diff options
Diffstat (limited to 'src/content')
-rw-r--r-- | src/content/content.js | 9 | ||||
-rw-r--r-- | src/content/staticNS.js | 82 |
2 files changed, 19 insertions, 72 deletions
diff --git a/src/content/content.js b/src/content/content.js index e7fb331..eabf7c3 100644 --- a/src/content/content.js +++ b/src/content/content.js @@ -58,10 +58,6 @@ var notifyPage = async () => { debug("Page %s shown, %s", document.URL, document.readyState); if (document.readyState === "complete") { try { - if (!("canScript" in ns)) { - ns.fetchPolicy(); - return; - } await Messages.send("pageshow", {seen: seen.list, canScript: ns.canScript}); return true; } catch (e) { @@ -74,8 +70,6 @@ var notifyPage = async () => { return false; } -notifyPage(); - window.addEventListener("pageshow", notifyPage); ns.on("capabilities", () => { @@ -105,3 +99,6 @@ ns.on("capabilities", () => { notifyPage(); }); + +ns.fetchPolicy(); +notifyPage(); diff --git a/src/content/staticNS.js b/src/content/staticNS.js index 7959341..bf91972 100644 --- a/src/content/staticNS.js +++ b/src/content/staticNS.js @@ -33,78 +33,27 @@ backlog.add(eventName); }, - async fetchPolicy() { - let policy = await Messages.send("fetchChildPolicy", {url: document.URL}); - if (!policy) { - debug(`No answer to fetchChildPolicy message. This should not be happening.`); - return false; - } - this.setup(policy.permissions, policy.MARKER, true); - return true; + fetchPolicy() { + let url = document.URL; + let policy = browser.runtime.sendSyncMessage( + {id: "fetchPolicy", url, contextUrl: document.URL}); + if (!policy) { + debug(`No answer to fetchPolicy message. This should not be happening.`); + return false; + } + this.setup(policy); + return true; }, - setup(permissions, MARKER, fetched = false) { - this.config.permissions = permissions; - - // ugly hack: since now we use registerContentScript instead of the - // filterRequest dynamic script injection hack, we use a session cookie - // to store per-tab information, erasing it as soon as we see it - // (before any content can access it) + setup(policy) { + this.policy = policy; - let checkUnrestricted = challenge => sha256(`${MARKER}:${challenge}`); - - if ((this.config.MARKER = MARKER) && permissions) { - let cookieRx = new RegExp(`(?:^|;\\s*)(${MARKER}(?:_\\d+){2})=([^;]*)`); - let match = document.cookie.match(cookieRx); - if (match) { - let [cookie, cookieName, cookieValue] = match; - // delete cookie NOW - document.cookie = `${cookieName}=;expires=${new Date(Date.now() - 31536000000).toGMTString()}`; - try { - this.config.tabInfo = JSON.parse(decodeURIComponent(cookieValue)); - } catch (e) { - error(e); - } - } else if (UA.isMozilla && window !== window.top) { - // The cookie hack won't work for non-HTTP subframes (issue #48), - // or the cookie might have been deleted in a race condition, - // so here we try to check the parent - let checkParent = null; - try { - checkParent = parent.wrappedJSObject.checkNoScriptUnrestricted; - } catch (e) { - // may throw a SecurityException for cross-origin wrappedJSObject access - } - if (typeof checkParent === "function") { - try { - let challenge = uuid(); - let unrestricted = checkParent(challenge) === checkUnrestricted(challenge); - this.config.tabInfo = {unrestricted, inherited: true}; - } catch (e) { - debug("Exception thrown while checking parent unrestricted tab marker. Something fishy going on...") - error(e); - } - } - } - } - - if (!this.config.permissions || this.config.tabInfo.unrestricted) { - exportFunction(checkUnrestricted, window, {defineAs: "checkNoScriptUnrestricted"}); - debug("%s is loading unrestricted by user's choice (%o).", document.URL, this.config); + if (!policy.permissions || policy.unrestricted) { this.allows = () => true; this.capabilities = Object.assign( new Set(["script"]), { has() { return true; } }); } else { - if (!fetched) { - let hostname = window.location.hostname; - if (hostname && hostname.startsWith("[")) { - // WebExt match patterns don't seem to support IPV6 (Firefox 63)... - debug("Ignoring child policy setup parameters for IPV6 address %s, forcing IPC...", hostname); - this.fetchPolicy(); - return; - } - } - let perms = this.config.permissions; + let perms = policy.permissions; this.capabilities = new Set(perms.capabilities); new DocumentCSP(document).apply(this.capabilities, this.embeddingDocument); } @@ -112,7 +61,8 @@ this.canScript = this.allows("script"); this.fire("capabilities"); }, - config: { permissions: null, tabInfo: {}, MARKER: "" }, + + policy: null, allows(cap) { return this.capabilities && this.capabilities.has(cap); |