Issue 6704 - Prevent $rewrite filters from matching against request types that load code

lib/filterClasses.js

 /*
  * This file is part of Adblock Plus <https://adblockplus.org/>,
  * Copyright (C) 2006-present eyeo GmbH
  *
  * Adblock Plus is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
  * published by the Free Software Foundation.
  *
  * Adblock Plus is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ skipping 808 matching lines @@
         collapse = false;
       else if (option == "SITEKEY" && value)
         sitekeys = value.toUpperCase();
       else if (option == "REWRITE" && value)
         rewrite = value;
       else
         return new InvalidFilter(origText, "filter_unknown_option");
     }
   }
 
+  // For security reasons, never match $rewrite filters
+  // against requests that might load any code to be executed.
+  if (rewrite != null)
+  {
+    if (contentType == null)
+      ({contentType} = RegExpFilter.prototype);
+    contentType &= ~(RegExpFilter.typeMap.SCRIPT |
+                     RegExpFilter.typeMap.SUBDOCUMENT |
+                     RegExpFilter.typeMap.OBJECT);
+  }
+
   try
   {
     if (blocking)
     {
       if (csp && Filter.invalidCSPRegExp.test(csp))
         return new InvalidFilter(origText, "filter_invalid_csp");
 
       return new BlockingFilter(origText, text, contentType, matchCase, domains,
                                 thirdParty, sitekeys, collapse, csp, rewrite);
     }
@@ skipping 263 matching lines @@
  */
 function ElemHideEmulationFilter(text, domains, selector)
 {
   ElemHideBase.call(this, text, domains, selector);
 }
 exports.ElemHideEmulationFilter = ElemHideEmulationFilter;
 
 ElemHideEmulationFilter.prototype = extend(ElemHideBase, {
   type: "elemhideemulation"
 });