summaryrefslogtreecommitdiff
path: root/content/main.js
AgeCommit message (Collapse)Author
2021-09-09simplify CSP handlingWojtek Kosior
All page's CSP rules are now removed when a payload is to be injected. When there is no payload, CSP rules are not modified but only supplemented with Hachette's own.
2021-09-08Fix sanitizing of non-HTML XMLDocument'sWojtek Kosior
2021-09-06re-enable sanitizing of data: URLs and also sanitize intrinsics on non-HTML ↵Wojtek Kosior
pages where CSP doesn't work
2021-09-04fix script blocking bug under ChromiumWojtek Kosior
2021-09-04merge changes before version 0.1Wojtek Kosior
2021-09-03disable payload injection on non-html pagesWojtek Kosior
2021-09-02implement rethinked <meta> tags sanitizing approachWojtek Kosior
This has not been tested yet. Additionally, functionality for blocking of `data:' urls needs to be re-enabled.
2021-09-02enable toggling of global script blocking policy\n\nThis commit also ↵Wojtek Kosior
introduces `light_storage' module which is later going to replace the storage code we use right now.\nAlso included is a hack to properly display scrollbars under Mozilla (needs testing on newer Mozilla browsers).
2021-08-27add support for `ftp://' protocolWojtek Kosior
2021-08-27enable whitelisting of `file://' protocol\n\nThis commit additionally also ↵Wojtek Kosior
changes the semantics of triple asterisk wildcard in URL path.
2021-08-26improve signing\n\nSignature timestamp is now handled in a saner way. Sha256 ↵Wojtek Kosior
implementation is no longer pulled in contexts that don't require it.
2021-08-23use StreamFilter under Mozilla to prevent csp <meta> tags from blocking our ↵Wojtek Kosior
injected scripts
2021-08-20sanitize `<meta>' tags containing CSP rules under ChromiumWojtek Kosior
This commit adds a mechanism of hijacking document when it loads and injecting sanitized nodes to the DOM from the level of content script.
2021-08-18remove unneeded policy-related cosole messages; restore IceCat 60 compatibilityWojtek Kosior
2021-08-18implement smuggling via cookies instead of URLWojtek Kosior
2021-08-14Revert changes to content/main.js to commit 25817b68c*jahoti
It turns out modifying the CSP headers in meta tags has no effect.
2021-08-02[UNTESTED- will test] Add filtering for http-equiv CSP headersjahoti
2021-07-26Remove unnecessary imports of url_item and add a CSP header-parsing functionjahoti
The parsing function isn't used yet; however, it will eventually be as a less destructive alternative to handling headers as indivisible units.
2021-07-20Merge rebranding to "Hachette"Wojtek Kosior
2021-07-20Merge commit 'ecb787046271de708b94da70240713e725299d86'Wojtek Kosior
2021-07-19Refer to the extension consistently as "Hachette" and remove TODOS.orgjahoti
from the copyright file
2021-07-18Streamline and harden unique values/settingsjahoti
The base URL is now included in the settings. The unique value no longer uses it directly, as it is included by virtue of the settings; however, the number of full hours since the epoch (UTC) is now incorporated.
2021-07-17Revamp signatures and break header caching on FFjahoti
Signatures, instead of consisting of the secure salt followed by the unique value generated from the URL, are now the unique value generated from the policy value (which will follow them) succeeded by the URL. CSP headers are now _always_ cleared on FF, regardless of whether the page is whitelisted or not. This means whitelisting takes effect on page reload, rather than only when caching occurs. However, it obviously presents security issues; refinment will occur in a future commit.
2021-07-16Use URL-based policy smugglingjahoti
Increase the power of URL-based smuggling by making it (effectively) compulsory in all cases and adapting a <salt><unique value><JSON-encoded settings> structure. While the details still need to be worked out, the potential for future expansion is there.
2021-07-12merge jahoti into masterWojtek Kosior
2021-07-12Stop using the nonce consistently for a URLjahoti
Nonces are now randomly generated, either in the page (for non-HTTP(S) pages) or by a background module which stores them by tab and frame IDs. In order to support the increased variance in nonce-generating methods and allow them to be loaded from the background, handle_page_actions is now invoked separately according to (non-)blocking mechanism.
2021-07-11Remove redundant nonce-based filtering in the script suppressorjahoti
2021-07-06show some settings of the current page in the popupWojtek Kosior
2021-07-02move parsing of url with targets to misc.jsWojtek Kosior
2021-06-30refactor 3 miscellaneous fnctionalities to a their single own fileWojtek Kosior
2021-06-30emply an sh-based build system; make some changes to blockingWojtek Kosior
2021-06-28License script-blocking techniques from NoScript in machine-readable format.jahoti
In-page blocking now works on Firefox, and JavaScript/data- URLs are properly blocked to ensure no JavaScript leaks in through backdoors. Blocking of HTML/XML data: urls should be refined (eventually) to align with current practice for pages in general. Also, script-blocking is now filtered by nonce, making it possible (albeit perhaps not desirable) to inject scripts before the DOM is complete.
2021-06-25gather all copyright info in 'copyright' fileWojtek Kosior
2021-06-18when possible inject CSP as http(s) header using webRequest instead of ↵Wojtek Kosior
adding a <meta> tag
2021-06-14change licensesWojtek Kosior
2021-05-13utilize CSP for blockingWojtek Kosior
2021-05-12use unique hashes when smuggling whitelist settingWojtek Kosior
2021-05-12stop using js modulesWojtek Kosior
2021-05-10initial commitWojtek Kosior
generated by cgit