From a1e567e9ec1f9d0ffd82a22c129165b60c499e0e Mon Sep 17 00:00:00 2001 From: hackademix Date: Sat, 25 Aug 2018 11:29:43 +0200 Subject: Hotfix for some possible reload loops before refactoring CSP management. --- src/bg/RequestGuard.js | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) (limited to 'src/bg') diff --git a/src/bg/RequestGuard.js b/src/bg/RequestGuard.js index 68b74b9..7bdc929 100644 --- a/src/bg/RequestGuard.js +++ b/src/bg/RequestGuard.js @@ -425,23 +425,25 @@ var RequestGuard = (() => { (!content.type || /^\s*(?:video|audio|application)\//.test(content.type))) { debug(`Suspicious content type "%s" in request %o with capabilities %o`, content.type, request, capabilities); - blockedTypes = CSP.types.filter(t => !capabilities.has(t)); + blockedTypes = new Set(CSP.types.filter(t => !capabilities.has(t))); } else if(!canScript) { - blockedTypes = ["script"]; + blockedTypes = new Set(["script"]); forbidData.add("object"); // data: URIs loaded in objects may run scripts + } else { + blockedTypes = new Set(); } for (let type of forbidData) { // object, font, media - if (blockedTypes.includes(type)) continue; + if (blockedTypes.has(type)) continue; // HTTP is blocked in onBeforeRequest, let's allow it only and block // for instance data: and blob: URIs let dataBlocker = {name: type, value: "http: https:"}; - if (blockedTypes) blockedTypes.push(dataBlocker) - else blockedTypes = [dataBlocker]; + blockedTypes.add(dataBlocker) } - debug("Blocked types", blockedTypes); - if (blockedTypes && blockedTypes.length) { + + if (blockedTypes.size) { + debug("Blocked types", blockedTypes); blocker = CSP.createBlocker(...blockedTypes); } -- cgit v1.2.3