Haketilo

/**

 * This file is part of Haketilo.

 *

 * Function: Filtering request headers to remove haketilo cookies that might

 *     have slipped through.

 *

 * Copyright (C) 2021 Wojtek Kosior

 * Redistribution terms are gathered in the `copyright' file.

 */

/*

 * IMPORTS_START

 * IMPORT extract_signed

 * IMPORTS_END

 */

function is_valid_haketilo_cookie(cookie)

{

    const match = /^haketilo-(\w*)=(.*)$/.exec(cookie);

    if (!match)

	return false;

    return !extract_signed(match.slice(1, 3)).fail;

}

function remove_haketilo_cookies(header)

{

    if (header.name !== "Cookie")

	return header;

    const cookies = header.value.split("; ");

    const value = cookies.filter(c => !is_valid_haketilo_cookie(c)).join("; ");

    return value ? {name: "Cookie", value} : null;

}

function filter_cookie_headers(headers)

{

    return headers.map(remove_haketilo_cookies).filter(h => h);

}

/*

 * EXPORTS_START

 * EXPORT filter_cookie_headers

 * EXPORTS_END

 */

 * IMPORT gen_nonce

 * IMPORT filter_cookie_headers

function on_headers_received(details)

    const [pattern, settings] = query_best(storage, details.url);

    const has_payload = !!(settings && settings.components);

    const allow = !has_payload &&

	  !!(settings ? settings.allow : policy_observable.value);

    const nonce = gen_nonce();

    const policy = {allow, url, nonce, has_payload};

    headers = inject_csp_headers(headers, policy);

function on_before_send_headers(details)

    let headers = details.requestHeaders;

    headers = filter_cookie_headers(headers);

    return {requestHeaders: headers};

	on_headers_received,

    browser.webRequest.onBeforeSendHeaders.addListener(

	on_before_send_headers,

	{urls: ["<all_urls>"], types: all_types},

	extra_opts.concat("requestHeaders")

 * IMPORT query_best

let policy_observable;

function send_actions(url, port)

{

    const [pattern, queried_settings] = query_best(storage, url);

    const settings = {allow: policy_observable && policy_observable.value};

    Object.assign(settings, queried_settings);

    if (settings.components)

	settings.allow = false;

    const repos = storage.get_all(TYPE_PREFIX.REPO);

    port.postMessage(["settings", [pattern, settings, repos]]);

    const components = settings.components;

    const processed_bags = new Set();

    if (components !== undefined)

	send_scripts([components], port, processed_bags);

}

    let url = message.url;

    console.log({url});

    send_actions(url, port);

    policy_observable = await light_storage.observe_var("default_allow");

 * IMPORT sign_data

 * IMPORT extract_signed

    let old_signature;

    let haketilo_header;

    for (const header of headers.filter(h => h.name === "x-haketilo")) {

	/* x-haketilo header has format: <signature>_0_<data> */

	const match = /^([^_]+)_(0_.*)$/.exec(header.value);

	if (!match)

	    continue;

	const result = extract_signed(...match.slice(1, 3));

	if (result.fail)

	    continue;

	/* This should succeed - it's our self-produced valid JSON. */

	const old_data = JSON.parse(decodeURIComponent(result.data));

	/* Confirmed- it's the originals, smuggled in! */

	csp_headers = old_data.csp_headers;

	old_signature = old_data.policy_sig;

	haketilo_header = header;

	break;

    if (policy.has_payload) {

	csp_headers = [];

	const non_csp_headers = [];

	const header_list =

	      h => csp_header_regex.test(h) ? csp_headers : non_csp_headers;

	headers.forEach(h => header_list(h.name).push(h));

	headers = non_csp_headers;

    } else {

	headers.push(...csp_headers || []);

    }

    if (!haketilo_header) {

	haketilo_header = {name: "x-haketilo"};

	headers.push(haketilo_header);

    }

    if (old_signature)

	headers = headers.filter(h => h.value.search(old_signature) === -1);

    const policy_str = encodeURIComponent(JSON.stringify(policy));

    const signed_policy = sign_data(policy_str, new Date().getTime());

    const later_30sec = new Date(new Date().getTime() + 30000).toGMTString();

    headers.push({

	name: "Set-Cookie",

	value: `haketilo-${signed_policy.join("=")}; Expires=${later_30sec};`

    });

    /*

     * Smuggle in the signature and the original CSP headers for future use.

     * These are signed with a time of 0, as it's not clear there is a limit on

     * how long Firefox might retain headers in the cache.

     */

    let haketilo_data = {csp_headers, policy_sig: signed_policy[0]};

    haketilo_data = encodeURIComponent(JSON.stringify(haketilo_data));

    haketilo_header.value = sign_data(haketilo_data, 0).join("_");

    if (!policy.allow) {

	const dummy_script =

	      `<script data-haketilo-deleteme="${properties.policy.nonce}" nonce="${properties.policy.nonce}">null</script>`;

    if (!policy.has_payload)

    properties.policy = policy;

    CHROMIUM_KEY=''

	CHROMIUM_KEY="$(dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64)"

	CHROMIUM_KEY=$(echo chromium-key-dummy-file-$CHROMIUM_KEY | tr / -)

	touch "$BUILDDIR"/$CHROMIUM_KEY

	CHROMIUM_KEY="\n\

	// WARNING!!!\n\

	// EACH USER SHOULD REPLACE DUMMY FILE's VALUE WITH A UNIQUE ONE!!!\n\

	// OTHERWISE, SECURITY CAN BE TRIVIALLY COMPROMISED!\n\

	// Only relevant to users of chrome-based browsers.\n\

	// Users of Firefox forks are safe.\n\

	\"$CHROMIUM_KEY\"\

"

s^_CHROMIUM_KEY_^$CHROMIUM_KEY^

    const script_src = policy.has_payload ?

/**

 * This file is part of Haketilo.

 *

 * Functions: Operations related to "signing" of data.

 *

 * Copyright (C) 2021 Wojtek Kosior

 * Redistribution terms are gathered in the `copyright' file.

 */

/*

 * IMPORTS_START

 * IMPORT sha256

 * IMPORT browser

 * IMPORT is_mozilla

 * IMPORTS_END

 */

/*

 * In order to make certain data synchronously accessible in certain contexts,

 * Haketilo smuggles it in string form in places like cookies, URLs and headers.

 * When using the smuggled data, we first need to make sure it isn't spoofed.

 * For that, we use this pseudo-signing mechanism.

 *

 * Despite what name suggests, no assymetric cryptography is involved, as it

 * would bring no additional benefits and would incur bigger performance

 * overhead. Instead, we hash the string data together with some secret value

 * that is supposed to be known only by this browser instance. Resulting hash

 * sum plays the role of the signature. In the hash we also include current

 * time. This way, even if signed data leaks (which shouldn't happen in the

 * first place), an attacker won't be able to re-use it indefinitely.

 *

 * The secret shared between execution contexts has to be available

 * synchronously. Under Mozilla, this is the extension's per-session id. Under

 * Chromium, this is a dummy web-accessible-resource name that resides in the

 * manifest and is supposed to be constructed by each user using a unique value

 * (this is done automatically by `build.sh').

 */

function get_secret()

{

    if (is_mozilla)

	return browser.runtime.getURL("dummy");

    return chrome.runtime.getManifest().web_accessible_resources

	.map(r => /^chromium-key-dummy-file-(.*)/.exec(r)).filter(r => r)[0][1];

}

function extract_signed(signature, signed_data)

{

    const match = /^([1-9][0-9]{12}|0)_(.*)$/.exec(signed_data);

    if (!match)

	return {fail: "bad format"};

    const result = {time: parseInt(match[1]), data: match[2]};

    if (sign_data(result.data, result.time)[0] !== signature)

	result.fail = "bad signature";

    return result;

}

/*

 * Sign a given string for a given time. Time should be either 0 or in the range

 * 10^12 <= time < 10^13.

 */

function sign_data(data, time) {

    return [sha256(get_secret() + time + data), `${time}_${data}`];

}

/*

 * EXPORTS_START

 * EXPORT extract_signed

 * EXPORT sign_data

 * EXPORTS_END

 */

    report_activity("settings", settings);

 * IMPORT extract_signed

 * IMPORT sign_data

function extract_cookie_policy(cookie, min_time)

{

    let best_result = {time: -1};

    let policy = null;

    const extracted_signatures = [];

    for (const match of cookie.matchAll(/haketilo-(\w*)=([^;]*)/g)) {

	const new_result = extract_signed(...match.slice(1, 3));

	if (new_result.fail)

	    continue;

	extracted_signatures.push(match[1]);

	if (new_result.time < Math.max(min_time, best_result.time))

	    continue;

	/* This should succeed - it's our self-produced valid JSON. */

	const new_policy = JSON.parse(decodeURIComponent(new_result.data));

	if (new_policy.url !== document.URL)

	    continue;

	best_result = new_result;

	policy = new_policy;

    }

    return [policy, extracted_signatures];

}

function extract_url_policy(url, min_time)

{

    const [base_url, payload, anchor] =

	  /^([^#]*)#?([^#]*)(#?.*)$/.exec(url).splice(1, 4);

    const match = /^haketilo_([^_]+)_(.*)$/.exec(payload);

    if (!match)

	return [null, url];

    const result = extract_signed(...match.slice(1, 3));

    if (result.fail)

	return [null, url];

    const original_url = base_url + anchor;

    const policy = result.time < min_time ? null :

	  JSON.parse(decodeURIComponent(result.data));

    return [policy.url === original_url ? policy : null, original_url];

}

function employ_nonhttp_policy(policy)

{

    if (!policy.allow)

	return;

    policy.nonce = gen_nonce();

    const [base_url, target] = /^([^#]*)(#?.*)$/.exec(policy.url).slice(1, 3);

    const encoded_policy = encodeURIComponent(JSON.stringify(policy));

    const payload = "haketilo_" +

	  sign_data(encoded_policy, new Date().getTime()).join("_");

    const resulting_url = `${base_url}#${payload}${target}`;

    location.href = resulting_url;

    location.reload();

}

async function disable_service_workers()

    console.warn("Service Workers detected on this page! Unregistering and reloading");

if (!is_privileged_url(document.URL)) {

    let policy_received_callback = () => undefined;

    let policy;

    /* Signature valid for half an hour. */

    const min_time = new Date().getTime() - 1800 * 1000;

    if (/^https?:/.test(document.URL)) {

	let signatures;

	[policy, signatures] = extract_cookie_policy(document.cookie, min_time);

	for (const signature of signatures)

	    document.cookie = `haketilo-${signature}=; Max-Age=-1;`;

    } else {

	const scheme = /^([^:]*)/.exec(document.URL)[1];

	const known_scheme = ["file", "ftp"].includes(scheme);

	if (!known_scheme)

	    console.warn(`Unknown url scheme: \`${scheme}'!`);

	let original_url;

	[policy, original_url] = extract_url_policy(document.URL, min_time);

	history.replaceState(null, "", original_url);

	if (known_scheme && !policy)

	    policy_received_callback = employ_nonhttp_policy;

    if (!policy) {

	console.debug("Using fallback policy!");

	policy = {allow: false, nonce: gen_nonce()};

	policy.has_payload = false;

    handle_page_actions(policy.nonce, policy_received_callback, doc_ready);

 * IMPORT report_settings

let policy_received_callback;

let nonce;

    if (action === "settings") {

	report_settings(data);

	policy_received_callback({url, allow: data[1].allow});

    script.setAttribute("nonce", nonce);

function handle_page_actions(script_nonce, policy_received_cb,

			     doc_ready_promise) {

    policy_received_callback = policy_received_cb;

    port = browser.runtime.connect({name : CONNECTION_TYPE.PAGE_ACTIONS});

    port.onMessage.addListener(handle_message);

    port.postMessage({url});

    nonce = script_nonce;

	let [pattern, settings] = data;

	if (pattern) {

		  () => open_in_settings(TYPE_PREFIX.PAGE, pattern);

	const components = settings.components;

	if (components) {

	    payload_span.textContent = nice_name(...components);

	    const settings_opener = () => open_in_settings(...components);

    "web_accessible_resources": [_CHROMIUM_KEY_

    ],