Rietveld Code Review Tool
Help | Bug tracker | Discussion group | Source code

Delta Between Two Patch Sets: lib/filterClasses.js

Issue 29680689: [$csp2 adblockpluscore] Issue 6329 - Add the CSP filter type (Closed)
Left Patch Set: Addressed some more nits Created March 15, 2018, 10:24 a.m.
Right Patch Set: Addressed Sebastian's feedback Created March 21, 2018, 4:51 p.m.
Left:
Right:
Use n/p to move between diff chunks; N/P to move between comments.
Jump to:
Left: Side by side diff | Download
Right: Side by side diff | Download
« no previous file with change/comment | « no previous file | test/filterClasses.js » ('j') | no next file with change/comment »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
LEFTRIGHT
1 /* 1 /*
2 * This file is part of Adblock Plus <https://adblockplus.org/>, 2 * This file is part of Adblock Plus <https://adblockplus.org/>,
3 * Copyright (C) 2006-present eyeo GmbH 3 * Copyright (C) 2006-present eyeo GmbH
4 * 4 *
5 * Adblock Plus is free software: you can redistribute it and/or modify 5 * Adblock Plus is free software: you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 3 as 6 * it under the terms of the GNU General Public License version 3 as
7 * published by the Free Software Foundation. 7 * published by the Free Software Foundation.
8 * 8 *
9 * Adblock Plus is distributed in the hope that it will be useful, 9 * Adblock Plus is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of 10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
(...skipping 80 matching lines...) Expand 10 before | Expand all | Expand 10 after
91 /** 91 /**
92 * Regular expression that RegExp filters specified as RegExps should match 92 * Regular expression that RegExp filters specified as RegExps should match
93 * @type {RegExp} 93 * @type {RegExp}
94 */ 94 */
95 Filter.regexpRegExp = /^(@@)?\/.*\/(?:\$~?[\w-]+(?:=[^,\s]+)?(?:,~?[\w-]+(?:=[^, \s]+)?)*)?$/; 95 Filter.regexpRegExp = /^(@@)?\/.*\/(?:\$~?[\w-]+(?:=[^,\s]+)?(?:,~?[\w-]+(?:=[^, \s]+)?)*)?$/;
96 /** 96 /**
97 * Regular expression that options on a RegExp filter should match 97 * Regular expression that options on a RegExp filter should match
98 * @type {RegExp} 98 * @type {RegExp}
99 */ 99 */
100 Filter.optionsRegExp = /\$(~?[\w-]+(?:=[^,]+)?(?:,~?[\w-]+(?:=[^,]+)?)*)$/; 100 Filter.optionsRegExp = /\$(~?[\w-]+(?:=[^,]+)?(?:,~?[\w-]+(?:=[^,]+)?)*)$/;
101 /**
102 * Regular expression that matches an invalid Content Security Policy
103 * @type {RegExp}
104 */
105 Filter.invalidCSPRegExp = /(;|^) ?(base-uri|referrer|report-to|report-uri|upgrad e-insecure-requests)\b/i;
101 106
102 /** 107 /**
103 * Creates a filter of correct type from its text representation - does the 108 * Creates a filter of correct type from its text representation - does the
104 * basic parsing and calls the right constructor then. 109 * basic parsing and calls the right constructor then.
105 * 110 *
106 * @param {string} text as in Filter() 111 * @param {string} text as in Filter()
107 * @return {Filter} 112 * @return {Filter}
108 */ 113 */
109 Filter.fromText = function(text) 114 Filter.fromText = function(text)
110 { 115 {
(...skipping 54 matching lines...) Expand 10 before | Expand all | Expand 10 after
165 * Removes unnecessary whitespaces from filter text, will only return null if 170 * Removes unnecessary whitespaces from filter text, will only return null if
166 * the input parameter is null. 171 * the input parameter is null.
167 * @param {string} text 172 * @param {string} text
168 * @return {string} 173 * @return {string}
169 */ 174 */
170 Filter.normalize = function(text) 175 Filter.normalize = function(text)
171 { 176 {
172 if (!text) 177 if (!text)
173 return text; 178 return text;
174 179
175 // Remove line breaks and such 180 // Remove line breaks, tabs etc
176 text = text.replace(/[^\S ]+/g, ""); 181 text = text.replace(/[^\S ]+/g, "");
177 182
178 // Don't remove spaces inside comments 183 // Don't remove spaces inside comments
179 if (/^ *!/.test(text)) 184 if (/^ *!/.test(text))
180 return text.trim(); 185 return text.trim();
181 186
182 // Special treatment for element hiding filters, right side is allowed to 187 // Special treatment for element hiding filters, right side is allowed to
183 // contain spaces 188 // contain spaces
184 if (Filter.elemhideRegExp.test(text)) 189 if (Filter.elemhideRegExp.test(text))
185 { 190 {
186 let [, domain, separator, selector] = /^(.*?)(#@?#?)(.*)$/.exec(text); 191 let [, domain, separator, selector] = /^(.*?)(#@?#?)(.*)$/.exec(text);
187 return domain.replace(/ +/g, "") + separator + selector.trim(); 192 return domain.replace(/ +/g, "") + separator + selector.trim();
188 } 193 }
189 194
190 // For most regexp filters we strip all whitespace. 195 // For most regexp filters we strip all spaces, but $csp filter options
196 // are allowed to contain single (non trailing) spaces.
191 let strippedText = text.replace(/ +/g, ""); 197 let strippedText = text.replace(/ +/g, "");
192 if (!strippedText.includes("$") || !/\bcsp=/i.test(strippedText)) 198 if (!strippedText.includes("$") || !/\bcsp=/i.test(strippedText))
193 return strippedText; 199 return strippedText;
194 200
195 let optionsMatch = Filter.optionsRegExp.exec(strippedText); 201 let optionsMatch = Filter.optionsRegExp.exec(strippedText);
196 if (!optionsMatch) 202 if (!optionsMatch)
197 return strippedText; 203 return strippedText;
198 204
199 // But since the values of $csp filter options are allowed to contain single 205 // For $csp filters we must first separate out the options part of the
200 // (non trailing) spaces we have to be more careful if they might be present. 206 // text, being careful to preserve its spaces.
201 let beforeOptions = strippedText.substring(0, optionsMatch.index); 207 let beforeOptions = strippedText.substring(0, optionsMatch.index);
202 let optionsText = text; 208 let strippedDollarIndex = -1;
Manish Jethani 2018/03/15 11:13:25 By the way, I was wondering if we could avoid crea
Manish Jethani 2018/03/16 06:47:09 Out of curiosity, what do you think about this? It
kzar 2018/03/16 11:29:05 Well I think that what we have already is plenty g
Manish Jethani 2018/03/16 12:05:06 But the effort has already been spent, the code ha
kzar 2018/03/17 14:35:06 Then we have bigger problems, e.g. we ran the opti
sergei 2018/03/19 15:47:30 I actually agree with Manish here, in both the per
kzar 2018/03/19 16:38:58 Well I still disagree on the readability aspect, b
Manish Jethani 2018/03/19 18:03:38 Acknowledged.
203 for (let i = beforeOptions.split("$").length; i > 0; i--) 209 let dollarIndex = -1;
204 optionsText = optionsText.substr(optionsText.indexOf("$") + 1); 210 do
205 211 {
212 strippedDollarIndex = beforeOptions.indexOf("$", strippedDollarIndex + 1);
213 dollarIndex = text.indexOf("$", dollarIndex + 1);
214 }
215 while (strippedDollarIndex != -1);
216 let optionsText = text.substr(dollarIndex + 1);
217
218 // Then we can normalize spaces in the options part safely
206 let options = optionsText.split(","); 219 let options = optionsText.split(",");
207 for (let i = 0; i < options.length; i++) 220 for (let i = 0; i < options.length; i++)
208 { 221 {
209 let option = options[i]; 222 let option = options[i];
210 let cspMatch = /^ *c *s *p *=/i.exec(option); 223 let cspMatch = /^ *c *s *p *=/i.exec(option);
211 if (cspMatch) 224 if (cspMatch)
212 { 225 {
213 options[i] = cspMatch[0].replace(/ +/g, "") + 226 options[i] = cspMatch[0].replace(/ +/g, "") +
214 option.substr(cspMatch[0].length).trim().replace(/ +/g, " "); 227 option.substr(cspMatch[0].length).trim().replace(/ +/g, " ");
215 } 228 }
(...skipping 558 matching lines...) Expand 10 before | Expand all | Expand 10 after
774 option = option.substr(0, separatorIndex); 787 option = option.substr(0, separatorIndex);
775 } 788 }
776 option = option.replace(/-/, "_").toUpperCase(); 789 option = option.replace(/-/, "_").toUpperCase();
777 if (option in RegExpFilter.typeMap) 790 if (option in RegExpFilter.typeMap)
778 { 791 {
779 if (contentType == null) 792 if (contentType == null)
780 contentType = 0; 793 contentType = 0;
781 contentType |= RegExpFilter.typeMap[option]; 794 contentType |= RegExpFilter.typeMap[option];
782 795
783 if (option == "CSP" && typeof value != "undefined") 796 if (option == "CSP" && typeof value != "undefined")
784 { 797 csp = value;
785 if (csp)
786 csp.push(value);
787 else
788 csp = [value];
789 }
790 } 798 }
791 else if (option[0] == "~" && option.substr(1) in RegExpFilter.typeMap) 799 else if (option[0] == "~" && option.substr(1) in RegExpFilter.typeMap)
792 { 800 {
793 if (contentType == null) 801 if (contentType == null)
794 ({contentType} = RegExpFilter.prototype); 802 ({contentType} = RegExpFilter.prototype);
795 contentType &= ~RegExpFilter.typeMap[option.substr(1)]; 803 contentType &= ~RegExpFilter.typeMap[option.substr(1)];
796 } 804 }
797 else if (option == "MATCH_CASE") 805 else if (option == "MATCH_CASE")
798 matchCase = true; 806 matchCase = true;
799 else if (option == "~MATCH_CASE") 807 else if (option == "~MATCH_CASE")
(...skipping 12 matching lines...) Expand all
812 sitekeys = value.toUpperCase(); 820 sitekeys = value.toUpperCase();
813 else 821 else
814 return new InvalidFilter(origText, "filter_unknown_option"); 822 return new InvalidFilter(origText, "filter_unknown_option");
815 } 823 }
816 } 824 }
817 825
818 try 826 try
819 { 827 {
820 if (blocking) 828 if (blocking)
821 { 829 {
822 if (csp) 830 if (csp && Filter.invalidCSPRegExp.test(csp))
823 { 831 return new InvalidFilter(origText, "filter_invalid_csp");
824 csp = csp.join("; ").toLowerCase();
825
826 // Prevent filters from injecting report-uri or report-to directives
827 // since they are a privacy concern. Regexp based upon reBadCSP[1].
828 // [1] - https://github.com/gorhill/uBlock/blob/67e06f53b4d73df6179f6d32 0553a55da4ead40e/src/js/static-net-filtering.js#L1362
kzar 2018/03/15 16:09:47 Note: I no longer attribute uBlock here since we p
Manish Jethani 2018/03/15 16:55:34 Acknowledged.
829 if (/(;|^)\s*report-(to|uri)\b/.test(csp))
Manish Jethani 2018/03/15 13:24:44 Since we allow single spaces in the CSP, we should
kzar 2018/03/15 13:44:45 I don't think that's a problem, Sebastian noticed
Manish Jethani 2018/03/15 13:47:33 Thanks, I was just wondering about this. In that c
Manish Jethani 2018/03/15 13:50:48 Also, in the interest of landing this (so we can s
kzar 2018/03/15 14:13:37 I'd prefer not to land this without the security /
kzar 2018/03/15 14:13:37 It should be here at parse time IMO.
kzar 2018/03/15 14:13:38 Well spotted, there's a non-outdated version calle
Manish Jethani 2018/03/15 14:28:31 Referrer-Policy doesn't really concern us since we
Manish Jethani 2018/03/15 14:28:31 My only concern was to not allow filter authors to
Sebastian Noack 2018/03/15 19:03:05 Agreed. In the end, there is nothing we can effect
Manish Jethani 2018/03/16 12:25:05 Ack.
830 return new InvalidFilter(origText, "filter_invalid_csp");
831 }
832 832
833 return new BlockingFilter(origText, text, contentType, matchCase, domains, 833 return new BlockingFilter(origText, text, contentType, matchCase, domains,
834 thirdParty, sitekeys, collapse, csp); 834 thirdParty, sitekeys, collapse, csp);
835 } 835 }
836 return new WhitelistFilter(origText, text, contentType, matchCase, domains, 836 return new WhitelistFilter(origText, text, contentType, matchCase, domains,
837 thirdParty, sitekeys); 837 thirdParty, sitekeys);
838 } 838 }
839 catch (e) 839 catch (e)
840 { 840 {
841 return new InvalidFilter(origText, "filter_invalid_regexp"); 841 return new InvalidFilter(origText, "filter_invalid_regexp");
(...skipping 238 matching lines...) Expand 10 before | Expand all | Expand 10 after
1080 */ 1080 */
1081 function ElemHideEmulationFilter(text, domains, selector) 1081 function ElemHideEmulationFilter(text, domains, selector)
1082 { 1082 {
1083 ElemHideBase.call(this, text, domains, selector); 1083 ElemHideBase.call(this, text, domains, selector);
1084 } 1084 }
1085 exports.ElemHideEmulationFilter = ElemHideEmulationFilter; 1085 exports.ElemHideEmulationFilter = ElemHideEmulationFilter;
1086 1086
1087 ElemHideEmulationFilter.prototype = extend(ElemHideBase, { 1087 ElemHideEmulationFilter.prototype = extend(ElemHideBase, {
1088 type: "elemhideemulation" 1088 type: "elemhideemulation"
1089 }); 1089 });
LEFTRIGHT

Powered by Google App Engine
This is Rietveld