sanitize `<meta>' tags containing CSP rules under Chromium

This commit adds a mechanism of hijacking document when it loads and injecting sanitized nodes to the DOM from the level of content script.

1 files changed, 7 insertions, 16 deletions

diff --git a/background/policy_injector.js b/background/policy_injector.js
index 702f879..3398b53 100644
--- a/background/policy_injector.js
+++ b/background/policy_injector.js
@@ -18,19 +18,12 @@
  * IMPORT query_best
  * IMPORT sanitize_csp_header
  * IMPORT csp_rule
+ * IMPORT is_csp_header_name
  * IMPORTS_END
  */
 
 var storage;
 
-const csp_header_names = new Set([
-    "content-security-policy",
-    "x-webkit-csp",
-    "x-content-security-policy"
-]);
-
-const report_only = "content-security-policy-report-only";
-
 function headers_inject(details)
 {
     const url = details.url;
@@ -40,7 +33,6 @@ function headers_inject(details)
     const [pattern, settings] = query_best(storage, url);
     const allow = !!(settings && settings.allow);
     const nonce = gen_nonce();
-    const rule = `'nonce-${nonce}'`;
 
     let orig_csp_headers;
     let old_signature;
@@ -70,20 +62,19 @@ function headers_inject(details)
     }
 
     orig_csp_headers = orig_csp_headers ||
-	headers.filter(h => csp_header_names.has(h.name.toLowerCase()));
-    headers = headers.filter(h => !csp_header_names.has(h.name.toLowerCase()));
+	headers.filter(h => is_csp_header_name(h.name));
 
-    /* Remove headers that only snitch on us */
-    if (!allow)
-	headers = headers.filter(h => h.name.toLowerCase() !== report_only);
+    /* When blocking remove report-only CSP headers that snitch on us. */
+    headers = headers.filter(h => !is_csp_header_name(h.name, !allow));
 
     if (old_signature)
 	headers = headers.filter(h => h.name.search(old_signature) === -1);
 
-    const sanitizer = h => sanitize_csp_header(h, rule, allow);
+    const policy_object = {allow, nonce, url};
+    const sanitizer = h => sanitize_csp_header(h, policy_object);
     headers.push(...orig_csp_headers.map(sanitizer));
 
-    const policy = encodeURIComponent(JSON.stringify({allow, nonce, url}));
+    const policy = encodeURIComponent(JSON.stringify(policy_object));
     const policy_signature = sign_data(policy, new Date());
     const later_30sec = new Date(new Date().getTime() + 30000).toGMTString();
     headers.push({