Issue 5650 - Prevent attachShadowRoot to create closed shadow root.

inject.preload.js

Index: inject.preload.js
===================================================================
--- a/inject.preload.js
+++ b/inject.preload.js
@@ -133,16 +133,32 @@
           let thisShadow = shadowRoot(this);
           return thisShadow == ourShadowRoot ? null : thisShadow;
         }
       });
     }
   }
 
   /*
+   * Closed shadowRoot prevention.
+   * https://issues.adblockplus.org/ticket/5650
+   */
+  if ("attachShadow" in Element.prototype)
+  {
+    Element.prototype._attachShadow = Element.prototype.attachShadow;

[lainverse, 2017/09/29 15:57:35]

You left unwrapped _attachShadow right in the same object with a wrapped one.
Yandex and others will just check presence of this one first and use it instead
of standard one. Better define it as a local variable here and use 'return
_attachShadow.call(this, options);' below.

BTW, it makes ABP detection ridiculously easy. Just check presence of this
function in the Element's prototype.

[hub, 2017/09/29 16:54:29]

good point. done.

+    Element.prototype.attachShadow = options =>
+    {
+      if (options && options.mode == "closed")
+        options.mode = "open";

[lainverse, 2017/09/29 15:57:35]

This is indeed the easiest solution, but I think this could be considered as a
security violation in case there are banks which use shadow DOM as extra
protection.

Also, some sites may have crawler-like scripts which check presence of open
shadows and do changes there. This may break them.

Additionally this makes ABP detection easy. Create div, attach shadow, check if
shadowRoot present.

At least make a global WeakMap with all nodes which were affected and return
null in shadowRoot getters for them.

+
+      return this._attachShadow(options);
+    };
+  }
+
+  /*
    * Shared request checking code, used by both the WebSocket and
    * RTCPeerConnection wrappers.
    */
   let RealCustomEvent = window.CustomEvent;
 
   // If we've been injected into a frame via contentWindow then we can simply
   // grab the copy of checkRequest left for us by the parent document. Otherwise
   // we need to set it up now, along with the event handling functions.