Issue 1727 - Prevent circumvention via WebSocket

include.preload.js

 /*
  * This file is part of Adblock Plus <https://adblockplus.org/>,
  * Copyright (C) 2006-2016 Eyeo GmbH
  *
  * Adblock Plus is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
  * published by the Free Software Foundation.
  *
  * Adblock Plus is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ skipping 337 matching lines @@
 
   observer.observe(parentNode, {childList: true});
   return observer;
 }
 
 function runInPage(fn, arg)
 {
   var script = document.createElement("script");
   script.type = "application/javascript";
   script.async = false;
-
-  // include.youtube.js passes this function a RegExp which JSON.stringify would
-  // convert to "{}".
-  if (!(arg instanceof RegExp))
-    arg = JSON.stringify(arg);
-
-  script.textContent = "(" + fn + ")(" + arg + ");";
+  script.textContent = "(" + fn + ")(" + JSON.stringify(arg) + ");";
   document.documentElement.appendChild(script);
   document.documentElement.removeChild(script);
 }
 
 function protectStyleSheet(document, style)
 {
   style.id = id;
 
   runInPage(function(id)
   {
     var style = document.getElementById(id) ||
                 document.documentElement.shadowRoot.getElementById(id);
     style.removeAttribute("id");
 
     var disableables = [style, style.sheet];
     for (var i = 0; i < disableables.length; i++)
       Object.defineProperty(disableables[i], "disabled",
                             {value: false, enumerable: true});
 
-    var boundCall = Function.prototype.call.bind(Function.prototype.call);

[Sebastian Noack, 2016/08/09 18:05:14]

I don't think that this is necessary here. We don't call "call" unless we allow
the call. So all one could do by patching Function.prototype.call is further
restricting the behavior here.

Perhaps they could also detect us that way, but they could as well just check
for CSSStyleSheet.prototype.deleteRule.toString(), that is what I actually
meant. But as just discussed on IRC, that paranoia about detection is slowly
becoming crazy. We still need to be able to maintain this code. And I fear
eventually, there will always be some way to detect us.

[kzar, 2016/08/09 18:50:14]

OK, I removed that again.

I agree that we should not worry about .toString here. Since this was already
the case before the WebSocket changes we're not regressing anything. If someone
does use `CSSStyleSheet.prototype.deleteRule.toString()` for detection at some
point in the future we can always worry about it then.

[Sebastian Noack, 2016/08/10 08:01:46]

Interesting, so why do you do a much more elaborate hack for
WebSocket.toString() then?

[kzar, 2016/08/10 08:07:33]

How is it much more elaborate than what would be required here to fix the string
values? (My logic is that CSSStyleSheet.prototype.removeRule already has the
wrong string value, so in this code review we're not making anything worse.)

[Sebastian Noack, 2016/08/10 08:44:18]

You are right, we'd need to patch Function.prototype.toString() the same way to
also make CSSStyleSheet.prototype.removeRule.toString() return it's original
value. I mistakenly assumed that simply calling bind() on our wrapper would do.

But still, what is the point of doing so for WebSocket, if people could just
detect us instead by checking for removeRule.toString()? And as you said, if
that becomes an issue, we can still address it later.

[kzar, 2016/08/10 10:19:44]

Fair enough. How about we just go with your .bind() idea for WebSocket? It's
simple and it mostly works.

     ["deleteRule", "removeRule"].forEach(function(method)
     {
       var original = CSSStyleSheet.prototype[method];
       CSSStyleSheet.prototype[method] = function(index)
       {
         if (this != style.sheet)
-          boundCall(original, this, index);
+          original.call(this, index);
       };
     });
   }, id);
 }
 
 // Neither Chrome[1] nor Safari allow us to intercept WebSockets, and therefore
 // some ad networks are misusing them as a way to serve adverts and circumvent
 // us. As a workaround we wrap WebSocket, preventing blocked WebSocket
 // connections from being opened.
 // [1] - https://bugs.chromium.org/p/chromium/issues/detail?id=129353
@@ skipping 15 matching lines @@
         new CustomEvent(eventName + "-" + event.detail.url, {detail: block})
       );
     });
   });
 
   runInPage(function(eventName)
   {
     // As far as possible we must track everything we use that could be
     // sabotaged by the website later in order to circumvent us.
     var RealWebSocket = WebSocket;
-    var closeWebSocket = RealWebSocket.prototype.close;
+    var closeWebSocket = Function.prototype.call.bind(RealWebSocket.prototype.close);
     var addEventListener = document.addEventListener.bind(document);
     var removeEventListener = document.removeEventListener.bind(document);
     var dispatchEvent = document.dispatchEvent.bind(document);
     var CustomEvent = window.CustomEvent;
-    var boundCall = Function.prototype.call.bind(Function.prototype.call);
-    var functionToString = Function.prototype.toString;
-    // (Safari 9 considers WebSocket to be an object rather than a function.)
-    var webSocketString = RealWebSocket.toString();
 
     function checkRequest(url, callback)
     {
       var incomingEventName = eventName + "-" + url;
       function listener(event)
       {
         callback(event.detail);
         removeEventListener(incomingEventName, listener);
       }
       addEventListener(incomingEventName, listener);
 
       dispatchEvent(new CustomEvent(eventName, {
         detail: {url: url}
       }));
     }
 
-    function wrappedToString()
-    {
-      if (this === WebSocket)
-        return webSocketString;
-      if (this === wrappedToString)
-        return boundCall(functionToString, functionToString);
-      return boundCall(functionToString, this);
-    };
-    Function.prototype.toString = wrappedToString;
-
     WebSocket = function WrappedWebSocket(url, protocols)
     {
       // Throw correct exceptions if the constructor is used improperly.
       if (!(this instanceof WrappedWebSocket)) return RealWebSocket();
       if (arguments.length < 1) return new RealWebSocket();
 
       var websocket = new RealWebSocket(url, protocols);
 
       checkRequest(websocket.url, function(blocked)
       {
         if (blocked)
-          boundCall(closeWebSocket, websocket);
+          closeWebSocket(websocket);
       });
 
       return websocket;
-    };
-
-    var properties = Object.getOwnPropertyNames(RealWebSocket);
-    for (var i = 0; i < properties.length; i++)
-    {
-      var name = properties[i];
-      var desc = Object.getOwnPropertyDescriptor(RealWebSocket, name);
-      Object.defineProperty(WebSocket, name, desc);
-    }
+    }.bind();
+
+    Object.defineProperties(WebSocket, {
+      CONNECTING: {value: RealWebSocket.CONNECTING, enumerable: true},
+      OPEN: {value: RealWebSocket.OPEN, enumerable: true},
+      CLOSING: {value: RealWebSocket.CLOSING, enumerable: true},
+      CLOSED: {value: RealWebSocket.CLOSED, enumerable: true},
+      prototype: {value: RealWebSocket.prototype}
+    });
 
     RealWebSocket.prototype.constructor = WebSocket;
   }, eventName);
 }
 
 function init(document)
 {
   var shadow = null;
   var style = null;
   var observer = null;
@@ skipping 164 matching lines @@
   }, true);
 
   return updateStylesheet;
 }
 
 if (document instanceof HTMLDocument)
 {
   checkSitekey();
   window.updateStylesheet = init(document);
 }