Project

General

Profile

« Previous | Next » 

Revision c12b9ee3

Added by koszko about 2 years ago

disable payload injection on non-html pages

View differences:

content/page_actions.js
11 11 
 * IMPORT browser
12 12 
 * IMPORT report_script
13 13 
 * IMPORT report_settings
14 
 * IMPORT report_content_type
14 15 
 * IMPORTS_END
15 16 
 */
16 17 

  		




  17
  18
  
    
let policy_received_callback;


  		




  18
  
  
    
/* Snapshot url early because document.URL can be changed by other code. */


  		




  
  19
  
    
/* Snapshot url and content type early; these can be changed by other code. */


  		




  19
  20
  
    
let url;


  		




  
  21
  
    
let is_html;


  		




  20
  22
  
    
let port;


  		




  21
  23
  
    
let loaded = false;


  		




  22
  24
  
    
let scripts_awaiting = [];


  		




  ......




  52
  54
  
    

  		




  53
  55
  
    
function add_script(script_text)


  		




  54
  56
  
    
{


  		




  
  57
  
    
    if (!is_html)


  		




  
  58
  
    
	return;


  		




  
  59
  
    

  		




  55
  60
  
    
    let script = document.createElement("script");


  		




  56
  61
  
    
    script.textContent = script_text;


  		




  57
  62
  
    
    script.setAttribute("nonce", nonce);


  		




  ......




  64
  69
  
    
function handle_page_actions(script_nonce, policy_received_cb) {


  		




  65
  70
  
    
    policy_received_callback = policy_received_cb;


  		




  66
  71
  
    
    url = document.URL;


  		




  
  72
  
    
    is_html = /html/.test(document.contentType);


  		




  
  73
  
    
    report_content_type(document.contentType);


  		




  67
  74
  
    

  		




  68
  75
  
    
    document.addEventListener("DOMContentLoaded", document_loaded);


  		




  69
  76
  
    
    port = browser.runtime.connect({name : CONNECTION_TYPE.PAGE_ACTIONS});


  		












Also available in:  Unified diff