/ - Diff - Haketilo - Hydrilla issue tracker

« Previous | Next »

Revision 692577bb

Added by jahoti about 2 years ago

ID 692577bbde5e8110855c022ec913324dfddce9ae
Parent 0e002513
Child 8b823e1a

Use URL-based policy smuggling

Increase the power of URL-based smuggling by making it (effectively)
compulsory in all cases and adapting a structure. While the details still need to be worked out, the
potential for future expansion is there.

      * Myext injecting policy to page using webRequest
+     *
      * Copyright (C) 2021 Wojtek Kosior
      * Copyright (C) 2021 jahoti
      * Redistribution terms are gathered in the `copyright' file.
      */
-...
      * IMPORT browser
      * IMPORT is_chrome
      * IMPORT gen_unique
      * IMPORT gen_nonce
      * IMPORT url_item
      * IMPORT url_extract_policy
      * IMPORT get_query_best
      * IMPORT csp_rule
      * IMPORTS_END
-...
         return header.value === rule
+    }
     function inject(details)
     function url_inject(details)
+    {
         const url = url_item(details.url);
         const targets = url_extract_policy(details.url);
         if (targets.policy) {
     	return;
         } else if (targets.signed) {
     	/* Redirect; update policy */
     	targets.target = targets.target2;
     	delete targets.target2
+        }
         let redirect_url = targets.base_url + targets.sig;
         let [pattern, settings] = query_best(targets.base_url);
         if (!pattern)
     	/* Defaults */
     	settings = {};
         const policy = {allow: settings.allow, nonce: gen_nonce()};
         redirect_url += encodeURIComponent(JSON.stringify(policy));
         if (targets.target)
     	redirect_url += targets.target;
         if (targets.target2)
     	redirect_url += targets.target2;
         return {redirectUrl: redirect_url};
+    }
         const [pattern, settings] = query_best(url);
     function inject(details)
+    {
         const targets = url_extract_policy(details.url);
         if (!targets.policy)
     	/* Block unsigned requests */
     	return {cancel: true};
         const nonce = gen_unique(url);
         const rule = csp_rule(nonce);
         const rule = csp_rule(targets.policy.nonce);
         var headers;
         if (settings !== undefined && settings.allow) {
         if (targets.policy.allow) {
     	/*
     	 * Chrome doesn't have the buggy behavior of repeatedly injecting a
     	 * header we injected once. Firefox does and we have to remove it there.
-...
         if (is_chrome)
     	extra_opts.push("extraHeaders");
         browser.webRequest.onBeforeRequest.addListener(
     	url_inject,
+    	{
     	    urls: ["<all_urls>"],
     	    types: ["main_frame", "sub_frame"]
     	},
     	["blocking"]
         );
         browser.webRequest.onHeadersReceived.addListener(
     	inject,
+    	{

      * Myext miscellaneous operations refactored to a separate file
+     *
      * Copyright (C) 2021 Wojtek Kosior
      * Copyright (C) 2021 jahoti
      * Redistribution terms are gathered in the `copyright' file.
      */
-...
      * IMPORTS_END
      */
     /* Generate a random base64-encoded 128-bit sequence */
     function gen_nonce()
+    {
         let randomData = new Uint8Array(16);
         crypto.getRandomValues(randomData);
         return btoa(String.fromCharCode.apply(null, randomData));
+    }
     /*
      * generating unique, per-site value that can be computed synchronously
      * and is impossible to guess for a malicious website
-...
     function get_secure_salt()
+    {
         if (is_chrome)
     	return browser.runtime.getManifest().key.substring(0, 50);
     	return browser.runtime.getManifest().key.substring(0, 36);
         else
     	return browser.runtime.getURL("dummy");
     	return browser.runtime.getURL("dummy").substr(16, 36);
+    }
     /*
-...
         return !!/^(chrome(-extension)?|moz-extension):\/\/|^about:/i.exec(url);
+    }
     /* Extract any policy present in the URL */
     function url_extract_policy(url)
+    {
         const targets = url_extract_target(url);
         const key = '#' + get_secure_salt();
         targets.sig = key + gen_unique(targets.base_url);
         if (targets.target && targets.target.startsWith(key)) {
     	targets.signed = true;
     	if (targets.target.startsWith(targets.sig))
     	    try {
     		const policy_string = targets.target.substring(101);
     		targets.policy = JSON.parse(decodeURIComponent(policy_string));
     	    } catch (e) {
     		/* TODO what should happen here? */
+    	    }
+        }
         return targets;
+    }
     /*
      * EXPORTS_START
      * EXPORT gen_nonce
      * EXPORT gen_unique
      * EXPORT url_item
      * EXPORT url_extract_target
      * EXPORT url_extract_policy
      * EXPORT csp_rule
      * EXPORT nice_name
      * EXPORT open_in_settings

      * Myext main content script run in all frames
+     *
      * Copyright (C) 2021 Wojtek Kosior
      * Copyright (C) 2021 jahoti
      * Redistribution terms are gathered in the `copyright' file.
      */
-...
      * IMPORT handle_page_actions
      * IMPORT url_item
      * IMPORT url_extract_target
      * IMPORT url_extract_policy
      * IMPORT gen_unique
      * IMPORT gen_nonce
      * IMPORT csp_rule
      * IMPORT is_privileged_url
      * IMPORT sanitize_attributes
-...
      * urls has not yet been added to the extension.
      */
     let url = url_item(document.URL);
     let unique = gen_unique(url);
     function is_http()
+    {
         return !!/^https?:\/\//i.exec(document.URL);
+    }
     function is_whitelisted()
+    {
         const parsed_url = url_extract_target(document.URL);
         if (parsed_url.target !== undefined &&
     	parsed_url.target === '#' + unique) {
     	if (parsed_url.target2 !== undefined)
     	    window.location.href = parsed_url.base_url + parsed_url.target2;
     	else
     	    history.replaceState(null, "", parsed_url.base_url);
     	return true;
+        }
         return false;
+    }
     function handle_mutation(mutations, observer)
+    {
         if (document.readyState === 'complete') {
-...
         let meta = document.createElement("meta");
         meta.setAttribute("http-equiv", "Content-Security-Policy");
         meta.setAttribute("content", csp_rule(unique));
         meta.setAttribute("content", csp_rule(nonce));
         if (head.firstElementChild === null)
     	head.appendChild(meta);
-...
+    }
     if (!is_privileged_url(document.URL)) {
         const targets = url_extract_policy(document.URL);
         targets.policy = targets.policy || {};
         const nonce = targets.policy.nonce || gen_nonce();
         if (targets.signed)
     	if (targets.target2 !== undefined)
     	    window.location.href = targets.base_url + targets.target2;
     	else
     	    history.replaceState(null, "", targets.base_url);
         start_activity_info_server();
         handle_page_actions(unique);
         handle_page_actions(nonce);
         if (is_http()) {
     	/* rely on CSP injected through webRequest */
         } else if (is_whitelisted()) {
     	/* do not block scripts at all */
         } else {
         if (!targets.policy.allow) {
     	block_nodes_recursively(document.documentElement);
     	if (is_chrome) {

     Copyright: 2021 Wojtek Kosior <koszko@koszko.org>
     License: CC0
     Files: manifest.json
     Files: manifest.json background/policy_injector.js common/misc.js content/main.js
     Copyright: 2021 Wojtek Kosior <koszko@koszko.org>
 jahoti <jahoti@tilde.team>
     License: GPL-3+-javascript or Alicense-1.0

Also available in: Unified diff

Project

General

Profile

Haketilo

Revision 692577bb

Added by jahoti about 2 years ago