Issue 705 - Generate element hiding instead request blocking filters for non-HTTP URLs

include.postload.js

Index: include.postload.js
===================================================================
--- a/include.postload.js
+++ b/include.postload.js
@@ -381,6 +381,13 @@
     selectorList.push(selector);
   };
 
+  var addSelectorFromAttribute = function(element, attribute)
+  {
+    var value = element.getAttribute(attribute);
+    if (value)
+      addSelector(element.localName + "[" + attribute + '="' + value.replace(/"/g, '\\"') + '"]');

[Wladimir Palant, 2014/10/24 17:56:55]

This isn't a sufficient escaping approach. First of all, the attribute name
should be escaped as well. Here the corresponding code from Element Hiding
Helper:

function escapeChar(dummy, match)
{
  return "\\" + match.charCodeAt(0).toString(16) + " ";
}

function escapeName(name)
{
  return name.replace(/([^\w\-])/g, "\\$1")
             .replace(/\\([\{\}])/g, escapeChar);
}

The rules for escaping values are even more complicated, e.g. one has to make
sure to escape backslashes. Again, code from Element Hiding Helper:

var escapedValue = attr.selected.replace(/(["\\])/g, '\\$1')
                                .replace(/([\{\}])/g, escapeChar)
                                .replace(/([^\S ])/g, escapeChar);

Frankly, I no longer remember why all of this was necessary. We had lots of
issues with this code and had to adjust it multiple times - we would need to
look at the change history if we want to know the details.

Not that any other selectors the existing code proposes are properly escaped...

[Sebastian Noack, 2014/10/30 16:36:24]

The attribute name is hard-coded in the calling code and needs no escaping. I
restructured the code to make it more obvious.
Backslashes are escaped now. However, I tested it and there is no need to escape
curly brackets and any kind of whitespaces on Chrome and Safari.

+  };
+
   if (elementId)
     addSelector("#" + elementId);
 
@@ -396,8 +403,13 @@
 
   if (url)
   {
-    clickHideFilters.push(url.replace(/^[\w\-]+:\/+(?:www\.)?/, "||"));
-    selectorList.push('[src="' + elt.getAttribute("src") + '"]');
+    if (/^https?:/i.test(url))
+    {
+      clickHideFilters.push(url.replace(/^[\w\-]+:\/+(?:www\.)?/, "||"));
+      selectorList.push('[src="' + elt.getAttribute("src") + '"]');
+    }
+    else
+      addSelectorFromAttribute(elt, "src");
   }
 
   // Show popup
@@ -408,8 +420,8 @@
   unhighlightElement(currentElement);
 
   // as last resort, create a filter based on inline styles
-  if (clickHideFilters.length == 0 && elt.hasAttribute("style"))
-    addSelector(elt.localName + '[style="' + elt.getAttribute("style").replace(/"/g, '\\"') + '"]');
+  if (clickHideFilters.length == 0)
+    addSelectorFromAttribute(elt, "style");
 
   // Highlight the elements specified by selector in yellow
   highlightElements(selectorList.join(","));