8 |
9 | 
10 | 
11 |
12 |
18 |
10 |
11 |
13 | 
14 |
17 |
14 | Validated
15 |
16 |
19 |
20 |
21 |
22 |
23 |
28 |
21 |
22 |
24 | 
25 |
27 |
25 | Checking...
26 |
29 |
30 |
31 |
32 |
33 |
43 |
31 |
32 |
34 | 
35 |
42 |
35 | Possible Risk Detected
36 |
37 |
41 |
44 |
45 |
46 |
47 |
48 |
58 |
46 |
47 |
49 |
50 |
57 |
50 | Network Timed Out
51 |
52 |
56 |
59 |
60 |
61 |
62 |
63 |
72 |
61 |
62 |
64 | 
65 |
71 |
65 | Validation Failure
66 |
67 |
70 |
73 |
95 |
74 |
75 |
94 |
75 |
76 |
82 |
93 |
83 | 
84 | 
86 |
87 |
84 | Learn More
85 |
86 |
88 | 
89 |
91 |
92 |
89 | Download Source Code
90 |
91 |
96 |
97 |
98 |
99 |
100 |
108 |
98 |
99 |
101 |
107 | Report a Bug
102 |
103 |
106 |
109 |
110 |
111 |
112 |
115 |
116 |
123 |
124 |
125 |
126 |
--------------------------------------------------------------------------------
/src/css/popup.css:
--------------------------------------------------------------------------------
1 | /**
2 | * Copyright (c) Meta Platforms, Inc. and affiliates.
3 | *
4 | * This source code is licensed under the MIT license found in the
5 | * LICENSE file in the root directory of this source tree.
6 | */
7 |
8 | .action_bar {
9 | flex-direction: row;
10 | justify-content: space-between;
11 | margin: 24px 13px 0 13px;
12 | }
13 |
14 | .badge {
15 | height: 20px;
16 | }
17 |
18 | .content_body {
19 | align-items: center;
20 | display: flex;
21 | justify-content: center;
22 | flex-direction: column;
23 | }
24 |
25 | .anomaly_learn_more_button, .report_issue_button {
26 | border: 1px solid #CBD2D9;
27 | box-sizing: border-box;
28 | border-radius: 4px;
29 | height: 36px;
30 | width: 230px;
31 | background: #1C2B33;
32 | font-family: SF Pro Text;
33 | font-style: normal;
34 | font-weight: 500;
35 | font-size: 15px;
36 | line-height: 20px;
37 | text-align: center;
38 | letter-spacing: -0.23px;
39 | color: #FFFFFF;
40 | }
41 |
42 | .download_button,
43 | .risk_learn_more_button,
44 | .timeout_learn_more_button {
45 | border: 1px solid #CBD2D9;
46 | box-sizing: border-box;
47 | border-radius: 4px;
48 | height: 36px;
49 | width: 111px;
50 | background: #FFFFFF;
51 | font-family: SF Pro Text;
52 | font-style: normal;
53 | font-weight: 500;
54 | font-size: 15px;
55 | line-height: 20px;
56 | text-align: center;
57 | letter-spacing: -0.23px;
58 | color: #1C2B33;
59 | }
60 |
61 | .download_header {
62 | display: flex;
63 | }
64 |
65 | .download_title {
66 | font-family: Optimistic Display;
67 | font-style: normal;
68 | font-weight: bold;
69 | font-size: 17px;
70 | line-height: 22px;
71 | letter-spacing: 0.24px;
72 | color: #000000;
73 | height: 22px;
74 | width: 84px;
75 | margin: 0px 0px 0px 12px;
76 | padding-bottom: 21px;
77 | }
78 |
79 | .error_body {
80 | width: 262px;
81 | height: 288px;
82 | background: #FFFFFF;
83 | margin: 0;
84 | }
85 |
86 | header {
87 | display: flex;
88 | justify-content: space-between;
89 | padding: 16px 16px 0 16px;
90 | }
91 |
92 | .menu {
93 | cursor: pointer;
94 | height: 20px;
95 | }
96 |
97 | .menu_body {
98 | height: 227px;
99 | width: 256px;
100 | margin: 0px;
101 | }
102 |
103 | .menu_right_sidebar {
104 | display: flex;
105 | flex-direction: column;
106 | background: #F1F4F7;
107 | box-shadow: 0px 0px 16px rgba(52, 72, 84, 0.05);
108 | height: 227px;
109 | width: 209px;
110 | }
111 |
112 | .menu_row {
113 | display: flex;
114 | flex-direction: row;
115 | align-items: center;
116 | padding: 8px 16px;
117 | }
118 |
119 | .menu_row > p {
120 | font-family: SF Pro Text;
121 | font-style: normal;
122 | font-weight: 500;
123 | font-size: 15px;
124 | line-height: 20px;
125 | letter-spacing: -0.23px;
126 | color: #1C2B33;
127 | flex: none;
128 | order: 1;
129 | flex-grow: 1;
130 | margin: 0px 12px;
131 | width: 113px;
132 | }
133 |
134 | .menu_title {
135 | display: flex;
136 | flex-direction: row;
137 | justify-content: space-between;
138 | font-family: Optimistic Display;
139 | font-style: normal;
140 | font-weight: bold;
141 | font-size: 17px;
142 | line-height: 22px;
143 | letter-spacing: 0.24px;
144 | color: #000000;
145 | flex: none;
146 | order: 0;
147 | flex-grow: 0;
148 | margin: 0px 16px;
149 | }
150 |
151 | .menu_title > p {
152 | width: 138px;
153 | }
154 |
155 | .menu_title > button {
156 | border: none;
157 | cursor: pointer;
158 | width: 24px;
159 | height: 24px;
160 | margin: 16px 0 0;
161 | }
162 |
163 | .menu_top_level {
164 | display: flex;
165 | flex-direction: row;
166 | }
167 |
168 | .menu_top_level > .badge {
169 | margin: 13px 12px 0 15px;
170 | }
171 |
172 | .loading_body {
173 | width: 257px;
174 | height: 154px;
175 | background: #FFFFFF;
176 | margin: 0;
177 | }
178 |
179 | .loading_body_image {
180 | height: 32px;
181 | margin-top: 24px;
182 | width: 158px;
183 | }
184 |
185 | .retry_button {
186 | border: 1px solid #CBD2D9;
187 | box-sizing: border-box;
188 | border-radius: 4px;
189 | height: 36px;
190 | width: 111px;
191 | background: #1C2B33;
192 | font-family: SF Pro Text;
193 | font-style: normal;
194 | font-weight: 500;
195 | font-size: 15px;
196 | line-height: 20px;
197 | text-align: center;
198 | letter-spacing: -0.23px;
199 | color: #FFFFFF;
200 | }
201 |
202 | .row_image {
203 | flex: none;
204 | order: 0;
205 | flex-grow: 0;
206 | }
207 |
208 | .row_nav {
209 | flex: none;
210 | order: 2;
211 | flex-grow: 0;
212 | margin: 0px 12px;
213 | }
214 |
215 | .state_boundary {
216 | flex-direction: column;
217 | }
218 |
219 | .status_header {
220 | font-family: SF Pro Text;
221 | font-style: normal;
222 | font-weight: 600;
223 | font-size: 13px;
224 | line-height: 18px;
225 |
226 | text-align: center;
227 | letter-spacing: -0.08px;
228 |
229 | color: #1C2B33;
230 | margin-top: 12px;
231 | }
232 |
233 | .status_message {
234 | font-family: SF Pro Text;
235 | font-style: normal;
236 | font-weight: normal;
237 | font-size: 13px;
238 | line-height: 18px;
239 | text-align: center;
240 | letter-spacing: -0.08px;
241 | color: #63788A;
242 | margin: 0 36px;
243 | }
244 |
245 | .status_message_highlight {
246 | color: #1C2B33;
247 | }
248 |
249 | .valid_body {
250 | width: 262px;
251 | height: 164px;
252 | background: #FFFFFF;
253 | margin: 0;
254 | }
255 |
256 | .validated_body_image {
257 | height: 32px;
258 | margin-top: 24px;
259 | width: 158px;
260 | }
261 |
262 | .warning_risk_body {
263 | width: 262px;
264 | height: 270px;
265 | background: #FFFFFF;
266 | margin: 0;
267 | }
268 |
269 | .warning_timeout_body {
270 | width: 262px;
271 | height: 216px;
272 | background: #FFFFFF;
273 | margin: 0;
274 | }
275 |
276 | .warning_body_image {
277 | height: 32px;
278 | margin-top: 24px;
279 | width: 158px;
280 | }
281 |
--------------------------------------------------------------------------------
/images/loading-header.svg:
--------------------------------------------------------------------------------
1 |
37 |
--------------------------------------------------------------------------------
/images/error-header.svg:
--------------------------------------------------------------------------------
1 |
37 |
--------------------------------------------------------------------------------
/images/validated-header.svg:
--------------------------------------------------------------------------------
1 |
37 |
--------------------------------------------------------------------------------
/images/warning-header.svg:
--------------------------------------------------------------------------------
1 |
37 |
--------------------------------------------------------------------------------
/jest.config.js:
--------------------------------------------------------------------------------
1 | /*
2 | * For a detailed explanation regarding each configuration property, visit:
3 | * https://jestjs.io/docs/configuration
4 | */
5 |
6 | export default {
7 | // All imported modules in your tests should be mocked automatically
8 | // automock: false,
9 |
10 | // Stop running tests after `n` failures
11 | // bail: 0,
12 |
13 | // The directory where Jest should store its cached dependency information
14 | // cacheDirectory: "/tmp/rrh/jest_2fus",
15 |
16 | // Automatically clear mock calls and instances between every test
17 | clearMocks: true,
18 |
19 | // Indicates whether the coverage information should be collected while executing the test
20 | // collectCoverage: false,
21 |
22 | // An array of glob patterns indicating a set of files for which coverage information should be collected
23 | // collectCoverageFrom: undefined,
24 |
25 | // The directory where Jest should output its coverage files
26 | // coverageDirectory: undefined,
27 |
28 | // An array of regexp pattern strings used to skip coverage collection
29 | // coveragePathIgnorePatterns: [
30 | // "/node_modules/"
31 | // ],
32 |
33 | // Indicates which provider should be used to instrument code for coverage
34 | coverageProvider: "v8",
35 |
36 | // A list of reporter names that Jest uses when writing coverage reports
37 | // coverageReporters: [
38 | // "json",
39 | // "text",
40 | // "lcov",
41 | // "clover"
42 | // ],
43 |
44 | // An object that configures minimum threshold enforcement for coverage results
45 | // coverageThreshold: undefined,
46 |
47 | // A path to a custom dependency extractor
48 | // dependencyExtractor: undefined,
49 |
50 | // Make calling deprecated APIs throw helpful error messages
51 | // errorOnDeprecated: false,
52 |
53 | // Force coverage collection from ignored files using an array of glob patterns
54 | // forceCoverageMatch: [],
55 |
56 | // A path to a module which exports an async function that is triggered once before all test suites
57 | // globalSetup: undefined,
58 |
59 | // A path to a module which exports an async function that is triggered once after all test suites
60 | // globalTeardown: undefined,
61 |
62 | // A set of global variables that need to be available in all test environments
63 | // globals: {},
64 |
65 | // The maximum amount of workers used to run your tests. Can be specified as % or a number. E.g. maxWorkers: 10% will use 10% of your CPU amount + 1 as the maximum worker number. maxWorkers: 2 will use a maximum of 2 workers.
66 | // maxWorkers: "50%",
67 |
68 | // An array of directory names to be searched recursively up from the requiring module's location
69 | // moduleDirectories: [
70 | // "node_modules"
71 | // ],
72 |
73 | // An array of file extensions your modules use
74 | // moduleFileExtensions: [
75 | // "js",
76 | // "jsx",
77 | // "ts",
78 | // "tsx",
79 | // "json",
80 | // "node"
81 | // ],
82 |
83 | // A map from regular expressions to module names or to arrays of module names that allow to stub out resources with a single module
84 | // moduleNameMapper: {},
85 |
86 | // An array of regexp pattern strings, matched against all module paths before considered 'visible' to the module loader
87 | // modulePathIgnorePatterns: [],
88 |
89 | // Activates notifications for test results
90 | // notify: false,
91 |
92 | // An enum that specifies notification mode. Requires { notify: true }
93 | // notifyMode: "failure-change",
94 |
95 | // A preset that is used as a base for Jest's configuration
96 | // preset: undefined,
97 |
98 | // Run tests from one or more projects
99 | // projects: undefined,
100 |
101 | // Use this configuration option to add custom reporters to Jest
102 | // reporters: undefined,
103 |
104 | // Automatically reset mock state between every test
105 | // resetMocks: false,
106 |
107 | // Reset the module registry before running each individual test
108 | // resetModules: false,
109 |
110 | // A path to a custom resolver
111 | // resolver: undefined,
112 |
113 | // Automatically restore mock state between every test
114 | // restoreMocks: false,
115 |
116 | // The root directory that Jest should scan for tests and modules within
117 | // rootDir: undefined,
118 |
119 | // A list of paths to directories that Jest should use to search for files in
120 | // roots: [
121 | // "
112 | Download
113 | 114 |
115 |
117 |
118 |
121 |
122 | ' +
315 | ' ' +
316 | ' ' +
317 | '
';
318 | scanForScripts();
319 | expect(window.chrome.runtime.sendMessage.mock.calls.length).toBe(2);
320 | });
321 | });
322 | describe('processFoundJS', () => {
323 | // these are flaky because jest.resestModules doesn't work for esm
324 | // while the above may be true, redo these as async and flush promises and they should work.
325 | it('should send valid icon update when no src based scripts are invalid', async () => {
326 | document.body.innerHTML =
327 | '' +
328 | ' ' +
329 | ' ' +
330 | '
';
331 | scanForScripts();
332 | window.chrome.runtime.sendMessage.mockImplementation(
333 | (message, response) => {
334 | response && response({ valid: true });
335 | }
336 | );
337 | processFoundJS(ORIGIN_TYPE.WHATSAPP, '100');
338 | await (() => new Promise(res => setTimeout(res, 10)))();
339 | expect(window.chrome.runtime.sendMessage.mock.calls.length).toBe(9);
340 | expect(window.chrome.runtime.sendMessage.mock.calls[6][0].icon).toEqual(
341 | ICON_STATE.VALID
342 | );
343 | });
344 | it('should send valid icon update when no inline based scripts are invalid', async () => {
345 | document.body.innerHTML =
346 | '' +
347 | ' ' +
348 | ' ' +
349 | '
';
350 | scanForScripts();
351 | window.chrome.runtime.sendMessage.mockImplementation(
352 | (message, response) => {
353 | response && response({ valid: true });
354 | }
355 | );
356 | processFoundJS(ORIGIN_TYPE.WHATSAPP, '102');
357 | await (() => new Promise(res => setTimeout(res, 10)))();
358 | expect(window.chrome.runtime.sendMessage.mock.calls.length).toBe(11);
359 | expect(window.chrome.runtime.sendMessage.mock.calls[6][0].icon).toEqual(
360 | ICON_STATE.VALID
361 | );
362 | });
363 | it('should send invalid icon update when invalid response received with src', async () => {
364 | document.body.innerHTML =
365 | '' +
366 | ' ' +
367 | ' ' +
368 | '
';
369 | scanForScripts();
370 | window.chrome.runtime.sendMessage.mockImplementation(
371 | (message, response) => {
372 | response && response({ valid: false });
373 | }
374 | );
375 | processFoundJS(ORIGIN_TYPE.WHATSAPP, '101');
376 | await (() => new Promise(res => setTimeout(res, 10)))();
377 | expect(window.chrome.runtime.sendMessage.mock.calls.length).toBe(14);
378 | expect(window.chrome.runtime.sendMessage.mock.calls[7][0].icon).toEqual(
379 | ICON_STATE.INVALID_SOFT
380 | );
381 | });
382 | // it.todo(
383 | // 'should send invalid icon update when invalid inline response received'
384 | // );
385 | });
386 | });
387 |
--------------------------------------------------------------------------------
/src/js/background.js:
--------------------------------------------------------------------------------
1 | /**
2 | * Copyright (c) Meta Platforms, Inc. and affiliates.
3 | *
4 | * This source code is licensed under the MIT license found in the
5 | * LICENSE file in the root directory of this source tree.
6 | */
7 |
8 | import {
9 | MESSAGE_TYPE,
10 | ORIGIN_HOST,
11 | ORIGIN_TIMEOUT,
12 | ORIGIN_TYPE,
13 | } from './config.js';
14 | const manifestCache = new Map();
15 | const debugCache = new Map();
16 |
17 | // Emulate PageActions
18 | chrome.runtime.onInstalled.addListener(() => {
19 | chrome.action.disable();
20 | });
21 |
22 | function updateIconV3(message, sender) {
23 | chrome.action.setIcon({ tabId: sender.tab.id, path: message.icon.badge });
24 | const popupMessage = {
25 | tabId: sender.tab.id,
26 | popup: message.icon.popup,
27 | };
28 | chrome.action.setPopup(popupMessage);
29 | const messageForPopup = {
30 | popup: message.icon.popup,
31 | tabId: sender.tab.id,
32 | };
33 | chrome.runtime.sendMessage(messageForPopup);
34 | chrome.action.enable(sender.tab.id);
35 | }
36 |
37 | function updateIconV2(message, sender) {
38 | chrome.pageAction.setIcon({ tabId: sender.tab.id, path: message.icon.badge });
39 | const popupMessage = {
40 | tabId: sender.tab.id,
41 | popup: message.icon.popup,
42 | };
43 | chrome.pageAction.setPopup(popupMessage);
44 | const messageForPopup = {
45 | popup: message.icon.popup,
46 | tabId: sender.tab.id,
47 | };
48 | chrome.runtime.sendMessage(messageForPopup);
49 | chrome.pageAction.show(sender.tab.id);
50 | }
51 |
52 | function updateIcon(message, sender) {
53 | console.log('background messages are ', message);
54 | if (chrome.pageAction) {
55 | updateIconV2(message, sender);
56 | } else {
57 | updateIconV3(message, sender);
58 | }
59 | }
60 |
61 | function addDebugLog(tabId, debugMessage) {
62 | let tabDebugList = debugCache.get(tabId);
63 | if (tabDebugList == null) {
64 | tabDebugList = [];
65 | debugCache.set(tabId, tabDebugList);
66 | }
67 |
68 | tabDebugList.push(debugMessage);
69 | }
70 |
71 | const fromHexString = hexString =>
72 | new Uint8Array(hexString.match(/.{1,2}/g).map(byte => parseInt(byte, 16)));
73 | const toHexString = bytes =>
74 | bytes.reduce((str, byte) => str + byte.toString(16).padStart(2, '0'), '');
75 |
76 | function getCFHashWorkaroundFunction(host, version) {
77 | return new Promise((resolve, reject) => {
78 | fetch(
79 | 'https://staging-api.privacy-auditability.cloudflare.com/v1/hash/' +
80 | host +
81 | '/' +
82 | version,
83 | { method: 'GET' }
84 | )
85 | .then(response => {
86 | resolve(response);
87 | })
88 | .catch(response => {
89 | reject(response);
90 | });
91 | });
92 | }
93 |
94 | async function validateManifest(rootHash, leaves, host, version, workaround) {
95 | // does rootHash match what was published?
96 | const cfResponse = await getCFHashWorkaroundFunction(host, version).catch(
97 | cfError => {
98 | console.log('error fetching hash from CF', cfError);
99 | return {
100 | valid: false,
101 | reason: 'ENDPOINT_FAILURE',
102 | error: cfError,
103 | };
104 | }
105 | );
106 | if (cfResponse == null || cfResponse.json == null) {
107 | return {
108 | valid: false,
109 | reason: 'UNKNOWN_ENDPOINT_ISSUE',
110 | };
111 | }
112 | const cfPayload = await cfResponse.json();
113 | let cfRootHash = cfPayload.root_hash;
114 | if (cfPayload.root_hash.startsWith('0x')) {
115 | cfRootHash = cfPayload.root_hash.slice(2);
116 | }
117 | // validate
118 | if (rootHash !== cfRootHash) {
119 | console.log('hash mismatch with CF ', rootHash, cfRootHash);
120 |
121 | // secondary hash to mitigate accidental build issue.
122 | const encoder = new TextEncoder();
123 | const backupHashEncoded = encoder.encode(workaround);
124 | const backupHashArray = Array.from(
125 | new Uint8Array(await crypto.subtle.digest('SHA-256', backupHashEncoded))
126 | );
127 | const backupHash = backupHashArray
128 | .map(b => b.toString(16).padStart(2, '0'))
129 | .join('');
130 | console.log(
131 | 'secondary hashing of CF value fails too ',
132 | rootHash,
133 | backupHash
134 | );
135 | if (backupHash !== cfRootHash) {
136 | return {
137 | valid: false,
138 | reason: 'ROOT_HASH_VERFIY_FAIL_3RD_PARTY',
139 | };
140 | }
141 | }
142 |
143 | let oldhashes = leaves.map(
144 | leaf => fromHexString(leaf.replace('0x', '')).buffer
145 | );
146 | let newhashes = [];
147 | let bonus = '';
148 |
149 | while (oldhashes.length > 1) {
150 | for (let index = 0; index < oldhashes.length; index += 2) {
151 | const validSecondValue = index + 1 < oldhashes.length;
152 | if (validSecondValue) {
153 | const hashValue = new Uint8Array(
154 | oldhashes[index].byteLength + oldhashes[index + 1].byteLength
155 | );
156 | hashValue.set(new Uint8Array(oldhashes[index]), 0);
157 | hashValue.set(
158 | new Uint8Array(oldhashes[index + 1]),
159 | oldhashes[index].byteLength
160 | );
161 | newhashes.push(await crypto.subtle.digest('SHA-256', hashValue.buffer));
162 | } else {
163 | bonus = oldhashes[index];
164 | }
165 | }
166 | oldhashes = newhashes;
167 | if (bonus !== '') {
168 | oldhashes.push(bonus);
169 | }
170 | console.log(
171 | 'layer hex is ',
172 | oldhashes.map(hash => {
173 | return Array.from(new Uint8Array(hash))
174 | .map(b => b.toString(16).padStart(2, ''))
175 | .join('');
176 | })
177 | );
178 | newhashes = [];
179 | bonus = '';
180 | console.log(
181 | 'in loop hashes.length is',
182 | oldhashes.length,
183 | rootHash,
184 | oldhashes
185 | );
186 | }
187 | const lastHash = toHexString(new Uint8Array(oldhashes[0]));
188 | console.log('before return comparison', rootHash, lastHash);
189 | if (lastHash === rootHash) {
190 | return {
191 | valid: true,
192 | };
193 | }
194 | return {
195 | valid: false,
196 | reason: 'ROOT_HASH_VERFIY_FAIL_IN_PAGE',
197 | };
198 | }
199 |
200 | async function validateMetaCompanyManifest(rootHash, otherHashes, leaves) {
201 | // merge all the hashes into one
202 | const megaHash = JSON.stringify(leaves);
203 | // hash it
204 | const encoder = new TextEncoder();
205 | const encodedMegaHash = encoder.encode(megaHash);
206 | const jsHashArray = Array.from(
207 | new Uint8Array(await crypto.subtle.digest('SHA-256', encodedMegaHash))
208 | );
209 | const jsHash = jsHashArray.map(b => b.toString(16).padStart(2, '0')).join('');
210 | // compare to main and long tail, it should match one
211 | // then hash it with the other
212 | let combinedHash = '';
213 | if (jsHash === otherHashes.main || jsHash === otherHashes.longtail) {
214 | const combinedHashArray = Array.from(
215 | new Uint8Array(
216 | await crypto.subtle.digest(
217 | 'SHA-256',
218 | encoder.encode(otherHashes.longtail + otherHashes.main)
219 | )
220 | )
221 | );
222 | combinedHash = combinedHashArray
223 | .map(b => b.toString(16).padStart(2, '0'))
224 | .join('');
225 | } else {
226 | return false;
227 | }
228 |
229 | // ensure result matches root, return.
230 | console.log('combined hash is ', combinedHash, rootHash);
231 | return combinedHash === rootHash;
232 | }
233 |
234 | async function processJSWithSrc(message, manifest, tabId) {
235 | try {
236 | const sourceResponse = await fetch(message.src, { method: 'GET' });
237 | let sourceText = await sourceResponse.text();
238 | if (sourceText.indexOf('if (self.CavalryLogger) {') === 0) {
239 | sourceText = sourceText.slice(82).trim();
240 | }
241 | // we want to slice out the source URL from the source
242 | const sourceURLIndex = sourceText.indexOf('//# sourceURL');
243 | if (sourceURLIndex >= 0) {
244 | // doing minus 1 because there's usually either a space or new line
245 | sourceText = sourceText.slice(0, sourceURLIndex - 1);
246 | }
247 | // if ([ORIGIN_TYPE.FACEBOOK].includes(message.origin)) {
248 | // sourceText = unescape(sourceText);
249 | // }
250 | // strip i18n delimiters
251 | // eslint-disable-next-line no-useless-escape
252 | const i18nRegexp = /\/\*FBT_CALL\*\/.*?\/\*FBT_CALL\*\//g;
253 | const i18nStripped = sourceText.replace(i18nRegexp, '');
254 | // split package up if necessary
255 | const packages = i18nStripped.split('/*FB_PKG_DELIM*/\n');
256 | const encoder = new TextEncoder();
257 | for (let i = 0; i < packages.length; i++) {
258 | const encodedPackage = encoder.encode(packages[i]);
259 | const packageHashBuffer = await crypto.subtle.digest(
260 | 'SHA-256',
261 | encodedPackage
262 | );
263 | const packageHash = Array.from(new Uint8Array(packageHashBuffer))
264 | .map(b => b.toString(16).padStart(2, '0'))
265 | .join('');
266 | console.log(
267 | 'manifest is ',
268 | manifest.leaves.length,
269 | manifest.leaves.includes(packageHash),
270 | packageHash
271 | );
272 | if (!manifest.leaves.includes(packageHash)) {
273 | return false;
274 | }
275 | }
276 | return true; // YAY!
277 | } catch (error) {
278 | console.log('error occurred!', error);
279 | addDebugLog(
280 | tabId,
281 | 'Error: Processing JS with SRC ' +
282 | message.origin +
283 | ', ' +
284 | message.version +
285 | ' problematic JS is ' +
286 | message.src +
287 | 'error is ' +
288 | JSON.stringify(error).substring(0, 500)
289 | );
290 | return false;
291 | }
292 | }
293 |
294 | // async function processRawJS() {}
295 |
296 | function getDebugLog(tabId) {
297 | let tabDebugList = debugCache.get(tabId);
298 | return tabDebugList == null ? [] : tabDebugList;
299 | }
300 |
301 | export function handleMessages(message, sender, sendResponse) {
302 | console.log('in handle messages ', message);
303 | if (message.type == MESSAGE_TYPE.UPDATE_ICON) {
304 | updateIcon(message, sender);
305 | return;
306 | }
307 |
308 | if (message.type == MESSAGE_TYPE.LOAD_MANIFEST) {
309 | // validate manifest
310 | if ([ORIGIN_TYPE.FACEBOOK].includes(message.origin)) {
311 | validateMetaCompanyManifest(
312 | message.rootHash,
313 | message.otherHashes,
314 | message.leaves
315 | ).then(valid => {
316 | console.log('result is ', valid);
317 | if (valid) {
318 | let origin = manifestCache.get(message.origin);
319 | if (origin == null) {
320 | origin = new Map();
321 | manifestCache.set(message.origin, origin);
322 | }
323 | // roll through the existing manifests and remove expired ones
324 | if (ORIGIN_TIMEOUT[message.origin] > 0) {
325 | for (let [key, manif] of origin.entries()) {
326 | if (manif.start + ORIGIN_TIMEOUT[message.origin] < Date.now()) {
327 | origin.delete(key);
328 | }
329 | }
330 | }
331 |
332 | let manifest = origin.get(message.version);
333 | if (!manifest) {
334 | manifest = {
335 | leaves: [],
336 | root: message.rootHash,
337 | start: Date.now(),
338 | };
339 | origin.set(message.version, manifest);
340 | }
341 | message.leaves.forEach(leaf => {
342 | if (!manifest.leaves.includes(leaf)) {
343 | manifest.leaves.push(leaf);
344 | }
345 | });
346 | sendResponse({ valid: true });
347 | } else {
348 | sendResponse({ valid: false });
349 | }
350 | });
351 | } else {
352 | const slicedHash = message.rootHash.slice(2);
353 | const slicedLeaves = message.leaves.map(leaf => {
354 | return leaf.slice(2);
355 | });
356 | validateManifest(
357 | slicedHash,
358 | slicedLeaves,
359 | ORIGIN_HOST[message.origin],
360 | message.version,
361 | message.workaround
362 | ).then(validationResult => {
363 | if (validationResult.valid) {
364 | // store manifest to subsequently validate JS
365 | let origin = manifestCache.get(message.origin);
366 | if (origin == null) {
367 | origin = new Map();
368 | manifestCache.set(message.origin, origin);
369 | }
370 | // roll through the existing manifests and remove expired ones
371 | if (ORIGIN_TIMEOUT[message.origin] > 0) {
372 | for (let [key, manif] of origin.entries()) {
373 | if (manif.start + ORIGIN_TIMEOUT[message.origin] < Date.now()) {
374 | origin.delete(key);
375 | }
376 | }
377 | }
378 | console.log('result is ', validationResult.valid);
379 | origin.set(message.version, {
380 | leaves: slicedLeaves,
381 | root: slicedHash,
382 | start: Date.now(),
383 | });
384 | sendResponse({ valid: true });
385 | } else {
386 | sendResponse(validationResult);
387 | }
388 | });
389 | }
390 | return true;
391 | }
392 |
393 | if (message.type == MESSAGE_TYPE.JS_WITH_SRC) {
394 | // exclude known extension scripts from analysis
395 | if (
396 | message.src.indexOf('chrome-extension://') === 0 ||
397 | message.src.indexOf('moz-extension://') === 0
398 | ) {
399 | addDebugLog(
400 | sender.tab.id,
401 | 'Warning: User installed extension inserted script ' + message.src
402 | );
403 | sendResponse({
404 | valid: false,
405 | type: 'EXTENSION',
406 | reason: 'User installed extension has inserted script',
407 | });
408 | return;
409 | }
410 |
411 | const origin = manifestCache.get(message.origin);
412 | if (!origin) {
413 | addDebugLog(
414 | sender.tab.id,
415 | 'Error: JS with SRC had no matching origin ' + message.origin
416 | );
417 | sendResponse({ valid: false, reason: 'no matching origin' });
418 | return;
419 | }
420 | const manifestObj = origin.get(message.version);
421 | const manifest = manifestObj && manifestObj.leaves;
422 | if (!manifest) {
423 | addDebugLog(
424 | sender.tab.id,
425 | 'Error: JS with SRC had no matching manifest. origin: ' +
426 | message.origin +
427 | ' version: ' +
428 | message.version
429 | );
430 | sendResponse({ valid: false, reason: 'no matching manifest' });
431 | return;
432 | }
433 | // fetch and process the src
434 | processJSWithSrc(message, manifestObj, sender.tab.id).then(valid => {
435 | console.log('sending processJSWithSrc response ', valid);
436 | sendResponse({ valid: valid });
437 | });
438 | return true;
439 | }
440 |
441 | if (message.type == MESSAGE_TYPE.RAW_JS) {
442 | const origin = manifestCache.get(message.origin);
443 | if (!origin) {
444 | addDebugLog(
445 | sender.tab.id,
446 | 'Error: RAW_JS had no matching origin ' + message.origin
447 | );
448 | sendResponse({ valid: false, reason: 'no matching origin' });
449 | return;
450 | }
451 | const manifestObj = origin.get(message.version);
452 | const manifest = manifestObj && manifestObj.leaves;
453 | if (!manifest) {
454 | addDebugLog(
455 | sender.tab.id,
456 | 'Error: JS with SRC had no matching manifest. origin: ' +
457 | message.origin +
458 | ' version: ' +
459 | message.version
460 | );
461 | sendResponse({ valid: false, reason: 'no matching manifest' });
462 | return;
463 | }
464 |
465 | // fetch the src
466 | const encoder = new TextEncoder();
467 | const encodedJS = encoder.encode(message.rawjs);
468 | // hash the src
469 | crypto.subtle.digest('SHA-256', encodedJS).then(jsHashBuffer => {
470 | const jsHashArray = Array.from(new Uint8Array(jsHashBuffer));
471 | const jsHash = jsHashArray
472 | .map(b => b.toString(16).padStart(2, '0'))
473 | .join('');
474 |
475 | console.log('generate hash is ', jsHash);
476 | if (manifestObj.leaves.includes(jsHash)) {
477 | sendResponse({ valid: true });
478 | } else {
479 | addDebugLog(
480 | sender.tab.id,
481 | 'Error: hash does not match ' +
482 | message.origin +
483 | ', ' +
484 | message.version +
485 | ', unmatched JS is ' +
486 | message.rawjs.substring(0, 500)
487 | );
488 | sendResponse({
489 | valid: false,
490 | hash: jsHash,
491 | reason:
492 | 'Error: hash does not match ' +
493 | message.origin +
494 | ', ' +
495 | message.version +
496 | ', unmatched JS is ' +
497 | message.rawjs,
498 | });
499 | }
500 | });
501 | return true;
502 | }
503 |
504 | if (message.type == MESSAGE_TYPE.DEBUG) {
505 | addDebugLog(sender.tab.id, message.log);
506 | return;
507 | }
508 |
509 | if (message.type == MESSAGE_TYPE.GET_DEBUG) {
510 | const debuglist = getDebugLog(message.tabId);
511 | console.log('debug list is ', message.tabId, debuglist);
512 | sendResponse({ valid: true, debugList: debuglist });
513 | return;
514 | }
515 | }
516 |
517 | chrome.runtime.onMessage.addListener(handleMessages);
518 | chrome.tabs.onRemoved.addListener(tabId => {
519 | if (debugCache.has(tabId)) {
520 | debugCache.delete(tabId);
521 | }
522 | });
523 |
--------------------------------------------------------------------------------
/src/js/contentUtils.js:
--------------------------------------------------------------------------------
1 | /**
2 | * Copyright (c) Meta Platforms, Inc. and affiliates.
3 | *
4 | * This source code is licensed under the MIT license found in the
5 | * LICENSE file in the root directory of this source tree.
6 | */
7 |
8 | import {
9 | ICON_STATE,
10 | KNOWN_EXTENSION_HASHES,
11 | MESSAGE_TYPE,
12 | ORIGIN_TYPE,
13 | } from './config.js';
14 |
15 | const DOM_EVENTS = [
16 | 'onabort',
17 | 'onactivate',
18 | 'onattribute',
19 | 'onafterprint',
20 | 'onafterscriptexecute',
21 | 'onafterupdate',
22 | 'onanimationend',
23 | 'onanimationiteration',
24 | 'onanimationstart',
25 | 'onariarequest',
26 | 'onautocomplete',
27 | 'onautocompleteerror',
28 | 'onbeforeactivate',
29 | 'onbeforecopy',
30 | 'onbeforecut',
31 | 'onbeforedeactivate',
32 | 'onbeforeeditfocus',
33 | 'onbeforepaste',
34 | 'onbeforeprint',
35 | 'onbeforescriptexecute',
36 | 'onbeforeunload',
37 | 'onbeforeupdate',
38 | 'onbegin',
39 | 'onblur',
40 | 'onbounce',
41 | 'oncancel',
42 | 'oncanplay',
43 | 'oncanplaythrough',
44 | 'oncellchange',
45 | 'onchange',
46 | 'onclick',
47 | 'onclose',
48 | 'oncommand',
49 | 'oncompassneedscalibration',
50 | 'oncontextmenu',
51 | 'oncontrolselect',
52 | 'oncopy',
53 | 'oncuechange',
54 | 'oncut',
55 | 'ondataavailable',
56 | 'ondatasetchanged',
57 | 'ondatasetcomplete',
58 | 'ondblclick',
59 | 'ondeactivate',
60 | 'ondevicelight',
61 | 'ondevicemotion',
62 | 'ondeviceorientation',
63 | 'ondeviceproximity',
64 | 'ondrag',
65 | 'ondragdrop',
66 | 'ondragend',
67 | 'ondragenter',
68 | 'ondragleave',
69 | 'ondragover',
70 | 'ondragstart',
71 | 'ondrop',
72 | 'ondurationchange',
73 | 'onemptied',
74 | 'onend',
75 | 'onended',
76 | 'onerror',
77 | 'onerrorupdate',
78 | 'onexit',
79 | 'onfilterchange',
80 | 'onfinish',
81 | 'onfocus',
82 | 'onfocusin',
83 | 'onfocusout',
84 | 'onformchange',
85 | 'onforminput',
86 | 'onfullscreenchange',
87 | 'onfullscreenerror',
88 | 'ongotpointercapture',
89 | 'onhashchange',
90 | 'onhelp',
91 | 'oninput',
92 | 'oninvalid',
93 | 'onkeydown',
94 | 'onkeypress',
95 | 'onkeyup',
96 | 'onlanguagechange',
97 | 'onlayoutcomplete',
98 | 'onload',
99 | 'onloadeddata',
100 | 'onloadedmetadata',
101 | 'onloadstart',
102 | 'onlosecapture',
103 | 'onlostpointercapture',
104 | 'onmediacomplete',
105 | 'onmediaerror',
106 | 'onmessage',
107 | 'onmousedown',
108 | 'onmouseenter',
109 | 'onmouseleave',
110 | 'onmousemove',
111 | 'onmouseout',
112 | 'onmouseover',
113 | 'onmouseup',
114 | 'onmousewheel',
115 | 'onmove',
116 | 'onmoveend',
117 | 'onmovestart',
118 | 'onmozfullscreenchange',
119 | 'onmozfullscreenerror',
120 | 'onmozpointerlockchange',
121 | 'onmozpointerlockerror',
122 | 'onmscontentzoom',
123 | 'onmsfullscreenchange',
124 | 'onmsfullscreenerror',
125 | 'onmsgesturechange',
126 | 'onmsgesturedoubletap',
127 | 'onmsgestureend',
128 | 'onmsgesturehold',
129 | 'onmsgesturestart',
130 | 'onmsgesturetap',
131 | 'onmsgotpointercapture',
132 | 'onmsinertiastart',
133 | 'onmslostpointercapture',
134 | 'onmsmanipulationstatechanged',
135 | 'onmspointercancel',
136 | 'onmspointerdown',
137 | 'onmspointerenter',
138 | 'onmspointerleave',
139 | 'onmspointermove',
140 | 'onmspointerout',
141 | 'onmspointerover',
142 | 'onmspointerup',
143 | 'onmssitemodejumplistitemremoved',
144 | 'onmsthumbnailclick',
145 | 'onoffline',
146 | 'ononline',
147 | 'onoutofsync',
148 | 'onpage',
149 | 'onpagehide',
150 | 'onpageshow',
151 | 'onpaste',
152 | 'onpause',
153 | 'onplay',
154 | 'onplaying',
155 | 'onpointercancel',
156 | 'onpointerdown',
157 | 'onpointerenter',
158 | 'onpointerleave',
159 | 'onpointerlockchange',
160 | 'onpointerlockerror',
161 | 'onpointermove',
162 | 'onpointerout',
163 | 'onpointerover',
164 | 'onpointerup',
165 | 'onpopstate',
166 | 'onprogress',
167 | 'onpropertychange',
168 | 'onratechange',
169 | 'onreadystatechange',
170 | 'onreceived',
171 | 'onrepeat',
172 | 'onreset',
173 | 'onresize',
174 | 'onresizeend',
175 | 'onresizestart',
176 | 'onresume',
177 | 'onreverse',
178 | 'onrowdelete',
179 | 'onrowenter',
180 | 'onrowexit',
181 | 'onrowinserted',
182 | 'onrowsdelete',
183 | 'onrowsenter',
184 | 'onrowsexit',
185 | 'onrowsinserted',
186 | 'onscroll',
187 | 'onsearch',
188 | 'onseek',
189 | 'onseeked',
190 | 'onseeking',
191 | 'onselect',
192 | 'onselectionchange',
193 | 'onselectstart',
194 | 'onstalled',
195 | 'onstorage',
196 | 'onstoragecommit',
197 | 'onstart',
198 | 'onstop',
199 | 'onshow',
200 | 'onsyncrestored',
201 | 'onsubmit',
202 | 'onsuspend',
203 | 'onsynchrestored',
204 | 'ontimeerror',
205 | 'ontimeupdate',
206 | 'ontrackchange',
207 | 'ontransitionend',
208 | 'ontoggle',
209 | 'onunload',
210 | 'onurlflip',
211 | 'onuserproximity',
212 | 'onvolumechange',
213 | 'onwaiting',
214 | 'onwebkitanimationend',
215 | 'onwebkitanimationiteration',
216 | 'onwebkitanimationstart',
217 | 'onwebkitfullscreenchange',
218 | 'onwebkitfullscreenerror',
219 | 'onwebkittransitionend',
220 | 'onwheel',
221 | ];
222 |
223 | const foundScripts = new Map();
224 | foundScripts.set('', []);
225 | let currentState = ICON_STATE.VALID;
226 | let currentOrigin = '';
227 | let currentFilterType = '';
228 | let manifestTimeoutID = '';
229 |
230 | export function storeFoundJS(scriptNodeMaybe, scriptList) {
231 | // check if it's the manifest node
232 | if (
233 | scriptNodeMaybe.id === 'binary-transparency-manifest' ||
234 | scriptNodeMaybe.getAttribute('name') === 'binary-transparency-manifest'
235 | ) {
236 | if (manifestTimeoutID !== '') {
237 | clearTimeout(manifestTimeoutID);
238 | manifestTimeoutID = '';
239 | }
240 | const rawManifest = JSON.parse(scriptNodeMaybe.innerHTML);
241 |
242 | let leaves = rawManifest.leaves;
243 | let otherHashes = '';
244 | let otherType = '';
245 | let roothash = rawManifest.root;
246 | let version = rawManifest.version;
247 |
248 | if ([ORIGIN_TYPE.FACEBOOK].includes(currentOrigin)) {
249 | leaves = rawManifest.manifest;
250 | otherHashes = rawManifest.manifest_hashes;
251 | otherType = scriptNodeMaybe.getAttribute('data-manifest-type');
252 | roothash = otherHashes.combined_hash;
253 | version = scriptNodeMaybe.getAttribute('data-manifest-rev');
254 |
255 | if (currentFilterType != '') {
256 | currentFilterType = 'BOTH';
257 | }
258 | if (currentFilterType === '') {
259 | currentFilterType = otherType;
260 | }
261 | }
262 | // now that we know the actual version of the scripts, transfer the ones we know about.
263 | if (foundScripts.has('')) {
264 | foundScripts.set(version, foundScripts.get(''));
265 | foundScripts.delete('');
266 | }
267 |
268 | chrome.runtime.sendMessage(
269 | {
270 | type: MESSAGE_TYPE.LOAD_MANIFEST,
271 | leaves: leaves,
272 | origin: currentOrigin,
273 | otherHashes: otherHashes,
274 | otherType: otherType,
275 | rootHash: roothash,
276 | workaround: scriptNodeMaybe.innerHTML,
277 | version: version,
278 | },
279 | response => {
280 | chrome.runtime.sendMessage({
281 | type: MESSAGE_TYPE.DEBUG,
282 | log:
283 | 'manifest load response is ' + response
284 | ? JSON.stringify(response).substring(0, 500)
285 | : '',
286 | });
287 | // then start processing of it's JS
288 | if (response.valid) {
289 | window.setTimeout(() => processFoundJS(currentOrigin, version), 0);
290 | } else {
291 | if (
292 | ['ENDPOINT_FAILURE', 'UNKNOWN_ENDPOINT_ISSUE'].includes(
293 | response.reason
294 | )
295 | ) {
296 | currentState = ICON_STATE.WARNING_TIMEOUT;
297 | chrome.runtime.sendMessage({
298 | type: MESSAGE_TYPE.UPDATE_ICON,
299 | icon: ICON_STATE.WARNING_TIMEOUT,
300 | });
301 | return;
302 | }
303 | // TODO add Error state here, manifest didn't validate
304 | currentState = ICON_STATE.INVALID_SOFT;
305 | chrome.runtime.sendMessage({
306 | type: MESSAGE_TYPE.UPDATE_ICON,
307 | icon: ICON_STATE.INVALID_SOFT,
308 | });
309 | }
310 | }
311 | );
312 | // TODO: start timeout to check if manifest hasn't loaded?
313 | }
314 | if (
315 | scriptNodeMaybe.getAttribute('type') === 'application/json' ||
316 | (scriptNodeMaybe.src != null &&
317 | scriptNodeMaybe.src !== '' &&
318 | scriptNodeMaybe.src.indexOf('blob:') === 0)
319 | ) {
320 | // ignore innocuous data.
321 | return;
322 | }
323 | // need to get the src of the JS
324 | if (scriptNodeMaybe.src != null && scriptNodeMaybe.src !== '') {
325 | if (scriptList.size === 1) {
326 | scriptList.get(scriptList.keys().next().value).push({
327 | type: MESSAGE_TYPE.JS_WITH_SRC,
328 | src: scriptNodeMaybe.src,
329 | otherType: '', // TODO: read from DOM when available
330 | });
331 | }
332 | } else {
333 | // no src, access innerHTML for the code
334 | const hashLookupAttribute =
335 | scriptNodeMaybe.attributes['data-binary-transparency-hash-key'];
336 | const hashLookupKey = hashLookupAttribute && hashLookupAttribute.value;
337 | if (scriptList.size === 1) {
338 | scriptList.get(scriptList.keys().next().value).push({
339 | type: MESSAGE_TYPE.RAW_JS,
340 | rawjs: scriptNodeMaybe.innerHTML,
341 | lookupKey: hashLookupKey,
342 | otherType: '', // TODO: read from DOM when available
343 | });
344 | }
345 | }
346 | if (currentState == ICON_STATE.VALID) {
347 | chrome.runtime.sendMessage({
348 | type: MESSAGE_TYPE.UPDATE_ICON,
349 | icon: ICON_STATE.PROCESSING,
350 | });
351 | }
352 | }
353 |
354 | export function hasViolatingAnchorTag(htmlElement) {
355 | if (htmlElement.nodeName === 'A' && htmlElement.href !== '') {
356 | let checkURL = htmlElement.href;
357 | // make sure anchor tags don't have javascript urls
358 | if (checkURL.indexOf('javascript:') == 0) {
359 | chrome.runtime.sendMessage({
360 | type: MESSAGE_TYPE.DEBUG,
361 | log: 'violating attribute: javascript url in anchor tag',
362 | });
363 | currentState = ICON_STATE.INVALID_SOFT;
364 | chrome.runtime.sendMessage({
365 | type: MESSAGE_TYPE.UPDATE_ICON,
366 | icon: ICON_STATE.INVALID_SOFT,
367 | });
368 | }
369 |
370 | if (typeof htmlElement.childNodes !== 'undefined') {
371 | htmlElement.childNodes.forEach(element => {
372 | hasViolatingAnchorTag(element);
373 | });
374 | }
375 | }
376 | }
377 |
378 | export function hasInvalidAttributes(htmlElement) {
379 | if (
380 | typeof htmlElement.hasAttributes === 'function' &&
381 | htmlElement.hasAttributes()
382 | ) {
383 | Array.from(htmlElement.attributes).forEach(elementAttribute => {
384 | // check first for violating attributes
385 | if (DOM_EVENTS.indexOf(elementAttribute.localName) >= 0) {
386 | chrome.runtime.sendMessage({
387 | type: MESSAGE_TYPE.DEBUG,
388 | log:
389 | 'violating attribute ' +
390 | elementAttribute.localName +
391 | ' from element ' +
392 | htmlElement.outerHTML,
393 | });
394 | currentState = ICON_STATE.INVALID_SOFT;
395 | chrome.runtime.sendMessage({
396 | type: MESSAGE_TYPE.UPDATE_ICON,
397 | icon: ICON_STATE.INVALID_SOFT,
398 | });
399 | }
400 | });
401 | }
402 | }
403 |
404 | export function hasInvalidScripts(scriptNodeMaybe, scriptList) {
405 | // if not an HTMLElement ignore it!
406 | if (scriptNodeMaybe.nodeType !== 1) {
407 | return false;
408 | }
409 | hasInvalidAttributes(scriptNodeMaybe);
410 |
411 | if (scriptNodeMaybe.nodeName === 'SCRIPT') {
412 | return storeFoundJS(scriptNodeMaybe, scriptList);
413 | } else if (scriptNodeMaybe.childNodes.length > 0) {
414 | scriptNodeMaybe.childNodes.forEach(childNode => {
415 | // if not an HTMLElement ignore it!
416 | if (childNode.nodeType !== 1) {
417 | return;
418 | }
419 | hasViolatingAnchorTag(childNode);
420 | hasInvalidAttributes(childNode);
421 |
422 | if (childNode.nodeName === 'SCRIPT') {
423 | storeFoundJS(childNode, scriptList);
424 | return;
425 | }
426 |
427 | Array.from(childNode.getElementsByTagName('script')).forEach(
428 | childScript => {
429 | storeFoundJS(childScript, scriptList);
430 | }
431 | );
432 | });
433 | }
434 |
435 | return;
436 | }
437 |
438 | export const scanForScripts = () => {
439 | const allElements = document.getElementsByTagName('*');
440 |
441 | Array.from(allElements).forEach(allElement => {
442 | console.log('found existing scripts');
443 |
444 | hasViolatingAnchorTag(allElement);
445 | hasInvalidAttributes(allElement);
446 | // next check for existing script elements and if they're violating
447 | if (allElement.nodeName === 'SCRIPT') {
448 | storeFoundJS(allElement, foundScripts);
449 | }
450 | });
451 |
452 | // track any new scripts that get loaded in
453 | const scriptMutationObserver = new MutationObserver(mutationsList => {
454 | mutationsList.forEach(mutation => {
455 | if (mutation.type === 'childList') {
456 | Array.from(mutation.addedNodes).forEach(checkScript => {
457 | hasInvalidScripts(checkScript, foundScripts);
458 | });
459 | } else if (mutation.type === 'attributes') {
460 | currentState = ICON_STATE.INVALID_SOFT;
461 | chrome.runtime.sendMessage({
462 | type: MESSAGE_TYPE.UPDATE_ICON,
463 | icon: ICON_STATE.INVALID_SOFT,
464 | });
465 | chrome.runtime.sendMessage({
466 | type: MESSAGE_TYPE.DEBUG,
467 | log:
468 | 'Processed DOM mutation and invalid attribute added or changed ' +
469 | mutation.target,
470 | });
471 | }
472 | });
473 | });
474 |
475 | scriptMutationObserver.observe(document.getElementsByTagName('html')[0], {
476 | attributeFilter: DOM_EVENTS,
477 | childList: true,
478 | subtree: true,
479 | });
480 | };
481 |
482 | export const processFoundJS = (origin, version) => {
483 | // foundScripts
484 | const fullscripts = foundScripts.get(version).splice(0);
485 | const scripts = fullscripts.filter(script => {
486 | if (
487 | script.otherType === currentFilterType ||
488 | ['BOTH', ''].includes(currentFilterType)
489 | ) {
490 | return true;
491 | } else {
492 | foundScripts.get(version).push(script);
493 | }
494 | });
495 | let pendingScriptCount = scripts.length;
496 | scripts.forEach(script => {
497 | if (script.src) {
498 | chrome.runtime.sendMessage(
499 | {
500 | type: script.type,
501 | src: script.src,
502 | origin: origin,
503 | version: version,
504 | },
505 | response => {
506 | pendingScriptCount--;
507 | if (response.valid) {
508 | if (pendingScriptCount == 0 && currentState == ICON_STATE.VALID) {
509 | chrome.runtime.sendMessage({
510 | type: MESSAGE_TYPE.UPDATE_ICON,
511 | icon: ICON_STATE.VALID,
512 | });
513 | }
514 | } else {
515 | if (response.type === 'EXTENSION') {
516 | currentState = ICON_STATE.WARNING_RISK;
517 | chrome.runtime.sendMessage({
518 | type: MESSAGE_TYPE.UPDATE_ICON,
519 | icon: ICON_STATE.WARNING_RISK,
520 | });
521 | } else {
522 | currentState = ICON_STATE.INVALID_SOFT;
523 | chrome.runtime.sendMessage({
524 | type: MESSAGE_TYPE.UPDATE_ICON,
525 | icon: ICON_STATE.INVALID_SOFT,
526 | });
527 | }
528 | }
529 | chrome.runtime.sendMessage({
530 | type: MESSAGE_TYPE.DEBUG,
531 | log:
532 | 'processed JS with SRC, ' +
533 | script.src +
534 | ',response is ' +
535 | JSON.stringify(response).substring(0, 500),
536 | });
537 | }
538 | );
539 | } else {
540 | chrome.runtime.sendMessage(
541 | {
542 | type: script.type,
543 | rawjs: script.rawjs,
544 | lookupKey: script.lookupKey,
545 | origin: origin,
546 | version: version,
547 | },
548 | response => {
549 | pendingScriptCount--;
550 | if (response.valid) {
551 | if (pendingScriptCount == 0 && currentState == ICON_STATE.VALID) {
552 | chrome.runtime.sendMessage({
553 | type: MESSAGE_TYPE.UPDATE_ICON,
554 | icon: ICON_STATE.VALID,
555 | });
556 | }
557 | } else {
558 | if (KNOWN_EXTENSION_HASHES.includes(response.hash)) {
559 | currentState = ICON_STATE.WARNING_RISK;
560 | chrome.runtime.sendMessage({
561 | type: MESSAGE_TYPE.UPDATE_ICON,
562 | icon: ICON_STATE.WARNING_RISK,
563 | });
564 | } else {
565 | currentState = ICON_STATE.INVALID_SOFT;
566 | chrome.runtime.sendMessage({
567 | type: MESSAGE_TYPE.UPDATE_ICON,
568 | icon: ICON_STATE.INVALID_SOFT,
569 | });
570 | }
571 | }
572 | chrome.runtime.sendMessage({
573 | type: MESSAGE_TYPE.DEBUG,
574 | log:
575 | 'processed the RAW_JS, response is ' +
576 | response.hash +
577 | ' ' +
578 | JSON.stringify(response).substring(0, 500),
579 | });
580 | }
581 | );
582 | }
583 | });
584 | window.setTimeout(() => processFoundJS(origin, version), 3000);
585 | };
586 |
587 | export function startFor(origin) {
588 | currentOrigin = origin;
589 | scanForScripts();
590 | manifestTimeoutID = setTimeout(() => {
591 | // Manifest failed to load, flag a warning to the user.
592 | currentState = ICON_STATE.WARNING_TIMEOUT;
593 | chrome.runtime.sendMessage({
594 | type: MESSAGE_TYPE.UPDATE_ICON,
595 | icon: ICON_STATE.WARNING_TIMEOUT,
596 | });
597 | }, 45000);
598 | }
599 |
600 | chrome.runtime.sendMessage({
601 | type: MESSAGE_TYPE.UPDATE_ICON,
602 | icon: ICON_STATE.PROCESSING,
603 | });
604 |
--------------------------------------------------------------------------------