Issue 6539, 6782 - Implement support for snippets

lib/snippets.js

+/*
+ * This file is part of Adblock Plus <https://adblockplus.org/>,
+ * Copyright (C) 2006-present eyeo GmbH
+ *
+ * Adblock Plus is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * Adblock Plus is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with Adblock Plus.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+"use strict";
+
+const {defaultMatcher} = require("matcher");
+const {RegExpFilter, WhitelistFilter} = require("filterClasses");
+const {verifySignature} = require("rsa");
+const {extractHostFromFrame, getDecodedHostname,
+       isThirdParty, stringifyURL} = require("url");
+const {checkWhitelisted} = require("whitelisting");
+const {FilterNotifier} = require("filterNotifier");
+const devtools = require("devtools");
+const info = require("info");
+
+const {typeMap} = RegExpFilter;
+
+// Dummy public key and remote URL

[Manish Jethani, 2018/03/31 12:06:02]

The key is only for illustration purposes. If you want the corresponding private
key, look in adblockpluscore/test/signatures.js

FWIW I think the public key itself should be a separate file, bundled with the
extension.

+const publicKey = "MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALZc50pEXnz9TSRozwM04rryuaXl/wgUFqV9FHq8HDlkdKvRU0hXhb/AKrSpCJ0NCxHtal1l/kHYlHG9e7Ev6+MCAwEAAQ==";
+const remoteURL = "https://easylist-downloads.adblockplus.org/snippets.js";
+
+let libraries = {local: "", remote: ""};
+let executableCode = new Map();
+
+function fetchText(url)
+{
+  return fetch(url, {cache: "no-cache"}).then(response => response.text());
+}
+
+function updateLibrary(name, text)
+{
+  libraries[name] = text;
+
+  executableCode.clear();
+}
+
+function checkLibrarySignature(url, text)
+{
+  return fetchText(url + ".sig").then(

[Manish Jethani, 2018/03/31 12:06:02]

Even though we load the code over a TLS connection, it's a good idea to have
signature verification as a second line of defense (just in case of any
vulnerabilities in the browser's TLS implementation).

Also note that we never run the code in the background page's context, only in
the context of content scripts.

+    signature => verifySignature(publicKey, signature, text)
+  );
+}
+
+function loadLibrary(name, url, {verify = true} = {})
+{
+  fetchText(url).then(text =>
+  {
+    if (text != libraries[name])
+    {
+      let check = verify ? checkLibrarySignature(url, text) :
+                    Promise.resolve(true);
+      check.then(ok =>
+      {
+        if (ok)
+          updateLibrary(name, text);
+      });
+    }
+  });
+}
+
+function loadLocalLibrary()
+{
+  loadLibrary("local", browser.extension.getURL("/snippets.js"),
+              {verify: false});
+}
+
+function loadRemoteLibrary()
+{
+  loadLibrary("remote", remoteURL);
+}
+
+function getExecutableCode(snippet)
+{
+  let code = executableCode.get(snippet);
+  if (code)
+    return code;
+
+  code = `
+    "use strict";
+    {
+      let localImports = Object.create(null);
+      let remoteImports = Object.create(null);
+      new Function("exports", ${JSON.stringify(libraries.local)})(
+        localImports
+      );
+      new Function("exports", ${JSON.stringify(libraries.remote)})(
+        remoteImports
+      );
+      let imports = Object.assign(Object.create(null),

[Manish Jethani, 2018/03/31 12:06:02]

Remote imports override local imports.

+                                  localImports,
+                                  remoteImports);
+      let key = ${JSON.stringify(snippet)};
+      if (Object.prototype.hasOwnProperty.call(imports, key))
+      {
+        let value = imports[key];
+        if (typeof value == "function")
+          value();
+      }
+    }
+  `;
+
+  executableCode.set(snippet, code);
+  return code;
+}
+
+function injectCode(snippet, tabId, frameId)
+{
+  browser.tabs.executeScript(tabId, {
+    code: getExecutableCode(snippet),
+    frameId,
+    matchAboutBlank: true,
+    runAt: "document_start"
+  });
+}
+
+loadLocalLibrary();
+
+// Only Chrome supports dynamic loading of JS.

[Manish Jethani, 2018/03/31 12:06:03]

According to Felix Mozilla doesn't allow loading JS dynamically. It's just a
policy, not enforced.

+if (info.platform == "chromium")
+{
+  loadRemoteLibrary();
+
+  // Download every 24 hours.
+  setInterval(loadRemoteLibrary, 24 * 60 * 60 * 1000);
+}
+
+browser.webNavigation.onCommitted.addListener(details =>
+{
+  // There's a bug in Chrome that causes webNavigation.onCommitted to get
+  // dispatched twice if there's a URL filter present, therefore we must listen
+  // for all URLs and do an explicit check here.
+  if (!/^https?:\/\//.test(details.url))
+    return;
+
+  let url = new URL(details.url);
+  let urlString = stringifyURL(url);
+  let parentFrame = ext.getFrame(details.tabId, details.parentFrameId);
+  let hostname = extractHostFromFrame(parentFrame) || getDecodedHostname(url);
+  let thirdParty = isThirdParty(url, hostname);
+
+  let filter = defaultMatcher.matchesAny(urlString, typeMap.SNIPPET, hostname,
+                                         thirdParty, null, true);
+  if (!filter)
+    return;
+
+  let page = new ext.Page({id: details.tabId, url: details.url});
+  let frame = ext.getFrame(details.tabId, details.frameId);
+
+  if (checkWhitelisted(page, frame))
+    return;
+
+  devtools.logRequest(page, urlString, "SNIPPET", hostname, thirdParty, null,
+                      true, filter);
+  FilterNotifier.emit("filter.hitCount", filter, 0, 0, page);
+
+  if (filter instanceof WhitelistFilter)
+    return;
+
+  for (let snippet of filter.snippets)
+    injectCode(snippet, details.tabId, details.frameId);
+});