|
doc.addEventListener(...listener_args);
|
256 |
|
|
wait_loaded(doc).then(() => doc.removeEventListener(...listener_args));
|
257 |
|
|
|
258 |
|
|
sanitize_tree_urls(doc.documentElement);
|
259 |
31cc63c2
|
Wojtek Kosior
|
sanitize_tree_onevent(doc.documentElement);
|
260 |
7bedbcbd
|
Wojtek Kosior
|
#ENDIF
|
261 |
|
|
|
262 |
|
|
/*
|
263 |
|
|
* Ensure our CSP rules are employed from the beginning. This CSP injection
|
264 |
|
|
* method is, when possible, going to be applied together with CSP rules
|
265 |
|
|
* injected using webRequest.
|
266 |
|
|
* Using elements namespaced as HTML makes this CSP injection also work for
|
267 |
|
|
* non-HTML documents.
|
268 |
|
|
*/
|
269 |
|
|
const source = `\
|
270 |
|
|
<!DOCTYPE html>
|
271 |
|
|
<html>
|
272 |
|
|
<head>
|
273 |
|
|
<meta http-equiv="Content-Security-Policy" content="${policy.csp}"/>
|
274 |
|
|
</head>
|
275 |
|
|
<body>
|
276 |
|
|
Loading...
|
277 |
|
|
</body>
|
278 |
|
|
</html>`;
|
279 |
31cc63c2
|
Wojtek Kosior
|
const temporary_html =
|
280 |
7bedbcbd
|
Wojtek Kosior
|
new DOMParser().parseFromString(source, "text/html").documentElement;
|
281 |
|
|
|
282 |
|
|
/*
|
283 |
|
|
* Root node gets hijacked now, to be re-attached after <head> is loaded
|
284 |
|
|
* and sanitized.
|
285 |
|
|
*/
|
286 |
|
|
const root = doc.documentElement;
|
287 |
31cc63c2
|
Wojtek Kosior
|
root.replaceWith(temporary_html);
|
288 |
7bedbcbd
|
Wojtek Kosior
|
|
289 |
|
|
/*
|
290 |
|
|
* When we don't inject payload, we neither block document's CSP `<meta>'
|
291 |
|
|
* tags nor wait for `<head>' to be parsed.
|
292 |
|
|
*/
|
293 |
|
|
if (policy.payload) {
|
294 |
|
|
await wait_for_head(doc, root);
|
295 |
|
|
|
296 |
|
|
root.querySelectorAll("head meta")
|
297 |
|
|
.forEach(m => sanitize_meta(m, policy));
|
298 |
|
|
}
|
299 |
|
|
|
300 |
|
|
sanitize_tree_urls(root);
|
301 |
31cc63c2
|
Wojtek Kosior
|
root.querySelectorAll("script").forEach(s => sanitize_script(s, policy));
|
302 |
|
|
temporary_html.replaceWith(root);
|
303 |
7bedbcbd
|
Wojtek Kosior
|
root.querySelectorAll("script").forEach(s => desanitize_script(s, policy));
|
304 |
31cc63c2
|
Wojtek Kosior
|
#IF MOZILLA
|
305 |
|
|
sanitize_tree_onevent(root);
|
306 |
|
|
#ENDIF
|
307 |
7bedbcbd
|
Wojtek Kosior
|
|
308 |
31cc63c2
|
Wojtek Kosior
|
start_mo_sanitizing(doc);
|
309 |
7bedbcbd
|
Wojtek Kosior
|
}
|
310 |
|
|
|
311 |
|
|
async function _disable_service_workers() {
|
312 |
|
|
if (!navigator.serviceWorker)
|
313 |
|
|
return;
|
314 |
|
|
|
315 |
|
|
const registrations = await navigator.serviceWorker.getRegistrations();
|
316 |
|
|
if (registrations.length === 0)
|
317 |
|
|
return;
|
318 |
|
|
|
319 |
|
|
console.warn("Service Workers detected on this page! Unregistering and reloading.");
|
320 |
|
|
|
321 |
|
|
try {
|
322 |
|
|
await Promise.all(registrations.map(r => r.unregister()));
|
323 |
|
|
} finally {
|
324 |
|
|
location.reload();
|
325 |
|
|
}
|
326 |
|
|
|
327 |
|
|
/* Never actually return! */
|
328 |
|
|
return new Promise(() => 0);
|
329 |
|
|
}
|
330 |
|
|
|
331 |
|
|
/*
|
332 |
|
|
* Trying to use servce workers APIs might result in exceptions, for example
|
333 |
|
|
* when in a non-HTML document. Because of this, we wrap the function that does
|
334 |
|
|
* the actual work in a try {} block.
|
335 |
|
|
*/
|
336 |
|
|
async function disable_service_workers() {
|
337 |
|
|
try {
|
338 |
|
|
await _disable_service_workers()
|
339 |
|
|
} catch (e) {
|
340 |
|
|
console.debug("Exception thrown during an attempt to detect and disable service workers.", e);
|
341 |
|
|
}
|
342 |
|
|
}
|
343 |
|
|
|
344 |
|
|
function enforce_blocking(policy) {
|
345 |
|
|
if (policy.allow)
|
346 |
|
|
return;
|
347 |
|
|
|
348 |
|
|
return Promise.all([
|
349 |
|
|
sanitize_document(document, policy),
|
350 |
|
|
disable_service_workers(),
|
351 |
|
|
wait_loaded(document)
|
352 |
|
|
]);
|
353 |
|
|
}
|
354 |
|
|
#EXPORT enforce_blocking
|