From 6b53d6c840140fc5df6d7638808b978d96502a35 Mon Sep 17 00:00:00 2001
From: Wojtek Kosior <koszko@koszko.org>
Date: Mon, 23 Aug 2021 11:05:51 +0200
Subject: use StreamFilter under Mozilla to prevent csp <meta> tags from
 blocking our injected scripts

---
 background/stream_filter.js | 176 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 176 insertions(+)
 create mode 100644 background/stream_filter.js

(limited to 'background/stream_filter.js')

diff --git a/background/stream_filter.js b/background/stream_filter.js
new file mode 100644
index 0000000..2dce811
--- /dev/null
+++ b/background/stream_filter.js
@@ -0,0 +1,176 @@
+/**
+ * Hachette modifying a web page using the StreamFilter API
+ *
+ * Copyright (C) 2018 Giorgio Maone <giorgio@maone.net>
+ * Copyright (C) 2021 Wojtek Kosior
+ * Redistribution terms are gathered in the `copyright' file.
+ *
+ * Derived from `bg/ResponseProcessor.js' and `bg/ResponseMetaData.js'
+ * in LibreJS.
+ */
+
+/*
+ * IMPORTS_START
+ * IMPORT browser
+ * IMPORTS_END
+ */
+
+function validate_encoding(charset)
+{
+    try {
+	new TextDecoder();
+	return charset;
+    } catch(e) {
+	return undefined;
+    }
+}
+
+function is_content_type_header(header)
+{
+    header.name.toLowerCase().trim() === "content-type";
+}
+
+const charset_reg = /;\s*charset\s*=\s*([\w-]+)/i;
+
+function properties_from_headers(headers)
+{
+    const properties = {};
+
+    for (const header of headers.filter(is_content_type_header)) {
+	const match = charset_reg.exec(header.value);
+	if (!properties.detected_charset && validate_encoding(match[1]))
+	    properties.detected_charset = match[1];
+
+	if (/html/i.test(header.value))
+	    properties.html = true;
+    }
+
+    return properties;
+}
+
+const UTF8_BOM = [0xef, 0xbb, 0xbf];
+const BOMs = [
+    [UTF8_BOM, "utf-8"],
+    [[0xfe, 0xff], "utf-16be"],
+    [[0xff, 0xfe], "utf-16le"]
+];
+
+function charset_from_BOM(data)
+{
+    for (const [BOM, charset] of BOMs) {
+	if (BOM.reduce((ac, byte, i) => ac && byte === data[i], true))
+	    return charset;
+    }
+
+    return "";
+}
+
+const charset_attrs =
+      ['charset', 'http-equiv="content-type"', 'content*="charset"'];
+const charset_meta_selector =
+      charset_attrs.map(a => `head>meta[${a}]`).join(", ");
+
+function charset_from_meta_tags(doc)
+{
+    for (const meta of doc.querySelectorAll(charset_meta_selector)) {
+	const maybe_charset = meta.getAttribute("charset");
+	if (maybe_charset && validate_encoding(maybe_charset))
+	    return maybe_charset;
+
+        const match = charset_reg.exec(meta.getAttribute("content"));
+        if (match && validate_encoding(match[1]))
+	    return match[1];
+    }
+
+    return undefined;
+}
+
+function create_decoder(properties, data)
+{
+    let charset = charset_from_BOM(data) || properties.detected_charset;
+    if (!charset && data.indexOf(0) !== -1) {
+        console.debug("Warning: zeroes in bytestream, probable cached encoding mismatch. Trying to decode it as UTF-16.",
+		      properties);
+	return new TextDecoder("utf-16be");
+    }
+
+    /* Missing HTTP charset, sniffing in content... */
+    /*
+     * TODO: I recall there is some standard saying how early in the doc the
+     * charset has to be specified. We could process just this part of data.
+     */
+    const text = new TextDecoder("latin1").decode(data, {stream: true});
+    properties.html = properties.html || /html/i.test(text);
+
+    if (properties.html) {
+	const tmp_doc = new DOMParser().parseFromString(text, "text/html");
+	charset = charset_from_meta_tags(tmp_doc);
+    }
+
+    return new TextDecoder(charset || "latin1");
+}
+
+function filter_data(properties, event)
+{
+    const data = new Uint8Array(event.data);
+    let first_chunk = false;
+    if (!properties.decoder) {
+	first_chunk = true;
+	properties.decoder = create_decoder(properties, data);
+	properties.encoder = new TextEncoder();
+	/* Force UTF-8, this is the only encoding we can produce. */
+	properties.filter.write(new Uint8Array(UTF8_BOM));
+    }
+
+    let decoded = properties.decoder.decode(data);
+
+    if (first_chunk) {
+	/*
+	 * HAX! Our content scripts that execute at `document_start' will always
+	 * run before the first script in the document, but under Mozilla some
+	 * `<meta>' tags might already be loaded at that point. Here we inject a
+	 * dummy `<script>' at the beginning (before any `<meta>' tags) that
+	 * will force `document_start' to happen earlier. This way our content
+	 * scripts will be able to sanitize `http-equiv' tags with CSP rules
+	 * that would otherwise stop our injected scripts from executing.
+	 */
+	const dummy_script =
+	      `<script data-hachette-deleteme="${properties.policy.nonce}" nonce="${properties.policy.nonce}">null</script>`;
+	const doctype_decl = /^(\s*<!doctype[^<>"']*>)?/i.exec(decoded)[0];
+	decoded = doctype_decl + dummy_script +
+	    decoded.substring(doctype_decl.length);
+    }
+
+    properties.filter.write(properties.encoder.encode(decoded));
+
+    if (properties.decoder.encoding === "utf-8")
+	properties.filter.disconnect();
+}
+
+function apply_stream_filter(details, headers, policy)
+{
+    if (policy.allow)
+	return headers;
+
+    const properties = properties_from_headers(headers);
+    properties.policy = policy;
+
+    properties.filter =
+	browser.webRequest.filterResponseData(details.requestId);
+
+    properties.filter.ondata = event => filter_data(properties, event);
+    properties.filter.onstop = () => properties.filter.close();
+
+    /*
+     * In the future we might consider modifying the headers that specify
+     * encoding. For now we are not yet doing it, though. However, we
+     * prepend the data with UTF-8 BOM which should be enough.
+     */
+    return headers;
+}
+
+/*
+ * EXPORTS_START
+ * EXPORT apply_stream_filter
+ * EXPORTS_END
+ */
-- 
cgit v1.2.3


From 03d041ce03f630d2a28494946ae71588e36d257d Mon Sep 17 00:00:00 2001
From: Wojtek Kosior <koszko@koszko.org>
Date: Fri, 3 Sep 2021 18:46:26 +0200
Subject: only apply stream filter modifications when reasonably necessary

---
 background/main.js          |  5 +++--
 background/stream_filter.js | 47 +++++++++++++++++++++++++++++++++++++++++----
 2 files changed, 46 insertions(+), 6 deletions(-)

(limited to 'background/stream_filter.js')

diff --git a/background/main.js b/background/main.js
index 85f8ce8..2e9fa50 100644
--- a/background/main.js
+++ b/background/main.js
@@ -57,9 +57,10 @@ function on_headers_received(details)
 	return;
 
     const [pattern, settings] = query_best(storage, details.url);
-    const allow = !!(settings && settings.allow);
+    const has_payload = !!(settings && settings.components);
+    const allow = !has_payload && !!(settings && settings.allow);
     const nonce = gen_nonce();
-    const policy = {allow, url, nonce};
+    const policy = {allow, url, nonce, has_payload};
 
     let headers = details.responseHeaders;
     let skip = false;
diff --git a/background/stream_filter.js b/background/stream_filter.js
index 2dce811..96b6132 100644
--- a/background/stream_filter.js
+++ b/background/stream_filter.js
@@ -12,6 +12,7 @@
 /*
  * IMPORTS_START
  * IMPORT browser
+ * IMPORT is_csp_header_name
  * IMPORTS_END
  */
 
@@ -110,6 +111,35 @@ function create_decoder(properties, data)
     return new TextDecoder(charset || "latin1");
 }
 
+function may_define_csp_rules(html)
+{
+    const doc = new DOMParser().parseFromString(html, "text/html");
+
+    for (const meta of doc.querySelectorAll("head>meta[http-equiv]")) {
+	if (is_csp_header_name(meta.getAttribute("http-equiv"), true) &&
+	    meta.content)
+	    return true;
+    }
+
+    /*
+     * Even if no naughty `<meta>' tags were found, subsequent chunk of HTML
+     * data could add some. Before we return `false' we need to be sure we
+     * reached the start of `<body>' where `<meta>' tags are no longer valid.
+     */
+
+    if (doc.documentElement.nextSibling || doc.body.nextSibling ||
+	doc.body.childNodes.length > 1)
+	return false;
+
+    if (!doc.body.firstChild)
+	return true;
+
+    if (doc.body.firstChild.nodeName !== "#text")
+	return false;
+
+    return /^(<\/|&#|.)$/.test(doc.body.firstChild.wholeText);
+}
+
 function filter_data(properties, event)
 {
     const data = new Uint8Array(event.data);
@@ -118,13 +148,15 @@ function filter_data(properties, event)
 	first_chunk = true;
 	properties.decoder = create_decoder(properties, data);
 	properties.encoder = new TextEncoder();
-	/* Force UTF-8, this is the only encoding we can produce. */
-	properties.filter.write(new Uint8Array(UTF8_BOM));
     }
 
     let decoded = properties.decoder.decode(data);
 
-    if (first_chunk) {
+    /* Force UTF-8, this is the only encoding we can produce. */
+    if (first_chunk)
+	properties.filter.write(new Uint8Array(UTF8_BOM));
+
+    if (first_chunk && may_define_csp_rules(decoded)) {
 	/*
 	 * HAX! Our content scripts that execute at `document_start' will always
 	 * run before the first script in the document, but under Mozilla some
@@ -133,7 +165,14 @@ function filter_data(properties, event)
 	 * will force `document_start' to happen earlier. This way our content
 	 * scripts will be able to sanitize `http-equiv' tags with CSP rules
 	 * that would otherwise stop our injected scripts from executing.
+	 *
+	 * As we want to only process HTML files that happen to have naughty
+	 * `<meta>' tags in `<head>', we use a DOMParser-based heuristic in
+	 * `may_define_rules()'. We don't do any additional MIME sniffing as it
+	 * is too unreliable (and our heuristic will likely mark non-HTML files
+	 * as harmless anyway).
 	 */
+
 	const dummy_script =
 	      `<script data-hachette-deleteme="${properties.policy.nonce}" nonce="${properties.policy.nonce}">null</script>`;
 	const doctype_decl = /^(\s*<!doctype[^<>"']*>)?/i.exec(decoded)[0];
@@ -149,7 +188,7 @@ function filter_data(properties, event)
 
 function apply_stream_filter(details, headers, policy)
 {
-    if (policy.allow)
+    if (!policy.has_payload)
 	return headers;
 
     const properties = properties_from_headers(headers);
-- 
cgit v1.2.3


From 44e89d8ec71b441a431c848567f34b9a36f6b982 Mon Sep 17 00:00:00 2001
From: Wojtek Kosior <koszko@koszko.org>
Date: Thu, 9 Sep 2021 17:47:51 +0200
Subject: simplify CSP handling

All page's CSP rules are now removed when a payload is to be injected. When there is no payload, CSP rules are not modified but only supplemented with Hachette's own.
---
 background/policy_injector.js | 30 ++++++++++---------
 background/stream_filter.js   |  5 ++--
 common/misc.js                | 68 +++++++------------------------------------
 content/main.js               | 57 +++++++++++++++++++-----------------
 4 files changed, 60 insertions(+), 100 deletions(-)

(limited to 'background/stream_filter.js')

diff --git a/background/policy_injector.js b/background/policy_injector.js
index 72318d4..e5af055 100644
--- a/background/policy_injector.js
+++ b/background/policy_injector.js
@@ -10,9 +10,8 @@
  * IMPORTS_START
  * IMPORT sign_data
  * IMPORT extract_signed
- * IMPORT sanitize_csp_header
- * IMPORT csp_rule
- * IMPORT is_csp_header_name
+ * IMPORT make_csp_rule
+ * IMPORT csp_header_regex
  * IMPORTS_END
  */
 
@@ -43,22 +42,25 @@ function inject_csp_headers(headers, policy)
 	break;
     }
 
+    if (policy.has_payload) {
+	csp_headers = [];
+	const non_csp_headers = [];
+	const header_list =
+	      h => csp_header_regex.test(h) ? csp_headers : non_csp_headers;
+	headers.forEach(h => header_list(h.name).push(h));
+	headers = non_csp_headers;
+    } else {
+	headers.push(...csp_headers || []);
+    }
+
     if (!hachette_header) {
 	hachette_header = {name: "x-hachette"};
 	headers.push(hachette_header);
     }
 
-    csp_headers = csp_headers ||
-	headers.filter(h => is_csp_header_name(h.name));
-
-    /* When blocking remove report-only CSP headers that snitch on us. */
-    headers = headers.filter(h => !is_csp_header_name(h.name, !policy.allow));
-
     if (old_signature)
 	headers = headers.filter(h => h.value.search(old_signature) === -1);
 
-    headers.push(...csp_headers.map(h => sanitize_csp_header(h, policy)));
-
     const policy_str = encodeURIComponent(JSON.stringify(policy));
     const signed_policy = sign_data(policy_str, new Date().getTime());
     const later_30sec = new Date(new Date().getTime() + 30000).toGMTString();
@@ -76,12 +78,12 @@ function inject_csp_headers(headers, policy)
     hachette_data = encodeURIComponent(JSON.stringify(hachette_data));
     hachette_header.value = sign_data(hachette_data, 0).join("_");
 
-    /* To ensure there is a CSP header if required */
-    if (!policy.allow)
+    if (!policy.allow) {
 	headers.push({
 	    name: "content-security-policy",
-	    value: csp_rule(policy.nonce)
+	    value: make_csp_rule(policy)
 	});
+    }
 
     return headers;
 }
diff --git a/background/stream_filter.js b/background/stream_filter.js
index 96b6132..3e30a4b 100644
--- a/background/stream_filter.js
+++ b/background/stream_filter.js
@@ -12,7 +12,7 @@
 /*
  * IMPORTS_START
  * IMPORT browser
- * IMPORT is_csp_header_name
+ * IMPORT csp_header_regex
  * IMPORTS_END
  */
 
@@ -116,8 +116,7 @@ function may_define_csp_rules(html)
     const doc = new DOMParser().parseFromString(html, "text/html");
 
     for (const meta of doc.querySelectorAll("head>meta[http-equiv]")) {
-	if (is_csp_header_name(meta.getAttribute("http-equiv"), true) &&
-	    meta.content)
+	if (csp_header_regex.test(meta.httpEquiv) && meta.content)
 	    return true;
     }
 
diff --git a/common/misc.js b/common/misc.js
index 6adaf1e..6cded84 100644
--- a/common/misc.js
+++ b/common/misc.js
@@ -43,29 +43,19 @@ function gen_nonce(length=16)
     return Uint8toHex(randomData);
 }
 
-/* csp rule that blocks all scripts except for those injected by us */
-function csp_rule(nonce)
+/* CSP rule that blocks scripts according to policy's needs. */
+function make_csp_rule(policy)
 {
-    const rule = `'nonce-${nonce}'`;
-    return `script-src ${rule}; script-src-elem ${rule}; script-src-attr 'none'; prefetch-src 'none';`;
+    let rule = "prefetch-src 'none'; script-src-attr 'none';";
+    const script_src = policy.has_payload ?
+	  `'nonce-${policy.nonce}'` : "'none'";
+    rule += ` script-src ${script_src}; script-src-elem ${script_src};`;
+    return rule;
 }
 
 /* Check if some HTTP header might define CSP rules. */
-const csp_header_names = new Set([
-    "content-security-policy",
-    "x-webkit-csp",
-    "x-content-security-policy"
-]);
-
-const report_only_header_name = "content-security-policy-report-only";
-
-function is_csp_header_name(string, include_report_only)
-{
-    string = string && string.toLowerCase().trim() || "";
-
-    return (include_report_only && string === report_only_header_name) ||
-	csp_header_names.has(string);
-}
+const csp_header_regex =
+      /^\s*(content-security-policy|x-webkit-csp|x-content-security-policy)/i;
 
 /*
  * Print item together with type, e.g.
@@ -111,41 +101,6 @@ function parse_csp(csp) {
     return directives;
 }
 
-/* Make CSP headers do our bidding, not interfere */
-function sanitize_csp_header(header, policy)
-{
-    const rule = `'nonce-${policy.nonce}'`;
-    const csp = parse_csp(header.value);
-
-    if (!policy.allow) {
-	/* No snitching */
-	delete csp['report-to'];
-	delete csp['report-uri'];
-
-	delete csp['script-src'];
-	delete csp['script-src-elem'];
-
-	csp['script-src-attr'] = ["'none'"];
-	csp['prefetch-src'] = ["'none'"];
-    }
-
-    if ('script-src' in csp)
-	csp['script-src'].push(rule);
-    else
-	csp['script-src'] = [rule];
-
-    if ('script-src-elem' in csp)
-	csp['script-src-elem'].push(rule);
-    else
-	csp['script-src-elem'] = [rule];
-
-    const new_csp = Object.entries(csp).map(
-	i => `${i[0]} ${i[1].join(' ')};`
-    );
-
-    return {name: header.name, value: new_csp.join('')};
-}
-
 /* Regexes and objects to use as/in schemas for parse_json_with_schema(). */
 const nonempty_string_matcher = /.+/;
 
@@ -161,12 +116,11 @@ const matchers = {
 /*
  * EXPORTS_START
  * EXPORT gen_nonce
- * EXPORT csp_rule
- * EXPORT is_csp_header_name
+ * EXPORT make_csp_rule
+ * EXPORT csp_header_regex
  * EXPORT nice_name
  * EXPORT open_in_settings
  * EXPORT is_privileged_url
- * EXPORT sanitize_csp_header
  * EXPORT matchers
  * EXPORTS_END
  */
diff --git a/content/main.js b/content/main.js
index fb334dd..a26f72d 100644
--- a/content/main.js
+++ b/content/main.js
@@ -16,9 +16,8 @@
  * IMPORT is_chrome
  * IMPORT is_mozilla
  * IMPORT start_activity_info_server
- * IMPORT csp_rule
- * IMPORT is_csp_header_name
- * IMPORT sanitize_csp_header
+ * IMPORT make_csp_rule
+ * IMPORT csp_header_regex
  * IMPORTS_END
  */
 
@@ -172,22 +171,20 @@ function block_attribute(node, attr, ns=null)
 	const name = construct_name.join("");
 	seta(node, `${blocked_str}-${name}`, geta(node, name));
     }
-}
-
-function sanitize_meta(meta, policy)
-{
-    const value = meta.content || "";
 
-    if (!value || !is_csp_header_name(meta.httpEquiv || "", true))
-	return;
-
-    block_attribute(meta, "content");
+    rema(node, attr);
 }
 
 /*
- * Used to disable <script> that has not yet been added to live DOM (doesn't
- * work for those already added).
+ * Used to disable `<script>'s and `<meta>'s that have not yet been added to
+ * live DOM (doesn't work for those already added).
  */
+function sanitize_meta(meta)
+{
+    if (csp_header_regex.test(meta.httpEquiv) && meta.content)
+	block_attribute(meta, "content");
+}
+
 function sanitize_script(script)
 {
     script.hachette_blocked_type = script.getAttribute("type");
@@ -195,14 +192,14 @@ function sanitize_script(script)
 }
 
 /*
- * Executed after script has been connected to the DOM, when it is no longer
- * eligible for being executed by the browser
+ * Executed after `<script>' has been connected to the DOM, when it is no longer
+ * eligible for being executed by the browser.
  */
-function desanitize_script(script, policy)
+function desanitize_script(script)
 {
     script.setAttribute("type", script.hachette_blocked_type);
 
-    if (script.hachette_blocked_type === null)
+    if ([null, undefined].includes(script.hachette_blocked_type))
 	script.removeAttribute("type");
 
     delete script.hachette_blocked_type;
@@ -233,13 +230,18 @@ function start_data_urls_sanitizing(doc)
  * cause part of the DOM to be loaded when our content scripts get to run. Thus,
  * before the CSP rules we inject (for non-HTTP pages) become effective, we need
  * to somehow block the execution of `<script>'s and intrinsics that were
- * already there.
+ * already there. Additionally, some browsers (IceCat 60) seem to have problems
+ * applying this CSP to non-inline `<scripts>' in certain scenarios.
  */
+function prevent_script_execution(event)
+{
+    if (!event.target._hachette_payload)
+	event.preventDefault();
+}
+
 function mozilla_initial_block(doc)
 {
-    const blocker = e => e.preventDefault();
-    doc.addEventListener("beforescriptexecute", blocker);
-    setTimeout(() => doc.removeEventListener("beforescriptexecute", blocker));
+    doc.addEventListener("beforescriptexecute", prevent_script_execution);
 
     [...doc.all].flatMap(ele => [...ele.attributes].map(attr => [ele, attr]))
 	.map(([ele, attr]) => [ele, attr.localName])
@@ -273,7 +275,7 @@ async function sanitize_document(doc, policy)
      * non-HTML documents.
      */
     const html = new DOMParser().parseFromString(`<html><head><meta \
-http-equiv="Content-Security-Policy" content="${csp_rule(policy.nonce)}"\
+http-equiv="Content-Security-Policy" content="${make_csp_rule(policy)}"\
 /></head><body>Loading...</body></html>`, "text/html").documentElement;
 
     /*
@@ -284,10 +286,10 @@ http-equiv="Content-Security-Policy" content="${csp_rule(policy.nonce)}"\
     root.replaceWith(html);
 
     /*
-     * For XML documents, we don't intend to inject payload, so we neither block
-     * document's CSP `<meta>' tags nor wait for `<head>' to be parsed.
+     * When we don't inject payload, we neither block document's CSP `<meta>'
+     * tags nor wait for `<head>' to be parsed.
      */
-    if (document instanceof HTMLDocument) {
+    if (policy.has_payload) {
 	await wait_for_head(doc, root);
 
 	root.querySelectorAll("head meta")
@@ -333,6 +335,9 @@ if (!is_privileged_url(document.URL)) {
 	policy = {allow: false, nonce: gen_nonce()};
     }
 
+    if (!(document instanceof HTMLDocument))
+	policy.has_payload = false;
+
     console.debug("current policy", policy);
 
     const doc_ready = Promise.all([
-- 
cgit v1.2.3


From 2bd35bc4b0d32b70320b06d932db90e75e89373e Mon Sep 17 00:00:00 2001
From: Wojtek Kosior <koszko@koszko.org>
Date: Mon, 13 Sep 2021 16:56:44 +0200
Subject: rename the extension to "Haketilo"

---
 README.txt                        |   6 +-
 background/cookie_filter.js       |  17 ++---
 background/main.js                |   4 +-
 background/page_actions_server.js |   4 +-
 background/policy_injector.js     |  26 ++++----
 background/storage.js             |   4 +-
 background/storage_server.js      |   4 +-
 background/stream_filter.js       |   6 +-
 common/ajax.js                    |   5 +-
 common/connection_types.js        |   4 +-
 common/lock.js                    |   4 +-
 common/message_server.js          |   4 +-
 common/misc.js                    |   4 +-
 common/observable.js              |   5 +-
 common/once.js                    |   5 +-
 common/patterns.js                |   4 +-
 common/sanitize_JSON.js           |   5 +-
 common/settings_query.js          |   4 +-
 common/signing.js                 |   7 ++-
 common/storage_client.js          |   4 +-
 common/storage_light.js           |   5 +-
 common/storage_raw.js             |   5 +-
 common/stored_types.js            |   4 +-
 content/activity_info_server.js   |   7 ++-
 content/main.js                   |  22 ++++---
 content/page_actions.js           |   6 +-
 content/repo_query.js             |   5 +-
 copyright                         |   2 +-
 html/DOM_helpers.js               |   4 +-
 html/MOZILLA_scrollbar_fix.css    |   6 +-
 html/back_button.css              |   5 +-
 html/base.css                     |   4 +-
 html/default_blocking_policy.js   |   5 +-
 html/display-panel.html           |   8 ++-
 html/display-panel.js             |   4 +-
 html/import_frame.js              |   4 +-
 html/options.html                 |   6 +-
 html/options_main.js              |   4 +-
 icons/hachette.svg                | 127 --------------------------------------
 icons/hachette128.png             | Bin 6031 -> 0 bytes
 icons/hachette16.png              | Bin 752 -> 0 bytes
 icons/hachette32.png              | Bin 1358 -> 0 bytes
 icons/hachette48.png              | Bin 2154 -> 0 bytes
 icons/hachette64.png              | Bin 2908 -> 0 bytes
 icons/haketilo.svg                | 127 ++++++++++++++++++++++++++++++++++++++
 icons/haketilo128.png             | Bin 0 -> 6031 bytes
 icons/haketilo16.png              | Bin 0 -> 752 bytes
 icons/haketilo32.png              | Bin 0 -> 1358 bytes
 icons/haketilo48.png              | Bin 0 -> 2154 bytes
 icons/haketilo64.png              | Bin 0 -> 2908 bytes
 manifest.json                     |  28 +++++----
 re-generate_icons.sh              |   2 +-
 52 files changed, 292 insertions(+), 224 deletions(-)
 delete mode 100644 icons/hachette.svg
 delete mode 100644 icons/hachette128.png
 delete mode 100644 icons/hachette16.png
 delete mode 100644 icons/hachette32.png
 delete mode 100644 icons/hachette48.png
 delete mode 100644 icons/hachette64.png
 create mode 100644 icons/haketilo.svg
 create mode 100644 icons/haketilo128.png
 create mode 100644 icons/haketilo16.png
 create mode 100644 icons/haketilo32.png
 create mode 100644 icons/haketilo48.png
 create mode 100644 icons/haketilo64.png

(limited to 'background/stream_filter.js')

diff --git a/README.txt b/README.txt
index ad640b0..1aec0ba 100644
--- a/README.txt
+++ b/README.txt
@@ -1,4 +1,4 @@
-# Hachette - Make The Web Great Again! #
+# Haketilo - Make The Web Great Again! #
 
 This extension's goal is to allow replacing javascript served by websites
 with scripts specified by user. Something like NoScript and Greasemonkey
@@ -9,7 +9,7 @@ Currently, the target browsers for this extension are Ungoogled Chromium
 and various forks of Firefox (version 60+).
 
 This extension is still in an early stage. Also see
-`https://hachettebugs.koszko.org/projects/hachette/wiki/' for documentation in
+`https://hydrillabugs.koszko.org/projects/haketilo/wiki/' for documentation in
 development.
 
 ## Installation ##
@@ -28,6 +28,6 @@ various additional licenses and permissions for particular files.
 
 ## Contributing ##
 Get the code from: https://git.koszko.org/browser-extension/
-Come to: https://hachettebugs.koszko.org/projects/hachette
+Come to: https://hydrillabugs.koszko.org/projects/haketilo
 
 Optionally, write to $(echo a29zemtvQGtvc3prby5vcmcK | base64 -d)
diff --git a/background/cookie_filter.js b/background/cookie_filter.js
index fea2d23..64d18b2 100644
--- a/background/cookie_filter.js
+++ b/background/cookie_filter.js
@@ -1,7 +1,8 @@
 /**
- * part of Hachette
- * Filtering request headers to remove hachette cookies that might have slipped
- * through.
+ * This file is part of Haketilo.
+ *
+ * Function: Filtering request headers to remove haketilo cookies that might
+ *     have slipped through.
  *
  * Copyright (C) 2021 Wojtek Kosior
  * Redistribution terms are gathered in the `copyright' file.
@@ -13,29 +14,29 @@
  * IMPORTS_END
  */
 
-function is_valid_hachette_cookie(cookie)
+function is_valid_haketilo_cookie(cookie)
 {
-    const match = /^hachette-(\w*)=(.*)$/.exec(cookie);
+    const match = /^haketilo-(\w*)=(.*)$/.exec(cookie);
     if (!match)
 	return false;
 
     return !extract_signed(match.slice(1, 3)).fail;
 }
 
-function remove_hachette_cookies(header)
+function remove_haketilo_cookies(header)
 {
     if (header.name !== "Cookie")
 	return header;
 
     const cookies = header.value.split("; ");
-    const value = cookies.filter(c => !is_valid_hachette_cookie(c)).join("; ");
+    const value = cookies.filter(c => !is_valid_haketilo_cookie(c)).join("; ");
 
     return value ? {name: "Cookie", value} : null;
 }
 
 function filter_cookie_headers(headers)
 {
-    return headers.map(remove_hachette_cookies).filter(h => h);
+    return headers.map(remove_haketilo_cookies).filter(h => h);
 }
 
 /*
diff --git a/background/main.js b/background/main.js
index 03cd5d7..40b3a9e 100644
--- a/background/main.js
+++ b/background/main.js
@@ -1,5 +1,7 @@
 /**
- * Hachette main background script
+ * This file is part of Haketilo.
+ *
+ * Function: Main background script.
  *
  * Copyright (C) 2021 Wojtek Kosior
  * Redistribution terms are gathered in the `copyright' file.
diff --git a/background/page_actions_server.js b/background/page_actions_server.js
index e21ca6e..156a79f 100644
--- a/background/page_actions_server.js
+++ b/background/page_actions_server.js
@@ -1,5 +1,7 @@
 /**
- * Hachette serving of page actions to content scripts
+ * This file is part of Haketilo.
+ *
+ * Function: Serving page actions to content scripts.
  *
  * Copyright (C) 2021 Wojtek Kosior
  * Redistribution terms are gathered in the `copyright' file.
diff --git a/background/policy_injector.js b/background/policy_injector.js
index e5af055..881595b 100644
--- a/background/policy_injector.js
+++ b/background/policy_injector.js
@@ -1,5 +1,7 @@
 /**
- * Hachette injecting policy to page using webRequest
+ * This file is part of Haketilo.
+ *
+ * Function: Injecting policy to page by modifying HTTP headers.
  *
  * Copyright (C) 2021 Wojtek Kosior
  * Copyright (C) 2021 jahoti
@@ -19,10 +21,10 @@ function inject_csp_headers(headers, policy)
 {
     let csp_headers;
     let old_signature;
-    let hachette_header;
+    let haketilo_header;
 
-    for (const header of headers.filter(h => h.name === "x-hachette")) {
-	/* x-hachette header has format: <signature>_0_<data> */
+    for (const header of headers.filter(h => h.name === "x-haketilo")) {
+	/* x-haketilo header has format: <signature>_0_<data> */
 	const match = /^([^_]+)_(0_.*)$/.exec(header.value);
 	if (!match)
 	    continue;
@@ -38,7 +40,7 @@ function inject_csp_headers(headers, policy)
 	csp_headers = old_data.csp_headers;
 	old_signature = old_data.policy_sig;
 
-	hachette_header = header;
+	haketilo_header = header;
 	break;
     }
 
@@ -53,9 +55,9 @@ function inject_csp_headers(headers, policy)
 	headers.push(...csp_headers || []);
     }
 
-    if (!hachette_header) {
-	hachette_header = {name: "x-hachette"};
-	headers.push(hachette_header);
+    if (!haketilo_header) {
+	haketilo_header = {name: "x-haketilo"};
+	headers.push(haketilo_header);
     }
 
     if (old_signature)
@@ -66,7 +68,7 @@ function inject_csp_headers(headers, policy)
     const later_30sec = new Date(new Date().getTime() + 30000).toGMTString();
     headers.push({
 	name: "Set-Cookie",
-	value: `hachette-${signed_policy.join("=")}; Expires=${later_30sec};`
+	value: `haketilo-${signed_policy.join("=")}; Expires=${later_30sec};`
     });
 
     /*
@@ -74,9 +76,9 @@ function inject_csp_headers(headers, policy)
      * These are signed with a time of 0, as it's not clear there is a limit on
      * how long Firefox might retain headers in the cache.
      */
-    let hachette_data = {csp_headers, policy_sig: signed_policy[0]};
-    hachette_data = encodeURIComponent(JSON.stringify(hachette_data));
-    hachette_header.value = sign_data(hachette_data, 0).join("_");
+    let haketilo_data = {csp_headers, policy_sig: signed_policy[0]};
+    haketilo_data = encodeURIComponent(JSON.stringify(haketilo_data));
+    haketilo_header.value = sign_data(haketilo_data, 0).join("_");
 
     if (!policy.allow) {
 	headers.push({
diff --git a/background/storage.js b/background/storage.js
index 12c0c61..a4e626a 100644
--- a/background/storage.js
+++ b/background/storage.js
@@ -1,5 +1,7 @@
 /**
- * Hachette storage manager
+ * This file is part of Haketilo.
+ *
+ * Function: Storage manager.
  *
  * Copyright (C) 2021 Wojtek Kosior
  * Redistribution terms are gathered in the `copyright' file.
diff --git a/background/storage_server.js b/background/storage_server.js
index 2252eb5..73126d4 100644
--- a/background/storage_server.js
+++ b/background/storage_server.js
@@ -1,5 +1,7 @@
 /**
- * Hachette storage through connection (server side)
+ * This file is part of Haketilo.
+ *
+ * Function: Storage through messages (server side).
  *
  * Copyright (C) 2021 Wojtek Kosior
  * Redistribution terms are gathered in the `copyright' file.
diff --git a/background/stream_filter.js b/background/stream_filter.js
index 3e30a4b..e5e0827 100644
--- a/background/stream_filter.js
+++ b/background/stream_filter.js
@@ -1,5 +1,7 @@
 /**
- * Hachette modifying a web page using the StreamFilter API
+ * This file is part of Haketilo.
+ *
+ * Function: Modifying a web page using the StreamFilter API.
  *
  * Copyright (C) 2018 Giorgio Maone <giorgio@maone.net>
  * Copyright (C) 2021 Wojtek Kosior
@@ -173,7 +175,7 @@ function filter_data(properties, event)
 	 */
 
 	const dummy_script =
-	      `<script data-hachette-deleteme="${properties.policy.nonce}" nonce="${properties.policy.nonce}">null</script>`;
+	      `<script data-haketilo-deleteme="${properties.policy.nonce}" nonce="${properties.policy.nonce}">null</script>`;
 	const doctype_decl = /^(\s*<!doctype[^<>"']*>)?/i.exec(decoded)[0];
 	decoded = doctype_decl + dummy_script +
 	    decoded.substring(doctype_decl.length);
diff --git a/common/ajax.js b/common/ajax.js
index 8082bbe..7269a8a 100644
--- a/common/ajax.js
+++ b/common/ajax.js
@@ -1,6 +1,7 @@
 /**
- * part of Hachette
- * Wrapping XMLHttpRequest into a Promise.
+ * This file is part of Haketilo.
+ *
+ * Function: Wrapping XMLHttpRequest into a Promise.
  *
  * Copyright (C) 2021 Wojtek Kosior
  * Redistribution terms are gathered in the `copyright' file.
diff --git a/common/connection_types.js b/common/connection_types.js
index 88c6964..3e9df56 100644
--- a/common/connection_types.js
+++ b/common/connection_types.js
@@ -1,5 +1,7 @@
 /**
- * Hachette background scripts message connection types "enum"
+ * This file is part of Haketilo.
+ *
+ * Function: Define an "enum" of message connection types.
  *
  * Copyright (C) 2021 Wojtek Kosior
  * Redistribution terms are gathered in the `copyright' file.
diff --git a/common/lock.js b/common/lock.js
index 822ad1b..6cf0835 100644
--- a/common/lock.js
+++ b/common/lock.js
@@ -1,5 +1,7 @@
 /**
- * Hachette lock (aka binary semaphore aka mutex)
+ * This file is part of Haketilo.
+ *
+ * Function: Implement a lock (aka binary semaphore aka mutex).
  *
  * Copyright (C) 2021 Wojtek Kosior
  * Redistribution terms are gathered in the `copyright' file.
diff --git a/common/message_server.js b/common/message_server.js
index ea40487..c8c6696 100644
--- a/common/message_server.js
+++ b/common/message_server.js
@@ -1,5 +1,7 @@
 /**
- * Hachette message server
+ * This file is part of Haketilo.
+ *
+ * Function: Message server.
  *
  * Copyright (C) 2021 Wojtek Kosior
  * Redistribution terms are gathered in the `copyright' file.
diff --git a/common/misc.js b/common/misc.js
index 6cded84..9ffb7ff 100644
--- a/common/misc.js
+++ b/common/misc.js
@@ -1,5 +1,7 @@
 /**
- * Hachette miscellaneous operations refactored to a separate file
+ * This file is part of Haketilo.
+ *
+ * Function: Miscellaneous operations refactored to a separate file.
  *
  * Copyright (C) 2021 Wojtek Kosior
  * Copyright (C) 2021 jahoti
diff --git a/common/observable.js b/common/observable.js
index 02f1c1b..ab3b444 100644
--- a/common/observable.js
+++ b/common/observable.js
@@ -1,6 +1,7 @@
 /**
- * part of Hachette
- * Facilitate listening to events
+ * This file is part of Haketilo.
+ *
+ * Function: Facilitate listening to (internal, self-generated) events.
  *
  * Copyright (C) 2021 Wojtek Kosior
  * Redistribution terms are gathered in the `copyright' file.
diff --git a/common/once.js b/common/once.js
index 098b43f..93e842f 100644
--- a/common/once.js
+++ b/common/once.js
@@ -1,5 +1,8 @@
 /**
- * Hachette feature initialization promise
+ * This file is part of Haketilo.
+ *
+ * Function: Wrap APIs that depend on some asynchronous initialization into
+ *     promises.
  *
  * Copyright (C) 2021 Wojtek Kosior
  * Redistribution terms are gathered in the `copyright' file.
diff --git a/common/patterns.js b/common/patterns.js
index ae29fcd..625be05 100644
--- a/common/patterns.js
+++ b/common/patterns.js
@@ -1,5 +1,7 @@
 /**
- * Hachette operations on page url patterns
+ * This file is part of Haketilo.
+ *
+ * Function: Operations on page URL patterns.
  *
  * Copyright (C) 2021 Wojtek Kosior
  * Redistribution terms are gathered in the `copyright' file.
diff --git a/common/sanitize_JSON.js b/common/sanitize_JSON.js
index 8b86d2d..4cf1ef4 100644
--- a/common/sanitize_JSON.js
+++ b/common/sanitize_JSON.js
@@ -1,6 +1,7 @@
 /**
- * part of Hachette
- * Powerful, full-blown format enforcer for externally-obtained JSON
+ * This file is part of Haketilo.
+ *
+ * Function: Powerful, full-blown format enforcer for externally-obtained JSON.
  *
  * Copyright (C) 2021 Wojtek Kosior
  * Redistribution terms are gathered in the `copyright' file.
diff --git a/common/settings_query.js b/common/settings_query.js
index b54e580..7e1315e 100644
--- a/common/settings_query.js
+++ b/common/settings_query.js
@@ -1,5 +1,7 @@
 /**
- * Hachette querying page settings with regard to wildcard records
+ * This file is part of Haketilo.
+ *
+ * Function: Querying page settings.
  *
  * Copyright (C) 2021 Wojtek Kosior
  * Redistribution terms are gathered in the `copyright' file.
diff --git a/common/signing.js b/common/signing.js
index 1904bcd..11cd442 100644
--- a/common/signing.js
+++ b/common/signing.js
@@ -1,6 +1,7 @@
 /**
- * part of Hachette
- * Functions related to "signing" of data, refactored to a separate file.
+ * This file is part of Haketilo.
+ *
+ * Functions: Operations related to "signing" of data.
  *
  * Copyright (C) 2021 Wojtek Kosior
  * Redistribution terms are gathered in the `copyright' file.
@@ -16,7 +17,7 @@
 
 /*
  * In order to make certain data synchronously accessible in certain contexts,
- * hachette smuggles it in string form in places like cookies, URLs and headers.
+ * Haketilo smuggles it in string form in places like cookies, URLs and headers.
  * When using the smuggled data, we first need to make sure it isn't spoofed.
  * For that, we use this pseudo-signing mechanism.
  *
diff --git a/common/storage_client.js b/common/storage_client.js
index 2b2f495..ef4a0b8 100644
--- a/common/storage_client.js
+++ b/common/storage_client.js
@@ -1,5 +1,7 @@
 /**
- * Hachette storage through connection (client side)
+ * This file is part of Haketilo.
+ *
+ * Function: Storage through messages (client side).
  *
  * Copyright (C) 2021 Wojtek Kosior
  * Redistribution terms are gathered in the `copyright' file.
diff --git a/common/storage_light.js b/common/storage_light.js
index 067bf0c..32e3b1f 100644
--- a/common/storage_light.js
+++ b/common/storage_light.js
@@ -1,6 +1,7 @@
 /**
- * part of Hachette
- * Storage manager, lighter than the previous one.
+ * This file is part of Haketilo.
+ *
+ * Function: Storage manager, lighter than the previous one.
  *
  * Copyright (C) 2021 Wojtek Kosior
  * Redistribution terms are gathered in the `copyright' file.
diff --git a/common/storage_raw.js b/common/storage_raw.js
index 4c02ee4..e354b6b 100644
--- a/common/storage_raw.js
+++ b/common/storage_raw.js
@@ -1,6 +1,7 @@
 /**
- * part of Hachette
- * Basic wrappers for storage API functions.
+ * This file is part of Haketilo.
+ *
+ * Function: Basic wrappers for storage API functions.
  *
  * Copyright (C) 2021 Wojtek Kosior
  * Redistribution terms are gathered in the `copyright' file.
diff --git a/common/stored_types.js b/common/stored_types.js
index bfceba6..a693b1c 100644
--- a/common/stored_types.js
+++ b/common/stored_types.js
@@ -1,5 +1,7 @@
 /**
- * Hachette stored item types "enum"
+ * This file is part of Haketilo.
+ *
+ * Function: Define an "enum" of stored item types.
  *
  * Copyright (C) 2021 Wojtek Kosior
  * Redistribution terms are gathered in the `copyright' file.
diff --git a/content/activity_info_server.js b/content/activity_info_server.js
index 1b69703..d1dfe36 100644
--- a/content/activity_info_server.js
+++ b/content/activity_info_server.js
@@ -1,7 +1,8 @@
 /**
- * part of Hachette
- * Informing about activities performed by content script (script injection,
- * script blocking).
+ * This file is part of Haketilo.
+ *
+ * Function: Informing the popup about what happens in the content script
+ *     (script injection, script blocking, etc.).
  *
  * Copyright (C) 2021 Wojtek Kosior
  * Redistribution terms are gathered in the `copyright' file.
diff --git a/content/main.js b/content/main.js
index 6478ea0..cec9943 100644
--- a/content/main.js
+++ b/content/main.js
@@ -1,5 +1,7 @@
 /**
- * Hachette main content script run in all frames
+ * This file is part of Haketilo.
+ *
+ * Function: Main content script that runs in all frames.
  *
  * Copyright (C) 2021 Wojtek Kosior
  * Copyright (C) 2021 jahoti
@@ -33,7 +35,7 @@ function extract_cookie_policy(cookie, min_time)
     let policy = null;
     const extracted_signatures = [];
 
-    for (const match of cookie.matchAll(/hachette-(\w*)=([^;]*)/g)) {
+    for (const match of cookie.matchAll(/haketilo-(\w*)=([^;]*)/g)) {
 	const new_result = extract_signed(...match.slice(1, 3));
 	if (new_result.fail)
 	    continue;
@@ -60,7 +62,7 @@ function extract_url_policy(url, min_time)
     const [base_url, payload, anchor] =
 	  /^([^#]*)#?([^#]*)(#?.*)$/.exec(url).splice(1, 4);
 
-    const match = /^hachette_([^_]+)_(.*)$/.exec(payload);
+    const match = /^haketilo_([^_]+)_(.*)$/.exec(payload);
     if (!match)
 	return [null, url];
 
@@ -83,7 +85,7 @@ function employ_nonhttp_policy(policy)
     policy.nonce = gen_nonce();
     const [base_url, target] = /^([^#]*)(#?.*)$/.exec(policy.url).slice(1, 3);
     const encoded_policy = encodeURIComponent(JSON.stringify(policy));
-    const payload = "hachette_" +
+    const payload = "haketilo_" +
 	  sign_data(encoded_policy, new Date().getTime()).join("_");
     const resulting_url = `${base_url}#${payload}${target}`;
     location.href = resulting_url;
@@ -187,7 +189,7 @@ function sanitize_meta(meta)
 
 function sanitize_script(script)
 {
-    script.hachette_blocked_type = script.getAttribute("type");
+    script.haketilo_blocked_type = script.getAttribute("type");
     script.type = "text/plain";
 }
 
@@ -197,12 +199,12 @@ function sanitize_script(script)
  */
 function desanitize_script(script)
 {
-    script.setAttribute("type", script.hachette_blocked_type);
+    script.setAttribute("type", script.haketilo_blocked_type);
 
-    if ([null, undefined].includes(script.hachette_blocked_type))
+    if ([null, undefined].includes(script.haketilo_blocked_type))
 	script.removeAttribute("type");
 
-    delete script.hachette_blocked_type;
+    delete script.haketilo_blocked_type;
 }
 
 const bad_url_reg = /^data:([^,;]*ml|unknown-content-type)/i;
@@ -235,7 +237,7 @@ function start_data_urls_sanitizing(doc)
  */
 function prevent_script_execution(event)
 {
-    if (!event.target._hachette_payload)
+    if (!event.target.haketilo_payload)
 	event.preventDefault();
 }
 
@@ -336,7 +338,7 @@ if (!is_privileged_url(document.URL)) {
 	let signatures;
 	[policy, signatures] = extract_cookie_policy(document.cookie, min_time);
 	for (const signature of signatures)
-	    document.cookie = `hachette-${signature}=; Max-Age=-1;`;
+	    document.cookie = `haketilo-${signature}=; Max-Age=-1;`;
     } else {
 	const scheme = /^([^:]*)/.exec(document.URL)[1];
 	const known_scheme = ["file", "ftp"].includes(scheme);
diff --git a/content/page_actions.js b/content/page_actions.js
index 040b4ab..db7c352 100644
--- a/content/page_actions.js
+++ b/content/page_actions.js
@@ -1,5 +1,7 @@
 /**
- * Hachette handling of page actions in content scripts
+ * This file is part of Haketilo.
+ *
+ * Function: Handle page actions in a content script.
  *
  * Copyright (C) 2021 Wojtek Kosior
  * Redistribution terms are gathered in the `copyright' file.
@@ -60,7 +62,7 @@ function add_script(script_text)
     let script = document.createElement("script");
     script.textContent = script_text;
     script.setAttribute("nonce", nonce);
-    script._hachette_payload = true;
+    script.haketilo_payload = true;
     document.body.appendChild(script);
 
     report_script(script_text);
diff --git a/content/repo_query.js b/content/repo_query.js
index 3708108..637282c 100644
--- a/content/repo_query.js
+++ b/content/repo_query.js
@@ -1,6 +1,7 @@
 /**
- * part of Hachette
- * Getting available content for site from remote repositories.
+ * This file is part of Haketilo.
+ *
+ * Function: Getting available content for site from remote repositories.
  *
  * Copyright (C) 2021 Wojtek Kosior
  * Redistribution terms are gathered in the `copyright' file.
diff --git a/copyright b/copyright
index 4c37eb3..fe2aed7 100644
--- a/copyright
+++ b/copyright
@@ -1,5 +1,5 @@
 Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
-Upstream-Name: Hachette
+Upstream-Name: Haketilo
 Source: https://git.koszko.org/browser-extension/
 
 Files: *
diff --git a/html/DOM_helpers.js b/html/DOM_helpers.js
index 01e2be9..4fe118d 100644
--- a/html/DOM_helpers.js
+++ b/html/DOM_helpers.js
@@ -1,5 +1,7 @@
 /**
- * Hachette operations on DOM elements
+ * This file is part of Haketilo.
+ *
+ * Function: Operations on DOM elements.
  *
  * Copyright (C) 2021 Wojtek Kosior
  * Redistribution terms are gathered in the `copyright' file.
diff --git a/html/MOZILLA_scrollbar_fix.css b/html/MOZILLA_scrollbar_fix.css
index 5feb7c3..cdbd5c6 100644
--- a/html/MOZILLA_scrollbar_fix.css
+++ b/html/MOZILLA_scrollbar_fix.css
@@ -1,6 +1,8 @@
 /**
- * Hachette
- * Hacky fix for vertical scrollbar width being included in child's width.
+ * This file is part of Haketilo.
+ *
+ * Function: Hacky fix for vertical scrollbar width being included in child's
+ *     width.
  *
  * Copyright (C) 2021 Wojtek Kosior
  * Redistribution terms are gathered in the `copyright' file.
diff --git a/html/back_button.css b/html/back_button.css
index 1ddc5da..b83e834 100644
--- a/html/back_button.css
+++ b/html/back_button.css
@@ -1,6 +1,7 @@
 /**
- * part of Hachette
- * Style for a "back" button with a CSS arrow image.
+ * This file is part of Haketilo.
+ *
+ * Function: Style for a "back" button with a CSS arrow image.
  *
  * Copyright (C) 2021 Wojtek Kosior
  * Redistribution terms are gathered in the `copyright' file.
diff --git a/html/base.css b/html/base.css
index df52f7c..517a5c1 100644
--- a/html/base.css
+++ b/html/base.css
@@ -1,5 +1,7 @@
 /**
- * Hachette base styles
+ * This file is part of Haketilo.
+ *
+ * Function: Base styles.
  *
  * Copyright (C) 2021 Wojtek Kosior
  * Copyright (C) 2021 Nicholas Johnson
diff --git a/html/default_blocking_policy.js b/html/default_blocking_policy.js
index 2f49bac..b6458f3 100644
--- a/html/default_blocking_policy.js
+++ b/html/default_blocking_policy.js
@@ -1,6 +1,7 @@
 /**
- * part of Hachette
- * Default policy dialog logic.
+ * This file is part of Haketilo.
+ *
+ * Function: Logic for the dialog of default policy selection.
  *
  * Copyright (C) 2021 Wojtek Kosior
  * Redistribution terms are gathered in the `copyright' file.
diff --git a/html/display-panel.html b/html/display-panel.html
index 3ed1b7a..ee9e767 100644
--- a/html/display-panel.html
+++ b/html/display-panel.html
@@ -1,12 +1,16 @@
 <!doctype html>
 <!--
+    This file is part of Haketilo.
+
+    Function: Extension's popup page.
+
     Copyright (C) 2021 Wojtek Kosior
     Redistribution terms are gathered in the `copyright' file.
   -->
 <html>
   <head>
     <meta charset="utf-8"/>
-    <title>Hachette - page settings</title>
+    <title>Haketilo - page settings</title>
     <link type="text/css" rel="stylesheet" href="reset.css" />
     <link type="text/css" rel="stylesheet" href="base.css" />
     <link type="text/css" rel="stylesheet" href="back_button.css" />
@@ -331,7 +335,7 @@
 
       <div class="footer padding_inline has_upper_thin_line">
 	<button id="settings_but" type="button">
-	  Open Hachette settings
+	  Open Haketilo settings
 	</button>
       </div>
     </div>
diff --git a/html/display-panel.js b/html/display-panel.js
index 84c922f..c078850 100644
--- a/html/display-panel.js
+++ b/html/display-panel.js
@@ -1,5 +1,7 @@
 /**
- * Hachette display panel logic
+ * This file is part of Haketilo.
+ *
+ * Function: Popup logic.
  *
  * Copyright (C) 2021 Wojtek Kosior
  * Redistribution terms are gathered in the `copyright' file.
diff --git a/html/import_frame.js b/html/import_frame.js
index c0eb2f0..ae6fab4 100644
--- a/html/import_frame.js
+++ b/html/import_frame.js
@@ -1,5 +1,7 @@
 /**
- * Hachette HTML import frame script
+ * This file is part of Haketilo.
+ *
+ * Function: Logic for the settings import frame.
  *
  * Copyright (C) 2021 Wojtek Kosior
  * Redistribution terms are gathered in the `copyright' file.
diff --git a/html/options.html b/html/options.html
index 54ab9e8..2e8317c 100644
--- a/html/options.html
+++ b/html/options.html
@@ -1,12 +1,16 @@
 <!doctype html>
 <!--
+    This file is part of Haketilo.
+
+    Function: Extension's settings page.
+
     Copyright (C) 2021 Wojtek Kosior
     Redistribution terms are gathered in the `copyright' file.
   -->
 <html>
   <head>
     <meta charset="utf-8"/>
-    <title>Hachette options</title>
+    <title>Haketilo options</title>
     <link type="text/css" rel="stylesheet" href="reset.css" />
     <link type="text/css" rel="stylesheet" href="base.css" />
     <link type="text/css" rel="stylesheet" href="table.css" />
diff --git a/html/options_main.js b/html/options_main.js
index 27ab0ec..f8faf9b 100644
--- a/html/options_main.js
+++ b/html/options_main.js
@@ -1,5 +1,7 @@
 /**
- * Hachette HTML options page main script
+ * This file is part of Haketilo.
+ *
+ * Function: Settings page logic.
  *
  * Copyright (C) 2021 Wojtek Kosior
  * Redistribution terms are gathered in the `copyright' file.
diff --git a/icons/hachette.svg b/icons/hachette.svg
deleted file mode 100644
index 6e8948d..0000000
--- a/icons/hachette.svg
+++ /dev/null
@@ -1,127 +0,0 @@
-<?xml version="1.0" encoding="UTF-8" standalone="no"?>
-<svg
-   xmlns:dc="http://purl.org/dc/elements/1.1/"
-   xmlns:cc="http://creativecommons.org/ns#"
-   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
-   xmlns:svg="http://www.w3.org/2000/svg"
-   xmlns="http://www.w3.org/2000/svg"
-   width="128"
-   height="128"
-   viewBox="0 -0.6 33.866668 33.866666"
-   version="1.1"
-   id="svg8">
-  <title
-     id="title1418">Hatchet</title>
-  <defs
-     id="defs2">
-    <filter
-       style="color-interpolation-filters:sRGB"
-       id="filter994"
-       x="-0.78125864"
-       width="2.5625174"
-       y="-0.25392297"
-       height="1.5078459">
-      <feGaussianBlur
-         stdDeviation="1.7304741"
-         id="feGaussianBlur996" />
-    </filter>
-    <filter
-       style="color-interpolation-filters:sRGB"
-       id="filter1401"
-       x="-0.43681362"
-       width="1.8736273"
-       y="-0.032828163"
-       height="1.0656563">
-      <feGaussianBlur
-         stdDeviation="2.2606587"
-         id="feGaussianBlur1403" />
-    </filter>
-  </defs>
-  <metadata
-     id="metadata5">
-    <rdf:RDF>
-      <cc:Work
-         rdf:about="">
-        <dc:format>image/svg+xml</dc:format>
-        <dc:type
-           rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
-        <dc:title>Hatchet</dc:title>
-        <dc:creator>
-          <cc:Agent>
-            <dc:title>David Lyons</dc:title>
-          </cc:Agent>
-        </dc:creator>
-        <dc:publisher>
-          <cc:Agent>
-            <dc:title>dlyons</dc:title>
-          </cc:Agent>
-        </dc:publisher>
-        <cc:license
-           rdf:resource="http://creativecommons.org/licenses/by-sa/4.0/" />
-        <dc:date>2017-05</dc:date>
-        <dc:subject>
-          <rdf:Bag>
-            <rdf:li>hatchet</rdf:li>
-            <rdf:li>ax</rdf:li>
-            <rdf:li>wood</rdf:li>
-          </rdf:Bag>
-        </dc:subject>
-        <dc:description>Hatchet</dc:description>
-      </cc:Work>
-      <cc:License
-         rdf:about="http://creativecommons.org/licenses/by-sa/4.0/">
-        <cc:permits
-           rdf:resource="http://creativecommons.org/ns#Reproduction" />
-        <cc:permits
-           rdf:resource="http://creativecommons.org/ns#Distribution" />
-        <cc:requires
-           rdf:resource="http://creativecommons.org/ns#Notice" />
-        <cc:requires
-           rdf:resource="http://creativecommons.org/ns#Attribution" />
-        <cc:permits
-           rdf:resource="http://creativecommons.org/ns#DerivativeWorks" />
-        <cc:requires
-           rdf:resource="http://creativecommons.org/ns#ShareAlike" />
-      </cc:License>
-    </rdf:RDF>
-  </metadata>
-  <g
-     transform="matrix(0.18053177,-0.14666587,0.14666587,0.18053177,-0.67884005,5.998568)"
-     id="g4514">
-    <path
-       style="fill:#d38d5f;stroke-width:0.23824416"
-       d="M 7.30405,153.7586 C 20.54927,112.215 15.59359,34.229537 16.31646,33.113187 c 0.87975,-1.35862 11.98736,-0.3859 11.70824,-0.21673 0.17326,45.22237 7.01132,84.510963 -0.71993,131.991763 l -9.29885,-5.88681 z"
-       id="rect7" />
-    <path
-       style="stroke-width:0.27389684"
-       d="m 63.328435,18.175599 c 0,0 -18.017818,8.640905 -27.631388,12.644707 -3.823279,1.592294 -7.11998,3.047871 -9.996289,4.376476 -11.35319,0.247708 -19.4479991,0.01005 -19.8799245,1.450041 l 0.01602,16.049149 c 0.1225108,1.704999 8.9933655,2.136989 19.9713905,3.333131 6.538886,4.233937 13.307605,8.532834 17.153475,10.714075 9.058079,5.13742 18.504813,7.823295 18.504813,7.823295 0,0 5.056977,-21.237215 4.911847,-31.707625 C 66.23324,32.388436 63.328435,18.175599 63.328435,18.175599 Z"
-       id="rect9" />
-    <path
-       id="path35"
-       d="m 63.328435,18.175599 c 0,0 2.905055,14.268926 3.050195,24.739336 0.14513,10.47041 -4.912098,31.651538 -4.912098,31.651538 -11.67798,-3.788669 -16.221256,-6.527691 -16.221256,-6.527691 0,0 7.434244,-7.591907 9.174294,-22.366997 1.1592,-16.80443 -4.045711,-21.40711 -4.045711,-21.40711 3.905919,-1.879065 11.01257,-5.216217 12.954576,-6.089076 z"
-       style="opacity:0.45500004;fill:#ffffff;stroke-width:0.26458335" />
-    <path
-       style="opacity:0.45500004;fill:#ffffff;stroke-width:0.26458335"
-       d="m 63.208938,17.51176 c 0,0 3.024552,14.932765 3.169692,25.403175 0.14513,10.47041 -4.912098,31.621519 -4.912098,31.621519 -1.568463,-0.523507 -1.541936,-0.491688 -1.541936,-0.491688 0,0 5.456154,-26.034461 5.211644,-30.225191 -0.0315,-4.2355 -1.218109,-20.314453 -3.453104,-24.783592 0,0 0.723943,-0.407792 1.645299,-0.860384 z"
-       id="path1427" />
-    <path
-       style="fill:#784421;stroke:none;stroke-width:0.26458335px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1"
-       d="m 7.30405,153.7586 10.40103,5.0627 c 0,0 9.14195,5.35641 9.55606,6.02467 0.41411,0.66827 -4.66818,-0.88342 -7.90926,-2.11367 -3.24108,-1.23026 -8.21159,-4.9245 -10.36004,-6.6929 -2.14844,-1.76841 -1.68779,-2.2808 -1.68779,-2.2808 z"
-       id="path1407" />
-    <path
-       id="path999"
-       d="M 7.30405,153.7586 C 17.372688,112.40594 21.015256,78.343761 17.898744,32.568697 l 3.350934,-0.138515 c 0.131707,45.014525 3.851339,79.911868 -2.025736,127.174438 z"
-       style="opacity:0.3;fill:#2b1100;stroke-width:0.20724197" />
-    <path
-       style="opacity:1;fill:#1a1a1a;stroke:none;stroke-width:0.1832249"
-       d="m 37.364038,35.560531 9.400174,-5.992052 c 4.831746,9.986754 3.508267,19.973509 -0.303231,29.960263 l -9.096943,-5.992051 z"
-       id="rect4493" />
-    <rect
-       style="opacity:1;fill:#1a1a1a;stroke:none;stroke-width:0.37082145"
-       id="rect4504"
-       width="7.4658442"
-       height="15.338916"
-       x="23.754957"
-       y="38.224262" />
-  </g>
-</svg>
diff --git a/icons/hachette128.png b/icons/hachette128.png
deleted file mode 100644
index 18816e9..0000000
Binary files a/icons/hachette128.png and /dev/null differ
diff --git a/icons/hachette16.png b/icons/hachette16.png
deleted file mode 100644
index 182ede5..0000000
Binary files a/icons/hachette16.png and /dev/null differ
diff --git a/icons/hachette32.png b/icons/hachette32.png
deleted file mode 100644
index ffaa84b..0000000
Binary files a/icons/hachette32.png and /dev/null differ
diff --git a/icons/hachette48.png b/icons/hachette48.png
deleted file mode 100644
index 1ffcd38..0000000
Binary files a/icons/hachette48.png and /dev/null differ
diff --git a/icons/hachette64.png b/icons/hachette64.png
deleted file mode 100644
index a02abb0..0000000
Binary files a/icons/hachette64.png and /dev/null differ
diff --git a/icons/haketilo.svg b/icons/haketilo.svg
new file mode 100644
index 0000000..6e8948d
--- /dev/null
+++ b/icons/haketilo.svg
@@ -0,0 +1,127 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<svg
+   xmlns:dc="http://purl.org/dc/elements/1.1/"
+   xmlns:cc="http://creativecommons.org/ns#"
+   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
+   xmlns:svg="http://www.w3.org/2000/svg"
+   xmlns="http://www.w3.org/2000/svg"
+   width="128"
+   height="128"
+   viewBox="0 -0.6 33.866668 33.866666"
+   version="1.1"
+   id="svg8">
+  <title
+     id="title1418">Hatchet</title>
+  <defs
+     id="defs2">
+    <filter
+       style="color-interpolation-filters:sRGB"
+       id="filter994"
+       x="-0.78125864"
+       width="2.5625174"
+       y="-0.25392297"
+       height="1.5078459">
+      <feGaussianBlur
+         stdDeviation="1.7304741"
+         id="feGaussianBlur996" />
+    </filter>
+    <filter
+       style="color-interpolation-filters:sRGB"
+       id="filter1401"
+       x="-0.43681362"
+       width="1.8736273"
+       y="-0.032828163"
+       height="1.0656563">
+      <feGaussianBlur
+         stdDeviation="2.2606587"
+         id="feGaussianBlur1403" />
+    </filter>
+  </defs>
+  <metadata
+     id="metadata5">
+    <rdf:RDF>
+      <cc:Work
+         rdf:about="">
+        <dc:format>image/svg+xml</dc:format>
+        <dc:type
+           rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
+        <dc:title>Hatchet</dc:title>
+        <dc:creator>
+          <cc:Agent>
+            <dc:title>David Lyons</dc:title>
+          </cc:Agent>
+        </dc:creator>
+        <dc:publisher>
+          <cc:Agent>
+            <dc:title>dlyons</dc:title>
+          </cc:Agent>
+        </dc:publisher>
+        <cc:license
+           rdf:resource="http://creativecommons.org/licenses/by-sa/4.0/" />
+        <dc:date>2017-05</dc:date>
+        <dc:subject>
+          <rdf:Bag>
+            <rdf:li>hatchet</rdf:li>
+            <rdf:li>ax</rdf:li>
+            <rdf:li>wood</rdf:li>
+          </rdf:Bag>
+        </dc:subject>
+        <dc:description>Hatchet</dc:description>
+      </cc:Work>
+      <cc:License
+         rdf:about="http://creativecommons.org/licenses/by-sa/4.0/">
+        <cc:permits
+           rdf:resource="http://creativecommons.org/ns#Reproduction" />
+        <cc:permits
+           rdf:resource="http://creativecommons.org/ns#Distribution" />
+        <cc:requires
+           rdf:resource="http://creativecommons.org/ns#Notice" />
+        <cc:requires
+           rdf:resource="http://creativecommons.org/ns#Attribution" />
+        <cc:permits
+           rdf:resource="http://creativecommons.org/ns#DerivativeWorks" />
+        <cc:requires
+           rdf:resource="http://creativecommons.org/ns#ShareAlike" />
+      </cc:License>
+    </rdf:RDF>
+  </metadata>
+  <g
+     transform="matrix(0.18053177,-0.14666587,0.14666587,0.18053177,-0.67884005,5.998568)"
+     id="g4514">
+    <path
+       style="fill:#d38d5f;stroke-width:0.23824416"
+       d="M 7.30405,153.7586 C 20.54927,112.215 15.59359,34.229537 16.31646,33.113187 c 0.87975,-1.35862 11.98736,-0.3859 11.70824,-0.21673 0.17326,45.22237 7.01132,84.510963 -0.71993,131.991763 l -9.29885,-5.88681 z"
+       id="rect7" />
+    <path
+       style="stroke-width:0.27389684"
+       d="m 63.328435,18.175599 c 0,0 -18.017818,8.640905 -27.631388,12.644707 -3.823279,1.592294 -7.11998,3.047871 -9.996289,4.376476 -11.35319,0.247708 -19.4479991,0.01005 -19.8799245,1.450041 l 0.01602,16.049149 c 0.1225108,1.704999 8.9933655,2.136989 19.9713905,3.333131 6.538886,4.233937 13.307605,8.532834 17.153475,10.714075 9.058079,5.13742 18.504813,7.823295 18.504813,7.823295 0,0 5.056977,-21.237215 4.911847,-31.707625 C 66.23324,32.388436 63.328435,18.175599 63.328435,18.175599 Z"
+       id="rect9" />
+    <path
+       id="path35"
+       d="m 63.328435,18.175599 c 0,0 2.905055,14.268926 3.050195,24.739336 0.14513,10.47041 -4.912098,31.651538 -4.912098,31.651538 -11.67798,-3.788669 -16.221256,-6.527691 -16.221256,-6.527691 0,0 7.434244,-7.591907 9.174294,-22.366997 1.1592,-16.80443 -4.045711,-21.40711 -4.045711,-21.40711 3.905919,-1.879065 11.01257,-5.216217 12.954576,-6.089076 z"
+       style="opacity:0.45500004;fill:#ffffff;stroke-width:0.26458335" />
+    <path
+       style="opacity:0.45500004;fill:#ffffff;stroke-width:0.26458335"
+       d="m 63.208938,17.51176 c 0,0 3.024552,14.932765 3.169692,25.403175 0.14513,10.47041 -4.912098,31.621519 -4.912098,31.621519 -1.568463,-0.523507 -1.541936,-0.491688 -1.541936,-0.491688 0,0 5.456154,-26.034461 5.211644,-30.225191 -0.0315,-4.2355 -1.218109,-20.314453 -3.453104,-24.783592 0,0 0.723943,-0.407792 1.645299,-0.860384 z"
+       id="path1427" />
+    <path
+       style="fill:#784421;stroke:none;stroke-width:0.26458335px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1"
+       d="m 7.30405,153.7586 10.40103,5.0627 c 0,0 9.14195,5.35641 9.55606,6.02467 0.41411,0.66827 -4.66818,-0.88342 -7.90926,-2.11367 -3.24108,-1.23026 -8.21159,-4.9245 -10.36004,-6.6929 -2.14844,-1.76841 -1.68779,-2.2808 -1.68779,-2.2808 z"
+       id="path1407" />
+    <path
+       id="path999"
+       d="M 7.30405,153.7586 C 17.372688,112.40594 21.015256,78.343761 17.898744,32.568697 l 3.350934,-0.138515 c 0.131707,45.014525 3.851339,79.911868 -2.025736,127.174438 z"
+       style="opacity:0.3;fill:#2b1100;stroke-width:0.20724197" />
+    <path
+       style="opacity:1;fill:#1a1a1a;stroke:none;stroke-width:0.1832249"
+       d="m 37.364038,35.560531 9.400174,-5.992052 c 4.831746,9.986754 3.508267,19.973509 -0.303231,29.960263 l -9.096943,-5.992051 z"
+       id="rect4493" />
+    <rect
+       style="opacity:1;fill:#1a1a1a;stroke:none;stroke-width:0.37082145"
+       id="rect4504"
+       width="7.4658442"
+       height="15.338916"
+       x="23.754957"
+       y="38.224262" />
+  </g>
+</svg>
diff --git a/icons/haketilo128.png b/icons/haketilo128.png
new file mode 100644
index 0000000..18816e9
Binary files /dev/null and b/icons/haketilo128.png differ
diff --git a/icons/haketilo16.png b/icons/haketilo16.png
new file mode 100644
index 0000000..182ede5
Binary files /dev/null and b/icons/haketilo16.png differ
diff --git a/icons/haketilo32.png b/icons/haketilo32.png
new file mode 100644
index 0000000..ffaa84b
Binary files /dev/null and b/icons/haketilo32.png differ
diff --git a/icons/haketilo48.png b/icons/haketilo48.png
new file mode 100644
index 0000000..1ffcd38
Binary files /dev/null and b/icons/haketilo48.png differ
diff --git a/icons/haketilo64.png b/icons/haketilo64.png
new file mode 100644
index 0000000..a02abb0
Binary files /dev/null and b/icons/haketilo64.png differ
diff --git a/manifest.json b/manifest.json
index ce2577e..9d34732 100644
--- a/manifest.json
+++ b/manifest.json
@@ -1,18 +1,20 @@
+// This is the manifest file of Haketilo.
+//
 // Copyright (C) 2021 Wojtek Kosior
 // Redistribution terms are gathered in the `copyright' file.
 {
     "manifest_version": 2,
-    "name": "Hachette",
-    "short_name": "Hachette",
+    "name": "Haketilo",
+    "short_name": "Haketilo",
     "version": "0.0.1",
     "author": "various",
     "description": "Control your \"Web\" browsing.",_GECKO_APPLICATIONS_
     "icons":{
-	"128": "icons/hachette128.png",
-	"64": "icons/hachette64.png",
-	"48": "icons/hachette48.png",
-	"32": "icons/hachette32.png",
-	"16": "icons/hachette16.png"
+	"128": "icons/haketilo128.png",
+	"64": "icons/haketilo64.png",
+	"48": "icons/haketilo48.png",
+	"32": "icons/haketilo32.png",
+	"16": "icons/haketilo16.png"
     },
     "permissions": [
 	"contextMenus",
@@ -29,13 +31,13 @@
     "browser_action": {
 	"browser_style": true,
 	"default_icon": {
-	    "128": "icons/hachette128.png",
-	    "64": "icons/hachette64.png",
-	    "48": "icons/hachette48.png",
-	    "32": "icons/hachette32.png",
-	    "16": "icons/hachette16.png"
+	    "128": "icons/haketilo128.png",
+	    "64": "icons/haketilo64.png",
+	    "48": "icons/haketilo48.png",
+	    "32": "icons/haketilo32.png",
+	    "16": "icons/haketilo16.png"
 	},
-	"default_title": "Hachette",
+	"default_title": "Haketilo",
 	"default_popup": "html/display-panel.html"
     },
     "options_ui": {
diff --git a/re-generate_icons.sh b/re-generate_icons.sh
index ba0c28a..e557ad0 100755
--- a/re-generate_icons.sh
+++ b/re-generate_icons.sh
@@ -4,5 +4,5 @@
 # Redistribution terms are gathered in the `copyright' file.
 
 for SIZE in 128 64 48 32 16; do
-    inkscape -z -e icons/hachette$SIZE.png -w $SIZE -h $SIZE icons/hachette.svg
+    inkscape -z -e icons/haketilo$SIZE.png -w $SIZE -h $SIZE icons/haketilo.svg
 done
-- 
cgit v1.2.3


From 96068ada37bfa1d7e6485551138ba36600664caf Mon Sep 17 00:00:00 2001
From: Wojtek Kosior <koszko@koszko.org>
Date: Sat, 20 Nov 2021 18:29:59 +0100
Subject: replace cookies with synchronous XmlHttpRequest as policy smuggling
 method.

Note: this breaks Mozilla port of Haketilo. Synchronous XmlHttpRequest doesn't work as well there. This will be fixed with dynamically-registered content scripts later.
---
 background/cookie_filter.js       |  46 -------------
 background/main.js                | 120 +++++++++++++++++++++++++++------
 background/page_actions_server.js |  32 ++-------
 background/policy_injector.js     |  67 +++---------------
 background/stream_filter.js       |   6 +-
 build.sh                          |  16 +----
 common/misc.js                    |   2 +-
 common/signing.js                 |  74 --------------------
 content/activity_info_server.js   |   4 +-
 content/main.js                   | 138 +++++++++++---------------------------
 content/page_actions.js           |  27 ++++----
 dummy                             |   0
 html/display-panel.js             |  13 ++--
 manifest.json                     |   3 +-
 14 files changed, 180 insertions(+), 368 deletions(-)
 delete mode 100644 background/cookie_filter.js
 delete mode 100644 common/signing.js
 create mode 100644 dummy

(limited to 'background/stream_filter.js')

diff --git a/background/cookie_filter.js b/background/cookie_filter.js
deleted file mode 100644
index 64d18b2..0000000
--- a/background/cookie_filter.js
+++ /dev/null
@@ -1,46 +0,0 @@
-/**
- * This file is part of Haketilo.
- *
- * Function: Filtering request headers to remove haketilo cookies that might
- *     have slipped through.
- *
- * Copyright (C) 2021 Wojtek Kosior
- * Redistribution terms are gathered in the `copyright' file.
- */
-
-/*
- * IMPORTS_START
- * IMPORT extract_signed
- * IMPORTS_END
- */
-
-function is_valid_haketilo_cookie(cookie)
-{
-    const match = /^haketilo-(\w*)=(.*)$/.exec(cookie);
-    if (!match)
-	return false;
-
-    return !extract_signed(match.slice(1, 3)).fail;
-}
-
-function remove_haketilo_cookies(header)
-{
-    if (header.name !== "Cookie")
-	return header;
-
-    const cookies = header.value.split("; ");
-    const value = cookies.filter(c => !is_valid_haketilo_cookie(c)).join("; ");
-
-    return value ? {name: "Cookie", value} : null;
-}
-
-function filter_cookie_headers(headers)
-{
-    return headers.map(remove_haketilo_cookies).filter(h => h);
-}
-
-/*
- * EXPORTS_START
- * EXPORT filter_cookie_headers
- * EXPORTS_END
- */
diff --git a/background/main.js b/background/main.js
index 40b3a9e..9cdfb97 100644
--- a/background/main.js
+++ b/background/main.js
@@ -17,11 +17,10 @@
  * IMPORT browser
  * IMPORT is_privileged_url
  * IMPORT query_best
- * IMPORT gen_nonce
  * IMPORT inject_csp_headers
  * IMPORT apply_stream_filter
- * IMPORT filter_cookie_headers
  * IMPORT is_chrome
+ * IMPORT is_mozilla
  * IMPORTS_END
  */
 
@@ -51,34 +50,53 @@ async function init_ext(install_details)
 
 browser.runtime.onInstalled.addListener(init_ext);
 
+/*
+ * The function below implements a more practical interface for what it does by
+ * wrapping the old query_best() function.
+ */
+function decide_policy_for_url(storage, policy_observable, url)
+{
+    if (storage === undefined)
+	return {allow: false};
+
+    const settings =
+	{allow: policy_observable !== undefined && policy_observable.value};
+
+    const [pattern, queried_settings] = query_best(storage, url);
+
+    if (queried_settings) {
+	settings.payload = queried_settings.components;
+	settings.allow = !!queried_settings.allow && !settings.payload;
+	settings.pattern = pattern;
+    }
+
+    return settings;
+}
 
 let storage;
 let policy_observable = {};
 
-function on_headers_received(details)
+function sanitize_web_page(details)
 {
     const url = details.url;
     if (is_privileged_url(details.url))
 	return;
 
-    const [pattern, settings] = query_best(storage, details.url);
-    const has_payload = !!(settings && settings.components);
-    const allow = !has_payload &&
-	  !!(settings ? settings.allow : policy_observable.value);
-    const nonce = gen_nonce();
-    const policy = {allow, url, nonce, has_payload};
+    const policy =
+	  decide_policy_for_url(storage, policy_observable, details.url);
 
     let headers = details.responseHeaders;
+
+    headers = inject_csp_headers(headers, policy);
+
     let skip = false;
     for (const header of headers) {
 	if ((header.name.toLowerCase().trim() === "content-disposition" &&
 	     /^\s*attachment\s*(;.*)$/i.test(header.value)))
 	    skip = true;
     }
-
-    headers = inject_csp_headers(headers, policy);
-
     skip = skip || (details.statusCode >= 300 && details.statusCode < 400);
+
     if (!skip) {
 	/* Check for API availability. */
 	if (browser.webRequest.filterResponseData)
@@ -88,11 +106,49 @@ function on_headers_received(details)
     return {responseHeaders: headers};
 }
 
-function on_before_send_headers(details)
+const request_url_regex = /^[^?]*\?url=(.*)$/;
+const redirect_url_template = browser.runtime.getURL("dummy") + "?settings=";
+
+function synchronously_smuggle_policy(details)
 {
-    let headers = details.requestHeaders;
-    headers = filter_cookie_headers(headers);
-    return {requestHeaders: headers};
+    /*
+     * Content script will make a synchronous XmlHttpRequest to extension's
+     * `dummy` file to query settings for given URL. We smuggle that
+     * information in query parameter of the URL we redirect to.
+     * A risk of fingerprinting arises if a page with script execution allowed
+     * guesses the dummy file URL and makes an AJAX call to it. It is currently
+     * a problem in ManifestV2 Chromium-family port of Haketilo because Chromium
+     * uses predictable URLs for web-accessible resources. We plan to fix it in
+     * the future ManifestV3 port.
+     */
+    if (details.type !== "xmlhttprequest")
+	return {cancel: true};
+
+    console.debug(`Settings queried using XHR for '${details.url}'.`);
+
+    let policy = {allow: false};
+
+    try {
+	/*
+	 * request_url should be of the following format:
+	 *     <url_for_extension's_dummy_file>?url=<valid_urlencoded_url>
+	 */
+	const match = request_url_regex.exec(details.url);
+	const queried_url = decodeURIComponent(match[1]);
+
+	if (details.initiator && !queried_url.startsWith(details.initiator)) {
+	    console.warn(`Blocked suspicious query of '${url}' by '${details.initiator}'. This might be the result of page fingerprinting the browser.`);
+	    return {cancel: true};
+	}
+
+	policy = decide_policy_for_url(storage, policy_observable, queried_url);
+    } catch (e) {
+	console.warn(`Bad request! Expected ${browser.runtime.getURL("dummy")}?url=<valid_urlencoded_url>. Got ${request_url}. This might be the result of page fingerprinting the browser.`);
+    }
+
+    const encoded_policy = encodeURIComponent(JSON.stringify(policy));
+
+    return {redirectUrl: redirect_url_template + encoded_policy};
 }
 
 const all_types = [
@@ -110,18 +166,40 @@ async function start_webRequest_operations()
 	extra_opts.push("extraHeaders");
 
     browser.webRequest.onHeadersReceived.addListener(
-	on_headers_received,
+	sanitize_web_page,
 	{urls: ["<all_urls>"], types: ["main_frame", "sub_frame"]},
 	extra_opts.concat("responseHeaders")
     );
 
-    browser.webRequest.onBeforeSendHeaders.addListener(
-	on_before_send_headers,
-	{urls: ["<all_urls>"], types: all_types},
-	extra_opts.concat("requestHeaders")
+    const dummy_url_pattern = browser.runtime.getURL("dummy") + "?url=*";
+    browser.webRequest.onBeforeRequest.addListener(
+	synchronously_smuggle_policy,
+	{urls: [dummy_url_pattern], types: ["xmlhttprequest"]},
+	extra_opts
     );
 
     policy_observable = await light_storage.observe_var("default_allow");
 }
 
 start_webRequest_operations();
+
+const code = `\
+console.warn("Hi, I'm Mr Dynamic!");
+
+console.debug("let's see how window.killtheweb looks like now");
+
+console.log("killtheweb", window.killtheweb);
+`
+
+async function test_dynamic_content_scripts()
+{
+    browser.contentScripts.register({
+	"js": [{code}],
+	"matches": ["<all_urls>"],
+	"allFrames": true,
+	"runAt": "document_start"
+});
+}
+
+if (is_mozilla)
+    test_dynamic_content_scripts();
diff --git a/background/page_actions_server.js b/background/page_actions_server.js
index 156a79f..74783c9 100644
--- a/background/page_actions_server.js
+++ b/background/page_actions_server.js
@@ -16,34 +16,12 @@
  * IMPORT browser
  * IMPORT listen_for_connection
  * IMPORT sha256
- * IMPORT query_best
  * IMPORT make_ajax_request
  * IMPORTS_END
  */
 
 var storage;
 var handler;
-let policy_observable;
-
-function send_actions(url, port)
-{
-    const [pattern, queried_settings] = query_best(storage, url);
-
-    const settings = {allow: policy_observable && policy_observable.value};
-    Object.assign(settings, queried_settings);
-    if (settings.components)
-	settings.allow = false;
-
-    const repos = storage.get_all(TYPE_PREFIX.REPO);
-
-    port.postMessage(["settings", [pattern, settings, repos]]);
-
-    const components = settings.components;
-    const processed_bags = new Set();
-
-    if (components !== undefined)
-	send_scripts([components], port, processed_bags);
-}
 
 // TODO: parallelize script fetching
 async function send_scripts(components, port, processed_bags)
@@ -116,9 +94,11 @@ async function fetch_remote_script(script_data)
 function handle_message(port, message, handler)
 {
     port.onMessage.removeListener(handler[0]);
-    let url = message.url;
-    console.log({url});
-    send_actions(url, port);
+    console.debug(`Loading payload '${message.payload}'.`);
+
+    const processed_bags = new Set();
+
+    send_scripts([message.payload], port, processed_bags);
 }
 
 function new_connection(port)
@@ -134,8 +114,6 @@ async function start_page_actions_server()
     storage = await get_storage();
 
     listen_for_connection(CONNECTION_TYPE.PAGE_ACTIONS, new_connection);
-
-    policy_observable = await light_storage.observe_var("default_allow");
 }
 
 /*
diff --git a/background/policy_injector.js b/background/policy_injector.js
index 881595b..b49ec47 100644
--- a/background/policy_injector.js
+++ b/background/policy_injector.js
@@ -10,77 +10,28 @@
 
 /*
  * IMPORTS_START
- * IMPORT sign_data
- * IMPORT extract_signed
  * IMPORT make_csp_rule
  * IMPORT csp_header_regex
+ * Re-enable the import below once nonce stuff here is ready
+ * !mport gen_nonce
  * IMPORTS_END
  */
 
 function inject_csp_headers(headers, policy)
 {
     let csp_headers;
-    let old_signature;
-    let haketilo_header;
 
-    for (const header of headers.filter(h => h.name === "x-haketilo")) {
-	/* x-haketilo header has format: <signature>_0_<data> */
-	const match = /^([^_]+)_(0_.*)$/.exec(header.value);
-	if (!match)
-	    continue;
+    if (policy.payload) {
+	headers = headers.filter(h => !csp_header_regex.test(h.name));
 
-	const result = extract_signed(...match.slice(1, 3));
-	if (result.fail)
-	    continue;
+	// TODO: make CSP rules with nonces and facilitate passing them to
+	// content scripts via dynamic content script registration or
+	// synchronous XHRs
 
-	/* This should succeed - it's our self-produced valid JSON. */
-	const old_data = JSON.parse(decodeURIComponent(result.data));
-
-	/* Confirmed- it's the originals, smuggled in! */
-	csp_headers = old_data.csp_headers;
-	old_signature = old_data.policy_sig;
-
-	haketilo_header = header;
-	break;
+	// policy.nonce = gen_nonce();
     }
 
-    if (policy.has_payload) {
-	csp_headers = [];
-	const non_csp_headers = [];
-	const header_list =
-	      h => csp_header_regex.test(h) ? csp_headers : non_csp_headers;
-	headers.forEach(h => header_list(h.name).push(h));
-	headers = non_csp_headers;
-    } else {
-	headers.push(...csp_headers || []);
-    }
-
-    if (!haketilo_header) {
-	haketilo_header = {name: "x-haketilo"};
-	headers.push(haketilo_header);
-    }
-
-    if (old_signature)
-	headers = headers.filter(h => h.value.search(old_signature) === -1);
-
-    const policy_str = encodeURIComponent(JSON.stringify(policy));
-    const signed_policy = sign_data(policy_str, new Date().getTime());
-    const later_30sec = new Date(new Date().getTime() + 30000).toGMTString();
-    headers.push({
-	name: "Set-Cookie",
-	value: `haketilo-${signed_policy.join("=")}; Expires=${later_30sec};`
-    });
-
-    /*
-     * Smuggle in the signature and the original CSP headers for future use.
-     * These are signed with a time of 0, as it's not clear there is a limit on
-     * how long Firefox might retain headers in the cache.
-     */
-    let haketilo_data = {csp_headers, policy_sig: signed_policy[0]};
-    haketilo_data = encodeURIComponent(JSON.stringify(haketilo_data));
-    haketilo_header.value = sign_data(haketilo_data, 0).join("_");
-
-    if (!policy.allow) {
+    if (!policy.allow && (policy.nonce || !policy.payload)) {
 	headers.push({
 	    name: "content-security-policy",
 	    value: make_csp_rule(policy)
diff --git a/background/stream_filter.js b/background/stream_filter.js
index e5e0827..e5d124c 100644
--- a/background/stream_filter.js
+++ b/background/stream_filter.js
@@ -174,8 +174,7 @@ function filter_data(properties, event)
 	 * as harmless anyway).
 	 */
 
-	const dummy_script =
-	      `<script data-haketilo-deleteme="${properties.policy.nonce}" nonce="${properties.policy.nonce}">null</script>`;
+	const dummy_script = `<script>null</script>`;
 	const doctype_decl = /^(\s*<!doctype[^<>"']*>)?/i.exec(decoded)[0];
 	decoded = doctype_decl + dummy_script +
 	    decoded.substring(doctype_decl.length);
@@ -189,11 +188,10 @@ function filter_data(properties, event)
 
 function apply_stream_filter(details, headers, policy)
 {
-    if (!policy.has_payload)
+    if (!policy.payload)
 	return headers;
 
     const properties = properties_from_headers(headers);
-    properties.policy = policy;
 
     properties.filter =
 	browser.webRequest.filterResponseData(details.requestId);
diff --git a/build.sh b/build.sh
index 936ab06..ed6a141 100755
--- a/build.sh
+++ b/build.sh
@@ -180,7 +180,6 @@ build_main() {
 	mkdir -p "$BUILDDIR"/$DIR
     done
 
-    CHROMIUM_KEY=''
     CHROMIUM_UPDATE_URL=''
     GECKO_APPLICATIONS=''
 
@@ -189,20 +188,7 @@ build_main() {
     fi
 
     if [ "$BROWSER" = "chromium" ]; then
-	CHROMIUM_KEY="$(dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64)"
-	CHROMIUM_KEY=$(echo chromium-key-dummy-file-$CHROMIUM_KEY | tr / -)
-	touch "$BUILDDIR"/$CHROMIUM_KEY
-
 	CHROMIUM_UPDATE_URL="$UPDATE_URL"
-
-	CHROMIUM_KEY="\n\
-	// WARNING!!!\n\
-	// EACH USER SHOULD REPLACE DUMMY FILE's VALUE WITH A UNIQUE ONE!!!\n\
-	// OTHERWISE, SECURITY CAN BE TRIVIALLY COMPROMISED!\n\
-	// Only relevant to users of chrome-based browsers.\n\
-	// Users of Firefox forks are safe.\n\
-	\"$CHROMIUM_KEY\"\
-"
     else
 	GECKO_APPLICATIONS="\n\
     \"applications\": {\n\
@@ -215,7 +201,6 @@ build_main() {
 
     sed "\
 s^_GECKO_APPLICATIONS_^$GECKO_APPLICATIONS^
-s^_CHROMIUM_KEY_^$CHROMIUM_KEY^
 s^_CHROMIUM_UPDATE_URL_^$CHROMIUM_UPDATE_URL^
 s^_BGSCRIPTS_^$BGSCRIPTS^
 s^_CONTENTSCRIPTS_^$CONTENTSCRIPTS^" \
@@ -279,6 +264,7 @@ EOF
     fi
 
     cp -r copyright licenses/ "$BUILDDIR"
+    cp dummy "$BUILDDIR"
     cp html/*.css "$BUILDDIR"/html
     mkdir "$BUILDDIR"/icons
     cp icons/*.png "$BUILDDIR"/icons
diff --git a/common/misc.js b/common/misc.js
index 9ffb7ff..5b0addb 100644
--- a/common/misc.js
+++ b/common/misc.js
@@ -49,7 +49,7 @@ function gen_nonce(length=16)
 function make_csp_rule(policy)
 {
     let rule = "prefetch-src 'none'; script-src-attr 'none';";
-    const script_src = policy.has_payload ?
+    const script_src = policy.nonce !== undefined ?
 	  `'nonce-${policy.nonce}'` : "'none'";
     rule += ` script-src ${script_src}; script-src-elem ${script_src};`;
     return rule;
diff --git a/common/signing.js b/common/signing.js
deleted file mode 100644
index 11cd442..0000000
--- a/common/signing.js
+++ /dev/null
@@ -1,74 +0,0 @@
-/**
- * This file is part of Haketilo.
- *
- * Functions: Operations related to "signing" of data.
- *
- * Copyright (C) 2021 Wojtek Kosior
- * Redistribution terms are gathered in the `copyright' file.
- */
-
-/*
- * IMPORTS_START
- * IMPORT sha256
- * IMPORT browser
- * IMPORT is_mozilla
- * IMPORTS_END
- */
-
-/*
- * In order to make certain data synchronously accessible in certain contexts,
- * Haketilo smuggles it in string form in places like cookies, URLs and headers.
- * When using the smuggled data, we first need to make sure it isn't spoofed.
- * For that, we use this pseudo-signing mechanism.
- *
- * Despite what name suggests, no assymetric cryptography is involved, as it
- * would bring no additional benefits and would incur bigger performance
- * overhead. Instead, we hash the string data together with some secret value
- * that is supposed to be known only by this browser instance. Resulting hash
- * sum plays the role of the signature. In the hash we also include current
- * time. This way, even if signed data leaks (which shouldn't happen in the
- * first place), an attacker won't be able to re-use it indefinitely.
- *
- * The secret shared between execution contexts has to be available
- * synchronously. Under Mozilla, this is the extension's per-session id. Under
- * Chromium, this is a dummy web-accessible-resource name that resides in the
- * manifest and is supposed to be constructed by each user using a unique value
- * (this is done automatically by `build.sh').
- */
-
-function get_secret()
-{
-    if (is_mozilla)
-	return browser.runtime.getURL("dummy");
-
-    return chrome.runtime.getManifest().web_accessible_resources
-	.map(r => /^chromium-key-dummy-file-(.*)/.exec(r)).filter(r => r)[0][1];
-}
-
-function extract_signed(signature, signed_data)
-{
-    const match = /^([1-9][0-9]{12}|0)_(.*)$/.exec(signed_data);
-    if (!match)
-	return {fail: "bad format"};
-
-    const result = {time: parseInt(match[1]), data: match[2]};
-    if (sign_data(result.data, result.time)[0] !== signature)
-	result.fail = "bad signature";
-
-    return result;
-}
-
-/*
- * Sign a given string for a given time. Time should be either 0 or in the range
- * 10^12 <= time < 10^13.
- */
-function sign_data(data, time) {
-    return [sha256(get_secret() + time + data), `${time}_${data}`];
-}
-
-/*
- * EXPORTS_START
- * EXPORT extract_signed
- * EXPORT sign_data
- * EXPORTS_END
- */
diff --git a/content/activity_info_server.js b/content/activity_info_server.js
index d1dfe36..aa92b75 100644
--- a/content/activity_info_server.js
+++ b/content/activity_info_server.js
@@ -42,7 +42,9 @@ function report_script(script_data)
 
 function report_settings(settings)
 {
-    report_activity("settings", settings);
+    const settings_clone = {};
+    Object.assign(settings_clone, settings)
+    report_activity("settings", settings_clone);
 }
 
 function report_document_type(is_html)
diff --git a/content/main.js b/content/main.js
index cec9943..ce1ff7a 100644
--- a/content/main.js
+++ b/content/main.js
@@ -11,15 +11,15 @@
 /*
  * IMPORTS_START
  * IMPORT handle_page_actions
- * IMPORT extract_signed
- * IMPORT sign_data
  * IMPORT gen_nonce
  * IMPORT is_privileged_url
+ * IMPORT browser
  * IMPORT is_chrome
  * IMPORT is_mozilla
  * IMPORT start_activity_info_server
  * IMPORT make_csp_rule
  * IMPORT csp_header_regex
+ * IMPORT report_settings
  * IMPORTS_END
  */
 
@@ -29,69 +29,6 @@ const wait_loaded = e => e.content_loaded ? Promise.resolve() :
 
 wait_loaded(document).then(() => document.content_loaded = true);
 
-function extract_cookie_policy(cookie, min_time)
-{
-    let best_result = {time: -1};
-    let policy = null;
-    const extracted_signatures = [];
-
-    for (const match of cookie.matchAll(/haketilo-(\w*)=([^;]*)/g)) {
-	const new_result = extract_signed(...match.slice(1, 3));
-	if (new_result.fail)
-	    continue;
-
-	extracted_signatures.push(match[1]);
-
-	if (new_result.time < Math.max(min_time, best_result.time))
-	    continue;
-
-	/* This should succeed - it's our self-produced valid JSON. */
-	const new_policy = JSON.parse(decodeURIComponent(new_result.data));
-	if (new_policy.url !== document.URL)
-	    continue;
-
-	best_result = new_result;
-	policy = new_policy;
-    }
-
-    return [policy, extracted_signatures];
-}
-
-function extract_url_policy(url, min_time)
-{
-    const [base_url, payload, anchor] =
-	  /^([^#]*)#?([^#]*)(#?.*)$/.exec(url).splice(1, 4);
-
-    const match = /^haketilo_([^_]+)_(.*)$/.exec(payload);
-    if (!match)
-	return [null, url];
-
-    const result = extract_signed(...match.slice(1, 3));
-    if (result.fail)
-	return [null, url];
-
-    const original_url = base_url + anchor;
-    const policy = result.time < min_time ? null :
-	  JSON.parse(decodeURIComponent(result.data));
-
-    return [policy.url === original_url ? policy : null, original_url];
-}
-
-function employ_nonhttp_policy(policy)
-{
-    if (!policy.allow)
-	return;
-
-    policy.nonce = gen_nonce();
-    const [base_url, target] = /^([^#]*)(#?.*)$/.exec(policy.url).slice(1, 3);
-    const encoded_policy = encodeURIComponent(JSON.stringify(policy));
-    const payload = "haketilo_" +
-	  sign_data(encoded_policy, new Date().getTime()).join("_");
-    const resulting_url = `${base_url}#${payload}${target}`;
-    location.href = resulting_url;
-    location.reload();
-}
-
 /*
  * In the case of HTML documents:
  * 1. When injecting some payload we need to sanitize <meta> CSP tags before
@@ -306,7 +243,7 @@ http-equiv="Content-Security-Policy" content="${make_csp_rule(policy)}"\
     start_data_urls_sanitizing(doc);
 }
 
-async function disable_service_workers()
+async function _disable_service_workers()
 {
     if (!navigator.serviceWorker)
 	return;
@@ -315,7 +252,7 @@ async function disable_service_workers()
     if (registrations.length === 0)
 	return;
 
-    console.warn("Service Workers detected on this page! Unregistering and reloading");
+    console.warn("Service Workers detected on this page! Unregistering and reloading.");
 
     try {
 	await Promise.all(registrations.map(r => r.unregister()));
@@ -327,50 +264,57 @@ async function disable_service_workers()
     return new Promise(() => 0);
 }
 
-if (!is_privileged_url(document.URL)) {
-    let policy_received_callback = () => undefined;
-    let policy;
-
-    /* Signature valid for half an hour. */
-    const min_time = new Date().getTime() - 1800 * 1000;
-
-    if (/^https?:/.test(document.URL)) {
-	let signatures;
-	[policy, signatures] = extract_cookie_policy(document.cookie, min_time);
-	for (const signature of signatures)
-	    document.cookie = `haketilo-${signature}=; Max-Age=-1;`;
-    } else {
-	const scheme = /^([^:]*)/.exec(document.URL)[1];
-	const known_scheme = ["file", "ftp"].includes(scheme);
-
-	if (!known_scheme)
-	    console.warn(`Unknown url scheme: \`${scheme}'!`);
-
-	let original_url;
-	[policy, original_url] = extract_url_policy(document.URL, min_time);
-	history.replaceState(null, "", original_url);
-
-	if (known_scheme && !policy)
-	    policy_received_callback = employ_nonhttp_policy;
+/*
+ * Trying to use servce workers APIs might result in exceptions, for example
+ * when in a non-HTML document. Because of this, we wrap the function that does
+ * the actual work in a try {} block.
+ */
+async function disable_service_workers()
+{
+    try {
+	await _disable_service_workers()
+    } catch (e) {
+	console.debug("Exception thrown during an attempt to detect and disable service workers.", e);
     }
+}
 
-    if (!policy) {
-	console.debug("Using fallback policy!");
-	policy = {allow: false, nonce: gen_nonce()};
+function synchronously_get_policy(url)
+{
+    const encoded_url = encodeURIComponent(url);
+    const request_url = `${browser.runtime.getURL("dummy")}?url=${encoded_url}`;
+
+    try {
+	var xhttp = new XMLHttpRequest();
+	xhttp.open("GET", request_url, false);
+	xhttp.send();
+    } catch(e) {
+	console.error("Failure to synchronously fetch policy for url.", e);
+	return {allow: false};
     }
 
+    const policy = /^[^?]*\?settings=(.*)$/.exec(xhttp.responseURL)[1];
+    return JSON.parse(decodeURIComponent(policy));
+}
+
+if (!is_privileged_url(document.URL)) {
+    const policy = synchronously_get_policy(document.URL);
+
     if (!(document instanceof HTMLDocument))
-	policy.has_payload = false;
+	delete policy.payload;
 
     console.debug("current policy", policy);
 
+    report_settings(policy);
+
+    policy.nonce = gen_nonce();
+
     const doc_ready = Promise.all([
 	policy.allow ? Promise.resolve() : sanitize_document(document, policy),
 	policy.allow ? Promise.resolve() : disable_service_workers(),
 	wait_loaded(document)
     ]);
 
-    handle_page_actions(policy.nonce, policy_received_callback, doc_ready);
+    handle_page_actions(policy, doc_ready);
 
     start_activity_info_server();
 }
diff --git a/content/page_actions.js b/content/page_actions.js
index db7c352..845e452 100644
--- a/content/page_actions.js
+++ b/content/page_actions.js
@@ -12,19 +12,17 @@
  * IMPORT CONNECTION_TYPE
  * IMPORT browser
  * IMPORT report_script
- * IMPORT report_settings
  * IMPORT report_document_type
  * IMPORTS_END
  */
 
-let policy_received_callback;
+let policy;
 /* Snapshot url and content type early; these can be changed by other code. */
 let url;
 let is_html;
 let port;
 let loaded = false;
 let scripts_awaiting = [];
-let nonce;
 
 function handle_message(message)
 {
@@ -38,9 +36,8 @@ function handle_message(message)
 		scripts_awaiting.push(script_text);
 	}
     }
-    if (action === "settings") {
-	report_settings(data);
-	policy_received_callback({url, allow: data[1].allow});
+    else {
+	console.error(`Bad page action '${action}'.`);
     }
 }
 
@@ -61,27 +58,27 @@ function add_script(script_text)
 
     let script = document.createElement("script");
     script.textContent = script_text;
-    script.setAttribute("nonce", nonce);
+    script.setAttribute("nonce", policy.nonce);
     script.haketilo_payload = true;
     document.body.appendChild(script);
 
     report_script(script_text);
 }
 
-function handle_page_actions(script_nonce, policy_received_cb,
-			     doc_ready_promise) {
-    policy_received_callback = policy_received_cb;
+function handle_page_actions(_policy, doc_ready_promise) {
+    policy = _policy;
+
     url = document.URL;
     is_html = document instanceof HTMLDocument;
     report_document_type(is_html);
 
     doc_ready_promise.then(document_ready);
 
-    port = browser.runtime.connect({name : CONNECTION_TYPE.PAGE_ACTIONS});
-    port.onMessage.addListener(handle_message);
-    port.postMessage({url});
-
-    nonce = script_nonce;
+    if (policy.payload) {
+	port = browser.runtime.connect({name : CONNECTION_TYPE.PAGE_ACTIONS});
+	port.onMessage.addListener(handle_message);
+	port.postMessage({payload: policy.payload});
+    }
 }
 
 /*
diff --git a/dummy b/dummy
new file mode 100644
index 0000000..e69de29
diff --git a/html/display-panel.js b/html/display-panel.js
index c078850..4fe0173 100644
--- a/html/display-panel.js
+++ b/html/display-panel.js
@@ -229,14 +229,14 @@ function handle_activity_report(message)
     const [type, data] = message;
 
     if (type === "settings") {
-	let [pattern, settings] = data;
+	const settings = data;
 
 	blocked_span.textContent = settings.allow ? "no" : "yes";
 
-	if (pattern) {
+	if (settings.pattern) {
 	    pattern_span.textContent = pattern;
 	    const settings_opener =
-		  () => open_in_settings(TYPE_PREFIX.PAGE, pattern);
+		  () => open_in_settings(TYPE_PREFIX.PAGE, settings.pattern);
 	    view_pattern_but.classList.remove("hide");
 	    view_pattern_but.addEventListener("click", settings_opener);
 	} else {
@@ -244,11 +244,10 @@ function handle_activity_report(message)
 	    blocked_span.textContent = blocked_span.textContent + " (default)";
 	}
 
-	const components = settings.components;
-	if (components) {
-	    payload_span.textContent = nice_name(...components);
+	if (settings.payload) {
+	    payload_span.textContent = nice_name(...settings.payload);
 	    payload_buttons_div.classList.remove("hide");
-	    const settings_opener = () => open_in_settings(...components);
+	    const settings_opener = () => open_in_settings(...settings.payload);
 	    view_payload_but.addEventListener("click", settings_opener);
 	} else {
 	    payload_span.textContent = "none";
diff --git a/manifest.json b/manifest.json
index b18ea3e..7b4cb26 100644
--- a/manifest.json
+++ b/manifest.json
@@ -44,8 +44,7 @@
 	"page": "html/options.html",
 	"open_in_tab": true
     }_CHROMIUM_UPDATE_URL_,
-    "web_accessible_resources": [_CHROMIUM_KEY_
-    ],
+    "web_accessible_resources": ["dummy"],
     "background": {
 	"persistent": true,
 	"scripts": [_BGSCRIPTS_]
-- 
cgit v1.2.3