From e2b63cf98204a45f4c55ba446689d20e524c188c Mon Sep 17 00:00:00 2001 From: hackademix Date: Mon, 27 Aug 2018 00:31:37 +0200 Subject: Further CSP refactoring and removal of obsolete fallbacks. --- src/bg/RequestGuard.js | 148 +++++++------------------------------------------ 1 file changed, 21 insertions(+), 127 deletions(-) (limited to 'src/bg/RequestGuard.js') diff --git a/src/bg/RequestGuard.js b/src/bg/RequestGuard.js index cf2ff71..5dea994 100644 --- a/src/bg/RequestGuard.js +++ b/src/bg/RequestGuard.js @@ -2,12 +2,9 @@ var RequestGuard = (() => { 'use strict'; const VERSION_LABEL = `NoScript ${browser.runtime.getManifest().version}`; browser.browserAction.setTitle({title: VERSION_LABEL}); - const REPORT_URI = "https://noscript-csp.invalid/__NoScript_Probe__/"; const REPORT_GROUP = "NoScript-Endpoint"; - let csp = new ReportingCSP(REPORT_URI, REPORT_GROUP); - const policyTypesMap = { main_frame: "", sub_frame: "frame", @@ -25,7 +22,6 @@ var RequestGuard = (() => { }; const allTypes = Object.keys(policyTypesMap); Object.assign(policyTypesMap, {"webgl": "webgl"}); // fake types - const TabStatus = { map: new Map(), types: ["script", "object", "media", "frame", "font"], @@ -36,13 +32,11 @@ var RequestGuard = (() => { noscriptFrames: {}, } }, - initTab(tabId, records = this.newRecords()) { if (tabId < 0) return; this.map.set(tabId, records); return records; }, - _record(request, what, optValue) { let {tabId, frameId, type, url, documentUrl} = request; let policyType = policyTypesMap[type] || type; @@ -54,7 +48,6 @@ var RequestGuard = (() => { } else { records = this.initTab(tabId); } - if (what === "noscriptFrame" && type !== "object") { let nsf = records.noscriptFrames; nsf[frameId] = optValue; @@ -76,7 +69,6 @@ var RequestGuard = (() => { } return records; }, - record(request, what, optValue) { let {tabId} = request; if (tabId < 0) return; @@ -85,9 +77,7 @@ var RequestGuard = (() => { this.updateTab(request.tabId); } }, - _pendingTabs: new Set(), - updateTab(tabId) { if (tabId < 0) return; if (this._pendingTabs.size === 0) { @@ -105,22 +95,18 @@ var RequestGuard = (() => { let records = this.map.get(tabId) || this.initTab(tabId); let {allowed, blocked, noscriptFrames} = records; let topAllowed = !(noscriptFrames && noscriptFrames[0]); - let numAllowed = 0, numBlocked = 0, sum = 0; let report = this.types.map(t => { let a = allowed[t] && allowed[t].length || 0, b = blocked[t] && blocked[t].length || 0, s = a + b; numAllowed+= a, numBlocked += b, sum += s; return s && `<${t === "sub_frame" ? "frame" : t}>: ${b}/${s}`; }).filter(s => s).join("\n"); - let enforced = ns.isEnforced(tabId); - let icon = topAllowed ? (numBlocked ? "part" : enforced ? "yes" : "global") : (numAllowed ? "sub" : "no"); let showBadge = ns.local.showCountBadge && numBlocked > 0; - let browserAction = browser.browserAction; browserAction.setIcon({tabId, path: {64: `/img/ui-${icon}64.png`}}); browserAction.setBadgeText({tabId, text: showBadge ? numBlocked.toString() : ""}); @@ -131,11 +117,9 @@ var RequestGuard = (() => { : _("NotEnforced")}` }); }, - totalize(sum, value) { return sum + value; }, - async probe(tabId) { if (tabId === undefined) { (await browser.tabs.query({})).forEach(tab => TabStatus.probe(tab.id)); @@ -147,7 +131,6 @@ var RequestGuard = (() => { } } }, - recordAll(tabId, seen) { if (seen) { let records = TabStatus.map.get(tabId); @@ -156,17 +139,21 @@ var RequestGuard = (() => { records.blocked = {}; } for (let thing of seen) { - thing.request.tabId = tabId; - TabStatus._record(thing.request, thing.allowed ? "allowed" : "blocked"); + let {request, allowed} = thing; + request.tabId = tabId; + debug(`Recording`, request); + TabStatus._record(request, allowed ? "allowed" : "blocked"); + if (request.key === "noscript-probe" && request.type === "main_frame" ) { + request.frameId = 0; + TabStatus._record(request, "noscriptFrame", !allowed); + } } this._updateTabNow(tabId); } }, - async onActivatedTab(info) { let {tabId} = info; let seen = await ns.collectSeen(tabId); - TabStatus.recordAll(tabId, seen); }, onRemovedTab(tabId) { @@ -175,12 +162,9 @@ var RequestGuard = (() => { } browser.tabs.onActivated.addListener(TabStatus.onActivatedTab); browser.tabs.onRemoved.addListener(TabStatus.onRemovedTab); - if (!("setIcon" in browser.browserAction)) { // unsupported on Android TabStatus._updateTabNow = TabStatus.updateTab = () => {}; } - - let messageHandler = { async pageshow(message, sender) { TabStatus.recordAll(sender.tab.id, message.seen); @@ -215,7 +199,6 @@ var RequestGuard = (() => { if (!capabilities.has(policyType)) { perms = new Permissions(new Set(capabilities), false); perms.capabilities.add(policyType); - /* TODO: handle contextual permissions if (documentUrl) { let context = new URL(documentUrl).origin; @@ -228,23 +211,8 @@ var RequestGuard = (() => { } return true; }, - - async queryDocStatus(message, sender) { - let {frameId, tab} = sender; - let {url} = message; - let tabId = tab.id; - let records = TabStatus.map.get(tabId); - let noscriptFrames = records && records.noscriptFrames; - let canScript = !(noscriptFrames && noscriptFrames[sender.frameId]); - let shouldScript = !ns.isEnforced(tabId) || !url.startsWith("http") || ns.policy.can(url, "script"); - debug("Frame %s %s of %o, canScript: %s, shouldScript: %s", frameId, url, noscriptFrames, canScript, shouldScript); - return {canScript, shouldScript}; - } - } - const Content = { - async reportTo(request, allowed, policyType) { let {requestId, tabId, frameId, type, url, documentUrl, originUrl} = request; let pending = pendingRequests.get(requestId); // null if from a CSP report @@ -276,7 +244,6 @@ var RequestGuard = (() => { } } }; - const pendingRequests = new Map(); function initPendingRequest(request) { let {requestId, url} = request; @@ -288,8 +255,6 @@ var RequestGuard = (() => { }); return redirected; } - - const ABORT = {cancel: true}, ALLOW = {}; const INTERNAL_SCHEME = /^(?:chrome|resource|moz-extension|about):/; const listeners = { @@ -307,7 +272,6 @@ var RequestGuard = (() => { // livemark request or similar browser-internal, always allow; return ALLOW; } - if (/^(?:data|blob):/.test(url)) { request._dataUrl = url; request.url = url = documentUrl; @@ -316,7 +280,6 @@ var RequestGuard = (() => { !ns.isEnforced(request.tabId) || policy.can(url, policyType, originUrl); Content.reportTo(request, allowed, policyType); - if (!allowed) { debug(`Blocking ${policyType}`, request); TabStatus.record(request, "blocked"); @@ -326,13 +289,10 @@ var RequestGuard = (() => { } catch (e) { error(e); } - return ALLOW; }, - async onHeadersReceived(request) { // called for main_frame, sub_frame and object - // check for duplicate calls let pending = pendingRequests.get(request.requestId); if (pending) { @@ -347,67 +307,28 @@ var RequestGuard = (() => { pending = pendingRequests.get(request.requestId); } pending.headersProcessed = true; - let {url, documentUrl, statusCode, tabId, responseHeaders, type} = request; - let isMainFrame = type === "main_frame"; - try { - let header; - let content = {}; - const REPORT_TO = csp.reportToHeader; - let hasReportTo = false; - for (let h of responseHeaders) { - if (csp.isMine(h)) { - header = h; - h.value = csp.inject(h.value, ""); - } else if (/^\s*Content-(Type|Disposition)\s*$/i.test(h.name)) { - content[RegExp.$1.toLowerCase()] = h.value; - } else if (h.name === REPORT_TO.name && h.value === REPORT_TO.value) { - hasReportTo = true; - } - } - + let capabilities; if (ns.isEnforced(tabId)) { let policy = ns.policy; let perms = policy.get(url, documentUrl).perms; - if (policy.autoAllowTop && isMainFrame && perms === policy.DEFAULT) { policy.set(Sites.optimalKey(url), perms = policy.TRUSTED.tempTwin); await ChildPolicies.update(policy); } - - let blockHttp = !content.disposition && - (!content.type || /^\s*(?:video|audio|application)\//.test(content.type)); - if (blockHttp) { - debug(`Suspicious content type "%s" in request %o with capabilities %o`, - content.type, request, capabilities); - } - - let blocker = csp.buildFromCapabilities(perms.capabilities, blockHttp); - if (blocker) { - if (!hasReportTo) { - responseHeaders.push(csp.reportToHeader); - } - - if (header) { - pending.cspHeader = header; - header.value = csp.inject(header.value, blocker); - } else { - header = csp.asHeader(blocker); - responseHeaders.push(header); - } - - debug(`CSP blocker on %s:`, url, blocker, header.value); - } - - if (isMainFrame && !TabStatus.map.has(tabId)) { - debug("No TabStatus data yet for noscriptFrame", tabId); - TabStatus.record(request, "noscriptFrame", true); - } + capabilities = perms.capabilities; } - + if (isMainFrame && !TabStatus.map.has(tabId)) { + debug("No TabStatus data yet for noscriptFrame", tabId); + TabStatus.record(request, "noscriptFrame", + capabilities && !capabilities.has("script")); + } + let header = csp.patchHeaders(responseHeaders, capabilities); if (header) { + pending.cspHeader = header; + debug(`CSP blocker on %s:`, url, header.value); return {responseHeaders}; } } catch (e) { @@ -415,7 +336,6 @@ var RequestGuard = (() => { } return ALLOW; }, - onResponseStarted(request) { debug("onResponseStarted", request); let {requestId, url, tabId, frameId, type} = request; @@ -430,25 +350,15 @@ var RequestGuard = (() => { let pending = pendingRequests.get(requestId); if (pending) { pending.scriptBlocked = scriptBlocked; - if (!(pending.headersProcessed && + if (!(pending.headersProcessed && (scriptBlocked || !ns.isEnforced(tabId) || ns.policy.can(url, "script", request.documentURL)) )) { debug("[WARNING] onHeadersReceived %s %o", frameId, tabId, - pending.headersProcessed ? "has been overridden on": "could not process", + pending.headersProcessed ? "has been overridden on": "could not process", request); - - if (tabId !== -1 && type !== "object") { - debug("[WARNING] Reloading %s frame %s of tab %s.", url, frameId, tabId); - browser.tabs.executeScript(tabId, { - runAt: "document_start", - code: "window.location.reload(false)", - frameId - }); - } } } }, - onCompleted(request) { let {requestId} = request; if (pendingRequests.has(requestId)) { @@ -463,12 +373,10 @@ var RequestGuard = (() => { } } }, - onErrorOccurred(request) { pendingRequests.delete(request.requestId); } }; - function fakeRequestFromCSP(report, request) { let type = report["violated-directive"].split("-", 1)[0]; // e.g. script-src 'none' => script if (type === "frame") type = "sub_frame"; @@ -479,7 +387,6 @@ var RequestGuard = (() => { type, }); } - async function onViolationReport(request) { try { let decoder = new TextDecoder("UTF-8"); @@ -501,28 +408,21 @@ var RequestGuard = (() => { } return ABORT; } - const RequestGuard = { async start() { Messages.addHandler(messageHandler); - let wr = browser.webRequest; let listen = (what, ...args) => wr[what].addListener(listeners[what], ...args); - let allUrls = [""]; let docTypes = ["main_frame", "sub_frame", "object"]; - let filterDocs = {urls: allUrls, types: docTypes}; let filterAll = {urls: allUrls, types: allTypes}; - listen("onBeforeRequest", filterAll, ["blocking"]); - listen("onHeadersReceived", filterDocs, ["blocking", "responseHeaders"]); - (listeners.onHeadersReceivedLast = new LastListener(wr.onHeadersReceived, request => { let {requestId, responseHeaders} = request; let pending = pendingRequests.get(request.requestId); - if (pending && pending.headersProcessed) { + if (pending && pending.headersProcessed) { let {cspHeader} = pending; if (cspHeader) { debug("Safety net: injecting again %o in %o", cspHeader, request); @@ -541,18 +441,13 @@ var RequestGuard = (() => { } return null; }, filterDocs, ["blocking", "responseHeaders"])).install(); - listen("onResponseStarted", filterDocs, ["responseHeaders"]); listen("onCompleted", filterAll); listen("onErrorOccurred", filterAll); - - wr.onBeforeRequest.addListener(onViolationReport, {urls: [csp.reportURI], types: ["csp_report"]}, ["blocking", "requestBody"]); - TabStatus.probe(); }, - stop() { let wr = browser.webRequest; for (let [name, listener] of Object.entries(listeners)) { @@ -566,6 +461,5 @@ var RequestGuard = (() => { Messages.removeHandler(messageHandler); } }; - return RequestGuard; })(); -- cgit v1.2.3