open.source/stylus
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

move sandbox patch into PatchCSP option

Browse Source
This commit is contained in:
tophf 2020-11-16 10:02:19 +03:00
parent c83594519b
commit 88146c4a96
2 changed files with 27 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
_locales/en/messages.json
View File

@ -980,7 +980,7 @@
"message": "Patch <code>CSP</code> to allow style assets" "message": "Patch <code>CSP</code> to allow style assets"
}, },
"optionsAdvancedPatchCspNote": { "optionsAdvancedPatchCspNote": {
"message": "Enable this if some of your styles fail to show an image/background/font on sites with a strict <code>Content-Security-Policy</code>.\n\nEnabling this will loosen CSP a bit by merging it with <code>img-src data: *; font-src data: *; style-src 'unsafe-inline'</code> which means you should accept the potential risk and/or regularly check the CSS code of your styles. Read about CSS-based attacks for more information.\n\nNote, this is not guaranteed to take effect if another installed extension modifies the network response first." "message": "Enable this if some of your styles fail to show an image/background/font on sites with a strict <code>Content-Security-Policy</code>.\n\nEnabling this will loosen CSP a bit (only on sites where a userstyle is applied) by merging it with <code>img-src data: *; font-src data: *; style-src 'unsafe-inline'</code> (and <code>allow-same-origin</code> for <code>sandbox</code> if it's specified) which means you should accept the potential risk and/or regularly check the CSS code of your styles. Read about CSS-based attacks for more information.\n\nNote, this is not guaranteed to take effect if another installed extension modifies the network response first."
}, },
"optionsAdvancedStyleViaXhr": { "optionsAdvancedStyleViaXhr": {
"message": "Instant inject mode" "message": "Instant inject mode"

37
background/style-via-webrequest.js
View File

@ -80,42 +80,47 @@ CHROME && (async () => {
/** @param {chrome.webRequest.WebResponseHeadersDetails} req */ /** @param {chrome.webRequest.WebResponseHeadersDetails} req */
function modifyHeaders(req) { function modifyHeaders(req) {
const {responseHeaders} = req; const {responseHeaders} = req;
const csp = responseHeaders.find(h => h.name.toLowerCase() === 'content-security-policy');
const id = stylesToPass[req.requestId]; const id = stylesToPass[req.requestId];
if (!id) { if (!id) {
return; return;
} }
let res;
if (enabled.xhr) { if (enabled.xhr) {
res = true;
responseHeaders.push({ responseHeaders.push({
name: 'Set-Cookie', name: 'Set-Cookie',
value: `${chrome.runtime.id}=${id}`, value: `${chrome.runtime.id}=${id}`,
}); });
// Allow cookies in CSP sandbox (known case: raw github urls) }
const csp = enabled.csp &&
responseHeaders.find(h => h.name.toLowerCase() === 'content-security-policy');
if (csp) { if (csp) {
csp.value = csp.value.replace(/(?:^|;)\s*sandbox(\s+[^;]*|)(?=;|$)/, (s, allow) => patchCsp(csp);
allow.split(/\s+/).includes('allow-same-origin') ? s : `${s} allow-same-origin`); }
if (enabled.xhr || csp) {
return {responseHeaders};
} }
} }
if (enabled.csp && csp) {
res = true; /** @param {chrome.webRequest.HttpHeader} csp */
function patchCsp(csp) {
const src = {}; const src = {};
for (let p of csp.value.split(';')) { for (let p of csp.value.split(';')) {
p = p.trim().split(/\s+/); p = p.trim().split(/\s+/);
src[p[0]] = p.slice(1); src[p[0]] = p.slice(1);
} }
addToCsp(src, 'img-src', 'data:', '*'); // Allow style assets
addToCsp(src, 'font-src', 'data:', '*'); patchCspSrc(src, 'img-src', 'data:', '*');
addToCsp(src, 'style-src', "'unsafe-inline'"); patchCspSrc(src, 'font-src', 'data:', '*');
csp.value = Object.entries(src).map(([k, v]) => `${k} ${v.join(' ')}`).join('; '); // Allow our DOM styles
} patchCspSrc(src, 'style-src', '\'unsafe-inline\'');
if (res) { // Allow our XHR cookies in CSP sandbox (known case: raw github urls)
return {responseHeaders}; if (src.sandbox && !src.sandbox.includes('allow-same-origin')) {
src.sandbox.push('allow-same-origin');
} }
csp.value = Object.entries(src).map(([k, v]) =>
`${k}${v.length ? ' ' : ''}${v.join(' ')}`).join('; ');
} }
function addToCsp(src, name, ...values) { function patchCspSrc(src, name, ...values) {
let def = src['default-src']; let def = src['default-src'];
let list = src[name]; let list = src[name];
if (def || list) { if (def || list) {