summaryrefslogtreecommitdiff
path: root/src/content/sanitizePaste.js
diff options
context:
space:
mode:
Diffstat (limited to 'src/content/sanitizePaste.js')
-rw-r--r--src/content/sanitizePaste.js71
1 files changed, 38 insertions, 33 deletions
diff --git a/src/content/sanitizePaste.js b/src/content/sanitizePaste.js
index 703f5b3..a1bcf53 100644
--- a/src/content/sanitizePaste.js
+++ b/src/content/sanitizePaste.js
@@ -1,58 +1,63 @@
'use strict';
-
-window.addEventListener("paste", e => {
- let data = e.clipboardData;
- let html = data.getData("text/html");
- let t = e.target;
- if (t.nodeType !== 1) t = t.parentElement;
-
- try {
- let node = t.cloneNode();
-
- node.innerHTML = html;
-
- if (sanitizeExtras(node)) {
- let sanitized = node.innerHTML;
- setTimeout(function() { try {
- if (sanitizeExtras(t)) {
- console.log(`[NoScript] Sanitized\n<PASTE>\n${html}\n</PASTE>to\n<PASTE>\n${t.innerHTML}\n</PASTE>`, t);
+{
+ let urlAttributes = ['href', 'to', 'from', 'by', 'values'];
+ let selector = urlAttributes.map(a => `[${a}]`).join(',');
+
+ for (let evType of ["drop", "paste"]) window.addEventListener(evType, e => {
+ let container = e.target;
+ let editing = false;
+ for (let el = container; el; el = el.parentElement) {
+ if (el.setRangeText || el.contentEditable) {
+ editing = true;
+ break;
+ }
+ }
+ if (!editing) return;
+
+ let html = container.innerHTML;
+ // we won't touch DOM elements which are already there
+ let oldNodes = new Set(container.querySelectorAll(selector + ",form"));
+ window.setTimeout(() => {
+ // we delay our custom sanitization after the browser performed the paste
+ // or drop job, rather than replacing it, in order to avoid interferences
+ // with built-in sanitization
+ try {
+ if (sanitizeExtras(container, oldNodes)) {
+ let t = e.type;
+ console.log(`[NoScript] Sanitized\n<${t}>\n${html}\n</${t}>to\n<${t}>\n${container.innerHTML}\n</${t}>`, container);
}
} catch(ex) {
console.log(ex);
- }}, 0);
- }
- } catch(ex) {
- console.log(ex);
- }
+ }
+ }, 0);
+ }, true);
function removeAttribute(node, name, value = node.getAttribute(name)) {
node.setAttribute(`data-noscript-removed-${name}`, value);
node.removeAttribute(name);
}
- function sanitizeExtras(el) {
+ function sanitizeExtras(container, oldNodes = []) {
let ret = false;
// remove attributes from forms
- for (let f of el.getElementsByTagName("form")) {
- for (let a of f.attributes) {
- f.removeAttribute(a.name);
- ret = true;
+ for (let f of container.getElementsByTagName("form")) {
+ if (oldNodes.has(f)) continue;
+ for (let a of [...f.attributes]) {
+ removeAttribute(f, a.name);
}
}
- let urlAttributes = ['href', 'to', 'from', 'by', 'values'];
- let selector = urlAttributes.map(a => `[${a}]`).join(',');
- for (let node of el.querySelectorAll(selector)) {
+ for (let node of container.querySelectorAll(selector)) {
+ if (oldNodes.has(node)) continue;
for (let name of urlAttributes) {
let value = node.getAttribute(name);
if (/^\W*(?:(?:javascript|data):|https?:[\s\S]+[[(<])/i.test(unescape(value))) {
- node.setAttribute(`data-noscript-removed-${name}`, value);
- node.removeAttribute(name);
+ removeAttribute(node, name, value);
ret = true;
}
}
}
return ret;
}
-}, true);
+}