/** * Myext miscellaneous operations refactored to a separate file * * Copyright (C) 2021 Wojtek Kosior * Redistribution terms are gathered in the `copyright' file. */ /* * IMPORTS_START * IMPORT sha256 * IMPORT browser * IMPORT is_chrome * IMPORTS_END */ /* * generating unique, per-site value that can be computed synchronously * and is impossible to guess for a malicious website */ function gen_unique(url) { return sha256(get_secure_salt() + url); } function get_secure_salt() { if (is_chrome) return browser.runtime.getManifest().key.substring(0, 50); else return browser.runtime.getURL("dummy"); } /* * stripping url from query and target (everything after `#' or `?' * gets removed) */ function url_item(url) { let url_re = /^([^?#]*).*$/; let match = url_re.exec(url); return match[1]; } /* * Assume a url like: https://example.com/green?illuminati=confirmed#tinky#winky * This function will make it into an object like: * { * "base_url" : "https://example.com/green?illuminati=confirmed", * "target" : "#tinky", * "target2" : "#winky" * } * In case url doesn't have 2 #'s, target2 and target can be set to undefined. */ function url_extract_target(url) { let url_re = /^([^#]*)((#[^#]*)(#.*)?)?$/; let match = url_re.exec(url); return { base_url : match[1], target : match[3], target2 : match[4] }; } /* csp rule that blocks all scripts except for those injected by us */ function csp_rule(nonce) { let rule = `script-src 'nonce-${nonce}';`; if (is_chrome) rule += `script-src-elem 'nonce-${nonce}';`; return rule; } /* * EXPORTS_START * EXPORT gen_unique * EXPORT url_item * EXPORT url_extract_target * EXPORT csp_rule * EXPORTS_END */