Haketilo

 * IMPORT sign_data

function extract_cookie_policy(cookie, min_time)

{

    for (const match of cookie.matchAll(/hachette-(\w*)=([^;]*)/g)) {

    return [policy, extracted_signatures];

}

function extract_url_policy(url, min_time)

{

    const [base_url, payload, anchor] =

	  /^([^#]*)#?([^#]*)(#?.*)$/.exec(url).splice(1, 4);

    const match = /^hachette_([^_]+)_(.*)$/.exec(payload);

    if (!match)

	return [null, url];

    const result = extract_signed(...match.slice(1, 3));

    if (result.fail)

	return [null, url];

    const original_url = base_url + anchor;

    const policy = result.time < min_time ? null :

	  JSON.parse(decodeURIComponent(result.data));

    return [policy.url === original_url ? policy : null, original_url];

}

function employ_nonhttp_policy(policy)

{

    if (!policy.allow)

	return;

    policy.nonce = gen_nonce();

    const [base_url, target] = /^([^#]*)(#?.*)$/.exec(policy.url).slice(1, 3);

    const encoded_policy = encodeURIComponent(JSON.stringify(policy));

    const payload = "hachette_" +

	  sign_data(encoded_policy, new Date().getTime()).join("_");

    const resulting_url = `${base_url}#${payload}${target}`;

    location.href = resulting_url;

    location.reload();

}

if (!is_privileged_url(document.URL)) {

    let policy_received_callback = () => undefined;

    let policy;

    /* Signature valid for half an hour. */

    const min_time = new Date().getTime() - 1800 * 1000;

    if (/^https?:/.test(document.URL)) {

	let signatures;

	[policy, signatures] = extract_cookie_policy(document.cookie, min_time);

	for (const signature of signatures)

	    document.cookie = `hachette-${signature}=; Max-Age=-1;`;

    } else {

	const scheme = /^([^:]*)/.exec(document.URL)[1];

	const known_scheme = ["file"].includes(scheme);

	if (!known_scheme)

	    console.warn(`Unknown url scheme: \`${scheme}'!`);

	let original_url;

	[policy, original_url] = extract_url_policy(document.URL, min_time);

	history.replaceState(null, "", original_url);

	if (known_scheme && !policy)

	    policy_received_callback = employ_nonhttp_policy;

    }

	console.warn("Using default policy!");

    handle_page_actions(policy.nonce, policy_received_callback);

	if (is_mozilla) {

	    const script = document.querySelector("script");

	    if (script)

		script.textContent = "throw 'blocked';\n" + script.textContent;

	}