[$csp2 adblockpluscore] Issue 6329 - Add the CSP filter type

lib/filterClasses.js

 /*
  * This file is part of Adblock Plus <https://adblockplus.org/>,
  * Copyright (C) 2006-present eyeo GmbH
  *
  * Adblock Plus is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
  * published by the Free Software Foundation.
  *
  * Adblock Plus is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ skipping 80 matching lines @@
 /**
  * Regular expression that RegExp filters specified as RegExps should match
  * @type {RegExp}
  */
 Filter.regexpRegExp = /^(@@)?\/.*\/(?:\$~?[\w-]+(?:=[^,\s]+)?(?:,~?[\w-]+(?:=[^,\s]+)?)*)?$/;
 /**
  * Regular expression that options on a RegExp filter should match
  * @type {RegExp}
  */
 Filter.optionsRegExp = /\$(~?[\w-]+(?:=[^,]+)?(?:,~?[\w-]+(?:=[^,]+)?)*)$/;
+/**
+ * Regular expression that matches an invalid Content Security Policy
+ * @type {RegExp}
+ */
+Filter.invalidCSPRegExp = /(;|^) ?(base-uri|referrer|report-to|report-uri|upgrade-insecure-requests)\b/i;
 
 /**
  * Creates a filter of correct type from its text representation - does the
  * basic parsing and calls the right constructor then.
  *
  * @param {string} text   as in Filter()
  * @return {Filter}
  */
 Filter.fromText = function(text)
 {
@@ skipping 55 matching lines @@
  * the input parameter is null.
  * @param {string} text
  * @return {string}
  */
 Filter.normalize = function(text)
 {
   if (!text)
     return text;
 
   // Remove line breaks, tabs etc
   text = text.replace(/[^\S ]+/g, "");

[sergei, 2018/03/16 16:49:25]

This change (including the same changes below) seems unrelated and since it
seems to be a good optimization, if it's not difficult I would recommend to make
it in separate commit and it can be landed pretty quickly.

[kzar, 2018/03/17 14:35:06]

I would rather just land this all together (same below).

[sergei, 2018/03/19 15:47:31]

OK, however if it gets a bit longer then could you please do it in a separate
commit, additionally IMO this as well as perhaps some other changes are worth
mentioning in the commit message.

 
   // Don't remove spaces inside comments
   if (/^ *!/.test(text))

[sergei, 2018/03/16 16:49:24]

This change seems unrelated too and to tell the truth it's not clear that it
should be done. It can be a good optimization but IMO it should be confirmed
that there are only spaces (0x20).

[kzar, 2018/03/17 14:35:07]

It is the case since we've already replaced other whitespace above.

[sergei, 2018/03/19 15:47:32]

Acknowledged.

     return text.trim();
 
   // Special treatment for element hiding filters, right side is allowed to
   // contain spaces
   if (Filter.elemhideRegExp.test(text))
   {
     let [, domain, separator, selector] = /^(.*?)(#@?#?)(.*)$/.exec(text);
     return domain.replace(/ +/g, "") + separator + selector.trim();
   }
 
   // For most regexp filters we strip all spaces, but $csp filter options
   // are allowed to contain single (non trailing) spaces.
   let strippedText = text.replace(/ +/g, "");
   if (!strippedText.includes("$") || !/\bcsp=/i.test(strippedText))
     return strippedText;
 
   let optionsMatch = Filter.optionsRegExp.exec(strippedText);

[sergei, 2018/03/16 16:49:25]

I would like to carefully double check what is happening here and few lines
below, but have to run.

[sergei, 2018/03/16 16:49:25]

Since parsing time is very important could you please estimate how many times it
reaches this line and goes below for most popular subscriptions? Perhaps it can
be done as a part of hub#1020.

[kzar, 2018/03/17 14:35:07]

None in EasyList, 24 in the uBlock filter list[1].

[1] -
https://raw.githubusercontent.com/uBlockOrigin/uAssets/master/filters/filters...

[sergei, 2018/03/19 15:47:31]

Acknowledged. BTW, now it also additionally executes
`!strippedText.includes("$")` and if it includes then`
!/\bcsp=/i.test(strippedText)` for every filter. Fortunately `Filter.normalize`
seems called not each time when stored filters are read, so it should not be
crucial but still important to know because it can affect the first time run, in
particular on mobile platforms.

[kzar, 2018/03/19 16:38:59]

Yes I know.

   if (!optionsMatch)
     return strippedText;
 
   // For $csp filters we must first separate out the options part of the
   // text, being careful to preserve its spaces.
   let beforeOptions = strippedText.substring(0, optionsMatch.index);
-  let optionsText = text;
-  for (let i = beforeOptions.split("$").length; i > 0; i--)
-    optionsText = optionsText.substr(optionsText.indexOf("$") + 1);
+  let strippedDollarIndex = -1;
+  let dollarIndex = -1;
+  do
+  {
+    strippedDollarIndex = beforeOptions.indexOf("$", strippedDollarIndex + 1);
+    dollarIndex = text.indexOf("$", dollarIndex + 1);
+  }
+  while (strippedDollarIndex != -1);
+  let optionsText = text.substr(dollarIndex + 1);
 
   // Then we can normalize spaces in the options part safely
   let options = optionsText.split(",");
   for (let i = 0; i < options.length; i++)
   {
     let option = options[i];
     let cspMatch = /^ *c *s *p *=/i.exec(option);
     if (cspMatch)
     {
       options[i] = cspMatch[0].replace(/ +/g, "") +
@@ skipping 560 matching lines @@
         option = option.substr(0, separatorIndex);
       }
       option = option.replace(/-/, "_").toUpperCase();
       if (option in RegExpFilter.typeMap)
       {
         if (contentType == null)
           contentType = 0;
         contentType |= RegExpFilter.typeMap[option];
 
         if (option == "CSP" && typeof value != "undefined")
-        {
-          if (csp)
-            csp.push(value);
-          else
-            csp = [value];
-        }
+          csp = value;
       }
       else if (option[0] == "~" && option.substr(1) in RegExpFilter.typeMap)
       {
         if (contentType == null)
           ({contentType} = RegExpFilter.prototype);
         contentType &= ~RegExpFilter.typeMap[option.substr(1)];
       }
       else if (option == "MATCH_CASE")
         matchCase = true;
       else if (option == "~MATCH_CASE")
         matchCase = false;
       else if (option == "DOMAIN" && typeof value != "undefined")
         domains = value.toUpperCase();

[sergei, 2018/03/16 16:49:24]

Is this change related to the issue? When I was profiling I discovered that we
are duplicating a lot of strings by changing their case at another stage, so
this change can be just a good optimization. The changing the case here can
result that instead of creating several string objects containing the same data
we can create a string object with the data once and other string objects will
be just a references to that original one.

If it's not related could you please make it in a separate commit?

[kzar, 2018/03/17 14:35:06]

Yes.

       else if (option == "THIRD_PARTY")
         thirdParty = true;
       else if (option == "~THIRD_PARTY")
         thirdParty = false;
       else if (option == "COLLAPSE")
         collapse = true;
       else if (option == "~COLLAPSE")
         collapse = false;
       else if (option == "SITEKEY" && typeof value != "undefined")
         sitekeys = value.toUpperCase();
       else
         return new InvalidFilter(origText, "filter_unknown_option");
     }
   }
 
   try
   {
     if (blocking)
     {
-      if (csp)
-      {
-        csp = csp.join("; ").toLowerCase();
-
-        // Prevent injecting directives which could be a privacy concern
-        if (/(;|^) ?(report-to|report-uri|referrer)\b/.test(csp))
-          return new InvalidFilter(origText, "filter_invalid_csp");
-      }
+      if (csp && Filter.invalidCSPRegExp.test(csp))
+        return new InvalidFilter(origText, "filter_invalid_csp");
 
       return new BlockingFilter(origText, text, contentType, matchCase, domains,
                                 thirdParty, sitekeys, collapse, csp);
     }
     return new WhitelistFilter(origText, text, contentType, matchCase, domains,
                                thirdParty, sitekeys);
   }
   catch (e)
   {
     return new InvalidFilter(origText, "filter_invalid_regexp");
@@ skipping 238 matching lines @@
  */
 function ElemHideEmulationFilter(text, domains, selector)
 {
   ElemHideBase.call(this, text, domains, selector);
 }
 exports.ElemHideEmulationFilter = ElemHideEmulationFilter;
 
 ElemHideEmulationFilter.prototype = extend(ElemHideBase, {
   type: "elemhideemulation"
 });