Rietveld Code Review Tool
Help | Bug tracker | Discussion group | Source code

Side by Side Diff: lib/filterClasses.js

Issue 29680689: [$csp2 adblockpluscore] Issue 6329 - Add the CSP filter type (Closed)
Patch Set: Prevent the referrer directive Created March 15, 2018, 4:05 p.m.
Left:
Right:
Use n/p to move between diff chunks; N/P to move between comments.
Jump to:
View unified diff | Download patch
« no previous file with comments | « no previous file | test/filterClasses.js » ('j') | test/filterClasses.js » ('J')
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 /* 1 /*
2 * This file is part of Adblock Plus <https://adblockplus.org/>, 2 * This file is part of Adblock Plus <https://adblockplus.org/>,
3 * Copyright (C) 2006-present eyeo GmbH 3 * Copyright (C) 2006-present eyeo GmbH
4 * 4 *
5 * Adblock Plus is free software: you can redistribute it and/or modify 5 * Adblock Plus is free software: you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 3 as 6 * it under the terms of the GNU General Public License version 3 as
7 * published by the Free Software Foundation. 7 * published by the Free Software Foundation.
8 * 8 *
9 * Adblock Plus is distributed in the hope that it will be useful, 9 * Adblock Plus is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of 10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
(...skipping 79 matching lines...) Expand 10 before | Expand all | Expand 10 after
90 Filter.elemhideRegExp = /^([^/*|@"!]*?)#([@?])?#(.+)$/; 90 Filter.elemhideRegExp = /^([^/*|@"!]*?)#([@?])?#(.+)$/;
91 /** 91 /**
92 * Regular expression that RegExp filters specified as RegExps should match 92 * Regular expression that RegExp filters specified as RegExps should match
93 * @type {RegExp} 93 * @type {RegExp}
94 */ 94 */
95 Filter.regexpRegExp = /^(@@)?\/.*\/(?:\$~?[\w-]+(?:=[^,\s]+)?(?:,~?[\w-]+(?:=[^, \s]+)?)*)?$/; 95 Filter.regexpRegExp = /^(@@)?\/.*\/(?:\$~?[\w-]+(?:=[^,\s]+)?(?:,~?[\w-]+(?:=[^, \s]+)?)*)?$/;
96 /** 96 /**
97 * Regular expression that options on a RegExp filter should match 97 * Regular expression that options on a RegExp filter should match
98 * @type {RegExp} 98 * @type {RegExp}
99 */ 99 */
100 Filter.optionsRegExp = /\$(~?[\w-]+(?:=[^,\s]+)?(?:,~?[\w-]+(?:=[^,\s]+)?)*)$/; 100 Filter.optionsRegExp = /\$(~?[\w-]+(?:=[^,]+)?(?:,~?[\w-]+(?:=[^,]+)?)*)$/;
101 101
102 /** 102 /**
103 * Creates a filter of correct type from its text representation - does the 103 * Creates a filter of correct type from its text representation - does the
104 * basic parsing and calls the right constructor then. 104 * basic parsing and calls the right constructor then.
105 * 105 *
106 * @param {string} text as in Filter() 106 * @param {string} text as in Filter()
107 * @return {Filter} 107 * @return {Filter}
108 */ 108 */
109 Filter.fromText = function(text) 109 Filter.fromText = function(text)
110 { 110 {
(...skipping 55 matching lines...) Expand 10 before | Expand all | Expand 10 after
166 * the input parameter is null. 166 * the input parameter is null.
167 * @param {string} text 167 * @param {string} text
168 * @return {string} 168 * @return {string}
169 */ 169 */
170 Filter.normalize = function(text) 170 Filter.normalize = function(text)
171 { 171 {
172 if (!text) 172 if (!text)
173 return text; 173 return text;
174 174
175 // Remove line breaks and such 175 // Remove line breaks and such
176 text = text.replace(/[^\S ]/g, ""); 176 text = text.replace(/[^\S ]+/g, "");
177 177
178 if (/^\s*!/.test(text)) 178 // Don't remove spaces inside comments
179 if (/^ *!/.test(text))
180 return text.trim();
181
182 // Special treatment for element hiding filters, right side is allowed to
183 // contain spaces
184 if (Filter.elemhideRegExp.test(text))
179 { 185 {
180 // Don't remove spaces inside comments 186 let [, domain, separator, selector] = /^(.*?)(#@?#?)(.*)$/.exec(text);
181 return text.trim(); 187 return domain.replace(/ +/g, "") + separator + selector.trim();
182 } 188 }
183 else if (Filter.elemhideRegExp.test(text)) 189
190 // For most regexp filters we strip all whitespace.
191 let strippedText = text.replace(/ +/g, "");
192 if (!strippedText.includes("$") || !/\bcsp=/i.test(strippedText))
193 return strippedText;
194
195 let optionsMatch = Filter.optionsRegExp.exec(strippedText);
196 if (!optionsMatch)
197 return strippedText;
198
199 // But since the values of $csp filter options are allowed to contain single
200 // (non trailing) spaces we have to be more careful if they might be present.
201 let beforeOptions = strippedText.substring(0, optionsMatch.index);
202 let optionsText = text;
203 for (let i = beforeOptions.split("$").length; i > 0; i--)
204 optionsText = optionsText.substr(optionsText.indexOf("$") + 1);
205
206 let options = optionsText.split(",");
207 for (let i = 0; i < options.length; i++)
184 { 208 {
185 // Special treatment for element hiding filters, right side is allowed to 209 let option = options[i];
186 // contain spaces 210 let cspMatch = /^ *c *s *p *=/i.exec(option);
187 let [, domain, separator, selector] = /^(.*?)(#@?#?)(.*)$/.exec(text); 211 if (cspMatch)
188 return domain.replace(/\s/g, "") + separator + selector.trim(); 212 {
213 options[i] = cspMatch[0].replace(/ +/g, "") +
214 option.substr(cspMatch[0].length).trim().replace(/ +/g, " ");
215 }
216 else
217 options[i] = option.replace(/ +/g, "");
189 } 218 }
190 return text.replace(/\s/g, ""); 219
220 return beforeOptions + "$" + options.join();
191 }; 221 };
192 222
193 /** 223 /**
194 * @see filterToRegExp 224 * @see filterToRegExp
195 */ 225 */
196 Filter.toRegExp = filterToRegExp; 226 Filter.toRegExp = filterToRegExp;
197 227
198 /** 228 /**
199 * Class for invalid filters 229 * Class for invalid filters
200 * @param {string} text see Filter() 230 * @param {string} text see Filter()
(...skipping 519 matching lines...) Expand 10 before | Expand all | Expand 10 after
720 blocking = false; 750 blocking = false;
721 text = text.substr(2); 751 text = text.substr(2);
722 } 752 }
723 753
724 let contentType = null; 754 let contentType = null;
725 let matchCase = null; 755 let matchCase = null;
726 let domains = null; 756 let domains = null;
727 let sitekeys = null; 757 let sitekeys = null;
728 let thirdParty = null; 758 let thirdParty = null;
729 let collapse = null; 759 let collapse = null;
760 let csp = null;
730 let options; 761 let options;
731 let match = (text.indexOf("$") >= 0 ? Filter.optionsRegExp.exec(text) : null); 762 let match = (text.indexOf("$") >= 0 ? Filter.optionsRegExp.exec(text) : null);
732 if (match) 763 if (match)
733 { 764 {
734 options = match[1].toUpperCase().split(","); 765 options = match[1].split(",");
735 text = match.input.substr(0, match.index); 766 text = match.input.substr(0, match.index);
736 for (let option of options) 767 for (let option of options)
737 { 768 {
738 let value = null; 769 let value = null;
739 let separatorIndex = option.indexOf("="); 770 let separatorIndex = option.indexOf("=");
740 if (separatorIndex >= 0) 771 if (separatorIndex >= 0)
741 { 772 {
742 value = option.substr(separatorIndex + 1); 773 value = option.substr(separatorIndex + 1);
743 option = option.substr(0, separatorIndex); 774 option = option.substr(0, separatorIndex);
744 } 775 }
745 option = option.replace(/-/, "_"); 776 option = option.replace(/-/, "_").toUpperCase();
746 if (option in RegExpFilter.typeMap) 777 if (option in RegExpFilter.typeMap)
747 { 778 {
748 if (contentType == null) 779 if (contentType == null)
749 contentType = 0; 780 contentType = 0;
750 contentType |= RegExpFilter.typeMap[option]; 781 contentType |= RegExpFilter.typeMap[option];
782
783 if (option == "CSP" && typeof value != "undefined")
784 {
785 if (csp)
786 csp.push(value);
787 else
788 csp = [value];
789 }
751 } 790 }
752 else if (option[0] == "~" && option.substr(1) in RegExpFilter.typeMap) 791 else if (option[0] == "~" && option.substr(1) in RegExpFilter.typeMap)
753 { 792 {
754 if (contentType == null) 793 if (contentType == null)
755 ({contentType} = RegExpFilter.prototype); 794 ({contentType} = RegExpFilter.prototype);
756 contentType &= ~RegExpFilter.typeMap[option.substr(1)]; 795 contentType &= ~RegExpFilter.typeMap[option.substr(1)];
757 } 796 }
758 else if (option == "MATCH_CASE") 797 else if (option == "MATCH_CASE")
759 matchCase = true; 798 matchCase = true;
760 else if (option == "~MATCH_CASE") 799 else if (option == "~MATCH_CASE")
761 matchCase = false; 800 matchCase = false;
762 else if (option == "DOMAIN" && typeof value != "undefined") 801 else if (option == "DOMAIN" && typeof value != "undefined")
763 domains = value; 802 domains = value.toUpperCase();
764 else if (option == "THIRD_PARTY") 803 else if (option == "THIRD_PARTY")
765 thirdParty = true; 804 thirdParty = true;
766 else if (option == "~THIRD_PARTY") 805 else if (option == "~THIRD_PARTY")
767 thirdParty = false; 806 thirdParty = false;
768 else if (option == "COLLAPSE") 807 else if (option == "COLLAPSE")
769 collapse = true; 808 collapse = true;
770 else if (option == "~COLLAPSE") 809 else if (option == "~COLLAPSE")
771 collapse = false; 810 collapse = false;
772 else if (option == "SITEKEY" && typeof value != "undefined") 811 else if (option == "SITEKEY" && typeof value != "undefined")
773 sitekeys = value; 812 sitekeys = value.toUpperCase();
774 else 813 else
775 return new InvalidFilter(origText, "filter_unknown_option"); 814 return new InvalidFilter(origText, "filter_unknown_option");
776 } 815 }
777 } 816 }
778 817
779 try 818 try
780 { 819 {
781 if (blocking) 820 if (blocking)
782 { 821 {
822 if (csp)
823 {
824 csp = csp.join("; ").toLowerCase();
825
826 // Prevent injecting directives which could be a privacy concern
827 if (/(;|^) ?(report-to|report-uri|referrer)\b/.test(csp))
828 return new InvalidFilter(origText, "filter_invalid_csp");
829 }
830
783 return new BlockingFilter(origText, text, contentType, matchCase, domains, 831 return new BlockingFilter(origText, text, contentType, matchCase, domains,
784 thirdParty, sitekeys, collapse); 832 thirdParty, sitekeys, collapse, csp);
785 } 833 }
786 return new WhitelistFilter(origText, text, contentType, matchCase, domains, 834 return new WhitelistFilter(origText, text, contentType, matchCase, domains,
787 thirdParty, sitekeys); 835 thirdParty, sitekeys);
788 } 836 }
789 catch (e) 837 catch (e)
790 { 838 {
791 return new InvalidFilter(origText, "filter_invalid_regexp"); 839 return new InvalidFilter(origText, "filter_invalid_regexp");
792 } 840 }
793 }; 841 };
794 842
795 /** 843 /**
796 * Maps type strings like "SCRIPT" or "OBJECT" to bit masks 844 * Maps type strings like "SCRIPT" or "OBJECT" to bit masks
797 */ 845 */
798 RegExpFilter.typeMap = { 846 RegExpFilter.typeMap = {
799 OTHER: 1, 847 OTHER: 1,
800 SCRIPT: 2, 848 SCRIPT: 2,
801 IMAGE: 4, 849 IMAGE: 4,
802 STYLESHEET: 8, 850 STYLESHEET: 8,
803 OBJECT: 16, 851 OBJECT: 16,
804 SUBDOCUMENT: 32, 852 SUBDOCUMENT: 32,
805 DOCUMENT: 64, 853 DOCUMENT: 64,
806 WEBSOCKET: 128, 854 WEBSOCKET: 128,
807 WEBRTC: 256, 855 WEBRTC: 256,
856 CSP: 512,
808 XBL: 1, 857 XBL: 1,
809 PING: 1024, 858 PING: 1024,
810 XMLHTTPREQUEST: 2048, 859 XMLHTTPREQUEST: 2048,
811 OBJECT_SUBREQUEST: 4096, 860 OBJECT_SUBREQUEST: 4096,
812 DTD: 1, 861 DTD: 1,
813 MEDIA: 16384, 862 MEDIA: 16384,
814 FONT: 32768, 863 FONT: 32768,
815 864
816 BACKGROUND: 4, // Backwards compat, same as IMAGE 865 BACKGROUND: 4, // Backwards compat, same as IMAGE
817 866
818 POPUP: 0x10000000, 867 POPUP: 0x10000000,
819 GENERICBLOCK: 0x20000000, 868 GENERICBLOCK: 0x20000000,
820 ELEMHIDE: 0x40000000, 869 ELEMHIDE: 0x40000000,
821 GENERICHIDE: 0x80000000 870 GENERICHIDE: 0x80000000
822 }; 871 };
823 872
824 // DOCUMENT, ELEMHIDE, POPUP, GENERICHIDE and GENERICBLOCK options shouldn't 873 // CSP, DOCUMENT, ELEMHIDE, POPUP, GENERICHIDE and GENERICBLOCK options
825 // be there by default 874 // shouldn't be there by default
826 RegExpFilter.prototype.contentType &= ~(RegExpFilter.typeMap.DOCUMENT | 875 RegExpFilter.prototype.contentType &= ~(RegExpFilter.typeMap.CSP |
876 RegExpFilter.typeMap.DOCUMENT |
827 RegExpFilter.typeMap.ELEMHIDE | 877 RegExpFilter.typeMap.ELEMHIDE |
828 RegExpFilter.typeMap.POPUP | 878 RegExpFilter.typeMap.POPUP |
829 RegExpFilter.typeMap.GENERICHIDE | 879 RegExpFilter.typeMap.GENERICHIDE |
830 RegExpFilter.typeMap.GENERICBLOCK); 880 RegExpFilter.typeMap.GENERICBLOCK);
831 881
832 /** 882 /**
833 * Class for blocking filters 883 * Class for blocking filters
834 * @param {string} text see Filter() 884 * @param {string} text see Filter()
835 * @param {string} regexpSource see RegExpFilter() 885 * @param {string} regexpSource see RegExpFilter()
836 * @param {number} contentType see RegExpFilter() 886 * @param {number} contentType see RegExpFilter()
837 * @param {boolean} matchCase see RegExpFilter() 887 * @param {boolean} matchCase see RegExpFilter()
838 * @param {string} domains see RegExpFilter() 888 * @param {string} domains see RegExpFilter()
839 * @param {boolean} thirdParty see RegExpFilter() 889 * @param {boolean} thirdParty see RegExpFilter()
840 * @param {string} sitekeys see RegExpFilter() 890 * @param {string} sitekeys see RegExpFilter()
841 * @param {boolean} collapse 891 * @param {boolean} collapse
842 * defines whether the filter should collapse blocked content, can be null 892 * defines whether the filter should collapse blocked content, can be null
893 * @param {string} [csp]
894 * Content Security Policy to inject when the filter matches
843 * @constructor 895 * @constructor
844 * @augments RegExpFilter 896 * @augments RegExpFilter
845 */ 897 */
846 function BlockingFilter(text, regexpSource, contentType, matchCase, domains, 898 function BlockingFilter(text, regexpSource, contentType, matchCase, domains,
847 thirdParty, sitekeys, collapse) 899 thirdParty, sitekeys, collapse, csp)
848 { 900 {
849 RegExpFilter.call(this, text, regexpSource, contentType, matchCase, domains, 901 RegExpFilter.call(this, text, regexpSource, contentType, matchCase, domains,
850 thirdParty, sitekeys); 902 thirdParty, sitekeys);
851 903
852 this.collapse = collapse; 904 this.collapse = collapse;
905 this.csp = csp;
853 } 906 }
854 exports.BlockingFilter = BlockingFilter; 907 exports.BlockingFilter = BlockingFilter;
855 908
856 BlockingFilter.prototype = extend(RegExpFilter, { 909 BlockingFilter.prototype = extend(RegExpFilter, {
857 type: "blocking", 910 type: "blocking",
858 911
859 /** 912 /**
860 * Defines whether the filter should collapse blocked content. 913 * Defines whether the filter should collapse blocked content.
861 * Can be null (use the global preference). 914 * Can be null (use the global preference).
862 * @type {boolean} 915 * @type {boolean}
863 */ 916 */
864 collapse: null 917 collapse: null,
918
919 /**
920 * Content Security Policy to inject for matching requests.
921 * @type {string}
922 */
923 csp: null
865 }); 924 });
866 925
867 /** 926 /**
868 * Class for whitelist filters 927 * Class for whitelist filters
869 * @param {string} text see Filter() 928 * @param {string} text see Filter()
870 * @param {string} regexpSource see RegExpFilter() 929 * @param {string} regexpSource see RegExpFilter()
871 * @param {number} contentType see RegExpFilter() 930 * @param {number} contentType see RegExpFilter()
872 * @param {boolean} matchCase see RegExpFilter() 931 * @param {boolean} matchCase see RegExpFilter()
873 * @param {string} domains see RegExpFilter() 932 * @param {string} domains see RegExpFilter()
874 * @param {boolean} thirdParty see RegExpFilter() 933 * @param {boolean} thirdParty see RegExpFilter()
(...skipping 144 matching lines...) Expand 10 before | Expand all | Expand 10 after
1019 */ 1078 */
1020 function ElemHideEmulationFilter(text, domains, selector) 1079 function ElemHideEmulationFilter(text, domains, selector)
1021 { 1080 {
1022 ElemHideBase.call(this, text, domains, selector); 1081 ElemHideBase.call(this, text, domains, selector);
1023 } 1082 }
1024 exports.ElemHideEmulationFilter = ElemHideEmulationFilter; 1083 exports.ElemHideEmulationFilter = ElemHideEmulationFilter;
1025 1084
1026 ElemHideEmulationFilter.prototype = extend(ElemHideBase, { 1085 ElemHideEmulationFilter.prototype = extend(ElemHideBase, {
1027 type: "elemhideemulation" 1086 type: "elemhideemulation"
1028 }); 1087 });
OLDNEW
« no previous file with comments | « no previous file | test/filterClasses.js » ('j') | test/filterClasses.js » ('J')

Powered by Google App Engine
This is Rietveld