Further CSP refactoring and removal of obsolete fallbacks.

4 files changed, 123 insertions, 152 deletions

diff --git a/src/bg/ChildPolicies.js b/src/bg/ChildPolicies.js
index 32abafe..91263fd 100644
--- a/src/bg/ChildPolicies.js
+++ b/src/bg/ChildPolicies.js
@@ -1,6 +1,7 @@
 "use strict";
 {
   let marker = JSON.stringify(uuid());
+  let allUrls = ["<all_urls>"];
   
   let Scripts = {
     references: new Set(),
@@ -10,27 +11,52 @@
       matchAboutBlank: true,
       runAt: "document_start"
     },
+    async init() {
+      let opts = Object.assign({}, this.opts);
+      opts.js = [{file: "/content/dynamicNS.js"}];
+      opts.matches = allUrls;
+      delete opts.excludedMatches;
+      this._stubScript = await browser.contentScripts.register(opts);
+      
+      this.init = this.forget;
+    },
     forget() {
       for (let script of [...this.references]) {
         script.unregister();
         this.references.delete(script);
       }
     },
+    debug: false,
+    trace(code) {
+      return this.debug
+        ? `console.debug("Executing child policy", ${JSON.stringify(code)});${code}`
+        : code
+        ;
+    },
     async register(code, matches, excludeMatches) {
       debug("Registering child policy.", code, matches, excludeMatches);
       if (!matches.length) return;
       try {
-        this.opts.js[0].code = code;
-        this.opts.matches = matches;
+        let opts = Object.assign({}, this.opts);
+        opts.js[0].code = this.trace(code); 
+        opts.matches = matches;
         if (excludeMatches && excludeMatches.length) {
-          this.opts.excludeMatches = excludeMatches;
-        } else {
-          delete this.opts.excludeMatches;
+          opts.excludeMatches = excludeMatches;
         }
-        this.references.add(await browser.contentScripts.register(this.opts));
+        this.references.add(await browser.contentScripts.register(opts));
       } catch (e) {
         error(e);
       }
+    },
+    
+    buildPerms(perms, finalizeSetup = false) {
+      if (typeof perms !== "string") {
+        perms = JSON.stringify(perms);
+      }
+      return finalizeSetup
+        ? `ns.setup(${perms}, ${marker});` 
+        : `ns.config.CURRENT = ${perms};`
+        ;
     }
   };
   
@@ -69,12 +95,13 @@
         error(e);
       }
     },
-    async update(policy) {
-      Scripts.forget();
+    async update(policy, debug) {
+      if (debug !== "undefined") Scripts.debug = debug;
+      
+      await Scripts.init();
       
       if (!policy.enforced) {
-        await Scripts.register(`ns.setup(null, ${marker});`, 
-           ["<all_urls>"]);
+        await Scripts.register(`ns.setup(null, ${marker});`, allUrls);
         return;
       }
       
@@ -122,10 +149,27 @@
       
       // register new content scripts
       for (let [perms, keys] of [...permsMap]) {
-        await Scripts.register(`ns.perms.CURRENT = ${perms};`, siteKeys2MatchPatterns(keys), excludeMap.get(perms));
+        await Scripts.register(Scripts.buildPerms(perms), siteKeys2MatchPatterns(keys), excludeMap.get(perms));
       }
-      await Scripts.register(`ns.setup(${JSON.stringify(serialized.DEFAULT)}, ${marker});`, 
-         ["<all_urls>"]);
+      await Scripts.register(Scripts.buildPerms(serialized.DEFAULT, true), allUrls);
+    },
+    
+    getForDocument(policy, url, context = null) {
+      return {
+        CURRENT: policy.get(url, context).perms.dry(),
+        DEFAULT: policy.DEFAULT.dry(),
+        MARKER: marker
+      };
+    },
+    
+    async updateFrame(tabId, frameId, perms, defaultPreset) {
+      let code = Scripts.buildPerms(perms) + Scripts.buildPerms(defaultPreset, true);
+      await browser.tabs.executeScript(tabId, {
+        code,
+        frameId,
+        matchAboutBlank: true,
+        runAt: "document_start"
+      });   
     }
-  }
+  };
 }
diff --git a/src/bg/ReportingCSP.js b/src/bg/ReportingCSP.js
index f8764e8..03926c2 100644
--- a/src/bg/ReportingCSP.js
+++ b/src/bg/ReportingCSP.js
@@ -1,6 +1,12 @@
 "use strict";
   
-function ReportingCSP(reportURI, reportGroup) { 
+function ReportingCSP(reportURI, reportGroup) {
+  const REPORT_TO = {
+    name: "Report-To",
+    value: JSON.stringify({ "url": reportURI,
+             "group": reportGroup,
+             "max-age": 10886400 }),
+  };
   return Object.assign(
     new CapsCSP(new NetCSP(
       `report-uri ${reportURI};`,
@@ -9,11 +15,32 @@ function ReportingCSP(reportURI, reportGroup) {
     {
       reportURI,
       reportGroup,
-      reportToHeader: {
-        name: "Report-To",
-        value: JSON.stringify({ "url": reportURI,
-                 "group": reportGroup,
-                 "max-age": 10886400 }),
+      patchHeaders(responseHeaders, capabilities) {
+        let header = null;
+        let hasReportTo = false;
+        for (let h of responseHeaders) {
+          if (this.isMine(h)) {
+            header = h;
+            h.value = this.inject(h.value, "");
+          } else if (h.name === REPORT_TO.name && h.value === REPORT_TO.value) {
+            hasReportTo = true;
+          }
+        }
+
+        let blocker = capabilities && this.buildFromCapabilities(capabilities);
+        if (blocker) {
+          if (!hasReportTo) {
+            responseHeaders.push(REPORT_TO);
+          }
+          if (header) {
+            header.value = this.inject(header.value, blocker);
+          } else {
+            header = this.asHeader(blocker);
+            responseHeaders.push(header);
+          }
+        }
+        
+        return header;
       }
     }
   );
diff --git a/src/bg/RequestGuard.js b/src/bg/RequestGuard.js
index cf2ff71..5dea994 100644
--- a/src/bg/RequestGuard.js
+++ b/src/bg/RequestGuard.js
@@ -2,12 +2,9 @@ var RequestGuard = (() => {
   'use strict';
   const VERSION_LABEL =  `NoScript ${browser.runtime.getManifest().version}`;
   browser.browserAction.setTitle({title: VERSION_LABEL});
-  
   const REPORT_URI = "https://noscript-csp.invalid/__NoScript_Probe__/";
   const REPORT_GROUP = "NoScript-Endpoint";
-  
   let csp = new ReportingCSP(REPORT_URI, REPORT_GROUP);
-  
   const policyTypesMap = {
       main_frame:  "",
       sub_frame: "frame",
@@ -25,7 +22,6 @@ var RequestGuard = (() => {
   };
   const allTypes = Object.keys(policyTypesMap);
   Object.assign(policyTypesMap, {"webgl": "webgl"}); // fake types
-
   const TabStatus = {
     map: new Map(),
     types: ["script", "object", "media", "frame", "font"],
@@ -36,13 +32,11 @@ var RequestGuard = (() => {
         noscriptFrames: {},
       }
     },
-
     initTab(tabId, records = this.newRecords()) {
       if (tabId < 0) return;
       this.map.set(tabId, records);
       return records;
     },
-
     _record(request, what, optValue) {
       let {tabId, frameId, type, url, documentUrl} = request;
       let policyType = policyTypesMap[type] || type;
@@ -54,7 +48,6 @@ var RequestGuard = (() => {
       } else {
         records = this.initTab(tabId);
       }
-
       if (what === "noscriptFrame" && type !== "object") {
         let nsf = records.noscriptFrames;
         nsf[frameId] = optValue;
@@ -76,7 +69,6 @@ var RequestGuard = (() => {
       }
       return records;
     },
-
     record(request, what, optValue) {
       let {tabId} = request;
       if (tabId < 0) return;
@@ -85,9 +77,7 @@ var RequestGuard = (() => {
         this.updateTab(request.tabId);
       }
     },
-
     _pendingTabs: new Set(),
-
     updateTab(tabId) {
       if (tabId < 0) return;
       if (this._pendingTabs.size === 0) {
@@ -105,22 +95,18 @@ var RequestGuard = (() => {
       let records = this.map.get(tabId) || this.initTab(tabId);
       let {allowed, blocked, noscriptFrames} = records;
       let topAllowed = !(noscriptFrames && noscriptFrames[0]);
-
       let numAllowed = 0, numBlocked = 0, sum = 0;
       let report = this.types.map(t => {
         let a = allowed[t] && allowed[t].length || 0, b = blocked[t] && blocked[t].length || 0, s = a + b;
         numAllowed+= a, numBlocked += b, sum += s;
         return s && `<${t === "sub_frame" ? "frame" : t}>: ${b}/${s}`;
       }).filter(s => s).join("\n");
-
       let enforced = ns.isEnforced(tabId);
-
       let icon = topAllowed ?
         (numBlocked ? "part"
           : enforced ? "yes" : "global")
         : (numAllowed ? "sub" : "no");
       let showBadge = ns.local.showCountBadge && numBlocked > 0;
-
       let browserAction = browser.browserAction;
       browserAction.setIcon({tabId, path: {64: `/img/ui-${icon}64.png`}});
       browserAction.setBadgeText({tabId, text: showBadge ? numBlocked.toString() : ""});
@@ -131,11 +117,9 @@ var RequestGuard = (() => {
             : _("NotEnforced")}`
       });
     },
-
     totalize(sum, value) {
       return sum + value;
     },
-
     async probe(tabId) {
       if (tabId === undefined) {
         (await browser.tabs.query({})).forEach(tab => TabStatus.probe(tab.id));
@@ -147,7 +131,6 @@ var RequestGuard = (() => {
         }
       }
     },
-
     recordAll(tabId, seen) {
       if (seen) {
         let records = TabStatus.map.get(tabId);
@@ -156,17 +139,21 @@ var RequestGuard = (() => {
           records.blocked = {};
         }
         for (let thing of seen) {
-          thing.request.tabId = tabId;
-          TabStatus._record(thing.request, thing.allowed ? "allowed" : "blocked");
+          let {request, allowed} = thing;
+          request.tabId = tabId;
+          debug(`Recording`, request);
+          TabStatus._record(request, allowed ? "allowed" : "blocked");
+          if (request.key === "noscript-probe" && request.type === "main_frame" ) {
+            request.frameId = 0;
+            TabStatus._record(request, "noscriptFrame", !allowed);
+          }
         }
         this._updateTabNow(tabId);
       }
     },
-
     async onActivatedTab(info) {
       let {tabId} = info;
       let seen = await ns.collectSeen(tabId);
-
       TabStatus.recordAll(tabId, seen);
     },
     onRemovedTab(tabId) {
@@ -175,12 +162,9 @@ var RequestGuard = (() => {
   }
   browser.tabs.onActivated.addListener(TabStatus.onActivatedTab);
   browser.tabs.onRemoved.addListener(TabStatus.onRemovedTab);
-
   if (!("setIcon" in browser.browserAction)) { // unsupported on Android
     TabStatus._updateTabNow = TabStatus.updateTab = () => {};
   }
-  
-  
   let messageHandler = {
     async pageshow(message, sender) {
       TabStatus.recordAll(sender.tab.id, message.seen);
@@ -215,7 +199,6 @@ var RequestGuard = (() => {
       if (!capabilities.has(policyType)) {
         perms = new Permissions(new Set(capabilities), false);
         perms.capabilities.add(policyType);
-
         /* TODO: handle contextual permissions
         if (documentUrl) {
           let context = new URL(documentUrl).origin;
@@ -228,23 +211,8 @@ var RequestGuard = (() => {
       }
       return true;
     },
-    
-    async queryDocStatus(message, sender) {
-      let {frameId, tab} = sender;
-      let {url} = message;
-      let tabId = tab.id;
-      let records = TabStatus.map.get(tabId);
-      let noscriptFrames = records && records.noscriptFrames;
-      let canScript = !(noscriptFrames && noscriptFrames[sender.frameId]);
-      let shouldScript = !ns.isEnforced(tabId) || !url.startsWith("http") || ns.policy.can(url, "script");
-      debug("Frame %s %s of  %o, canScript: %s, shouldScript: %s", frameId, url, noscriptFrames, canScript, shouldScript);
-      return {canScript, shouldScript};
-    }
-    
   }
-  
   const Content = {
-
     async reportTo(request, allowed, policyType) {
       let {requestId, tabId, frameId, type, url, documentUrl, originUrl} = request;
       let pending = pendingRequests.get(requestId); // null if from a CSP report
@@ -276,7 +244,6 @@ var RequestGuard = (() => {
       }
     }
   };
-
   const pendingRequests = new Map();
   function initPendingRequest(request) {
     let {requestId, url} = request;
@@ -288,8 +255,6 @@ var RequestGuard = (() => {
     });
     return redirected;
   }
-
-
   const ABORT = {cancel: true}, ALLOW = {};
   const INTERNAL_SCHEME = /^(?:chrome|resource|moz-extension|about):/;
   const listeners = {
@@ -307,7 +272,6 @@ var RequestGuard = (() => {
             // livemark request or similar browser-internal, always allow;
             return ALLOW;
           }
-
           if (/^(?:data|blob):/.test(url)) {
             request._dataUrl = url;
             request.url = url = documentUrl;
@@ -316,7 +280,6 @@ var RequestGuard = (() => {
             !ns.isEnforced(request.tabId) ||
             policy.can(url, policyType, originUrl);
           Content.reportTo(request, allowed, policyType);
-          
           if (!allowed) {
             debug(`Blocking ${policyType}`, request);
             TabStatus.record(request, "blocked");
@@ -326,13 +289,10 @@ var RequestGuard = (() => {
       } catch (e) {
         error(e);
       }
-
       return ALLOW;
     },
-
     async onHeadersReceived(request) {
       // called for main_frame, sub_frame and object
-      
       // check for duplicate calls
       let pending = pendingRequests.get(request.requestId);
       if (pending) {
@@ -347,67 +307,28 @@ var RequestGuard = (() => {
         pending = pendingRequests.get(request.requestId);
       }
       pending.headersProcessed = true;
-      
       let {url, documentUrl, statusCode, tabId, responseHeaders, type} = request;
-      
       let isMainFrame = type === "main_frame";
-      
       try {
-        let header;
-        let content = {};
-        const REPORT_TO = csp.reportToHeader;
-        let hasReportTo = false;
-        for (let h of responseHeaders) {
-          if (csp.isMine(h)) {
-            header = h;
-            h.value = csp.inject(h.value, "");
-          } else if (/^\s*Content-(Type|Disposition)\s*$/i.test(h.name)) {
-            content[RegExp.$1.toLowerCase()] = h.value;
-          } else if (h.name === REPORT_TO.name && h.value === REPORT_TO.value) {
-            hasReportTo = true;
-          }
-        }
-        
+        let capabilities;
         if (ns.isEnforced(tabId)) {
           let policy = ns.policy;
           let perms = policy.get(url, documentUrl).perms;
-          
           if (policy.autoAllowTop && isMainFrame && perms === policy.DEFAULT) {
             policy.set(Sites.optimalKey(url), perms = policy.TRUSTED.tempTwin);
             await ChildPolicies.update(policy);
           }
-          
-          let blockHttp = !content.disposition &&
-            (!content.type || /^\s*(?:video|audio|application)\//.test(content.type));
-          if (blockHttp) {
-            debug(`Suspicious content type "%s" in request %o with capabilities %o`,
-              content.type, request, capabilities);
-          }
-          
-          let blocker = csp.buildFromCapabilities(perms.capabilities, blockHttp);
-          if (blocker) {
-            if (!hasReportTo) {
-              responseHeaders.push(csp.reportToHeader);
-            }
-            
-            if (header) {
-              pending.cspHeader = header;
-              header.value = csp.inject(header.value, blocker);
-            } else {
-              header = csp.asHeader(blocker);
-              responseHeaders.push(header);
-            }
-            
-            debug(`CSP blocker on %s:`, url, blocker, header.value);
-          }
-          
-          if (isMainFrame && !TabStatus.map.has(tabId)) {
-            debug("No TabStatus data yet for noscriptFrame", tabId);
-            TabStatus.record(request, "noscriptFrame", true);
-          }
+          capabilities = perms.capabilities;
         }
-
+        if (isMainFrame && !TabStatus.map.has(tabId)) {
+          debug("No TabStatus data yet for noscriptFrame", tabId);
+          TabStatus.record(request, "noscriptFrame",
+            capabilities && !capabilities.has("script"));
+        }
+        let header = csp.patchHeaders(responseHeaders, capabilities);
         if (header) {
+          pending.cspHeader = header;
+          debug(`CSP blocker on %s:`, url, header.value);
           return {responseHeaders};
         }
       } catch (e) {
@@ -415,7 +336,6 @@ var RequestGuard = (() => {
       }
       return ALLOW;
     },
-
     onResponseStarted(request) {
       debug("onResponseStarted", request);
       let {requestId, url, tabId, frameId, type} = request;
@@ -430,25 +350,15 @@ var RequestGuard = (() => {
       let pending = pendingRequests.get(requestId);
       if (pending) {
         pending.scriptBlocked = scriptBlocked;
-        if (!(pending.headersProcessed && 
+        if (!(pending.headersProcessed &&
             (scriptBlocked || !ns.isEnforced(tabId) || ns.policy.can(url, "script", request.documentURL))
           )) {
           debug("[WARNING] onHeadersReceived %s %o", frameId, tabId,
-            pending.headersProcessed ? "has been overridden on": "could not process", 
+            pending.headersProcessed ? "has been overridden on": "could not process",
             request);
-
-          if (tabId !== -1 && type !== "object") {
-            debug("[WARNING] Reloading %s frame %s of tab %s.", url, frameId, tabId);
-            browser.tabs.executeScript(tabId, {
-              runAt: "document_start",
-              code: "window.location.reload(false)",
-              frameId
-            });
-          }
         }
       }
     },
-
     onCompleted(request) {
       let {requestId} = request;
       if (pendingRequests.has(requestId)) {
@@ -463,12 +373,10 @@ var RequestGuard = (() => {
         }
       }
     },
-
     onErrorOccurred(request) {
       pendingRequests.delete(request.requestId);
     }
   };
-
   function fakeRequestFromCSP(report, request) {
     let type = report["violated-directive"].split("-", 1)[0]; // e.g. script-src 'none' => script
     if (type === "frame") type = "sub_frame";
@@ -479,7 +387,6 @@ var RequestGuard = (() => {
       type,
     });
   }
-
   async function onViolationReport(request) {
     try {
       let decoder = new TextDecoder("UTF-8");
@@ -501,28 +408,21 @@ var RequestGuard = (() => {
     }
     return ABORT;
   }
-  
   const RequestGuard = {
     async start() {
       Messages.addHandler(messageHandler);
-      
       let wr = browser.webRequest;
       let listen = (what, ...args) => wr[what].addListener(listeners[what], ...args);
-      
       let allUrls = ["<all_urls>"];
       let docTypes = ["main_frame", "sub_frame", "object"];
-      
       let filterDocs = {urls: allUrls, types: docTypes};
       let filterAll = {urls: allUrls, types: allTypes};
-      
       listen("onBeforeRequest", filterAll, ["blocking"]);
-      
       listen("onHeadersReceived", filterDocs, ["blocking", "responseHeaders"]);
-      
       (listeners.onHeadersReceivedLast = new LastListener(wr.onHeadersReceived, request => {
         let {requestId, responseHeaders} = request;
         let pending = pendingRequests.get(request.requestId);
-        if (pending && pending.headersProcessed) {    
+        if (pending && pending.headersProcessed) {
           let {cspHeader} = pending;
           if (cspHeader) {
             debug("Safety net: injecting again %o in %o", cspHeader, request);
@@ -541,18 +441,13 @@ var RequestGuard = (() => {
         }
         return null;
       }, filterDocs, ["blocking", "responseHeaders"])).install();
-      
       listen("onResponseStarted", filterDocs, ["responseHeaders"]);
       listen("onCompleted", filterAll);
       listen("onErrorOccurred", filterAll);
-
-
       wr.onBeforeRequest.addListener(onViolationReport,
         {urls: [csp.reportURI], types: ["csp_report"]}, ["blocking", "requestBody"]);
-
       TabStatus.probe();
     },
-
     stop() {
       let wr = browser.webRequest;
       for (let [name, listener] of Object.entries(listeners)) {
@@ -566,6 +461,5 @@ var RequestGuard = (() => {
       Messages.removeHandler(messageHandler);
     }
   };
-
   return RequestGuard;
 })();
diff --git a/src/bg/main.js b/src/bg/main.js
index 47d28a3..fa2831c 100644
--- a/src/bg/main.js
+++ b/src/bg/main.js
@@ -23,10 +23,13 @@
   }
 
   async function init() {
+    await include("/bg/defaults.js");
+    await ns.defaults;
+    
     let policyData = (await Storage.get("sync", "policy")).policy;
     if (policyData && policyData.DEFAULT) {
       ns.policy = new Policy(policyData);
-      await ChildPolicies.update(policyData);
+      await ChildPolicies.update(policyData, ns.local.debug);
     } else {
       await include("/legacy/Legacy.js");
       ns.policy = await Legacy.createOrMigratePolicy();
@@ -34,8 +37,7 @@
     }
     
     
-    await include("/bg/defaults.js");
-    await ns.defaults;
+    
     await include("/bg/RequestGuard.js");
     await RequestGuard.start();
     await XSS.start(); // we must start it anyway to initialize sub-objects
@@ -135,7 +137,11 @@
     async importSettings({data}) {
       return await Settings.import(data);
     },
-
+    
+    async fetchChildPolicy({url, contextUrl}) {
+      return ChildPolicies.getForDocument(ns.policy, url, contextUrl);
+    },
+    
     async openStandalonePopup() {
       let win = await browser.windows.getLastFocused();
       let [tab] = (await browser.tabs.query({
@@ -203,7 +209,7 @@
 
     async savePolicy() {
       if (this.policy) {
-        await ChildPolicies.update(this.policy);
+        await ChildPolicies.update(this.policy, this.local.debug);
         await Storage.set("sync", {
           policy: this.policy.dry()
         });