aboutsummaryrefslogtreecommitdiff
path: root/background
AgeCommit message (Collapse)Author
2021-07-20Merge commit 'ecb787046271de708b94da70240713e725299d86'Wojtek Kosior
2021-07-18Streamline and harden unique values/settingsjahoti
The base URL is now included in the settings. The unique value no longer uses it directly, as it is included by virtue of the settings; however, the number of full hours since the epoch (UTC) is now incorporated.
2021-07-17Revamp signatures and break header caching on FFjahoti
Signatures, instead of consisting of the secure salt followed by the unique value generated from the URL, are now the unique value generated from the policy value (which will follow them) succeeded by the URL. CSP headers are now _always_ cleared on FF, regardless of whether the page is whitelisted or not. This means whitelisting takes effect on page reload, rather than only when caching occurs. However, it obviously presents security issues; refinment will occur in a future commit.
2021-07-16Use URL-based policy smugglingjahoti
Increase the power of URL-based smuggling by making it (effectively) compulsory in all cases and adapting a <salt><unique value><JSON-encoded settings> structure. While the details still need to be worked out, the potential for future expansion is there.
2021-07-12merge jahoti into masterWojtek Kosior
2021-07-12Stop using the nonce consistently for a URLjahoti
Nonces are now randomly generated, either in the page (for non-HTTP(S) pages) or by a background module which stores them by tab and frame IDs. In order to support the increased variance in nonce-generating methods and allow them to be loaded from the background, handle_page_actions is now invoked separately according to (non-)blocking mechanism.
2021-07-06Merge popup displayWojtek Kosior
2021-07-06show some settings of the current page in the popupWojtek Kosior
2021-07-04Revamp default settingsjahoti
Default settings are now provided in the same format as data exported from the extension, incorporating them into the main program as part of the build process. Also, modify their contents; the apparently non-functional FSF stuff is gone, replaced with fixes for BandCamp, WorldCat, and SumOfUs.
2021-06-30fix whitelisting under FirefoxWojtek Kosior
2021-06-30refactor 3 miscellaneous fnctionalities to a their single own fileWojtek Kosior
2021-06-30emply an sh-based build system; make some changes to blockingWojtek Kosior
2021-06-25gather all copyright info in 'copyright' fileWojtek Kosior
2021-06-23Fix storage initialization on Icecat 60jahoti
This patch fixes storage initialization on Gecko browsers by switching from using a background page to using a list of scripts. It remains a mystery why that should have any effect; the only hint is that browser.runtime.onInstalled does not fire when called from a script loaded in a background page. Signed-off-by: jahoti <jahoti@tilde.team>
2021-06-18remove unused source filesWojtek Kosior
2021-06-18when possible inject CSP as http(s) header using webRequest instead of ↵Wojtek Kosior
adding a <meta> tag
2021-06-14change licensesWojtek Kosior
2021-05-14support wildcard urls in settingsWojtek Kosior
2021-05-13only allow a single injection payload for page, rely on script bags for ↵Wojtek Kosior
complex payloads
2021-05-12rename "bundles" to "bags"Wojtek Kosior
2021-05-12use unique hashes when smuggling whitelist settingWojtek Kosior
2021-05-12stop using js modulesWojtek Kosior
2021-05-12remove remnants of LibreJSWojtek Kosior
2021-05-10initial commitWojtek Kosior
generated by cgit