mirror of
https://github.com/gorhill/uMatrix.git
synced 2024-06-02 02:14:52 +12:00
code review: giving more thoughts to reporting CSP violations
This commit is contained in:
parent
60cd27c347
commit
35ddcc80eb
|
@ -1,7 +1,7 @@
|
|||
/*******************************************************************************
|
||||
|
||||
uMatrix - a Chromium browser extension to black/white list requests.
|
||||
Copyright (C) 2017 Raymond Hill
|
||||
Copyright (C) 2017-2018 Raymond Hill
|
||||
|
||||
This program is free software: you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
|
@ -30,51 +30,69 @@
|
|||
|
||||
if ( typeof vAPI !== 'object' ) { return; }
|
||||
|
||||
vAPI.reportedViolations = vAPI.reportedViolations || new Set();
|
||||
vAPI.selfScriptSrcReported = vAPI.selfScriptSrcReported || false;
|
||||
vAPI.selfWorkerSrcReported = vAPI.selfWorkerSrcReported || false;
|
||||
|
||||
var reportedViolations = vAPI.reportedViolations;
|
||||
var reBadScriptSrc = /script-src[^;,]+?'(?:unsafe-inline|nonce-[^']+)'/,
|
||||
reGoodWorkerSrc = /(?:child|worker)-src[^;,]+?'none'/;
|
||||
|
||||
var handler = function(ev) {
|
||||
if (
|
||||
ev.isTrusted !== true ||
|
||||
ev.originalPolicy.includes('about:blank') === false
|
||||
ev.originalPolicy.includes('report-uri about:blank') === false
|
||||
) {
|
||||
return false;
|
||||
}
|
||||
|
||||
// We do not want to report internal resources more than once.
|
||||
// However, we do want to report external resources each time.
|
||||
// TODO: this could eventually lead to duplicated reports for external
|
||||
// resources if another extension uses the same approach as
|
||||
// uMatrix. Think about what could be done to avoid duplicate
|
||||
// reports.
|
||||
var internal = ev.blockedURI.includes('://') === false;
|
||||
|
||||
// Firefox and Chromium differs in how they fill the
|
||||
// 'effectiveDirective' property. Need to normalize here.
|
||||
var directive = ev.effectiveDirective;
|
||||
if ( directive.startsWith('script-src') ) {
|
||||
if ( internal && vAPI.selfScriptSrcReported ) { return true; }
|
||||
directive = 'script-src';
|
||||
} else if ( directive.startsWith('worker-src') ) {
|
||||
directive = 'worker-src';
|
||||
} else if ( directive.startsWith('child-src') ) {
|
||||
} else if (
|
||||
directive.startsWith('worker-src') ||
|
||||
directive.startsWith('child-src')
|
||||
) {
|
||||
if ( internal && vAPI.selfWorkerSrcReported ) { return true; }
|
||||
directive = 'worker-src';
|
||||
} else {
|
||||
return false;
|
||||
}
|
||||
|
||||
var blockedURL;
|
||||
try {
|
||||
blockedURL = new URL(ev.blockedURI);
|
||||
} catch(ex) {
|
||||
// Further validate that the policy violation is relevant to uMatrix:
|
||||
// the event still could have been fired as a result of a CSP header
|
||||
// not injected by uMatrix.
|
||||
if ( directive === 'script-src' ) {
|
||||
if ( reBadScriptSrc.test(ev.originalPolicy) === true ) {
|
||||
return false;
|
||||
}
|
||||
if ( internal ) {
|
||||
vAPI.selfScriptSrcReported = true;
|
||||
}
|
||||
} else /* if ( directive === 'worker-src' ) */ {
|
||||
if ( reGoodWorkerSrc.test(ev.originalPolicy) === false ) {
|
||||
return false;
|
||||
}
|
||||
if ( internal ) {
|
||||
vAPI.selfWorkerSrcReported = true;
|
||||
}
|
||||
}
|
||||
blockedURL = blockedURL !== undefined ? blockedURL.href || '' : '';
|
||||
|
||||
// Avoid reporting same violations repeatedly.
|
||||
var violationKey = (directive + ' ' + blockedURL).trim();
|
||||
if ( reportedViolations.has(violationKey) ) {
|
||||
return true;
|
||||
}
|
||||
reportedViolations.add(violationKey);
|
||||
|
||||
vAPI.messaging.send(
|
||||
'contentscript.js',
|
||||
{
|
||||
what: 'securityPolicyViolation',
|
||||
directive: directive,
|
||||
blockedURI: blockedURL,
|
||||
blockedURI: ev.blockedURI,
|
||||
documentURI: ev.documentURI,
|
||||
blocked: ev.disposition === 'enforce'
|
||||
}
|
||||
|
|
|
@ -408,19 +408,15 @@ var collapser = (function() {
|
|||
|
||||
(function() {
|
||||
if (
|
||||
vAPI.reportedViolations === undefined ||
|
||||
vAPI.reportedViolations.has('script-src') === false
|
||||
vAPI.selfScriptSrcReported !== true &&
|
||||
document.querySelector('script:not([src])') !== null
|
||||
) {
|
||||
if ( document.querySelector('script:not([src])') !== null ) {
|
||||
vAPI.messaging.send('contentscript.js', {
|
||||
what: 'securityPolicyViolation',
|
||||
directive: 'script-src',
|
||||
documentURI: window.location.href
|
||||
});
|
||||
if ( vAPI.reportedViolations ) {
|
||||
vAPI.reportedViolations.add('script-src');
|
||||
}
|
||||
}
|
||||
vAPI.messaging.send('contentscript.js', {
|
||||
what: 'securityPolicyViolation',
|
||||
directive: 'script-src',
|
||||
documentURI: window.location.href
|
||||
});
|
||||
vAPI.selfScriptSrcReported = true;
|
||||
}
|
||||
|
||||
collapser.addMany(document.querySelectorAll('img'));
|
||||
|
|
Loading…
Reference in a new issue