Haketilo

/**

 * Myext injecting policy to page using webRequest

 *

 * Copyright (C) 2021 Wojtek Kosior

 *

 * This code is dual-licensed under:

 * - Asshole license 1.0,

 * - GPLv3 or (at your option) any later version

 *

 * "dual-licensed" means you can choose the license you prefer.

 *

 * This code is released under a permissive license because I disapprove of

 * copyright and wouldn't be willing to sue a violator. Despite not putting

 * this code under copyleft (which is also kind of copyright), I do not want

 * it to be made proprietary. Hence, the permissive alternative to GPL is the

 * Asshole license 1.0 that allows me to call you an asshole if you use it.

 * This means you're legally ok regardless of how you utilize this code but if

 * you make it into something nonfree, you're an asshole.

 *

 * You should have received a copy of both GPLv3 and Asshole license 1.0

 * together with this code. If not, please see:

 * - https://www.gnu.org/licenses/gpl-3.0.en.html

 * - https://koszko.org/asshole-license.txt

 */

"use strict";

(() => {

    const TYPE_PREFIX = window.TYPE_PREFIX;

    const get_storage = window.get_storage;

    const browser = window.browser;

    const is_chrome = window.is_chrome;

    const gen_unique = window.gen_unique;

    const url_item = window.url_item;

    const get_query_best = window.get_query_best;

    var storage;

    var query_best;

    let csp_header_names = {

	"content-security-policy" : true,

	"x-webkit-csp" : true,

	"x-content-security-policy" : true

    };

    function is_noncsp_header(header)

    {

	return !csp_header_names[header.name.toLowerCase()];

    }

    function inject(details)

    {

	let url = url_item(details.url);

	let [pattern, settings] = query_best(url);

	if (settings !== undefined && settings.allow) {

	    console.log("allowing", url);

	    return {cancel : false};

	}

	let nonce = gen_unique(url).substring(1);

	let headers = details.responseHeaders.filter(is_noncsp_header);

	headers.push({

	    name : "content-security-policy",

	    value : `script-src 'nonce-${nonce}'; script-src-elem 'nonce-${nonce}';`

	});

	console.log("modified headers", url, headers);

	return {responseHeaders: headers};

    }

    async function start() {

	storage = await get_storage();

	query_best = await get_query_best();

	let extra_opts = ["blocking", "responseHeaders"];

	if (is_chrome)

	    extra_opts.push("extraHeaders");

	browser.webRequest.onHeadersReceived.addListener(

	    inject,

	    {

		urls: ["<all_urls>"],

		types: ["main_frame", "sub_frame"]

	    },

	    extra_opts

	);

    }

    window.start_policy_injector = start;

})();