aboutsummaryrefslogtreecommitdiff
path: root/common
diff options
context:
space:
mode:
Diffstat (limited to 'common')
-rw-r--r--common/gen_unique.js33
-rw-r--r--common/misc.js59
-rw-r--r--common/url_item.js19
3 files changed, 59 insertions, 52 deletions
diff --git a/common/gen_unique.js b/common/gen_unique.js
deleted file mode 100644
index 7ec8b4a..0000000
--- a/common/gen_unique.js
+++ /dev/null
@@ -1,33 +0,0 @@
-/**
- * Myext generating unique, per-site hash
- *
- * Copyright (C) 2021 Wojtek Kosior
- * Redistribution terms are gathered in the `copyright' file.
- */
-
-/*
- * IMPORTS_START
- * IMPORT sha256
- * IMPORT browser
- * IMPORT is_chrome
- * IMPORTS_END
- */
-
-function get_id()
-{
- if (is_chrome)
- return browser.runtime.getManifest().key.substring(0, 50);
- else
- return browser.runtime.getURL("dummy");
-}
-
-function gen_unique(url)
-{
- return "#" + sha256(get_id() + url);
-}
-
-/*
- * EXPORTS_START
- * EXPORT gen_unique
- * EXPORTS_END
- */
diff --git a/common/misc.js b/common/misc.js
new file mode 100644
index 0000000..5754bd0
--- /dev/null
+++ b/common/misc.js
@@ -0,0 +1,59 @@
+/**
+ * Myext miscellaneous operations refactored to a separate file
+ *
+ * Copyright (C) 2021 Wojtek Kosior
+ * Redistribution terms are gathered in the `copyright' file.
+ */
+
+/*
+ * IMPORTS_START
+ * IMPORT sha256
+ * IMPORT browser
+ * IMPORT is_chrome
+ * IMPORTS_END
+ */
+
+/*
+ * generating unique, per-site value that can be computed synchronously
+ * and is impossible to guess for a malicious website
+ */
+function gen_unique(url)
+{
+ return sha256(get_secure_salt() + url);
+}
+
+function get_secure_salt()
+{
+ if (is_chrome)
+ return browser.runtime.getManifest().key.substring(0, 50);
+ else
+ return browser.runtime.getURL("dummy");
+}
+
+/*
+ * stripping url from query and target (everything after `#' or `?'
+ * gets removed)
+ */
+function url_item(url)
+{
+ let url_re = /^([^?#]*).*$/;
+ let match = url_re.exec(url);
+ return match[1];
+}
+
+/* csp rule that blocks all scripts except for those injected by us */
+function csp_rule(nonce)
+{
+ let rule = `script-src 'nonce-${nonce}';`;
+ if (is_chrome)
+ rule += `script-src-elem 'nonce-${nonce}';`;
+ return rule;
+}
+
+/*
+ * EXPORTS_START
+ * EXPORT gen_unique
+ * EXPORT url_item
+ * EXPORT csp_rule
+ * EXPORTS_END
+ */
diff --git a/common/url_item.js b/common/url_item.js
deleted file mode 100644
index 102f117..0000000
--- a/common/url_item.js
+++ /dev/null
@@ -1,19 +0,0 @@
-/**
- * Myext stripping url from query and target
- *
- * Copyright (C) 2021 Wojtek Kosior
- * Redistribution terms are gathered in the `copyright' file.
- */
-
-function url_item(url)
-{
- let url_re = /^([^?#]*).*$/;
- let match = url_re.exec(url);
- return match[1];
-}
-
-/*
- * EXPORTS_START
- * EXPORT url_item
- * EXPORTS_END
- */