Issue 6969 - Implement abort-on-property-read snippet

lib/content/snippets.js

Index: lib/content/snippets.js
===================================================================
--- a/lib/content/snippets.js
+++ b/lib/content/snippets.js
@@ -486,8 +486,57 @@
     {
       event.preventDefault();
     }
   },
   true);
 }
 
 exports["prevent-inline-scripts"] = preventInlineScripts;
+
+function randomId()
+{
+  // 2176782336 is 36^6 which mean 6 chars [a-z0-9]
+  // 60466176 is 36^5
+  // 2176782336 - 60466176 = 2116316160. This ensure always 6 chars
+  // for when Math.random() returns 0.0
+  return Math.floor(Math.random() * 2116316160 + 60466176).toString(36);
+}
+
+/**
+ * Will patch a property on the window object to abort when read.
+ * It will intercept the onerror callback and block it if tagged.
+ *
+ * @todo handle properties of properties.
+ *
+ * @param {string} prop the name of the property.
+ */
+function abortOnPropertyRead(prop)
+{
+  if (!prop)
+    return;
+
+  let rid = randomId();
+
+  function canceller()
+  {
+    throw new ReferenceError(rid);
+  }
+
+  let {onerror} = window;
+  window.onerror = (message, ...rest) =>
+  {
+    if (typeof message == "string" && message.includes(rid))
+      return true;
+    if (onerror && typeof onerror == "function")
+      return onerror(this, message, ...rest);

[Manish Jethani, 2018/10/23 15:31:24]

This needs to be onerror.call

[hub, 2018/10/23 18:23:17]

Done.

+  };
+
+  (function(o, p)

[Manish Jethani, 2018/10/23 15:31:24]

I think this should be a separate function:

  function wrapPropertyAccess(object, property, descriptor)

If the descriptor does not contain a specific accessor (get or set), it should
be replaced with a passthrough (forward the call to the original descriptor). If
it contains a specific accessor (get or set) but the value is null, it should
use the null value (meaning don't include that accessor).

[hub, 2018/10/23 18:23:17]

Done.

+  {
+    // simple property
+    let d = Object.getOwnPropertyDescriptor(o, p);
+    if (!d || d.get != canceller)
+      Object.defineProperty(o, p, {get: canceller, set() {}});
+  })(window, prop);
+}
+
+exports["abort-on-property-read"] = makeInjector(abortOnPropertyRead, randomId);