Issue 6969 - Implement abort-on-property-read snippet

lib/content/snippets.js

Index: lib/content/snippets.js
===================================================================
--- a/lib/content/snippets.js
+++ b/lib/content/snippets.js
@@ -486,8 +486,77 @@
     {
       event.preventDefault();
     }
   },
   true);
 }
 
 exports["prevent-inline-scripts"] = preventInlineScripts;
+
+/**
+ * Generate an alpha-numeric id 6 chars long, in the range 100000..zzzzzz.

[Manish Jethani, 2018/10/24 23:02:10]

Some nits:

s/Generate/Generates/

s/an alpha-numeric id 6 chars long .../a random alphanumeric ID consisting of 6
base-36 digits from the range 100000..zzzzzz (both inclusive)./

s/{string} the random id./{string} The random ID./

[hub, 2018/10/25 14:32:27]

Done.

+ *
+ * @returns {string} the random id.
+ */
+function randomId()
+{
+  // 2176782336 is 36^6 which mean 6 chars [a-z0-9]
+  // 60466176 is 36^5
+  // 2176782336 - 60466176 = 2116316160. This ensure to always have 6
+  // chars even if Math.random() returns its minimum value 0.0
+  return Math.floor(Math.random() * 2116316160 + 60466176).toString(36);
+}
+
+function wrapPropertyAccess(object, property, descriptor)
+{
+  // simple property

[Manish Jethani, 2018/10/24 23:02:10]

Do we need this comment? The code is quite straightforward in what it does.

[hub, 2018/10/25 14:32:28]

was carried over from other changes. removed it.

+  let currentDescriptor = Object.getOwnPropertyDescriptor(object, property);
+  if (!currentDescriptor)
+    currentDescriptor = {};
+  if (typeof descriptor.get != "undefined")
+  {
+    if (currentDescriptor.get != descriptor.get)

[Manish Jethani, 2018/10/24 23:02:10]

I'm not seeing the point of this check.

[hub, 2018/10/25 14:32:28]

Done.

+      currentDescriptor.get = descriptor.get;
+  }
+  if (typeof descriptor.set != "undefined")
+  {
+    if (currentDescriptor.set != descriptor.set)
+      currentDescriptor.set = descriptor.set;
+  }
+  Object.defineProperty(object, property, currentDescriptor);
+}
+
+/**
+ * Will patch a property on the window object to abort when read.
+ * It will intercept the onerror callback and block it if tagged.
+ *
+ * @todo handle properties of properties.
+ *
+ * @param {string} property the name of the property.
+ */
+function abortOnPropertyRead(property)
+{
+  if (!property)
+    return;
+
+  let rid = randomId();
+
+  function abort()
+  {
+    throw new ReferenceError(rid);
+  }
+
+  let {onerror} = window;
+  window.onerror = (message, ...rest) =>
+  {
+    if (typeof message == "string" && message.includes(rid))
+      return true;
+    if (typeof onerror == "function")
+      return onerror(message, ...rest);
+  };
+
+  wrapPropertyAccess(window, property, {get: abort, set() {}});
+}
+
+exports["abort-on-property-read"] = makeInjector(abortOnPropertyRead,
+                                                 wrapPropertyAccess,
+                                                 randomId);