Issue 581 - Fixed element hiding/collapsing in anonymous frames on Chrome

include.preload.js

 /*
  * This file is part of Adblock Plus <http://adblockplus.org/>,
  * Copyright (C) 2006-2014 Eyeo GmbH
  *
  * Adblock Plus is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
  * published by the Free Software Foundation.
  *
  * Adblock Plus is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ skipping 45 matching lines @@
       }
     );
   }
 }
 
 function checkExceptionKey()
 {
   var attr = document.documentElement.getAttribute("data-adblockkey");
   if (attr)
     ext.backgroundPage.sendMessage({type: "add-key-exception", token: attr});
 }

[Wladimir Palant, 2014/06/02 11:20:40]

Why read the signature from a tag in Chrome? We read it from the headers, that's
the better approach anyway. And an anonymous frame cannot be expected to have a
signature anyway, only higher-level frames.

[Sebastian Noack, 2014/06/03 06:55:27]

This function isn't called for anonymous frames. However that code is used on
Chrome since we have added it for Safari. Nothing new here actually. Feel free
to file a separate issue if you think we must not support that way to provide a
site key on Chrome. But IMO its not worth adding yet another browser switch.

 
+function hasInlineURL(element, attribute)
+{
+  var value = element.getAttribute(attribute);
+  return value == null || /^\s*(javascript:|about:|$)/i.test(value);
+}
+
+function isInlineFrame(element)
+{
+  switch (element.localName)
+  {
+    case "iframe":
+      return hasInlineURL(element, "src") || element.hasAttribute("srcdoc");
+    case "frame":
+      return hasInlineURL(element, "src");
+    case "object":
+      return hasInlineURL(element, "data") && element.contentDocument;
+    default:
+      return false;
+  }
+}
+
 // Converts relative to absolute URL
 // e.g.: foo.swf on http://example.com/whatever/bar.html
 //  -> http://example.com/whatever/foo.swf
 function relativeToAbsoluteUrl(url)
 {
   // If URL is already absolute, don't mess with it
   if (!url || /^[\w\-]+:/i.test(url))
     return url;
 
   // Leading / means absolute path
   // Leading // means network path
   if (url[0] == '/')
   {
     if (url[1] == '/')
       return document.location.protocol + url;
     else
       return document.location.protocol + "//" + document.location.host + url;
   }
 
   // Remove filename and add relative URL to it
   var base = document.baseURI.match(/.+\//);
   if (!base)
     return document.baseURI + "/" + url;
   return base[0] + url;
 }
 
 function init(document)
 {
   var canUseShadow = "webkitCreateShadowRoot" in document.documentElement;
-  var fixAnonymousFrames = false;
+  var fixInlineFrames = false;
 
   var match = navigator.userAgent.match(/\bChrome\/(\d+)/);
   if (match)
   {
     var chromeVersion = parseInt(match[1]);
 
     // the <shadow> element is ignored in Chrome 32 (#309). Also Chrome 31-33
     // crashes in some situations on some pages when using shadow DOM (#498).
     // So we must not use Shadow DOM on those versions of Chrome.
     if (chromeVersion >= 31 && chromeVersion <= 33)
       canUseShadow = false;
 
-    // prior to Chrome 37, content scripts don't run in anonymous frames.
-    // So we have to apply element hiding and collapsing from
-    // the parent frame, when an anonymous sub frame loaded.
+    // prior to Chrome 37, content scripts don't run on about:blank
+    // and about:srcdoc. So we have to apply element hiding and collapsing
+    // from the parent frame, when inline frames are loaded.
     if (chromeVersion < 37)
-      fixAnonymousFrames = true;
+      fixInlineFrames = true;
   }
 
   // use Shadow DOM if available to don't mess with web pages that
   // rely on the order of their own <style> tags (#309). However we
   // must not create the shadow root in the response callback passed
   // to sendMessage(), otherwise Chrome breaks some websites (#450).
   if (canUseShadow)
   {
     var shadow = document.documentElement.webkitCreateShadowRoot();
     shadow.appendChild(document.createElement("shadow"));
@@ skipping 55 matching lines @@
     setRules();
   };
 
   document.addEventListener("error", function(event)
   {
     checkCollapse(event.target);
   }, true);
 
   document.addEventListener("load", function(event)
   {
-    if (/^i?frame$/.test(event.target.localName))
-    {
-      checkCollapse(event.target);
-
-      if (fixAnonymousFrames && /^(javascript:|$)/.test(event.target.src))

[Wladimir Palant, 2014/06/02 11:20:40]

I think you want to check event.target.contentWindow.location.href, this will
give you a real URL rather than something bogus (e.g. multiple spaces). It will
also throw an exception for frames you aren't allowed to access so you can
ignore those.

The frames that we need to handle here are:

* about:blank
* about:srcdoc
* javascript:* (is that their document URL or rather about:blank?)
* data:*

It is likely that we still have to handle at the very least data:* "manually" in
Chrome 37, this is something you should check.

[Sebastian Noack, 2014/06/03 06:55:27]

I thought it would be simpler to check for the src attribute. So I don't have to
handle cross-domain-policy violations. But you are right, that approach isn't
really reliable.
Done.
In case of javascript: URLs, the frame's src attribute returns the given
javascript: URL, while the document's URL will be "about:blank".
Content scripts don't run on data: URLs, not even on Chrome 37 with
"match_about_blank". However the workaround this path implements doesn't work
for data: URLs due to cross-domain-policy.

[Sebastian Noack, 2014/06/03 07:40:35]

It seems that checking for the document's URL instead frame's src attribute
don't work in cases like:

<iframe onload="document.location.replace(...)">

However this case seems to be pretty common. :(

-      {
-        var contentDocument = event.target.contentDocument;
-
-        if (contentDocument.documentElement instanceof HTMLElement)
-        {
-          init(contentDocument);
-
-          for (var tagName in typeMap)
-            Array.prototype.forEach.call(contentDocument.getElementsByTagName(tagName), checkCollapse);
-        }
-      }
+    var element = event.target;
+
+    if (/^i?frame$/.test(element.localName))
+      checkCollapse(element);
+
+    if (fixInlineFrames && isInlineFrame(element))
+    {
+      init(element.contentDocument);
+
+      for (var tagName in typeMap)
+        Array.prototype.forEach.call(element.contentDocument.getElementsByTagName(tagName), checkCollapse);
     }
   }, true);
 
   ext.backgroundPage.sendMessage({type: "get-selectors"}, setElemhideCSSRules);

[Wladimir Palant, 2014/06/02 11:20:40]

In the background page, who will be the sender of this message in case of an
anonymous frame? Its parent window I guess? That should work correctly then.

What about Chrome 37? Won't the background page see a request coming in from
about:blank URL? That should break element hiding then.

[Sebastian Noack, 2014/06/03 06:55:27]

Correct.
I can confirm your concern. This also affects Safari, which behaves like Chrome
37 with "match_about_blank". In order to address that, I'm falling back to the
parent's frame URL now, when attempting to get the host of the URL of an
anonymous frame.

 }
 
 if (document.documentElement instanceof HTMLElement)
 {
   checkExceptionKey();
   init(document);
 }