[$csp2 adblockpluscore] Issue 6329 - Add the CSP filter type

lib/filterClasses.js

 /*
  * This file is part of Adblock Plus <https://adblockplus.org/>,
  * Copyright (C) 2006-present eyeo GmbH
  *
  * Adblock Plus is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
  * published by the Free Software Foundation.
  *
  * Adblock Plus is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ skipping 69 matching lines @@
 /**
  * Cache for known filters, maps string representation to filter objects.
  * @type {Map.<string,Filter>}
  */
 Filter.knownFilters = new Map();
 
 /**
  * Regular expression that element hiding filters should match
  * @type {RegExp}
  */
-Filter.elemhideRegExp = /^([^/*|@"!]*?)(#([@?])?#)(.+)$/;
+Filter.elemhideRegExp = /^([^/*|@"!]*?)#([@?])?#(.+)$/;
 /**
  * Regular expression that RegExp filters specified as RegExps should match
  * @type {RegExp}
  */
 Filter.regexpRegExp = /^(@@)?\/.*\/(?:\$~?[\w-]+(?:=[^,\s]+)?(?:,~?[\w-]+(?:=[^,\s]+)?)*)?$/;
 /**
  * Regular expression that options on a RegExp filter should match
  * @type {RegExp}
  */
 Filter.optionsRegExp = /\$(~?[\w-]+(?:=[^,]+)?(?:,~?[\w-]+(?:=[^,]+)?)*)$/;
+/**
+ * Regular expression that matches an invalid Content Security Policy
+ * @type {RegExp}
+ */
+Filter.invalidCSPRegExp = /(;|^) ?(base-uri|referrer|report-to|report-uri|upgrade-insecure-requests)\b/i;
 
 /**
  * Creates a filter of correct type from its text representation - does the
- * basic normalisation and parsing where possible before deferring to the right
- * constructor.
+ * basic parsing and calls the right constructor then.
+ *
  * @param {string} text   as in Filter()
  * @return {Filter}
  */
 Filter.fromText = function(text)
 {
   let filter = Filter.knownFilters.get(text);
   if (filter)
     return filter;
 
   let match = (text.includes("#") ? Filter.elemhideRegExp.exec(text) : null);
   if (match)
   {
-    let [, domain, seperator, type, selector] = match;
-
-    domain = domain.replace(/\s/g, "");
-    selector = selector.trim();
-
     let propsMatch;
-    if (!type &&
-        (propsMatch = /\[-abp-properties=(["'])([^"']+)\1\]/.exec(selector)))
+    if (!match[2] &&
+        (propsMatch = /\[-abp-properties=(["'])([^"']+)\1\]/.exec(match[3])))
     {
       // This is legacy CSS properties syntax, convert to current syntax
-      let prefix = selector.substr(0, propsMatch.index);
+      let prefix = match[3].substr(0, propsMatch.index);
       let expression = propsMatch[2];
-      let suffix = selector.substr(propsMatch.index + propsMatch[0].length);
-      return Filter.fromText(`${domain}#?#` +
+      let suffix = match[3].substr(propsMatch.index + propsMatch[0].length);
+      return Filter.fromText(`${match[1]}#?#` +
           `${prefix}:-abp-properties(${expression})${suffix}`);
     }
 
     filter = ElemHideBase.fromText(
-      domain + seperator + selector, domain, type, selector
+      text, match[1], match[2], match[3]
     );
   }
   else if (text[0] == "!")
     filter = new CommentFilter(text);
   else
     filter = RegExpFilter.fromText(text);
 
   Filter.knownFilters.set(filter.text, filter);
   return filter;
 };
@@ skipping 13 matching lines @@
       filter._disabled = (obj.disabled == "true");
     if ("hitCount" in obj)
       filter._hitCount = parseInt(obj.hitCount, 10) || 0;
     if ("lastHit" in obj)
       filter._lastHit = parseInt(obj.lastHit, 10) || 0;
   }
   return filter;
 };
 
 /**
- * Strip linebreaks etc and then trim whitespace from the filter text.
- * Will only return null if the input parameter is null.
+ * Removes unnecessary whitespaces from filter text, will only return null if
+ * the input parameter is null.
  * @param {string} text
  * @return {string}
  */
-Filter.stripJunk = function(text)
+Filter.normalize = function(text)
 {
   if (!text)
     return text;
-  return text.replace(/[^\S ]/g, "").trim();
+
+  // Remove line breaks, tabs etc
+  text = text.replace(/[^\S ]+/g, "");
+
+  // Don't remove spaces inside comments
+  if (/^ *!/.test(text))
+    return text.trim();
+
+  // Special treatment for element hiding filters, right side is allowed to
+  // contain spaces
+  if (Filter.elemhideRegExp.test(text))
+  {
+    let [, domain, separator, selector] = /^(.*?)(#@?#?)(.*)$/.exec(text);
+    return domain.replace(/ +/g, "") + separator + selector.trim();
+  }
+
+  // For most regexp filters we strip all spaces, but $csp filter options
+  // are allowed to contain single (non trailing) spaces.
+  let strippedText = text.replace(/ +/g, "");
+  if (!strippedText.includes("$") || !/\bcsp=/i.test(strippedText))
+    return strippedText;
+
+  let optionsMatch = Filter.optionsRegExp.exec(strippedText);
+  if (!optionsMatch)
+    return strippedText;
+
+  // For $csp filters we must first separate out the options part of the
+  // text, being careful to preserve its spaces.
+  let beforeOptions = strippedText.substring(0, optionsMatch.index);
+  let strippedDollarIndex = -1;
+  let dollarIndex = -1;
+  do
+  {
+    strippedDollarIndex = beforeOptions.indexOf("$", strippedDollarIndex + 1);
+    dollarIndex = text.indexOf("$", dollarIndex + 1);
+  }
+  while (strippedDollarIndex != -1);
+  let optionsText = text.substr(dollarIndex + 1);
+
+  // Then we can normalize spaces in the options part safely
+  let options = optionsText.split(",");
+  for (let i = 0; i < options.length; i++)
+  {
+    let option = options[i];
+    let cspMatch = /^ *c *s *p *=/i.exec(option);
+    if (cspMatch)
+    {
+      options[i] = cspMatch[0].replace(/ +/g, "") +
+                   option.substr(cspMatch[0].length).trim().replace(/ +/g, " ");
+    }
+    else
+      options[i] = option.replace(/ +/g, "");
+  }
+
+  return beforeOptions + "$" + options.join();
 };
 
 /**
  * @see filterToRegExp
  */
 Filter.toRegExp = filterToRegExp;
 
 /**
  * Class for invalid filters
  * @param {string} text see Filter()
@@ skipping 505 matching lines @@
   get() { return this; }
 });
 
 /**
  * Creates a RegExp filter from its text representation
  * @param {string} text   same as in Filter()
  * @return {Filter}
  */
 RegExpFilter.fromText = function(text)
 {
+  let blocking = true;
+  let origText = text;
+  if (text.indexOf("@@") == 0)
+  {
+    blocking = false;
+    text = text.substr(2);
+  }
+
   let contentType = null;
-  let csp = null;
   let matchCase = null;
   let domains = null;
   let sitekeys = null;
   let thirdParty = null;
   let collapse = null;
-  let origText;
-
+  let csp = null;
+  let options;
   let match = (text.indexOf("$") >= 0 ? Filter.optionsRegExp.exec(text) : null);
-  if (!match)
-  {
-    origText = text = text.replace(/\s/g, "");
-  }
-  else
-  {
-    text = match.input.substring(0, match.index).replace(/\s/g, "");
-
-    // Strip all whitespace from the options string, except for CSP values which
-    // we only trim.
-    let rawOptions = match[1];
-    let options = "";
-    let offset = 0;
-    let cspMatch;
-    let cspRegexp = /((?:^|,)csp=)([^,]+)/gi;
-    while ((cspMatch = cspRegexp.exec(rawOptions)))
-    {
-      options += rawOptions.substring(offset, cspMatch.index).replace(/\s/g, "");
-      options += cspMatch[1] + cspMatch[2].trim();
-      offset = cspRegexp.lastIndex;
-    }
-    options += rawOptions.substring(offset).replace(/\s/g, "");
-
-    origText = text + "$" + options;
-
-    for (let option of options.toUpperCase().split(","))
+  if (match)
+  {
+    options = match[1].split(",");
+    text = match.input.substr(0, match.index);
+    for (let option of options)
     {
       let value = null;
       let separatorIndex = option.indexOf("=");
       if (separatorIndex >= 0)
       {
         value = option.substr(separatorIndex + 1);
-        option = option.substring(0, separatorIndex);
+        option = option.substr(0, separatorIndex);
       }
-      option = option.replace(/-/, "_");
+      option = option.replace(/-/, "_").toUpperCase();
       if (option in RegExpFilter.typeMap)
       {
         if (contentType == null)
           contentType = 0;
         contentType |= RegExpFilter.typeMap[option];
 
-        if (option == "CSP" && typeof value == "string")
-        {
-          csp = value.toLowerCase();

[Manish Jethani, 2018/02/06 05:54:20]

We could avoid uppercasing and then lowercasing the value here by first only
uppercasing the name part of the option and here deciding if the value should be
uppercase or lowercase.

[kzar, 2018/03/06 15:37:53]

Done.

-          // Quick check to prevent report-uri and report-to directives
-          if (csp.includes("report-"))

[Manish Jethani, 2018/02/06 05:54:20]

Couldn't the value contain "report-" in a different place than the directive
name? e.g. "default-src https://report-generator.example.com". I think this
check should be more specific.

[kzar, 2018/03/06 15:37:53]

Done.

-            return new InvalidFilter(origText, "filter_invalid_csp");
-        }
+        if (option == "CSP" && typeof value != "undefined")
+          csp = value;
       }
       else if (option[0] == "~" && option.substr(1) in RegExpFilter.typeMap)
       {
         if (contentType == null)
           ({contentType} = RegExpFilter.prototype);
         contentType &= ~RegExpFilter.typeMap[option.substr(1)];
       }
       else if (option == "MATCH_CASE")
         matchCase = true;
       else if (option == "~MATCH_CASE")
         matchCase = false;
       else if (option == "DOMAIN" && typeof value != "undefined")
-        domains = value;
+        domains = value.toUpperCase();
       else if (option == "THIRD_PARTY")
         thirdParty = true;
       else if (option == "~THIRD_PARTY")
         thirdParty = false;
       else if (option == "COLLAPSE")
         collapse = true;
       else if (option == "~COLLAPSE")
         collapse = false;
       else if (option == "SITEKEY" && typeof value != "undefined")
-        sitekeys = value;
+        sitekeys = value.toUpperCase();
       else
         return new InvalidFilter(origText, "filter_unknown_option");
     }
   }
 
   try
   {
-    if (text.indexOf("@@") == 0)
-    {
-      return new WhitelistFilter(origText, text.substr(2), contentType,
-                                 matchCase, domains, thirdParty, sitekeys);
-    }
-    return new BlockingFilter(origText, text, contentType, matchCase, domains,
-                              thirdParty, sitekeys, collapse, csp);
+    if (blocking)
+    {
+      if (csp && Filter.invalidCSPRegExp.test(csp))
+        return new InvalidFilter(origText, "filter_invalid_csp");
+
+      return new BlockingFilter(origText, text, contentType, matchCase, domains,
+                                thirdParty, sitekeys, collapse, csp);
+    }
+    return new WhitelistFilter(origText, text, contentType, matchCase, domains,
+                               thirdParty, sitekeys);
   }
   catch (e)
   {
     return new InvalidFilter(origText, "filter_invalid_regexp");
   }
 };
 
 /**
  * Maps type strings like "SCRIPT" or "OBJECT" to bit masks
  */
 RegExpFilter.typeMap = {
   OTHER: 1,
   SCRIPT: 2,
   IMAGE: 4,
   STYLESHEET: 8,
   OBJECT: 16,
   SUBDOCUMENT: 32,
   DOCUMENT: 64,
   WEBSOCKET: 128,
+  WEBRTC: 256,
   CSP: 512,

[Manish Jethani, 2018/02/06 05:54:20]

Perhaps a good idea to place CSP after WEBRTC?

[kzar, 2018/03/06 15:37:53]

Done.

-  WEBRTC: 256,
   XBL: 1,
   PING: 1024,
   XMLHTTPREQUEST: 2048,
   OBJECT_SUBREQUEST: 4096,
   DTD: 1,
   MEDIA: 16384,
   FONT: 32768,
 
   BACKGROUND: 4,    // Backwards compat, same as IMAGE
 
@@ skipping 211 matching lines @@
  */
 function ElemHideEmulationFilter(text, domains, selector)
 {
   ElemHideBase.call(this, text, domains, selector);
 }
 exports.ElemHideEmulationFilter = ElemHideEmulationFilter;
 
 ElemHideEmulationFilter.prototype = extend(ElemHideBase, {
   type: "elemhideemulation"
 });