[$csp4 adblockpluschrome] Issue 5241 - Add support for Content Security Policy filters

lib/csp.js

 /*
  * This file is part of Adblock Plus <https://adblockplus.org/>,
  * Copyright (C) 2006-present eyeo GmbH
  *
  * Adblock Plus is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
  * published by the Free Software Foundation.
  *
  * Adblock Plus is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with Adblock Plus.  If not, see <http://www.gnu.org/licenses/>.
  */
 
 "use strict";
 
 const {defaultMatcher} = require("matcher");
-const {BlockingFilter,
-       RegExpFilter,
-       WhitelistFilter} = require("filterClasses");
-const {getDecodedHostname, stringifyURL} = require("url");
+const {RegExpFilter, WhitelistFilter} = require("filterClasses");
+const {extractHostFromFrame, getDecodedHostname,
+       isThirdParty, stringifyURL} = require("url");
 const {checkWhitelisted} = require("whitelisting");
 const {FilterNotifier} = require("filterNotifier");
 const devtools = require("devtools");
 
 const {typeMap} = RegExpFilter;
 
 browser.webRequest.onHeadersReceived.addListener(details =>
 {
-  // Chrome seems to sometimes give the response type of "xmlhttprequest"
-  // instead of "main_frame", but when it does the tabId is always -1 and
-  // the URL matches the initiator's URL (once normalised).
-  // https://bugs.chromium.org/p/chromium/issues/detail?id=805649
-  if (details.type == "xmlhttprequest" &&
-      (details.tabId > -1 || details.initiator &&
-       details.url != new URL(details.initiator).toString()))
-  {
-    return;
-  }
+  let url = new URL(details.url);
+  let urlString = stringifyURL(url);
+  let parentFrame = ext.getFrame(details.tabId, details.parentFrameId);
+  let hostname = extractHostFromFrame(parentFrame) || getDecodedHostname(url);
+  let thirdParty = isThirdParty(url, hostname);
 
-  // To avoid an extra matchesAny for the common case let's assume no
-  // $genericblock filters apply when searching for a matching $csp filter,
-  // we can double check later if necessary.
-  let specificOnly = false;
-
-  let url = new URL(details.url);
-  let hostname = getDecodedHostname(url);
-  let cspMatch = defaultMatcher.matchesAny(details.url, typeMap.CSP, hostname,
-                                           false, null, specificOnly);
-  let page = null;
-
+  let cspMatch = defaultMatcher.matchesAny(urlString, typeMap.CSP, hostname,
+                                           thirdParty, null, false);
   if (cspMatch)
   {
-    if (details.tabId > -1)
+    let page = new ext.Page({id: details.tabId, url: details.url});
+    let frame = ext.getFrame(details.tabId, details.frameId);
+
+    if (checkWhitelisted(page, frame))
+      return;
+
+    // To avoid an extra matchesAny for the common case we assumed no
+    // $genericblock filters applied when searching for a matching $csp filter.
+    // We must now pay the price by first checking for a $genericblock filter
+    // and if necessary that our $csp filter is specific.
+    let specificOnly = !!checkWhitelisted(page, frame, typeMap.GENERICBLOCK);
+    if (specificOnly)
     {
-      page = new ext.Page({id: details.tabId, url: details.url});
-
-      if (cspMatch instanceof WhitelistFilter)
-      {
-        if (devtools)
-        {
-          devtools.logWhitelistedDocument(page, details.url, typeMap.CSP,
-                                          hostname, cspMatch);

[Sebastian Noack, 2018/03/07 17:27:07]

This is redundant, checkWhitelisted() is already calling
logWhitelistedDocument().

[Sebastian Noack, 2018/03/13 03:58:13]

What is about this comment?

[kzar, 2018/03/13 18:11:01]

Done.

-        }
+      cspMatch = defaultMatcher.matchesAny(urlString, typeMap.CSP, hostname,
+                                           thirdParty, null, specificOnly);
+      if (!cspMatch)
         return;
-      }
-
-      let frame = ext.getFrame(details.tabId, details.frameId);
-

[Sebastian Noack, 2018/03/07 17:27:07]

Nit: I think it reads slightly better without a blank line here. Wouldn't insist
though.

[kzar, 2018/03/13 18:11:02]

Done.

-      if (checkWhitelisted(page, frame, typeMap.DOCUMENT | typeMap.CSP))
-        return;
-
-      // We pay the price now for skipping the specificOnly check earlier, we
-      // must check again for a CSP filter, this time making sure it's specific.
-      specificOnly = !!checkWhitelisted(page, frame, typeMap.GENERICBLOCK);
-      if (specificOnly)
-      {
-        cspMatch = defaultMatcher.matchesAny(details.url, typeMap.CSP, hostname,
-                                             false, null, specificOnly);
-        if (!(cspMatch instanceof BlockingFilter))
-          return;
-      }
-
-      FilterNotifier.emit("filter.hitCount", cspMatch, 0, 0, page);
-    }
-    // If we don't know the associated tab we'll have to check that if the URL
-    // is whitelisted manually. Things like $sitekey whitelisting and filter hit
-    // logging won't work, but it's the best we can do.
-    else if (cspMatch instanceof WhitelistFilter ||
-             defaultMatcher.whitelist.matchesAny(stringifyURL(url),
-                                                 typeMap.DOCUMENT | typeMap.CSP,
-                                                 hostname))
-    {
-      return;
     }
 
-    if (devtools)

[Sebastian Noack, 2018/03/07 17:27:07]

Is this check still necessary? IIRC, require('devtools') only returned null on
Safari, where we don't include that module. Now, where we use WebPack it even
gets automatically included as soon as any other module requires it.

[Sebastian Noack, 2018/03/13 03:58:13]

What is about this comment?

[kzar, 2018/03/13 18:11:01]

Done.

-    {
-      devtools.logRequest(page, details.url, "CSP", hostname,
-                          false, null, specificOnly, cspMatch);
-    }
+    devtools.logRequest(page, urlString, "CSP", hostname, thirdParty, null,
+                        specificOnly, cspMatch);
+    FilterNotifier.emit("filter.hitCount", cspMatch, 0, 0, page);
+
+    if (cspMatch instanceof WhitelistFilter)
+      return;
 
     details.responseHeaders.push({
       name: "Content-Security-Policy",
       value: cspMatch.csp
     });
 
     return {responseHeaders: details.responseHeaders};
   }
 }, {
   urls: ["http://*/*", "https://*/*"],
-  types: ["main_frame", "sub_frame", "xmlhttprequest"]
+  types: ["main_frame", "sub_frame"]
 }, ["blocking", "responseHeaders"]);