From 1f0ce1cd447770b981032152cf13276968350f0a Mon Sep 17 00:00:00 2001 From: hackademix Date: Feb 12 2019 20:11:20 +0000 Subject: [PATCH 1/2] UI: contextual view-source links for inline scripts and intrinsic events. --- diff --git a/html/display_panel/content/main_panel.js b/html/display_panel/content/main_panel.js index 2509545..f662b35 100644 --- a/html/display_panel/content/main_panel.js +++ b/html/display_panel/content/main_panel.js @@ -111,11 +111,16 @@ function createList(data, group){ container.classList.add("empty"); } // generate list + let viewSourceToHuman = /^view-source:(.*)#line(\d+)\(([^)]*)\)/; for (let entry of entries) { let [scriptId, reason] = entry; let li = liTemplate.cloneNode(true); let a = li.querySelector("a"); a.href = scriptId.split("(")[0]; + if (scriptId.startsWith("view-source:")) { + a.target ="LibreJS-ViewSource"; + scriptId = scriptId.replace(viewSourceToHuman, "$3 at line $2 of $1"); + } a.textContent = scriptId; li.querySelector(".reason").textContent = reason; let bySite = !!reason.match(/https?:\/\/[^/]+\/\*/); diff --git a/main_background.js b/main_background.js index b62788a..3da5bc3 100644 --- a/main_background.js +++ b/main_background.js @@ -1055,16 +1055,21 @@ async function editHtml(html, documentUrl, tabId, frameId, whitelisted){ // Do not process inline scripts scripts = []; } else { + let findLine = finder => finder.test(html) && html.substring(0, finder.lastIndex).split(/\n/).length || 0; let modified = false; - // Deal with intrinsic events let intrinsecindex = 0; + let intrinsicFinder = /<[a-z][^>]*\b(on\w+|href\s*=\s*['"]?javascript:)/gi; for (let element of html_doc.all) { - for (let attr of element.attributes){ - if (attr.name.startsWith("on") || (attr.name === "href" && attr.value.startsWith("javascript:"))){ + let line = -1; + for (let attr of element.attributes) { + if (attr.name.startsWith("on") || (attr.name === "href" && attr.value.toLowerCase().startsWith("javascript:"))){ intrinsecindex++; + if (line === -1) { + line = findLine(intrinsicFinder); + } try { - let url = `${documentUrl}# Intrinsic event ${intrinsecindex} [${attr.name}]`; + let url = `view-source:${documentUrl}#line${line}(<${element.tagName} ${attr.name}>)`; let edited = await get_script(attr.value, url, tabId, whitelist.contains(url)); if (edited) { let value = edited; @@ -1081,14 +1086,17 @@ async function editHtml(html, documentUrl, tabId, frameId, whitelisted){ } let modifiedInline = false; + let scriptFinder = /)`; + let edited = await get_script(source, url, tabId, whitelisted, i); if (edited) { let edited_source = edited[0]; - let unedited_source = script.textContent.trim(); + let unedited_source = source.trim(); if (edited_source.trim() !== unedited_source) { script.textContent = edited_source; modified = modifiedInline = true; From 77e9a691e7930adf2a776dc6a85bdf122b2ff511 Mon Sep 17 00:00:00 2001 From: hackademix Date: Feb 12 2019 23:05:00 +0000 Subject: [PATCH 2/2] Fixed regression hiding some inline scripts and global license ref from UI reports. --- diff --git a/html/display_panel/content/main_panel.js b/html/display_panel/content/main_panel.js index f662b35..7934fee 100644 --- a/html/display_panel/content/main_panel.js +++ b/html/display_panel/content/main_panel.js @@ -111,7 +111,7 @@ function createList(data, group){ container.classList.add("empty"); } // generate list - let viewSourceToHuman = /^view-source:(.*)#line(\d+)\(([^)]*)\)/; + let viewSourceToHuman = /^view-source:(.*)#line(\d+)\(([^)]*)\).*/; for (let entry of entries) { let [scriptId, reason] = entry; let li = liTemplate.cloneNode(true); diff --git a/main_background.js b/main_background.js index 3da5bc3..65ffe60 100644 --- a/main_background.js +++ b/main_background.js @@ -1039,7 +1039,7 @@ async function editHtml(html, documentUrl, tabId, frameId, whitelisted){ // get the potential inline source that can contain a license for (let script of scripts) { // The script must be in-line and exist - if(script && !script.src){ + if(script && !script.src) { first_script_src = script.textContent; break; } @@ -1049,13 +1049,21 @@ async function editHtml(html, documentUrl, tabId, frameId, whitelisted){ if (first_script_src != "") { license = legacy_license_lib.check(first_script_src); } + + let findLine = finder => finder.test(html) && html.substring(0, finder.lastIndex).split(/\n/).length || 0; if (read_metadata(meta_element) || license) { console.log("Valid license for intrinsic events found"); - addReportEntry(tabId, url, {url, "accepted":[url, `Global license for the page: ${license}`]}); + let line = 0; + if (meta_element) { + line = findLine(/id\s*=\s*['"]?LibreJS-info\b/gi); + } else if (license) { + line = html.substring(0, html.indexOf(first_script_src)).split(/\n/).length; + } + let viewUrl = line ? `view-source:${documentUrl}#line${line}(<${meta_element ? meta_element.tagName : "SCRIPT"}>)(0)` : url; + addReportEntry(tabId, url, {url, "accepted":[viewUrl, `Global license for the page: ${license}`]}); // Do not process inline scripts scripts = []; } else { - let findLine = finder => finder.test(html) && html.substring(0, finder.lastIndex).split(/\n/).length || 0; let modified = false; // Deal with intrinsic events let intrinsecindex = 0; @@ -1069,7 +1077,7 @@ async function editHtml(html, documentUrl, tabId, frameId, whitelisted){ line = findLine(intrinsicFinder); } try { - let url = `view-source:${documentUrl}#line${line}(<${element.tagName} ${attr.name}>)`; + let url = `view-source:${documentUrl}#line${line}(<${element.tagName} ${attr.name}>)(${intrinsicIndex})`; let edited = await get_script(attr.value, url, tabId, whitelist.contains(url)); if (edited) { let value = edited; @@ -1092,7 +1100,7 @@ async function editHtml(html, documentUrl, tabId, frameId, whitelisted){ let line = findLine(scriptFinder); if (!script.src && !(script.type && script.type !== "text/javascript")) { let source = script.textContent; - let url = `view-source:${documentUrl}#line${line}(