Issue 5650 - Prevent attachShadowRoot to create closed shadow root.

inject.preload.js

 /*
  * This file is part of Adblock Plus <https://adblockplus.org/>,
  * Copyright (C) 2006-present eyeo GmbH
  *
  * Adblock Plus is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
  * published by the Free Software Foundation.
  *
  * Adblock Plus is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ skipping 120 matching lines @@
         configurable: true, enumerable: true, get()
         {
           let thisShadow = shadowRoot(this);
           return thisShadow == ourShadowRoot ? null : thisShadow;
         }
       });
     }
   }
 
   /*
+   * Closed shadowRoot prevention.
+   * https://issues.adblockplus.org/ticket/5650
+   */
+  if ("attachShadow" in Element.prototype)
+  {
+    Element.prototype._attachShadow = Element.prototype.attachShadow;

[lainverse, 2017/09/29 15:57:35]

You left unwrapped _attachShadow right in the same object with a wrapped one.
Yandex and others will just check presence of this one first and use it instead
of standard one. Better define it as a local variable here and use 'return
_attachShadow.call(this, options);' below.

BTW, it makes ABP detection ridiculously easy. Just check presence of this
function in the Element's prototype.

[hub, 2017/09/29 16:54:29]

good point. done.

+    Element.prototype.attachShadow = options =>
+    {
+      if (options && options.mode == "closed")
+        options.mode = "open";

[lainverse, 2017/09/29 15:57:35]

This is indeed the easiest solution, but I think this could be considered as a
security violation in case there are banks which use shadow DOM as extra
protection.

Also, some sites may have crawler-like scripts which check presence of open
shadows and do changes there. This may break them.

Additionally this makes ABP detection easy. Create div, attach shadow, check if
shadowRoot present.

At least make a global WeakMap with all nodes which were affected and return
null in shadowRoot getters for them.

+
+      return this._attachShadow(options);
+    };
+  }
+
+  /*
    * Shared request checking code, used by both the WebSocket and
    * RTCPeerConnection wrappers.
    */
   let RealCustomEvent = window.CustomEvent;
 
   // If we've been injected into a frame via contentWindow then we can simply
   // grab the copy of checkRequest left for us by the parent document. Otherwise
   // we need to set it up now, along with the event handling functions.
   if (injectedIntoContentWindow)
     checkRequest = window[eventName];
@@ skipping 245 matching lines @@
   if (typeof sandbox != "string" || /(^|\s)allow-scripts(\s|$)/i.test(sandbox))
   {
     let script = document.createElement("script");
     script.type = "application/javascript";
     script.async = false;
     script.textContent = "(" + injected + ")('" + randomEventName + "');";
     document.documentElement.appendChild(script);
     document.documentElement.removeChild(script);
   }
 }