/** * Hachette main content script run in all frames * * Copyright (C) 2021 Wojtek Kosior * Copyright (C) 2021 jahoti * Redistribution terms are gathered in the `copyright' file. */ /* * IMPORTS_START * IMPORT handle_page_actions * IMPORT extract_signed * IMPORT sign_data * IMPORT gen_nonce * IMPORT is_privileged_url * IMPORT mozilla_suppress_scripts * IMPORT is_chrome * IMPORT is_mozilla * IMPORT start_activity_info_server * IMPORT csp_rule * IMPORT is_csp_header_name * IMPORT sanitize_csp_header * IMPORTS_END */ function extract_cookie_policy(cookie, min_time) { let best_result = {time: -1}; let policy = null; const extracted_signatures = []; for (const match of cookie.matchAll(/hachette-(\w*)=([^;]*)/g)) { const new_result = extract_signed(...match.slice(1, 3)); if (new_result.fail) continue; extracted_signatures.push(match[1]); if (new_result.time < Math.max(min_time, best_result.time)) continue; /* This should succeed - it's our self-produced valid JSON. */ const new_policy = JSON.parse(decodeURIComponent(new_result.data)); if (new_policy.url !== document.URL) continue; best_result = new_result; policy = new_policy; } return [policy, extracted_signatures]; } function extract_url_policy(url, min_time) { const [base_url, payload, anchor] = /^([^#]*)#?([^#]*)(#?.*)$/.exec(url).splice(1, 4); const match = /^hachette_([^_]+)_(.*)$/.exec(payload); if (!match) return [null, url]; const result = extract_signed(...match.slice(1, 3)); if (result.fail) return [null, url]; const original_url = base_url + anchor; const policy = result.time < min_time ? null : JSON.parse(decodeURIComponent(result.data)); return [policy.url === original_url ? policy : null, original_url]; } function employ_nonhttp_policy(policy) { if (!policy.allow) return; policy.nonce = gen_nonce(); const [base_url, target] = /^([^#]*)(#?.*)$/.exec(policy.url).slice(1, 3); const encoded_policy = encodeURIComponent(JSON.stringify(policy)); const payload = "hachette_" + sign_data(encoded_policy, new Date().getTime()).join("_"); const resulting_url = `${base_url}#${payload}${target}`; location.href = resulting_url; location.reload(); } /* * 1. When injecting some payload we need to sanitize CSP tags before * they reach the document. * 2. Only tags inside are considered valid by the browser and * need to be considered. * 3. We want to detach from document, wait until its completes * loading, sanitize it and re-attach . * 4. Browsers are eager to add 's that appear after `' but before * `'. Due to this behavior the `DOMContentLoaded' event is considered * unreliable (although it could still work properly, it is just problematic * to verify). * 5. We shall wait for anything to appear in or after and take that as * a sign has _really_ finished loading. */ function make_body_start_observer(DOM_element, waiting) { const observer = new MutationObserver(() => try_body_started(waiting)); observer.observe(DOM_element, {childList: true}); return observer; } function try_body_started(waiting) { const body = waiting.detached_html.querySelector("body"); if ((body && (body.firstChild || body.nextSibling)) || waiting.doc.documentElement.nextSibling) { finish_waiting(waiting); return true; } if (body && waiting.observers.length < 2) waiting.observers.push(make_body_start_observer(body, waiting)); } function finish_waiting(waiting) { waiting.observers.forEach(observer => observer.disconnect()); waiting.doc.removeEventListener("DOMContentLoaded", waiting.loaded_cb); setTimeout(waiting.callback, 0); } function _wait_for_head(doc, detached_html, callback) { const waiting = {doc, detached_html, callback, observers: []}; if (try_body_started(waiting)) return; waiting.observers = [make_body_start_observer(detached_html, waiting)]; waiting.loaded_cb = () => finish_waiting(waiting); doc.addEventListener("DOMContentLoaded", waiting.loaded_cb); } function wait_for_head(doc, detached_html) { return new Promise(cb => _wait_for_head(doc, detached_html, cb)); } const blocked_str = "blocked"; function block_attribute(node, attr) { /* * Disabling attributes this way allows them to still be relatively * easily accessed in case they contain some useful data. */ const construct_name = [attr]; while (node.hasAttribute(construct_name.join(""))) construct_name.unshift(blocked_str); while (construct_name.length > 1) { construct_name.shift(); const name = construct_name.join(""); node.setAttribute(`${blocked_str}-${name}`, node.getAttribute(name)); } node.removeAttribute(attr); } function sanitize_meta(meta, policy) { const http_equiv = meta.getAttribute("http-equiv"); const value = meta.content; if (!value || !is_csp_header_name(http_equiv, true)) return; block_attribute(meta, "content"); if (is_csp_header_name(http_equiv, false)) meta.content = sanitize_csp_header({value}, policy).value; } function sanitize_script(script) { script.hachette_blocked_type = script.type; script.type = "text/plain"; } /* * Executed after script has been connected to the DOM, when it is no longer * eligible for being executed by the browser */ function desanitize_script(script, policy) { script.setAttribute("type", script.hachette_blocked_type); if (script.hachette_blocked_type === undefined) script.removeAttribute("type"); delete script.hachette_blocked_type; } function apply_hachette_csp_rules(doc, policy) { const meta = doc.createElement("meta"); meta.setAttribute("http-equiv", "Content-Security-Policy"); meta.setAttribute("content", csp_rule(policy.nonce)); doc.head.append(meta); /* CSP is already in effect, we can remove the now. */ meta.remove(); } async function sanitize_document(doc, policy) { /* * Ensure our CSP rules are employed from the beginning. This CSP injection * method is, when possible, going to be applied together with CSP rules * injected using webRequest. */ const has_own_head = doc.head; if (!has_own_head) doc.documentElement.prepend(doc.createElement("head")); apply_hachette_csp_rules(doc, policy); /* Probably not needed, but...: proceed with DOM in its initial state. */ if (!has_own_head) doc.head.remove(); /* * node gets hijacked now, to be re-attached after is loaded * and sanitized. */ const old_html = doc.documentElement; const new_html = doc.createElement("html"); old_html.replaceWith(new_html); await wait_for_head(doc, old_html); for (const meta of old_html.querySelectorAll("head meta")) sanitize_meta(meta, policy); for (const script of old_html.querySelectorAll("script")) sanitize_script(script, policy); new_html.replaceWith(old_html); for (const script of old_html.querySelectorAll("script")) desanitize_script(script, policy); } if (!is_privileged_url(document.URL)) { let policy_received_callback = () => undefined; let policy; /* Signature valid for half an hour. */ const min_time = new Date().getTime() - 1800 * 1000; if (/^https?:/.test(document.URL)) { let signatures; [policy, signatures] = extract_cookie_policy(document.cookie, min_time); for (const signature of signatures) document.cookie = `hachette-${signature}=; Max-Age=-1;`; } else { const scheme = /^([^:]*)/.exec(document.URL)[1]; const known_scheme = ["file", "ftp"].includes(scheme); if (!known_scheme) console.warn(`Unknown url scheme: \`${scheme}'!`); let original_url; [policy, original_url] = extract_url_policy(document.URL, min_time); history.replaceState(null, "", original_url); if (known_scheme && !policy) policy_received_callback = employ_nonhttp_policy; } if (!policy) { console.warn("Using fallback policy!"); policy = {allow: false, nonce: gen_nonce()}; } const doc_ready = Promise.all([ policy.allow ? Promise.resolve : sanitize_document(document, policy), new Promise(cb => document.addEventListener("DOMContentLoaded", cb, {once: true})) ]); handle_page_actions(policy.nonce, policy_received_callback, doc_ready); start_activity_info_server(); }