Rietveld Code Review Tool
Help | Bug tracker | Discussion group | Source code

Delta Between Two Patch Sets: inject.preload.js

Issue 29590611: Issue 5953 - Bypass site CSP for script injection in Firefox (Closed)
Left Patch Set: Created Nov. 3, 2017, 6:16 p.m.
Right Patch Set: Add comment Created Nov. 6, 2017, 2:59 p.m.
Left:
Right:
Use n/p to move between diff chunks; N/P to move between comments.
Jump to:
Left: Side by side diff | Download
Right: Side by side diff | Download
« no previous file with change/comment | « no previous file | no next file » | no next file with change/comment »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
LEFTRIGHT
1 /* 1 /*
2 * This file is part of Adblock Plus <https://adblockplus.org/>, 2 * This file is part of Adblock Plus <https://adblockplus.org/>,
3 * Copyright (C) 2006-present eyeo GmbH 3 * Copyright (C) 2006-present eyeo GmbH
4 * 4 *
5 * Adblock Plus is free software: you can redistribute it and/or modify 5 * Adblock Plus is free software: you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 3 as 6 * it under the terms of the GNU General Public License version 3 as
7 * published by the Free Software Foundation. 7 * published by the Free Software Foundation.
8 * 8 *
9 * Adblock Plus is distributed in the hope that it will be useful, 9 * Adblock Plus is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of 10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
(...skipping 380 matching lines...) Expand 10 before | Expand all | Expand 10 after
391 if (document instanceof HTMLDocument) 391 if (document instanceof HTMLDocument)
392 { 392 {
393 let sandbox = window.frameElement && 393 let sandbox = window.frameElement &&
394 window.frameElement.getAttribute("sandbox"); 394 window.frameElement.getAttribute("sandbox");
395 395
396 if (typeof sandbox != "string" || /(^|\s)allow-scripts(\s|$)/i.test(sandbox)) 396 if (typeof sandbox != "string" || /(^|\s)allow-scripts(\s|$)/i.test(sandbox))
397 { 397 {
398 let script = document.createElement("script"); 398 let script = document.createElement("script");
399 script.type = "application/javascript"; 399 script.type = "application/javascript";
400 script.async = false; 400 script.async = false;
401 let code = "(" + injected + ")('" + randomEventName + "');"; 401 // Firefox 58 only bypasses site CSPs when assigning to 'src'.
402 let blob = new Blob([code]); 402 let url = URL.createObjectURL(new Blob([
Sebastian Noack 2017/11/03 21:12:15 Nit: At least this temporary variable can be avoid
kzar 2017/11/06 11:32:51 Yea, how about this? let url = URL.createObjectUR
403 let url = URL.createObjectURL(blob); 403 "(" + injected + ")('" + randomEventName + "');"
404 ]));
404 script.src = url; 405 script.src = url;
405 document.documentElement.appendChild(script); 406 document.documentElement.appendChild(script);
406 document.documentElement.removeChild(script); 407 document.documentElement.removeChild(script);
407 URL.revokeObjectURL(url); 408 URL.revokeObjectURL(url);
408 } 409 }
409 } 410 }
LEFTRIGHT
« no previous file | no next file » | Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Toggle Comments ('s')

Powered by Google App Engine
This is Rietveld