├── .gitignore ├── LICENSE ├── README.md ├── extra_icons ├── off_48.png ├── off_96.png ├── on_48_blue.png ├── on_48_green.png ├── on_48_red.png ├── on_96_blue.png ├── on_96_green.png └── on_96_red.png ├── make_xpi.sh ├── src ├── icons │ ├── doyensec_logo.svg │ ├── off_48.png │ ├── off_96.png │ ├── on_48.png │ └── on_96.png ├── js │ ├── background.js │ ├── bkg_api.js │ ├── rewriter.js │ └── switcheroo.js ├── manifest.json └── pages │ ├── config │ ├── config.css │ ├── config.html │ ├── config.js │ └── validate.js │ ├── options │ ├── options.css │ └── options.html │ └── popup │ ├── menu.css │ ├── menu.html │ └── menu.js ├── ss.png └── test ├── init.js ├── test.html └── tests.js /.gitignore: -------------------------------------------------------------------------------- 1 | ev.zip 2 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | GNU GENERAL PUBLIC LICENSE 2 | Version 3, 29 June 2007 3 | 4 | Copyright (C) 2007 Free Software Foundation, Inc. 5 | Everyone is permitted to copy and distribute verbatim copies 6 | of this license document, but changing it is not allowed. 7 | 8 | Preamble 9 | 10 | The GNU General Public License is a free, copyleft license for 11 | software and other kinds of works. 12 | 13 | The licenses for most software and other practical works are designed 14 | to take away your freedom to share and change the works. By contrast, 15 | the GNU General Public License is intended to guarantee your freedom to 16 | share and change all versions of a program--to make sure it remains free 17 | software for all its users. We, the Free Software Foundation, use the 18 | GNU General Public License for most of our software; it applies also to 19 | any other work released this way by its authors. You can apply it to 20 | your programs, too. 21 | 22 | When we speak of free software, we are referring to freedom, not 23 | price. Our General Public Licenses are designed to make sure that you 24 | have the freedom to distribute copies of free software (and charge for 25 | them if you wish), that you receive source code or can get it if you 26 | want it, that you can change the software or use pieces of it in new 27 | free programs, and that you know you can do these things. 28 | 29 | To protect your rights, we need to prevent others from denying you 30 | these rights or asking you to surrender the rights. Therefore, you have 31 | certain responsibilities if you distribute copies of the software, or if 32 | you modify it: responsibilities to respect the freedom of others. 33 | 34 | For example, if you distribute copies of such a program, whether 35 | gratis or for a fee, you must pass on to the recipients the same 36 | freedoms that you received. You must make sure that they, too, receive 37 | or can get the source code. And you must show them these terms so they 38 | know their rights. 39 | 40 | Developers that use the GNU GPL protect your rights with two steps: 41 | (1) assert copyright on the software, and (2) offer you this License 42 | giving you legal permission to copy, distribute and/or modify it. 43 | 44 | For the developers' and authors' protection, the GPL clearly explains 45 | that there is no warranty for this free software. For both users' and 46 | authors' sake, the GPL requires that modified versions be marked as 47 | changed, so that their problems will not be attributed erroneously to 48 | authors of previous versions. 49 | 50 | Some devices are designed to deny users access to install or run 51 | modified versions of the software inside them, although the manufacturer 52 | can do so. This is fundamentally incompatible with the aim of 53 | protecting users' freedom to change the software. The systematic 54 | pattern of such abuse occurs in the area of products for individuals to 55 | use, which is precisely where it is most unacceptable. Therefore, we 56 | have designed this version of the GPL to prohibit the practice for those 57 | products. If such problems arise substantially in other domains, we 58 | stand ready to extend this provision to those domains in future versions 59 | of the GPL, as needed to protect the freedom of users. 60 | 61 | Finally, every program is threatened constantly by software patents. 62 | States should not allow patents to restrict development and use of 63 | software on general-purpose computers, but in those that do, we wish to 64 | avoid the special danger that patents applied to a free program could 65 | make it effectively proprietary. To prevent this, the GPL assures that 66 | patents cannot be used to render the program non-free. 67 | 68 | The precise terms and conditions for copying, distribution and 69 | modification follow. 70 | 71 | TERMS AND CONDITIONS 72 | 73 | 0. Definitions. 74 | 75 | "This License" refers to version 3 of the GNU General Public License. 76 | 77 | "Copyright" also means copyright-like laws that apply to other kinds of 78 | works, such as semiconductor masks. 79 | 80 | "The Program" refers to any copyrightable work licensed under this 81 | License. Each licensee is addressed as "you". "Licensees" and 82 | "recipients" may be individuals or organizations. 83 | 84 | To "modify" a work means to copy from or adapt all or part of the work 85 | in a fashion requiring copyright permission, other than the making of an 86 | exact copy. The resulting work is called a "modified version" of the 87 | earlier work or a work "based on" the earlier work. 88 | 89 | A "covered work" means either the unmodified Program or a work based 90 | on the Program. 91 | 92 | To "propagate" a work means to do anything with it that, without 93 | permission, would make you directly or secondarily liable for 94 | infringement under applicable copyright law, except executing it on a 95 | computer or modifying a private copy. Propagation includes copying, 96 | distribution (with or without modification), making available to the 97 | public, and in some countries other activities as well. 98 | 99 | To "convey" a work means any kind of propagation that enables other 100 | parties to make or receive copies. Mere interaction with a user through 101 | a computer network, with no transfer of a copy, is not conveying. 102 | 103 | An interactive user interface displays "Appropriate Legal Notices" 104 | to the extent that it includes a convenient and prominently visible 105 | feature that (1) displays an appropriate copyright notice, and (2) 106 | tells the user that there is no warranty for the work (except to the 107 | extent that warranties are provided), that licensees may convey the 108 | work under this License, and how to view a copy of this License. If 109 | the interface presents a list of user commands or options, such as a 110 | menu, a prominent item in the list meets this criterion. 111 | 112 | 1. Source Code. 113 | 114 | The "source code" for a work means the preferred form of the work 115 | for making modifications to it. "Object code" means any non-source 116 | form of a work. 117 | 118 | A "Standard Interface" means an interface that either is an official 119 | standard defined by a recognized standards body, or, in the case of 120 | interfaces specified for a particular programming language, one that 121 | is widely used among developers working in that language. 122 | 123 | The "System Libraries" of an executable work include anything, other 124 | than the work as a whole, that (a) is included in the normal form of 125 | packaging a Major Component, but which is not part of that Major 126 | Component, and (b) serves only to enable use of the work with that 127 | Major Component, or to implement a Standard Interface for which an 128 | implementation is available to the public in source code form. A 129 | "Major Component", in this context, means a major essential component 130 | (kernel, window system, and so on) of the specific operating system 131 | (if any) on which the executable work runs, or a compiler used to 132 | produce the work, or an object code interpreter used to run it. 133 | 134 | The "Corresponding Source" for a work in object code form means all 135 | the source code needed to generate, install, and (for an executable 136 | work) run the object code and to modify the work, including scripts to 137 | control those activities. However, it does not include the work's 138 | System Libraries, or general-purpose tools or generally available free 139 | programs which are used unmodified in performing those activities but 140 | which are not part of the work. For example, Corresponding Source 141 | includes interface definition files associated with source files for 142 | the work, and the source code for shared libraries and dynamically 143 | linked subprograms that the work is specifically designed to require, 144 | such as by intimate data communication or control flow between those 145 | subprograms and other parts of the work. 146 | 147 | The Corresponding Source need not include anything that users 148 | can regenerate automatically from other parts of the Corresponding 149 | Source. 150 | 151 | The Corresponding Source for a work in source code form is that 152 | same work. 153 | 154 | 2. Basic Permissions. 155 | 156 | All rights granted under this License are granted for the term of 157 | copyright on the Program, and are irrevocable provided the stated 158 | conditions are met. This License explicitly affirms your unlimited 159 | permission to run the unmodified Program. The output from running a 160 | covered work is covered by this License only if the output, given its 161 | content, constitutes a covered work. This License acknowledges your 162 | rights of fair use or other equivalent, as provided by copyright law. 163 | 164 | You may make, run and propagate covered works that you do not 165 | convey, without conditions so long as your license otherwise remains 166 | in force. You may convey covered works to others for the sole purpose 167 | of having them make modifications exclusively for you, or provide you 168 | with facilities for running those works, provided that you comply with 169 | the terms of this License in conveying all material for which you do 170 | not control copyright. Those thus making or running the covered works 171 | for you must do so exclusively on your behalf, under your direction 172 | and control, on terms that prohibit them from making any copies of 173 | your copyrighted material outside their relationship with you. 174 | 175 | Conveying under any other circumstances is permitted solely under 176 | the conditions stated below. Sublicensing is not allowed; section 10 177 | makes it unnecessary. 178 | 179 | 3. Protecting Users' Legal Rights From Anti-Circumvention Law. 180 | 181 | No covered work shall be deemed part of an effective technological 182 | measure under any applicable law fulfilling obligations under article 183 | 11 of the WIPO copyright treaty adopted on 20 December 1996, or 184 | similar laws prohibiting or restricting circumvention of such 185 | measures. 186 | 187 | When you convey a covered work, you waive any legal power to forbid 188 | circumvention of technological measures to the extent such circumvention 189 | is effected by exercising rights under this License with respect to 190 | the covered work, and you disclaim any intention to limit operation or 191 | modification of the work as a means of enforcing, against the work's 192 | users, your or third parties' legal rights to forbid circumvention of 193 | technological measures. 194 | 195 | 4. Conveying Verbatim Copies. 196 | 197 | You may convey verbatim copies of the Program's source code as you 198 | receive it, in any medium, provided that you conspicuously and 199 | appropriately publish on each copy an appropriate copyright notice; 200 | keep intact all notices stating that this License and any 201 | non-permissive terms added in accord with section 7 apply to the code; 202 | keep intact all notices of the absence of any warranty; and give all 203 | recipients a copy of this License along with the Program. 204 | 205 | You may charge any price or no price for each copy that you convey, 206 | and you may offer support or warranty protection for a fee. 207 | 208 | 5. Conveying Modified Source Versions. 209 | 210 | You may convey a work based on the Program, or the modifications to 211 | produce it from the Program, in the form of source code under the 212 | terms of section 4, provided that you also meet all of these conditions: 213 | 214 | a) The work must carry prominent notices stating that you modified 215 | it, and giving a relevant date. 216 | 217 | b) The work must carry prominent notices stating that it is 218 | released under this License and any conditions added under section 219 | 7. This requirement modifies the requirement in section 4 to 220 | "keep intact all notices". 221 | 222 | c) You must license the entire work, as a whole, under this 223 | License to anyone who comes into possession of a copy. This 224 | License will therefore apply, along with any applicable section 7 225 | additional terms, to the whole of the work, and all its parts, 226 | regardless of how they are packaged. This License gives no 227 | permission to license the work in any other way, but it does not 228 | invalidate such permission if you have separately received it. 229 | 230 | d) If the work has interactive user interfaces, each must display 231 | Appropriate Legal Notices; however, if the Program has interactive 232 | interfaces that do not display Appropriate Legal Notices, your 233 | work need not make them do so. 234 | 235 | A compilation of a covered work with other separate and independent 236 | works, which are not by their nature extensions of the covered work, 237 | and which are not combined with it such as to form a larger program, 238 | in or on a volume of a storage or distribution medium, is called an 239 | "aggregate" if the compilation and its resulting copyright are not 240 | used to limit the access or legal rights of the compilation's users 241 | beyond what the individual works permit. Inclusion of a covered work 242 | in an aggregate does not cause this License to apply to the other 243 | parts of the aggregate. 244 | 245 | 6. Conveying Non-Source Forms. 246 | 247 | You may convey a covered work in object code form under the terms 248 | of sections 4 and 5, provided that you also convey the 249 | machine-readable Corresponding Source under the terms of this License, 250 | in one of these ways: 251 | 252 | a) Convey the object code in, or embodied in, a physical product 253 | (including a physical distribution medium), accompanied by the 254 | Corresponding Source fixed on a durable physical medium 255 | customarily used for software interchange. 256 | 257 | b) Convey the object code in, or embodied in, a physical product 258 | (including a physical distribution medium), accompanied by a 259 | written offer, valid for at least three years and valid for as 260 | long as you offer spare parts or customer support for that product 261 | model, to give anyone who possesses the object code either (1) a 262 | copy of the Corresponding Source for all the software in the 263 | product that is covered by this License, on a durable physical 264 | medium customarily used for software interchange, for a price no 265 | more than your reasonable cost of physically performing this 266 | conveying of source, or (2) access to copy the 267 | Corresponding Source from a network server at no charge. 268 | 269 | c) Convey individual copies of the object code with a copy of the 270 | written offer to provide the Corresponding Source. This 271 | alternative is allowed only occasionally and noncommercially, and 272 | only if you received the object code with such an offer, in accord 273 | with subsection 6b. 274 | 275 | d) Convey the object code by offering access from a designated 276 | place (gratis or for a charge), and offer equivalent access to the 277 | Corresponding Source in the same way through the same place at no 278 | further charge. You need not require recipients to copy the 279 | Corresponding Source along with the object code. If the place to 280 | copy the object code is a network server, the Corresponding Source 281 | may be on a different server (operated by you or a third party) 282 | that supports equivalent copying facilities, provided you maintain 283 | clear directions next to the object code saying where to find the 284 | Corresponding Source. Regardless of what server hosts the 285 | Corresponding Source, you remain obligated to ensure that it is 286 | available for as long as needed to satisfy these requirements. 287 | 288 | e) Convey the object code using peer-to-peer transmission, provided 289 | you inform other peers where the object code and Corresponding 290 | Source of the work are being offered to the general public at no 291 | charge under subsection 6d. 292 | 293 | A separable portion of the object code, whose source code is excluded 294 | from the Corresponding Source as a System Library, need not be 295 | included in conveying the object code work. 296 | 297 | A "User Product" is either (1) a "consumer product", which means any 298 | tangible personal property which is normally used for personal, family, 299 | or household purposes, or (2) anything designed or sold for incorporation 300 | into a dwelling. In determining whether a product is a consumer product, 301 | doubtful cases shall be resolved in favor of coverage. For a particular 302 | product received by a particular user, "normally used" refers to a 303 | typical or common use of that class of product, regardless of the status 304 | of the particular user or of the way in which the particular user 305 | actually uses, or expects or is expected to use, the product. A product 306 | is a consumer product regardless of whether the product has substantial 307 | commercial, industrial or non-consumer uses, unless such uses represent 308 | the only significant mode of use of the product. 309 | 310 | "Installation Information" for a User Product means any methods, 311 | procedures, authorization keys, or other information required to install 312 | and execute modified versions of a covered work in that User Product from 313 | a modified version of its Corresponding Source. The information must 314 | suffice to ensure that the continued functioning of the modified object 315 | code is in no case prevented or interfered with solely because 316 | modification has been made. 317 | 318 | If you convey an object code work under this section in, or with, or 319 | specifically for use in, a User Product, and the conveying occurs as 320 | part of a transaction in which the right of possession and use of the 321 | User Product is transferred to the recipient in perpetuity or for a 322 | fixed term (regardless of how the transaction is characterized), the 323 | Corresponding Source conveyed under this section must be accompanied 324 | by the Installation Information. But this requirement does not apply 325 | if neither you nor any third party retains the ability to install 326 | modified object code on the User Product (for example, the work has 327 | been installed in ROM). 328 | 329 | The requirement to provide Installation Information does not include a 330 | requirement to continue to provide support service, warranty, or updates 331 | for a work that has been modified or installed by the recipient, or for 332 | the User Product in which it has been modified or installed. Access to a 333 | network may be denied when the modification itself materially and 334 | adversely affects the operation of the network or violates the rules and 335 | protocols for communication across the network. 336 | 337 | Corresponding Source conveyed, and Installation Information provided, 338 | in accord with this section must be in a format that is publicly 339 | documented (and with an implementation available to the public in 340 | source code form), and must require no special password or key for 341 | unpacking, reading or copying. 342 | 343 | 7. Additional Terms. 344 | 345 | "Additional permissions" are terms that supplement the terms of this 346 | License by making exceptions from one or more of its conditions. 347 | Additional permissions that are applicable to the entire Program shall 348 | be treated as though they were included in this License, to the extent 349 | that they are valid under applicable law. If additional permissions 350 | apply only to part of the Program, that part may be used separately 351 | under those permissions, but the entire Program remains governed by 352 | this License without regard to the additional permissions. 353 | 354 | When you convey a copy of a covered work, you may at your option 355 | remove any additional permissions from that copy, or from any part of 356 | it. (Additional permissions may be written to require their own 357 | removal in certain cases when you modify the work.) You may place 358 | additional permissions on material, added by you to a covered work, 359 | for which you have or can give appropriate copyright permission. 360 | 361 | Notwithstanding any other provision of this License, for material you 362 | add to a covered work, you may (if authorized by the copyright holders of 363 | that material) supplement the terms of this License with terms: 364 | 365 | a) Disclaiming warranty or limiting liability differently from the 366 | terms of sections 15 and 16 of this License; or 367 | 368 | b) Requiring preservation of specified reasonable legal notices or 369 | author attributions in that material or in the Appropriate Legal 370 | Notices displayed by works containing it; or 371 | 372 | c) Prohibiting misrepresentation of the origin of that material, or 373 | requiring that modified versions of such material be marked in 374 | reasonable ways as different from the original version; or 375 | 376 | d) Limiting the use for publicity purposes of names of licensors or 377 | authors of the material; or 378 | 379 | e) Declining to grant rights under trademark law for use of some 380 | trade names, trademarks, or service marks; or 381 | 382 | f) Requiring indemnification of licensors and authors of that 383 | material by anyone who conveys the material (or modified versions of 384 | it) with contractual assumptions of liability to the recipient, for 385 | any liability that these contractual assumptions directly impose on 386 | those licensors and authors. 387 | 388 | All other non-permissive additional terms are considered "further 389 | restrictions" within the meaning of section 10. If the Program as you 390 | received it, or any part of it, contains a notice stating that it is 391 | governed by this License along with a term that is a further 392 | restriction, you may remove that term. If a license document contains 393 | a further restriction but permits relicensing or conveying under this 394 | License, you may add to a covered work material governed by the terms 395 | of that license document, provided that the further restriction does 396 | not survive such relicensing or conveying. 397 | 398 | If you add terms to a covered work in accord with this section, you 399 | must place, in the relevant source files, a statement of the 400 | additional terms that apply to those files, or a notice indicating 401 | where to find the applicable terms. 402 | 403 | Additional terms, permissive or non-permissive, may be stated in the 404 | form of a separately written license, or stated as exceptions; 405 | the above requirements apply either way. 406 | 407 | 8. Termination. 408 | 409 | You may not propagate or modify a covered work except as expressly 410 | provided under this License. Any attempt otherwise to propagate or 411 | modify it is void, and will automatically terminate your rights under 412 | this License (including any patent licenses granted under the third 413 | paragraph of section 11). 414 | 415 | However, if you cease all violation of this License, then your 416 | license from a particular copyright holder is reinstated (a) 417 | provisionally, unless and until the copyright holder explicitly and 418 | finally terminates your license, and (b) permanently, if the copyright 419 | holder fails to notify you of the violation by some reasonable means 420 | prior to 60 days after the cessation. 421 | 422 | Moreover, your license from a particular copyright holder is 423 | reinstated permanently if the copyright holder notifies you of the 424 | violation by some reasonable means, this is the first time you have 425 | received notice of violation of this License (for any work) from that 426 | copyright holder, and you cure the violation prior to 30 days after 427 | your receipt of the notice. 428 | 429 | Termination of your rights under this section does not terminate the 430 | licenses of parties who have received copies or rights from you under 431 | this License. If your rights have been terminated and not permanently 432 | reinstated, you do not qualify to receive new licenses for the same 433 | material under section 10. 434 | 435 | 9. Acceptance Not Required for Having Copies. 436 | 437 | You are not required to accept this License in order to receive or 438 | run a copy of the Program. Ancillary propagation of a covered work 439 | occurring solely as a consequence of using peer-to-peer transmission 440 | to receive a copy likewise does not require acceptance. However, 441 | nothing other than this License grants you permission to propagate or 442 | modify any covered work. These actions infringe copyright if you do 443 | not accept this License. Therefore, by modifying or propagating a 444 | covered work, you indicate your acceptance of this License to do so. 445 | 446 | 10. Automatic Licensing of Downstream Recipients. 447 | 448 | Each time you convey a covered work, the recipient automatically 449 | receives a license from the original licensors, to run, modify and 450 | propagate that work, subject to this License. You are not responsible 451 | for enforcing compliance by third parties with this License. 452 | 453 | An "entity transaction" is a transaction transferring control of an 454 | organization, or substantially all assets of one, or subdividing an 455 | organization, or merging organizations. If propagation of a covered 456 | work results from an entity transaction, each party to that 457 | transaction who receives a copy of the work also receives whatever 458 | licenses to the work the party's predecessor in interest had or could 459 | give under the previous paragraph, plus a right to possession of the 460 | Corresponding Source of the work from the predecessor in interest, if 461 | the predecessor has it or can get it with reasonable efforts. 462 | 463 | You may not impose any further restrictions on the exercise of the 464 | rights granted or affirmed under this License. For example, you may 465 | not impose a license fee, royalty, or other charge for exercise of 466 | rights granted under this License, and you may not initiate litigation 467 | (including a cross-claim or counterclaim in a lawsuit) alleging that 468 | any patent claim is infringed by making, using, selling, offering for 469 | sale, or importing the Program or any portion of it. 470 | 471 | 11. Patents. 472 | 473 | A "contributor" is a copyright holder who authorizes use under this 474 | License of the Program or a work on which the Program is based. The 475 | work thus licensed is called the contributor's "contributor version". 476 | 477 | A contributor's "essential patent claims" are all patent claims 478 | owned or controlled by the contributor, whether already acquired or 479 | hereafter acquired, that would be infringed by some manner, permitted 480 | by this License, of making, using, or selling its contributor version, 481 | but do not include claims that would be infringed only as a 482 | consequence of further modification of the contributor version. For 483 | purposes of this definition, "control" includes the right to grant 484 | patent sublicenses in a manner consistent with the requirements of 485 | this License. 486 | 487 | Each contributor grants you a non-exclusive, worldwide, royalty-free 488 | patent license under the contributor's essential patent claims, to 489 | make, use, sell, offer for sale, import and otherwise run, modify and 490 | propagate the contents of its contributor version. 491 | 492 | In the following three paragraphs, a "patent license" is any express 493 | agreement or commitment, however denominated, not to enforce a patent 494 | (such as an express permission to practice a patent or covenant not to 495 | sue for patent infringement). To "grant" such a patent license to a 496 | party means to make such an agreement or commitment not to enforce a 497 | patent against the party. 498 | 499 | If you convey a covered work, knowingly relying on a patent license, 500 | and the Corresponding Source of the work is not available for anyone 501 | to copy, free of charge and under the terms of this License, through a 502 | publicly available network server or other readily accessible means, 503 | then you must either (1) cause the Corresponding Source to be so 504 | available, or (2) arrange to deprive yourself of the benefit of the 505 | patent license for this particular work, or (3) arrange, in a manner 506 | consistent with the requirements of this License, to extend the patent 507 | license to downstream recipients. "Knowingly relying" means you have 508 | actual knowledge that, but for the patent license, your conveying the 509 | covered work in a country, or your recipient's use of the covered work 510 | in a country, would infringe one or more identifiable patents in that 511 | country that you have reason to believe are valid. 512 | 513 | If, pursuant to or in connection with a single transaction or 514 | arrangement, you convey, or propagate by procuring conveyance of, a 515 | covered work, and grant a patent license to some of the parties 516 | receiving the covered work authorizing them to use, propagate, modify 517 | or convey a specific copy of the covered work, then the patent license 518 | you grant is automatically extended to all recipients of the covered 519 | work and works based on it. 520 | 521 | A patent license is "discriminatory" if it does not include within 522 | the scope of its coverage, prohibits the exercise of, or is 523 | conditioned on the non-exercise of one or more of the rights that are 524 | specifically granted under this License. You may not convey a covered 525 | work if you are a party to an arrangement with a third party that is 526 | in the business of distributing software, under which you make payment 527 | to the third party based on the extent of your activity of conveying 528 | the work, and under which the third party grants, to any of the 529 | parties who would receive the covered work from you, a discriminatory 530 | patent license (a) in connection with copies of the covered work 531 | conveyed by you (or copies made from those copies), or (b) primarily 532 | for and in connection with specific products or compilations that 533 | contain the covered work, unless you entered into that arrangement, 534 | or that patent license was granted, prior to 28 March 2007. 535 | 536 | Nothing in this License shall be construed as excluding or limiting 537 | any implied license or other defenses to infringement that may 538 | otherwise be available to you under applicable patent law. 539 | 540 | 12. No Surrender of Others' Freedom. 541 | 542 | If conditions are imposed on you (whether by court order, agreement or 543 | otherwise) that contradict the conditions of this License, they do not 544 | excuse you from the conditions of this License. If you cannot convey a 545 | covered work so as to satisfy simultaneously your obligations under this 546 | License and any other pertinent obligations, then as a consequence you may 547 | not convey it at all. For example, if you agree to terms that obligate you 548 | to collect a royalty for further conveying from those to whom you convey 549 | the Program, the only way you could satisfy both those terms and this 550 | License would be to refrain entirely from conveying the Program. 551 | 552 | 13. Use with the GNU Affero General Public License. 553 | 554 | Notwithstanding any other provision of this License, you have 555 | permission to link or combine any covered work with a work licensed 556 | under version 3 of the GNU Affero General Public License into a single 557 | combined work, and to convey the resulting work. The terms of this 558 | License will continue to apply to the part which is the covered work, 559 | but the special requirements of the GNU Affero General Public License, 560 | section 13, concerning interaction through a network will apply to the 561 | combination as such. 562 | 563 | 14. Revised Versions of this License. 564 | 565 | The Free Software Foundation may publish revised and/or new versions of 566 | the GNU General Public License from time to time. Such new versions will 567 | be similar in spirit to the present version, but may differ in detail to 568 | address new problems or concerns. 569 | 570 | Each version is given a distinguishing version number. If the 571 | Program specifies that a certain numbered version of the GNU General 572 | Public License "or any later version" applies to it, you have the 573 | option of following the terms and conditions either of that numbered 574 | version or of any later version published by the Free Software 575 | Foundation. If the Program does not specify a version number of the 576 | GNU General Public License, you may choose any version ever published 577 | by the Free Software Foundation. 578 | 579 | If the Program specifies that a proxy can decide which future 580 | versions of the GNU General Public License can be used, that proxy's 581 | public statement of acceptance of a version permanently authorizes you 582 | to choose that version for the Program. 583 | 584 | Later license versions may give you additional or different 585 | permissions. However, no additional obligations are imposed on any 586 | author or copyright holder as a result of your choosing to follow a 587 | later version. 588 | 589 | 15. Disclaimer of Warranty. 590 | 591 | THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY 592 | APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT 593 | HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY 594 | OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, 595 | THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 596 | PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM 597 | IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF 598 | ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 599 | 600 | 16. Limitation of Liability. 601 | 602 | IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING 603 | WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS 604 | THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY 605 | GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE 606 | USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF 607 | DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD 608 | PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), 609 | EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF 610 | SUCH DAMAGES. 611 | 612 | 17. Interpretation of Sections 15 and 16. 613 | 614 | If the disclaimer of warranty and limitation of liability provided 615 | above cannot be given local legal effect according to their terms, 616 | reviewing courts shall apply local law that most closely approximates 617 | an absolute waiver of all civil liability in connection with the 618 | Program, unless a warranty or assumption of liability accompanies a 619 | copy of the Program in return for a fee. 620 | 621 | END OF TERMS AND CONDITIONS 622 | 623 | How to Apply These Terms to Your New Programs 624 | 625 | If you develop a new program, and you want it to be of the greatest 626 | possible use to the public, the best way to achieve this is to make it 627 | free software which everyone can redistribute and change under these terms. 628 | 629 | To do so, attach the following notices to the program. It is safest 630 | to attach them to the start of each source file to most effectively 631 | state the exclusion of warranty; and each file should have at least 632 | the "copyright" line and a pointer to where the full notice is found. 633 | 634 | 635 | Copyright (C) 636 | 637 | This program is free software: you can redistribute it and/or modify 638 | it under the terms of the GNU General Public License as published by 639 | the Free Software Foundation, either version 3 of the License, or 640 | (at your option) any later version. 641 | 642 | This program is distributed in the hope that it will be useful, 643 | but WITHOUT ANY WARRANTY; without even the implied warranty of 644 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 645 | GNU General Public License for more details. 646 | 647 | You should have received a copy of the GNU General Public License 648 | along with this program. If not, see . 649 | 650 | Also add information on how to contact you by electronic and paper mail. 651 | 652 | If the program does terminal interaction, make it output a short 653 | notice like this when it starts in an interactive mode: 654 | 655 | Copyright (C) 656 | This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'. 657 | This is free software, and you are welcome to redistribute it 658 | under certain conditions; type `show c' for details. 659 | 660 | The hypothetical commands `show w' and `show c' should show the appropriate 661 | parts of the General Public License. Of course, your program's commands 662 | might be different; for a GUI interface, you would use an "about box". 663 | 664 | You should also get your employer (if you work as a programmer) or school, 665 | if any, to sign a "copyright disclaimer" for the program, if necessary. 666 | For more information on this, and how to apply and follow the GNU GPL, see 667 | . 668 | 669 | The GNU General Public License does not permit incorporating your program 670 | into proprietary programs. If your program is a subroutine library, you 671 | may consider it more useful to permit linking proprietary applications with 672 | the library. If this is what you want to do, use the GNU Lesser General 673 | Public License instead of this License. But first, please read 674 | . 675 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # Eval Villain 2 | 3 | This is a web extension for Firefox that will hook dangerous functions, like 4 | eval, and warn you of their use. 5 | 6 | ![EV Console Screen Capture](./ss.png?raw=true) 7 | 8 | ## Why 9 | 10 | EV dramatically simplifies the discovery of many, otherwise difficult, DOM XSS 11 | vulnerabilities. EV can also be used to simplify the reverse engineering or 12 | debugging of JavaScript. 13 | 14 | ## Adding it to Firefox 15 | 16 | * Go [here](https://addons.mozilla.org/en-US/firefox/addon/eval-villain/) 17 | * Click "Add to Firefox" 18 | 19 | ## Normal use 20 | Turn it on, open the console `ctrl+shift+k` and browse some sites like normal. 21 | Eval Villain will inject its own henchmen into the page to keep an eye on some 22 | of the more nefarious JavaScript functions. When one of those functions is 23 | called, a notification will appear in the console. If it is of particular 24 | interest, it will be highlighted and formatted more strongly. 25 | 26 | ## Some Terminology 27 | You can probably skip this. If you don't understand how I use a term later, 28 | come back. 29 | * EV: short for Eval Villain 30 | * Hooked Input: EV hooks native JavaScript functions in order to see what input 31 | is being passed to them. I will refer to this input as hooked input. 32 | * Normal Result: Hooked Input is examined for potential user input. If no 33 | potential user input is found then the notification produced will be a normal 34 | result. 35 | * Interesting Result: Output from EV that is considered of higher priority. 36 | * popup: The popup is the menu that appears when you click the EV icon. 37 | * Configuration page: This is the page where the bulk of the configuration can 38 | be done. It can be reached by clicking "configure" in the popup menu, or in 39 | the options page. 40 | 41 | 42 | ## Configuration Options 43 | **Important**: You must refresh the web page you are testing after every single 44 | configuration change for that change to take affect. 45 | 46 | EV works by injecting a script into the page *at load time*. To limit the 47 | potential for a visited site to attack EV, EV does not have any further 48 | communication with the page after it is injected. 49 | 50 | ### popup Options 51 | Most of the popup menu just lets you turn some option on or off. EV itself can 52 | be enabled or disabled here. This should be pretty self explanatory. The only 53 | things unique to this menu are the "Enable/Disable" and "Auto Open" menus. 54 | Everything else can also be configured from the configuration page. You can get 55 | to the configuration page by clicking "configure" in the popup menu. 56 | 57 | ### Needles 58 | EV will search hooked input for each configured needle pattern. If the needle 59 | is found, EV will consider that function call an interesting result and a Needle 60 | section will be added to the output. The needle section will highlight the 61 | pattern where it is found in the input. 62 | 63 | The needle pattern can be set to a Regular Expression, see RegEx for more 64 | details. 65 | 66 | ### Blacklists 67 | Eval Villain checks if strings seen in sources are found in sinks. If a source 68 | string is found in a sink, the result is marked as interesting. It can be 69 | annoying to have common strings, like "true", marked as interesting. So 70 | configuring a blacklist will allow you to ignore these strings. 71 | 72 | Tips: 73 | * Dev out your blacklist pattern as a Needle first to make sure you are 74 | matching only what you want. 75 | * Use regex and match from the start to end `/^pattern$/` to ensure you do not 76 | not match on a string like `this contains pattern in it`. 77 | 78 | ### Regex 79 | A regular expression can be used as a pattern for Needles and Blacklists. A 80 | regular expression should always start with a "/" and end with a "/", 81 | potentially followed by the "g" and "i" flags. On the configuration page, any 82 | pattern considered by EV to be a regular expression will receive a brighter 83 | color for it's font. 84 | 85 | Internally EV uses JavaScript's RegEx implementation. 86 | 87 | Tips: 88 | * Dev RegEx in the console: 89 | ``` 90 | a = /^\s*pattern$/gi; 91 | a.test("Some pattern I found often"); // test false 92 | a.test(" pAtTerN"); // true 93 | ``` 94 | 95 | ### Targets 96 | Targets limit what pages are injected by EV. If no targets are enabled then 97 | EV will inject every page. Target patterns can contain wild cards, for example 98 | `*://example.com/*`. All the details can be found in the [Firefox 99 | documentation](https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Match_patterns) 100 | 101 | ### functions 102 | These are the functions that are being hooked. Configure new ones by putting in 103 | a nice descriptive name and a pattern that will resolve to the function. For a 104 | setter, like `innerHTML` use `setter(innerHTML)`. If no functions are enabled, 105 | then Eval Villain won't be doing much, even if it is on. Since EV injects the 106 | page before any JavaScript in the page has loaded, only native JavaScript 107 | functions can be configured. 108 | 109 | ### Enable/Disable (popup only) 110 | An entire feature can be disabled via this menu. One might disable "Query 111 | Search" if it is producing too many false positives. 112 | 113 | Tip: 114 | * Disable "Normal Results" and enable "Interesting Results" to cut down on 115 | spam. 116 | 117 | ### Auto Open (popup only) 118 | In the popup menu, the "Auto Open" section allows you to change how much 119 | information is visible by default for each result. Enabling an auto open means 120 | the console group that contains the information will automatically be open. 121 | 122 | Tip: 123 | * When working on developing a payload, auto open "Interesting Result" and 124 | "Needles" and configure a Needle to match your payload. You can then quickly 125 | see if your payload is getting filtered. 126 | * Stack should almost never be enabled here. It can be very large and you 127 | likely don't need to see it for every single result. 128 | 129 | ### Console Colors 130 | Console output is split up into various sections. Each section has a 131 | highlighting format and a default format. Default is used for most of the text 132 | while highlight is used to highlight key words. The "Console Colors" section of 133 | the configuration page allows you to configure arbitrary CSS for each format. 134 | 135 | Before saving your changes, be sure to test your configuration to see if it 136 | looks good. Open the console and click the "test" button in the configuration 137 | page. If you like the console output then click save to keep it. 138 | 139 | This version of Eval Villain was provided through the support of [Doyensec](https://doyensec.com/research.html). 140 | 141 | ![Doyensec Research](./src/icons/doyensec_logo.svg?raw=true) 142 | 143 | ## Todo: 144 | * If the config page is already open, go to that page instead of a new tab (may 145 | require permissions...) 146 | -------------------------------------------------------------------------------- /extra_icons/off_48.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swoops/eval_villain/9c5eadc46bd9f8d2199577b93d2d3a98ad69ba74/extra_icons/off_48.png -------------------------------------------------------------------------------- /extra_icons/off_96.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swoops/eval_villain/9c5eadc46bd9f8d2199577b93d2d3a98ad69ba74/extra_icons/off_96.png -------------------------------------------------------------------------------- /extra_icons/on_48_blue.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swoops/eval_villain/9c5eadc46bd9f8d2199577b93d2d3a98ad69ba74/extra_icons/on_48_blue.png -------------------------------------------------------------------------------- /extra_icons/on_48_green.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swoops/eval_villain/9c5eadc46bd9f8d2199577b93d2d3a98ad69ba74/extra_icons/on_48_green.png -------------------------------------------------------------------------------- /extra_icons/on_48_red.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swoops/eval_villain/9c5eadc46bd9f8d2199577b93d2d3a98ad69ba74/extra_icons/on_48_red.png -------------------------------------------------------------------------------- /extra_icons/on_96_blue.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swoops/eval_villain/9c5eadc46bd9f8d2199577b93d2d3a98ad69ba74/extra_icons/on_96_blue.png -------------------------------------------------------------------------------- /extra_icons/on_96_green.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swoops/eval_villain/9c5eadc46bd9f8d2199577b93d2d3a98ad69ba74/extra_icons/on_96_green.png -------------------------------------------------------------------------------- /extra_icons/on_96_red.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swoops/eval_villain/9c5eadc46bd9f8d2199577b93d2d3a98ad69ba74/extra_icons/on_96_red.png -------------------------------------------------------------------------------- /make_xpi.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | cd src 4 | zip -r -FS ../ev.zip * 5 | cd .. 6 | -------------------------------------------------------------------------------- /src/icons/doyensec_logo.svg: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 7 | 8 | 9 | 12 | 15 | 17 | 19 | 21 | 26 | 29 | 31 | 32 | 33 | 36 | 39 | 41 | 42 | 43 | 44 | 45 | 46 | 48 | 58 | 67 | 70 | 71 | 81 | 92 | 97 | 98 | 109 | 114 | 127 | 138 | 148 | 153 | 156 | 157 | 162 | 167 | 168 | 169 | 179 | 188 | 199 | 204 | 215 | 216 | 217 | 229 | 230 | 235 | 249 | 250 | 255 | 266 | 277 | 280 | 281 | 286 | 300 | 301 | 302 | -------------------------------------------------------------------------------- /src/icons/off_48.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swoops/eval_villain/9c5eadc46bd9f8d2199577b93d2d3a98ad69ba74/src/icons/off_48.png -------------------------------------------------------------------------------- /src/icons/off_96.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swoops/eval_villain/9c5eadc46bd9f8d2199577b93d2d3a98ad69ba74/src/icons/off_96.png -------------------------------------------------------------------------------- /src/icons/on_48.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swoops/eval_villain/9c5eadc46bd9f8d2199577b93d2d3a98ad69ba74/src/icons/on_48.png -------------------------------------------------------------------------------- /src/icons/on_96.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swoops/eval_villain/9c5eadc46bd9f8d2199577b93d2d3a98ad69ba74/src/icons/on_96.png -------------------------------------------------------------------------------- /src/js/background.js: -------------------------------------------------------------------------------- 1 | // default config stuff 2 | const defaultConfig = { 3 | "functions" : [ 4 | { 5 | "name" : "eval", 6 | "enabled" : true, 7 | "pattern" : "eval" 8 | }, { 9 | "name" : "Function", 10 | "enabled" : true, 11 | "pattern" : "Function" 12 | }, { 13 | "name" : "innerHTML", 14 | "enabled" : true, 15 | "pattern" : "set(Element.innerHTML)" 16 | }, { 17 | "name" : "outerHTML", 18 | "enabled" : true, 19 | "pattern" : "set(Element.outerHTML)" 20 | }, { 21 | "name" : "createContextualFragment", 22 | "enabled" : true, 23 | "pattern" : "value(Range.createContextualFragment)" 24 | }, { 25 | "name" : "document.write", 26 | "enabled" : true, 27 | "pattern" : "document.write" 28 | }, { 29 | "name" : "document.writeln", 30 | "enabled" : true, 31 | "pattern" : "document.writeln" 32 | }, { 33 | "name" : "setTimeout", 34 | "enabled" : true, 35 | "pattern" : "setTimeout" 36 | }, { 37 | "name" : "setInterval", 38 | "enabled" : true, 39 | "pattern" : "setInterval" 40 | }, { 41 | "name" : "addEventListener", 42 | "enabled" : true, 43 | "pattern" : "window.addEventListener" 44 | }, { 45 | "name" : "fetch", 46 | "enabled" : true, 47 | "pattern" : "fetch" 48 | }, { 49 | "name" : "XMLHttpRequest", 50 | "enabled" : true, 51 | "pattern" : "value(XMLHttpRequest.open)" 52 | }, { 53 | "name" : "URLSearchParams.get", 54 | "enabled" : false, 55 | "pattern" : "value(URLSearchParams.get)" 56 | }, { 57 | "name" : "decodeURI", 58 | "enabled" : false, 59 | "pattern" : "decodeURI" 60 | }, { 61 | "name" : "decodeURIComponent", 62 | "enabled" : false, 63 | "pattern" : "decodeURIComponent" 64 | } 65 | ], 66 | "blacklist" : [ 67 | { 68 | "name" : "Small Stuff", 69 | "enabled" : true, 70 | "pattern" : "/^\\s*\\S{0,3}\\s*$/" 71 | }, { 72 | "name" : "Boolean", 73 | "enabled" : true, 74 | "pattern" : "/^\\s*(?:true|false)\\s*$/gi" 75 | } 76 | ], 77 | "needles" : [ 78 | { 79 | "name" : "asdf", 80 | "enabled" : true, 81 | "pattern" : "asdf" 82 | }, { 83 | "name" : "postMessage handler", 84 | "enabled" : false, 85 | "pattern" :"/^message$/" 86 | } 87 | ], 88 | "targets" : [ 89 | { 90 | "name" : "Example Filter", 91 | "enabled" : false, 92 | "pattern" :"*://example.com/*" 93 | } 94 | ], 95 | "types" : [ 96 | { 97 | "name": "string", 98 | "pattern": "string", 99 | "enabled": true 100 | }, { 101 | "name": "object", 102 | "pattern": "object", 103 | "enabled": false 104 | }, { 105 | "name": "function", 106 | "pattern": "function", 107 | "enabled": false 108 | }, { 109 | "name": "number", 110 | "pattern": "number", 111 | "enabled": false 112 | }, { 113 | "name": "boolean", 114 | "pattern": "boolean", 115 | "enabled": false 116 | }, { 117 | "name": "undefined", 118 | "pattern": "undefined", 119 | "enabled": false 120 | }, { 121 | "name": "symbol", 122 | "pattern": "symbol", 123 | "enabled": false 124 | } 125 | ], 126 | "globals" : [ 127 | { 128 | "name" : "sinker", 129 | "enabled" : false, 130 | "pattern" : "evSinker" 131 | }, { 132 | "name" : "sourcer", 133 | "enabled" : false, 134 | "pattern" : "evSourcer" 135 | } 136 | ], 137 | "formats": [ 138 | { 139 | "name" : "title", 140 | "pretty" : "Normal Results", 141 | "use" : false, 142 | "open" : false, 143 | "default" : "color: none", 144 | "highlight" : "color: #088" 145 | }, { 146 | "name" : "interesting", 147 | "pretty" : "Interesting Results", 148 | "use" : true, 149 | "open" : true, 150 | "default" : "color: red", 151 | "highlight" : "color: #088" 152 | }, { 153 | "name" : "args", 154 | "pretty" : "Args Display", 155 | "use" : true, 156 | "open" : false, 157 | "default" : "color: none", 158 | "highlight" : "color: #088" 159 | }, { 160 | "name" : "needle", 161 | "pretty" : "Needles Search", 162 | "use" : true, 163 | "open" : true, 164 | "default" : "color: none", 165 | "highlight" : "color: #088" 166 | }, { 167 | "name" : "query", 168 | "pretty" : "Query Search", 169 | "limit" : 200, 170 | "use" : true, 171 | "open" : true, 172 | "default" : "color: none", 173 | "highlight" : "color: #088" 174 | }, { 175 | "name" : "fragment", 176 | "pretty" : "Fragment Search", 177 | "limit" : 64, 178 | "use" : true, 179 | "open" : true, 180 | "default" : "color: none", 181 | "highlight" : "color: #088" 182 | }, { 183 | "name" : "winname", 184 | "pretty" : "window.name Search", 185 | "limit" : 200, 186 | "use" : true, 187 | "open" : true, 188 | "default" : "color: none", 189 | "highlight" : "color: #088" 190 | }, { 191 | "name" : "path", 192 | "pretty" : "Path Search", 193 | "limit" : 32, 194 | "use" : false, 195 | "open" : true, 196 | "default" : "color: none", 197 | "highlight" : "color: #088" 198 | }, { 199 | "name" : "referrer", 200 | "pretty" : "Referrer Search", 201 | "limit" : 32, 202 | "use" : false, 203 | "open" : true, 204 | "default" : "color: none", 205 | "highlight" : "color: #088" 206 | }, { 207 | "name" : "cookie", 208 | "pretty" : "Cookie Search", 209 | "limit" : 32, 210 | "use" : true, 211 | "open" : false, 212 | "default" : "color: none", 213 | "highlight" : "color: yellow" 214 | }, { 215 | "name" : "localStore", 216 | "pretty" : "localStorage", 217 | "limit" : 100, 218 | "use" : true, 219 | "open" : false, 220 | "default" : "color: none", 221 | "highlight" : "color: yellow" 222 | }, { 223 | "name" : "userSource", 224 | "pretty" : "User Sources", 225 | "limit" : 100, 226 | "use" : true, 227 | "open" : false, 228 | "default" : "color: none", 229 | "highlight" : "color:#147599" 230 | }, { 231 | "name" : "stack", 232 | "pretty" : "Stack Display", 233 | "use" : true, 234 | "open" : false, 235 | "default" : "color: none", 236 | "highlight" : "color: #088" 237 | }, { 238 | "name" : "logReroute", 239 | "pretty" : "Log Reroute", 240 | "use" : true, 241 | "open" : null, 242 | "default" : "N/A", 243 | "highlight" : "N/A" 244 | } 245 | ] 246 | } 247 | 248 | function getAllConf() { 249 | return browser.storage.local.get(Object.keys(defaultConfig)).catch(console.error); 250 | } 251 | 252 | async function getAllConfValidated() { 253 | let dbconf = await getAllConf(); 254 | for (let i = 0; i < 2; i++) { // retry loop 255 | let success = true; 256 | for (const i of Object.keys(defaultConfig)) { 257 | if (dbconf[i] === undefined || !Array.isArray(dbconf[i])) { 258 | await checkStorage(); 259 | dbconf = await getAllConf(); 260 | success = false; 261 | } 262 | } 263 | if (success) { 264 | return dbconf; 265 | } 266 | } 267 | return null; 268 | } 269 | 270 | function debugLog() { 271 | if (!this.debug) return; 272 | console.log(...arguments); 273 | } 274 | 275 | async function checkStorage() { 276 | const dbconf = await getAllConf(); 277 | 278 | function updateIt(what) { 279 | const k = {}; 280 | k[what] = defaultConfig[what]; 281 | return browser.storage.local.set(k) 282 | .then(() => console.log(`updated ${what}`)); 283 | } 284 | 285 | for (const iter in defaultConfig) { 286 | if (dbconf[iter] === undefined) { 287 | updateIt(iter); // DNE, add it 288 | } else if (iter === "formats") { 289 | const dbf = dbconf.formats; 290 | if (!Array.isArray(dbf)) { 291 | updateIt(iter); 292 | continue; 293 | } 294 | // if defaultConfig has changed since install, we update 295 | const defFormats = defaultConfig.formats; 296 | const currentNames = dbf.map(x => x.name); 297 | const defNames = defFormats.map(x => x.name); 298 | if (!arraysEqual(currentNames, defNames)) { 299 | updateIt(iter); 300 | } 301 | 302 | // if formats fields change, update it 303 | dbf.some((obj, i) => { 304 | // TODO: improve DB representation of formats 305 | const def = defFormats[i]; 306 | if (obj.name != def.name) { 307 | updateIt(iter); 308 | return true; 309 | } 310 | const s1 = Object.keys(obj).join(); 311 | const s2 = Object.keys(def).join(); 312 | if (s1 != s2) { 313 | updateIt(iter); 314 | return true; 315 | } 316 | return false; 317 | }) 318 | } 319 | } 320 | } 321 | 322 | function arraysEqual(a, b) { 323 | if (a.length !== b.length) { 324 | return false; 325 | } 326 | for (let i = 0; i < a.length; i++) { 327 | if (a[i] !== b[i]) { 328 | return false; 329 | } 330 | } 331 | return true; 332 | } 333 | 334 | async function getConfigForRegister() { 335 | const dbconf = await getAllConfValidated(); 336 | // .then(worked); 337 | 338 | const config = {}; 339 | config.formats = {}; 340 | for (const i of dbconf.formats) { 341 | const tmp = Object.assign({}, i); 342 | config.formats[tmp.name] = tmp; 343 | delete tmp.name; 344 | } 345 | 346 | // globals 347 | for (const i of dbconf.globals) { 348 | if (i.enabled) { 349 | config[i.name] = i.pattern; 350 | } 351 | } 352 | 353 | for (const what of ["needles", "blacklist", "functions", "types"]) { 354 | config[what] = config[what] = dbconf[what] 355 | .filter(x => x.enabled) 356 | .map(x => x.pattern); 357 | } 358 | 359 | // target stuff { 360 | const match = []; 361 | const targRegex = /^(https?|wss?|file|ftp|\*):\/\/(\*|\*\.[^|)}>#]+|[^|)}>#]+)\/.*$/; 362 | for (const i of dbconf.targets) { 363 | if (i.enabled) { 364 | if (targRegex.test(i.pattern)) { 365 | match.push(i.pattern); 366 | } else { 367 | throw `Error on Target ${i.name}: ${i.pattern} must match: ${targRegex}`; 368 | } 369 | } 370 | } 371 | 372 | // no targets enabled means do all 373 | if (match.length === 0) { 374 | match.push(""); 375 | } 376 | debugLog("[EV DEBUG] matches: %s", match); 377 | return [config, match]; 378 | } 379 | 380 | 381 | /** 382 | * Registers the content script with the current config 383 | **/ 384 | async function register() { 385 | if (this.unreg != null) { 386 | // content script is registered already, so remove it first don't worry 387 | // about the icon though, if we fail something else will change it to off 388 | removeScript(false); 389 | } 390 | const [config, match] = await getConfigForRegister(); 391 | 392 | // anything to register? 393 | if (config.functions.length === 0) { 394 | removeScript(); 395 | res(false); 396 | return; 397 | } 398 | 399 | const code = `config = ${JSON.stringify(config)};`; 400 | 401 | 402 | // firefox >=59, not supported in chrome... 403 | this.unreg = await browser.contentScripts.register({ 404 | matches: match, 405 | js: [ 406 | {code: code}, // contains configuration for rewriter 407 | {file: "/js/rewriter.js"}, // Has actual code that gets injected into the page 408 | {file: "/js/switcheroo.js"} // cause the injection 409 | ], 410 | runAt: "document_start", 411 | allFrames: true 412 | }); 413 | 414 | browser.browserAction.setTitle({title: "EvalVillain: ON"}); 415 | browser.browserAction.setIcon({path: "/icons/on_48.png"}); 416 | debugLog("[EV_DEBUG] %cInjection Script registered", "color:#088;") 417 | return true; 418 | } 419 | 420 | function removeScript(icon=true) { 421 | if (this.unreg) { 422 | this.unreg.unregister(); 423 | } 424 | this.unreg = null; 425 | 426 | if (icon) { 427 | // turn of UI 428 | browser.browserAction.setTitle({title: "EvalVillain: OFF"}); 429 | browser.browserAction.setIcon({ path: "/icons/off_48.png"}); 430 | } 431 | } 432 | 433 | function toggleEV() { 434 | if (this.unreg) { 435 | removeScript(); 436 | return new Promise(res => res()); 437 | } else { 438 | return register(); 439 | } 440 | } 441 | 442 | browser.commands.onCommand.addListener(function(command) { 443 | if (command == "toggle") toggleEV(); 444 | }); 445 | 446 | function handleMessage(request, _sender, _sendResponse) { 447 | if (request === "on?") { 448 | return new Promise(res => res(this.unreg ? true: false)); 449 | } else if (request === "toggle") { 450 | return toggleEV(); 451 | } else if (request === "updated") { 452 | if (this.unreg) { 453 | return register(); 454 | } else { 455 | return new Promise(res => res(false)); 456 | } 457 | } else if (request === "getScriptInfo") { 458 | return getConfigForRegister(); 459 | } else { 460 | const er = `unkown msg: ${request}`; 461 | console.error(er); 462 | } 463 | } 464 | 465 | function handleInstalled(details) { 466 | this.debug = details.temporary; 467 | debugLog("[EV DEBUG] installed with debugging"); 468 | checkStorage(); 469 | if (this.debug) { 470 | register(); 471 | } 472 | } 473 | 474 | browser.runtime.onMessage.addListener(handleMessage); 475 | browser.runtime.onInstalled.addListener(handleInstalled); 476 | -------------------------------------------------------------------------------- /src/js/bkg_api.js: -------------------------------------------------------------------------------- 1 | async function updateBackground() { 2 | return browser.runtime.sendMessage("updated"); 3 | } 4 | 5 | async function amIOn() { 6 | return browser.runtime.sendMessage("on?"); 7 | } 8 | 9 | async function toggleBackground() { 10 | return browser.runtime.sendMessage("toggle"); 11 | } 12 | -------------------------------------------------------------------------------- /src/js/rewriter.js: -------------------------------------------------------------------------------- 1 | /* Eval Villain just jams this rewriter function into the loading page, with 2 | * some JSON as CONFIG. Normally Firefox does this for you from the 3 | * background.js file. But you could always copy paste this code anywhere you 4 | * want. Such as into a proxie'd response or electron instramentation. 5 | */ 6 | const rewriter = function(CONFIG) { 7 | // handled this way to preserve encoding... 8 | function getAllQueryParams(search) { 9 | return search.substr(search[0] == '?'? 1: 0) 10 | .split("&").map(x => x.split(/=(.*)/s)); 11 | } 12 | 13 | class SourceFifo { 14 | constructor(limit) { 15 | this.limit = limit; 16 | this.fifo = []; 17 | this.set = new Set(); 18 | this.removed = 0; 19 | } 20 | 21 | nq(sObj) { 22 | this.set.add(sObj.search); 23 | this.fifo.push(sObj); 24 | while (this.set.size > this.limit) { 25 | this.removed++; 26 | this.dq(); 27 | } 28 | return this.removed; 29 | } 30 | 31 | dq() { 32 | const last = this.fifo.shift(); 33 | this.set.delete(last.search); 34 | return last; 35 | } 36 | 37 | has(x) { 38 | return this.set.has(x); 39 | } 40 | 41 | *genAllMatches(str) { 42 | for (const sObj of this.fifo) { 43 | if (str.includes(sObj.search)) { 44 | yield sObj; 45 | } 46 | } 47 | } 48 | } 49 | 50 | /** hold all interest fifos */ 51 | const ALLSOURCES = {}; // Used to hold all interest Fifo's 52 | 53 | function strSpliter(str, needle) { 54 | const ret = []; 55 | str.split(needle).forEach((x, index, arr)=> { 56 | ret.push(x) 57 | if (index != arr.length-1) { 58 | ret.push(needle) 59 | } 60 | }); 61 | return ret; 62 | } 63 | 64 | function regexSpliter(str, needle) { 65 | const ret = []; 66 | if (needle.global == false) { 67 | // not global regex, so just split into two on first 68 | needle.lastIndex = 0; 69 | const m = needle.exec(str)[0]; 70 | const l = str.split(m); 71 | ret.push(l[0], m, l[1]); 72 | } else { 73 | let holder = str; 74 | let match = null; 75 | needle.lastIndex = 0; 76 | let prevLast = 0; 77 | 78 | while ((match = needle.exec(str)) != null) { 79 | const m = match[0]; 80 | ret.push(holder.substr(0, holder.indexOf(m))); 81 | ret.push(m); 82 | holder = holder.substr(holder.indexOf(m)+m.length); 83 | if (prevLast >= needle.lastIndex) { 84 | real.warn("[EV] Attempting to highlight matches for this regex will cause infinite loop, stopping") 85 | break; 86 | } 87 | prevLast = needle.lastIndex; 88 | } 89 | ret.push(holder); 90 | } 91 | return ret; 92 | } 93 | 94 | /** Contains regex/str searches for needles/blacklists **/ 95 | class NeedleBundle { 96 | 97 | /** 98 | * Hold user defined needles, string/regex, to search sinks for. 99 | * @param {string[]} needleList Array of needles, as strings 100 | * @example 101 | * // Needle bundle for substring `asdf` and regex `/asdf/gi` 102 | * const x = new NeedleBundle(["asdf", "/asdf/gi"]); 103 | **/ 104 | constructor(needleList) { 105 | this.needles = []; 106 | this.regNeedle = []; 107 | const test = /^\/(.*)\/(i|g|gi|ig)?$/; 108 | for (const need of needleList) { 109 | const s = test.exec(need); 110 | if (s) { 111 | const reg = new RegExp(s[1], 112 | s[2] === undefined? "": s[2]); 113 | this.regNeedle.push(reg); 114 | } else { 115 | this.needles.push(need); 116 | } 117 | } 118 | } 119 | 120 | *genStrMatches(str) { 121 | for (const need of this.needles) { 122 | if (str.includes(need)) { 123 | yield need; 124 | } 125 | } 126 | } 127 | 128 | *genRegMatches(str) { 129 | for (const need of this.regNeedle) { 130 | need.lastIndex = 0; // just to be sure there is no funny buisness 131 | if (need.test(str)) { 132 | need.lastIndex = 0; // This line is important b/c JS regex holds a state secretly :( 133 | yield need; 134 | } 135 | } 136 | } 137 | 138 | *genMatches(str) { 139 | for (const match of this.genStrMatches(str)) { 140 | yield match; 141 | } 142 | for (const match of this.genRegMatches(str)) { 143 | yield match; 144 | } 145 | } 146 | 147 | matchAny(str) { 148 | for (const match of this.genMatches(str)) { 149 | if (match) { 150 | return true; 151 | } 152 | } 153 | return false; 154 | } 155 | } 156 | 157 | /** Everything that might make a particular sink interesting */ 158 | class SearchBundle { 159 | /** 160 | * Contains qualifications for sink to be considered interesting 161 | * @param {NeedleBundle} needles Needles ie user provided string/regex 162 | * @param {object} fifoBank Maps source name to `SourceFifo` 163 | **/ 164 | constructor(needles, fifoBank) { 165 | this.needles = needles; 166 | this.fifoBank = fifoBank 167 | } 168 | 169 | *genSplits(str) { 170 | for (const match of this.needles.genStrMatches(str)) { 171 | yield { 172 | name: "needle", decode:"", 173 | search: match, 174 | split: strSpliter(str, match) 175 | }; 176 | } 177 | for (const match of this.needles.genRegMatches(str)) { 178 | yield { 179 | name: "needle", decode:"", 180 | search: match, 181 | split: regexSpliter(str, match) 182 | }; 183 | } 184 | 185 | for (const [key, fifo] of Object.entries(this.fifoBank)) { 186 | for (const match of fifo.genAllMatches(str)) { 187 | yield { 188 | name: key, 189 | split: strSpliter(str, match.search), 190 | ...match, 191 | }; 192 | } 193 | } 194 | } 195 | } 196 | 197 | let rotateWarnAt = 8; 198 | 199 | // set of strings to search for 200 | function addToFifo(sObj, fifoName) { // TODO: add blacklist arg 201 | const fifo = ALLSOURCES[fifoName]; 202 | if (!fifo) { 203 | throw `No ${fifoName}`; 204 | } 205 | for (const [search, decode] of deepDecode(sObj.search)) { 206 | const throwaway = fifo.nq({...sObj, search: search, decode: decode}); 207 | 208 | if (throwaway % rotateWarnAt == 1) { 209 | rotateWarnAt *= 2; 210 | const intCol = CONFIG.formats.interesting; 211 | real.log(`%c[EV INFO]%c '${CONFIG.formats[fifoName].pretty}' fifo limit (${fifo.limit}) exceeded. EV has rotated out ${throwaway} items so far. From url: %c${location.href}`, 212 | intCol.highlight, intCol.default, intCol.highlight 213 | ); 214 | } 215 | } 216 | 217 | function *deepDecode(s) { 218 | // TODO: Sets... 219 | if (typeof(s) === 'string') { 220 | yield *decodeAll(s); 221 | } else if (typeof(s) === "object") { 222 | const fwd = `\t{\n\t\tlet _ = ${JSON.stringify(s)};\n\t\t_`; 223 | yield *decodeAny(s, `\t\tx = _\n\t}\n`, fwd); 224 | } 225 | } 226 | 227 | function isNeedleBad(str) { 228 | if (typeof(str) !== "string" || str.length == 0 || fifo.has(str)) { 229 | return true; 230 | } 231 | return BLACKLIST.matchAny(str); 232 | } 233 | 234 | 235 | function *decodeAny(any, decoded, fwd) { 236 | if (Array.isArray(any)) { 237 | yield *decodeArray(any, decoded, fwd); 238 | } else if (typeof(any) == "object"){ 239 | yield *decodeObject(any, decoded, fwd); 240 | } else { 241 | yield *decodeAll(any, fwd + "= x;\n" + decoded); 242 | } 243 | } 244 | 245 | function *decodeArray(a, decoded, fwd) { 246 | for (const i in a) { 247 | yield *decodeAny(a[i], decoded, fwd+`[${i}]`); 248 | } 249 | } 250 | 251 | function* decodeObject(o, decoded, fwd) { 252 | for (const prop in o) { 253 | yield *decodeAny(o[prop], decoded, fwd+`[${JSON.stringify(prop)}]`); 254 | } 255 | } 256 | 257 | /** 258 | * Generate all possible decodings for string 259 | * @s {string} args array of arguments 260 | * @decoded {string} string representing deocoding method 261 | * 262 | **/ 263 | function *decodeAll(s, decoded="") { 264 | if (isNeedleBad (s)) { 265 | return; 266 | } 267 | yield [s, decoded]; 268 | 269 | // JSON 270 | try { 271 | const dec = real.JSON.parse(s); 272 | if (dec) { 273 | const fwd = `\t{\n\t\tlet _ = ${s};\n\t\t_`; 274 | yield *decodeAny(dec, `\t\tx = JSON.stringify(_);\n\t}\n${decoded}`, fwd); 275 | return; 276 | } 277 | } catch (_) {/**/} 278 | 279 | // URL decoder 280 | let url = null; 281 | try { 282 | url = new URL(s); // need to call URL, if it's not a URL you hit catch 283 | // This caused a lot of spam, so removing for now 284 | // if (url.hostname != location.hostname) { 285 | // const dec = `` 286 | // + `\t{\n` 287 | // + `\t\tconst _ = new URL("${s.replaceAll('"', "%22")}");\n` 288 | // + `\t\t_.hostname = x;\n` 289 | // + `\t\tx = _.href;\n` 290 | // + `\t}\n` 291 | // + decoded; 292 | // yield *decodeAll(url.hostname, dec); 293 | // } 294 | 295 | // query string of URL 296 | for (const [key, value] of getAllQueryParams(url.search)) { 297 | const dec = `` 298 | + `\t{\n` 299 | + `\t\tconst _ = new URL("${s.replaceAll('"', "%22")}");\n` 300 | + `\t\t_.searchParams.set('${key.replaceAll('"', '\x22')}', decodeURIComponent(x));\n` 301 | + `\t\tx = _.href;\n` 302 | + `\t}\n` 303 | + decoded; 304 | yield *decodeAll(value, dec); 305 | } 306 | if (url.hash.length > 1) { 307 | const dec = `` 308 | + `\t{\n` 309 | + `\t\tconst _ = new URL("${s.replaceAll('"', "%22")}");\n` 310 | + `\t\t_.hash = x;\n` 311 | + `\t\tx = _.href;\n` 312 | + `\t}\n` 313 | + decoded; 314 | yield *decodeAll(url.hash.substring(1), dec); 315 | } 316 | } catch (err) { 317 | if (url) { 318 | real.error("Got error during decoding: %s", JSON.stringify(err.name)); 319 | } 320 | } 321 | 322 | // atob 323 | try { 324 | const dec = real.atob.call(window, s); 325 | if (dec) { 326 | yield *decodeAll(dec, `\tx = btoa(x);\n${decoded}`); 327 | return; 328 | } 329 | } catch (_) {/**/} 330 | 331 | // string replace 332 | const dec = s.replaceAll("+", " "); 333 | if (dec !== s) { 334 | yield *decodeAll(dec, `\tx = x.replaceAll("+", " ");\n${decoded}`); 335 | } 336 | 337 | if (!s.includes("%")) { 338 | return; 339 | } 340 | 341 | // match all of them 342 | try { 343 | const dec = real.decodeURIComponent(s); 344 | if (dec && dec != s) { 345 | yield *decodeAll(dec, `\tx = encodeURIComponent(x);\n${decoded}`); 346 | } 347 | } catch(_){/**/} 348 | 349 | // match all of them 350 | try { 351 | const dec = real.decodeURI(s); 352 | if (dec && dec != s) { 353 | yield *decodeAll(dec, `\tx = encodeURIComponent(x);\n${decoded}`); 354 | } 355 | } catch(_){/**/} 356 | } 357 | } 358 | 359 | /** 360 | * Helper function to turn parsable arguments into nice strings 361 | * @arg {Object|string} arg Argument to be turned into a string 362 | **/ 363 | function argToString(arg) { 364 | if (typeof(arg) === "string") 365 | return arg 366 | if (typeof(arg) === "object") 367 | return real.JSON.stringify(arg) 368 | return arg.toString(); 369 | } 370 | 371 | /** 372 | * Returns the type of an argument. Returns null if the argument should be 373 | * skipped. 374 | * @arg arg Argument to have it's type checked 375 | */ 376 | function typeCheck(arg) { 377 | const knownTypes = [ 378 | "function", "string", "number", "object", "undefined", "boolean", 379 | "symbol" 380 | ]; 381 | const t = typeof(arg); 382 | 383 | // sanity 384 | if (!knownTypes.includes(t)) { 385 | throw `Unexpect argument type ${t} for ${arg}`; 386 | } 387 | 388 | // configured to not check 389 | if (!CONFIG.types.includes(t)) { 390 | return null; 391 | } 392 | 393 | return t; 394 | } 395 | 396 | /** 397 | * Turn all arguments into strings and change record original type 398 | * 399 | * @args {Object} args `arugments` object of hooked function 400 | */ 401 | function getArgs(args) { 402 | const ret = []; 403 | 404 | if (typeof(arguments[Symbol.iterator]) !== "function") { 405 | throw "Aguments can't be iterated over." 406 | } 407 | 408 | for (const i in args) { 409 | if (!args.hasOwnProperty(i)) continue; 410 | const t = typeCheck(args[i]); 411 | if (t === null) continue; 412 | const ar = { 413 | "type": t, 414 | "str": argToString(args[i]), 415 | "num": +i, 416 | } 417 | if (t !== "string") { 418 | ar["orig"] = args[i]; 419 | } 420 | ret.push(ar); 421 | } 422 | return {"args" : ret, "len" : args.length}; 423 | } 424 | 425 | function printTitle(name, format, num) { 426 | let titleGrp = "%c[EV] %c%s%c %s" 427 | let func = real.logGroup; 428 | const values = [ 429 | format.default, format.highlight, name, format.default, location.href 430 | ]; 431 | 432 | if (!format.open) { 433 | func = real.logGroupCollapsed; 434 | } 435 | if (num >1) { 436 | // add arg number in format 437 | titleGrp = "%c[EV] %c%s[%d]%c %s" 438 | values.splice(3,0,num); 439 | } 440 | func(titleGrp, ...values) 441 | return titleGrp; 442 | } 443 | 444 | /** 445 | * Print all the arguments to the hooked funciton 446 | * 447 | * @argObj {Array} args array of arguments 448 | **/ 449 | function printArgs(argObj) { 450 | const argFormat = CONFIG.formats.args; 451 | if (!argFormat.use) return; 452 | const func = argFormat.open ? real.logGroup : real.logGroupCollapsed; 453 | 454 | function printFuncAlso(arg) { 455 | if (arg.type === "function" && arg.orig) { 456 | real.log(arg.orig); 457 | } 458 | } 459 | 460 | if (argObj.len === 1 && argObj.args.length == 1) { 461 | const arg = argObj.args[0]; 462 | const argTitle ="%carg(%s):"; 463 | const data = [ 464 | argFormat.default, 465 | arg.type, 466 | ]; 467 | func(argTitle, ...data); 468 | real.log("%c%s", argFormat.highlight, arg.str); 469 | printFuncAlso(arg); 470 | real.logGroupEnd(argTitle); 471 | return 472 | } 473 | 474 | const argTitle = "%carg[%d/%d](%s): " 475 | const total = argObj.len; 476 | for (const i of argObj.args) { 477 | func(argTitle, argFormat.default, i.num + 1, total, i.type); 478 | real.log("%c%s", argFormat.highlight, i.str); 479 | printFuncAlso(i); 480 | real.logGroupEnd(argTitle); 481 | } 482 | } 483 | 484 | function zebraBuild(arr, fmts) { // fmt2 is used via arguments 485 | const fmt = "%c%s".repeat(arr.length); 486 | const args = []; 487 | for (let i=0; i 80) { 522 | dots = "..." 523 | word = s.search.substr(0, 77); 524 | } 525 | const title = [ 526 | s.param? `${display}[${s.param}]: ` :`${display}: `, word 527 | ]; 528 | if (argObj.len > 1) { 529 | title.push(`${dots} found (arg:`, arg.num, ")"); 530 | } else { 531 | title.push(`${dots} found`); 532 | } 533 | if (s.decode) { 534 | title.push(" [Decoded]"); 535 | } 536 | 537 | const end = zebraGroup(title, fmt); 538 | if (dots) { 539 | const d = "Entire needle:" 540 | real.logGroupCollapsed(d); 541 | real.log(s.search); 542 | real.logGroupEnd(d); 543 | } 544 | if (s.decode) { // TODO probably should be moved to the recursve decoder area 545 | const d = "Encoder function:"; 546 | real.logGroupCollapsed(d); 547 | let add = "\t"; 548 | let pmtwo = false; 549 | switch (s.name) { // TODO: this should be moved to interestBundle, I think 550 | case "path": 551 | if (!s.param) break; 552 | add += `if (y) {\n\t\t` 553 | add += `const pth = document.location.pathname.substring(1).split('/');\n\t\t`; 554 | add += `pth[${s.param}] = x;\n\t\t`; 555 | add += `document.location.pathname = '/' + pth.join('/');\n\t`; 556 | add += `}\n\t` 557 | pmtwo = true; 558 | break; 559 | case "localStore": 560 | if (!s.param) break; 561 | add += `if (y) localStorage.setItem("${s.param}", x);\n\t`; 562 | pmtwo = true; 563 | break; 564 | case "query": 565 | if (!s.param) break; 566 | add += `const _ = new URL(window.location.href);\n\t` 567 | add += `// next line might need some changes\n\t`; 568 | add += `_.searchParams.set('${s.param.replaceAll('"', '\x22')}', decodeURIComponent(x));\n\t`; 569 | add += `x = _.href;\n\t`; 570 | add += `if (y) window.location = x;\n\t` 571 | pmtwo = true; 572 | break; 573 | case "winname": 574 | add += `if (y) window.name = x;\n\t` 575 | pmtwo = true; 576 | break; 577 | } 578 | 579 | real.log(`encoder = ${pmtwo ? "(x, y)" : "x"} => {\n${s.decode}${add}return x;\n}//`); 580 | real.logGroupEnd(d); 581 | } 582 | zebraLog(s.split, fmt); 583 | real.logGroupEnd(end); 584 | } 585 | 586 | // update changing lists 587 | addChangingSearch(); 588 | 589 | const ret = []; 590 | 591 | for (const arg of argObj.args) { 592 | for (const match of intrBundle.genSplits(arg.str)) { 593 | ret.push(() => printer(match, arg)); 594 | } 595 | } 596 | 597 | return ret; 598 | } 599 | 600 | /** 601 | * Parse all arguments for function `name` and pretty print them in the console 602 | * @param {SearchBundle} intrBundle Used to check if a call is interesting 603 | * @param {string} name Name of function that is being hooked 604 | * @param {array} args array of arguments 605 | * @returns {boolean} Always returns `false` 606 | **/ 607 | function EvalVillainHook(intrBundle, name, args) { 608 | const fmts = CONFIG.formats; 609 | let argObj = {}; 610 | try { 611 | argObj = getArgs(args); 612 | } catch(err) { 613 | real.log("%c[ERROR]%c EV args error: %c%s%c on %c%s%c", 614 | fmts.interesting.default, 615 | fmts.interesting.highlight, 616 | fmts.interesting.default, err, fmts.interesting.highlight, 617 | fmts.interesting.default, document.location.href, fmts.interesting.highlight 618 | ); 619 | return false; 620 | } 621 | 622 | if (argObj.args.length == 0) { 623 | return false; 624 | } 625 | 626 | // does this call have an interesting result? 627 | let format = null; 628 | const printers = getInterest(argObj, intrBundle); 629 | 630 | if (printers.length > 0) { 631 | format = fmts.interesting; 632 | if (!format.use) { 633 | return false; 634 | } 635 | } else { 636 | format = fmts.title; 637 | if (!format.use) { 638 | return false; 639 | } 640 | } 641 | 642 | const titleGrp = printTitle(name, format, argObj.len); 643 | printArgs(argObj); 644 | 645 | // print all intereresting reuslts 646 | printers.forEach(x=>x()); 647 | 648 | // stack display 649 | // don't put this into a function, it will be one more thing on the call 650 | // stack 651 | const stackFormat = CONFIG.formats.stack; 652 | if (stackFormat.use) { 653 | const stackTitle = "%cstack: " 654 | if (stackFormat.open) { 655 | real.logGroup(stackTitle, stackFormat.default); 656 | } else { 657 | real.logGroupCollapsed(stackTitle, stackFormat.default); 658 | } 659 | real.trace(); 660 | real.logGroupEnd(stackTitle); 661 | } 662 | real.logGroupEnd(titleGrp); 663 | return false; 664 | } 665 | 666 | class evProxy { 667 | constructor(intr) { 668 | self.intr = intr; 669 | } 670 | 671 | // Start of Eval Villain hook 672 | apply(_target, _thisArg, args) { 673 | EvalVillainHook(self.intr, this.evname, args); 674 | return Reflect.apply(...arguments); 675 | } 676 | 677 | // Start of Eval Villain hook 678 | construct(_target, args, _newArg) { 679 | EvalVillainHook(self.intr, this.evname, args); 680 | return Reflect.construct(...arguments); 681 | } 682 | } 683 | 684 | /* 685 | * NOTICE: 686 | * updates here should maybe be reflected in input validation 687 | * file: /pages/config/config.js 688 | * function: validateFunctionsPattern 689 | */ 690 | /** 691 | * Accepts sink name, such as `document.write` or `value(URLSearchParams.get)` and replaces the sink with a proxy (`evProxy`). 692 | * @param {string} evname Name of sink to hook. 693 | **/ 694 | function applyEvalVillain(evname) { 695 | function getFunc(n) { 696 | const ret = {} 697 | ret.where = window; 698 | const groups = n.split("."); 699 | let i = 0; // outside for loop for a reason 700 | for (i=0; i 1) { 749 | for (const [key, value] of getAllQueryParams(srch)) { 750 | addToFifo({ 751 | param: key, 752 | search: value 753 | }, "query"); 754 | } 755 | } 756 | } 757 | 758 | if (ALLSOURCES.path) { 759 | const pth = location.pathname; 760 | if (pth.length >= 1) { 761 | addToFifo({search: pth}, "path"); 762 | pth.substring(1) 763 | .split('/').forEach((elm, index) => { 764 | addToFifo({ 765 | param: ""+index, 766 | search: elm 767 | }, "path"); 768 | }); 769 | } 770 | } 771 | } 772 | 773 | 774 | /** 775 | * Parses initial values contained in sources and updates fifos with them. 776 | **/ 777 | function buildSearches() { 778 | const {formats} = CONFIG; 779 | 780 | function putInUse(nm) { 781 | if (formats[nm] && formats[nm].use) { 782 | ALLSOURCES[nm] = new SourceFifo(formats[nm].limit); 783 | return true; 784 | } 785 | return false; 786 | } 787 | 788 | // referer 789 | let nm = "referrer"; 790 | if (putInUse(nm) && document.referrer) { 791 | const url = new URL(document.referrer); 792 | // don't show if referer is just https://example.com/ and we are on an example.com domain 793 | if (url.search != location.search || url.search && url.pathname !== "/" && url.hostname !== location.hostname) { 794 | addToFifo({ 795 | search: document.referrer 796 | }, nm); 797 | } 798 | } 799 | 800 | // cookies 801 | nm = "cookie"; 802 | if (putInUse(nm)) { 803 | for (const i of document.cookie.split(/;\s*/)) { 804 | const s = i.split("="); 805 | if (s.length >= 2) { 806 | addToFifo({ 807 | param: s[0], 808 | search: s[1], 809 | }, nm); 810 | } else { 811 | addToFifo({ 812 | search: s[0], 813 | }, nm); 814 | } 815 | } 816 | } 817 | 818 | nm = "localStore" 819 | if (putInUse(nm)){ 820 | const l = real.localStorage.length; 821 | for (let i=0; i EvalVillainHook(INTRBUNDLE, x, y); 885 | delete CONFIG.sinker; 886 | } 887 | 888 | if (CONFIG.sourcer) { 889 | const fmt = CONFIG.formats.userSource; 890 | if (fmt.use) { 891 | const srcer = CONFIG.sourcer; 892 | ALLSOURCES.userSource = new SourceFifo(fmt.limit); 893 | window[srcer] = (src_name, src_val, debug=false) => { 894 | // ex: evSourcer("Response from fetch", resp.json(), true) 895 | // debug=true results in a console.debug for each source injested 896 | if (debug) { 897 | const o = typeof(src_val) === 'string'? src_val: real.JSON.stringify(src_val); 898 | real.debug(`[EV] ${srcer}[${src_name}] from ${document.location.origin} added:\n ${o}`); 899 | } 900 | addToFifo({ 901 | display: `${srcer}[${src_name}]`, 902 | search: src_val, 903 | }, "userSource"); 904 | return false; 905 | } 906 | delete CONFIG.sourcer; 907 | } 908 | } 909 | 910 | real.log("%c[EV]%c Functions hooked for %c%s%c", 911 | CONFIG.formats.interesting.highlight, 912 | CONFIG.formats.interesting.default, 913 | CONFIG.formats.interesting.highlight, 914 | document.location.origin, 915 | CONFIG.formats.interesting.default 916 | ); 917 | } 918 | -------------------------------------------------------------------------------- /src/js/switcheroo.js: -------------------------------------------------------------------------------- 1 | /* The background.js file composes this with a `config` and the rewriter.js, 2 | * which contains the rewriter function. So complete source that will run looks like: 3 | * 4 | * const config = {"formats": .......} // config to be used by rewriter 5 | * const rewriter = function(CONFIG) { .... // Code to be injected into page, with above config 6 | * 7 | */ 8 | 9 | /** 10 | * Picks random number to verify the inject worked... does not need to be 11 | * random. It's overkill really. 12 | */ 13 | function makeid() { 14 | let ret = ''; 15 | const alph = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789'; 16 | let i = Math.random() * 16 + 8; 17 | while (i < 32) { 18 | ret += alph.charAt(Math.floor(Math.random() * alph.length)); 19 | i += 1; 20 | } 21 | return ret; 22 | } 23 | 24 | /* 25 | * start content script 26 | * 27 | * Everything above is what will be injected 28 | */ 29 | function inject_it(func, info) { 30 | const checkId = `data-${makeid()}`; // document gets a head.div with id checkId on success 31 | 32 | func = func.toString(); 33 | info["checkId"] = checkId; 34 | const inject = `(${func})(${JSON.stringify(info)});`; 35 | 36 | const s = document.createElement('script'); 37 | s.type = "text/javascript"; 38 | s.onload = () => this.remove(); // Keep dom clean 39 | s.innerHTML = inject; // yeah, it's ironic 40 | document.documentElement.appendChild(s); 41 | 42 | // If rewriter executes, checkId will be set. Otherwise CSP probably blocked 43 | if (!s.hasAttribute(checkId)) { 44 | console.log("%c[ERROR]%c EV failed to load on %c%s%c", 45 | config.formats.interesting.default, 46 | config.formats.interesting.highlight, 47 | config.formats.interesting.default, 48 | document.location.href, 49 | config.formats.interesting.highlight 50 | ); 51 | s.remove(); 52 | } 53 | } 54 | 55 | // config and rewriter should be put into this by the background script 56 | inject_it(rewriter, config); 57 | -------------------------------------------------------------------------------- /src/manifest.json: -------------------------------------------------------------------------------- 1 | { 2 | "manifest_version" : 2, 3 | "name" : "Eval Villain", 4 | "version" : "2.11", 5 | "description" : "Hook interesting functions to see their input.", 6 | "permissions": ["", "storage"], 7 | "icons" : { 8 | "48" : "icons/on_48.png", 9 | "96" : "icons/on_96.png" 10 | }, 11 | 12 | "background": { 13 | "scripts": ["/js/background.js"] 14 | }, 15 | 16 | "browser_action": { 17 | "default_title": "EvalVillain: off", 18 | "default_icon": { 19 | "48": "/icons/off_48.png", 20 | "96": "/icons/off_96.png" 21 | }, 22 | "default_popup": "/pages/popup/menu.html" 23 | }, 24 | 25 | "options_ui": { 26 | "page": "/pages/options/options.html" 27 | }, 28 | 29 | "commands": { 30 | "toggle": { 31 | "description": "Toggle Eval Villain" 32 | } 33 | } 34 | } 35 | -------------------------------------------------------------------------------- /src/pages/config/config.css: -------------------------------------------------------------------------------- 1 | * { 2 | margin: 0; 3 | padding: 0; 4 | } 5 | 6 | body { 7 | background: #000; 8 | color: #859900; 9 | font-family: 'Open Sans',arial,helvetica,sans-serif; 10 | font-weight: 400; 11 | font-size: 16px; 12 | } 13 | 14 | .container { 15 | margin: 48px auto; 16 | width: 610px; 17 | } 18 | 19 | h1 { 20 | font-size: 24px; 21 | font-weight: 400; 22 | color: #859900; 23 | margin: 15px 0; 24 | } 25 | 26 | .table { 27 | width: 600px; 28 | background: #111; 29 | border: 1px solid #aaa; 30 | display: inline-block; 31 | } 32 | 33 | .closed { display: none !important; } 34 | .open { display: block; } 35 | 36 | .row { 37 | display: flex; 38 | } 39 | 40 | .table .row:nth-child(1) { 41 | border-bottom: 1px solid #aaa; 42 | } 43 | 44 | .table .row:nth-child(even) { 45 | background: #181818; 46 | } 47 | 48 | .col { 49 | position: relative; 50 | width: 100%; 51 | min-height: 1px; 52 | padding: 15px 0; 53 | flex-basis: 0; 54 | flex-grow: 1; 55 | max-width: 100%; 56 | } 57 | 58 | .col-sm { 59 | flex: 0 0 25%; 60 | max-width: 25%; 61 | position: relative; 62 | width: 100%; 63 | min-height: 1px; 64 | } 65 | 66 | .col-md { 67 | flex: 0 0 33%; 68 | max-width: 33%; 69 | position: relative; 70 | width: 100%; 71 | min-height: 1px; 72 | } 73 | 74 | .col-lg { 75 | flex: 0 0 42%; 76 | max-width: 42%; 77 | position: relative; 78 | width: 100%; 79 | min-height: 1px; 80 | } 81 | 82 | .col-xl { 83 | flex: 0 0 50%; 84 | max-width: 50%; 85 | position: relative; 86 | width: 100%; 87 | min-height: 1px; 88 | } 89 | 90 | .cell { 91 | text-align: center; 92 | } 93 | 94 | legend { 95 | padding: 18px 0; 96 | font-size: 20px; 97 | } 98 | 99 | .legend { 100 | display: none; 101 | position: relative; 102 | transition: all 1s ease-out; 103 | } 104 | 105 | 106 | input.regex { 107 | color: #c7e600 !important; 108 | } 109 | 110 | div.regex { 111 | font-size: 12px; 112 | color: #c7e600; 113 | position: absolute; 114 | top: -13px; 115 | left: 13px; 116 | border: 1px solid #c7e600; 117 | background-color: rgb(133, 153, 0, 0.3); 118 | padding: 2px 4px; 119 | } 120 | 121 | legend span { 122 | cursor: pointer; 123 | color: #c7e600; 124 | } 125 | 126 | legend span:hover + .legend { 127 | display: inline; 128 | } 129 | 130 | input[type="text"] { 131 | max-width: 90%; 132 | border: none; 133 | padding: 16px 9px; 134 | background-color: transparent; 135 | color: #859900; 136 | text-align: center; 137 | font-size: 16px; 138 | } 139 | 140 | .errors { 141 | color: #990000; 142 | } 143 | .errors:hover { 144 | cursor: pointer; 145 | color: #700000; 146 | } 147 | 148 | .deletes { 149 | display: inline-block; 150 | color: #aaa; 151 | } 152 | 153 | .deletes .row { 154 | height: 52px; 155 | position: relative; 156 | } 157 | 158 | .ecks { 159 | cursor: pointer; 160 | font-size: 24px; 161 | position: absolute; 162 | top: 13px; 163 | left: 8px; 164 | } 165 | 166 | .ecks:hover { 167 | color: #990000; 168 | } 169 | 170 | .butts { 171 | display: block; 172 | width: 600px; 173 | text-align: right; 174 | } 175 | 176 | button { 177 | margin: 32px 0 48px 24px; 178 | padding: 8px 12px; 179 | cursor: pointer; 180 | color: #859900; 181 | font-size: 16px; 182 | background-color: #000; 183 | border: 2px solid #859900; 184 | } 185 | 186 | button:hover { 187 | color: #aaa; 188 | background-color: #859900; 189 | } 190 | 191 | button:disabled { 192 | color: #aaa; 193 | border: 2px dotted #aaa; 194 | cursor: default; 195 | } 196 | 197 | button:disabled:hover { 198 | color: #aaa; 199 | background-color: transparent; 200 | } 201 | 202 | 203 | /* ============== 204 | SWITCH 205 | ============== */ 206 | 207 | .switch { 208 | position: relative; 209 | display: inline-block; 210 | width: 30px; 211 | height: 17px; 212 | margin: 15px 8px 14px 8px; 213 | } 214 | 215 | .switch input {display:none;} 216 | 217 | .slider { 218 | position: absolute; 219 | cursor: pointer; 220 | top: 0; 221 | left: 0; 222 | right: 0; 223 | bottom: 0; 224 | background-color: #555; 225 | -webkit-transition: .4s; 226 | transition: .4s; 227 | border-radius: 17px; 228 | } 229 | 230 | .slider:before { 231 | position: absolute; 232 | content: ""; 233 | height: 13px; 234 | width: 13px; 235 | left: 2px; 236 | bottom: 2px; 237 | background-color: #ccc; 238 | -webkit-transition: .4s; 239 | transition: .4s; 240 | border-radius: 50%; 241 | } 242 | 243 | input:checked + .slider { background-color: #859900; } 244 | input:focus + .slider { box-shadow: 0 0 1px #859900; } 245 | 246 | input:checked + .slider:before { 247 | -webkit-transform: translateX(13px); 248 | -ms-transform: translateX(13px); 249 | transform: translateX(13px); 250 | } 251 | -------------------------------------------------------------------------------- /src/pages/config/config.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 |
12 |

Needles

13 |
14 |
15 | 16 |
17 |
18 |
19 | Enabled 20 |
21 |
22 |
23 |
24 | Name 25 |
26 |
27 |
28 |
29 | 30 | Pattern* 31 |
32 |
33 |

Regex will be highlighted

34 |
35 |
36 | 37 |
38 |
39 |
40 |
41 |
42 |
43 |
44 |
45 |
46 | 47 | 48 |
49 |
50 | 51 |
52 |

Blacklist

53 |
54 |
55 | 56 |
57 |
58 |
59 | Enabled 60 |
61 |
62 |
63 |
64 | Name 65 |
66 |
67 |
68 |
69 | 70 | Pattern* 71 |
72 |
73 |

Regex will be highlighted

74 |
75 |
76 | 77 |
78 |
79 |
80 |
81 |
82 |
83 |
84 |
85 |
86 | 87 | 88 |
89 |
90 | 91 |
92 |

Functions

93 |
94 |
95 | 96 |
97 |
98 |
99 | Enabled 100 |
101 |
102 |
103 |
104 | Name 105 |
106 |
107 |
108 |
109 | Pattern 110 |
111 |
112 |
113 |
114 |
115 |
116 |
117 |
118 |
119 | 120 | 121 |
122 |
123 | 124 |
125 |

Targets

126 |
127 |
128 | 129 |
130 |
131 |
132 | Enabled 133 |
134 |
135 |
136 |
137 | Name 138 |
139 |
140 |
141 |
142 | Pattern 143 |
144 |
145 |
146 |
147 |
148 |
149 |
150 |
151 |
152 | 153 | 154 |
155 |
156 | 157 |
158 |

Globals

159 |
160 |
161 | 162 |
163 |
164 |
165 | Enabled 166 |
167 |
168 |
169 |
170 | Name 171 |
172 |
173 |
174 |
175 | Exported Name 176 |
177 |
178 |
179 |
180 |
181 |
182 |
183 |
184 |
185 | 186 |
187 |
188 | 189 | 190 |
191 |

Console Colors

192 |
193 |
194 | 195 |
196 |
197 |
198 | Name 199 |
200 |
201 |
202 |
203 | Default CSS 204 |
205 |
206 |
207 |
208 | Highlight CSS 209 |
210 |
211 |
212 |
213 |
214 |
215 |
216 | 217 | 218 |
219 |
220 | 221 |
222 |

Limits

223 |
224 |
225 | 226 |
227 |
228 |
229 | Name 230 |
231 |
232 |
233 |
234 | Size Limit 235 |
236 |
237 |
238 |
239 |
240 |
241 |
242 |
243 |
244 | 245 |
246 |
247 | 248 | 249 |
250 |
251 | 252 | 253 | 254 | 255 | 256 | 257 | 258 | 259 | 260 | 261 | -------------------------------------------------------------------------------- /src/pages/config/config.js: -------------------------------------------------------------------------------- 1 | const configList = ["targets", "needles", "blacklist", "functions", "globals"]; 2 | const normalHeaders = ["enabled", "name", "pattern"]; 3 | 4 | function getTableData(tblName) { 5 | const tbl = document.getElementById(`${tblName}-form`); 6 | return Array.from(tbl.querySelectorAll(".row:not(:first-child)")).map(row => { 7 | const obj = {}; 8 | obj.row = row; 9 | 10 | for (const h of normalHeaders) { 11 | const input = row.querySelector(`input[name='${h}']`); 12 | if (input.type === "checkbox") { 13 | obj[h] = input.checked; 14 | } else { 15 | obj[h] = input.value; 16 | } 17 | } 18 | return obj; 19 | }) 20 | } 21 | 22 | // check entire table for updates that have not been saved 23 | // we get the whole table info from local storage, may as well check it all? 24 | function unsavedTable(tblName) { 25 | function markSaved(v) { 26 | const butt = document.getElementById(`save-${tblName}`); 27 | if (v) { 28 | butt.disabled = true; 29 | } else { 30 | butt.classList.remove("saved"); 31 | butt.disabled = false; 32 | } 33 | } 34 | 35 | function compareFormatData(saveData) { 36 | for ([save, nm, value] of genFormatPairs(tblName, saveData)) { 37 | const test = typeof(save[nm]) == "number"? Number(value): value; 38 | if (save[nm] != test) { 39 | markSaved(false); 40 | return; 41 | } 42 | } 43 | markSaved(true); 44 | } 45 | 46 | function compareData(saveData) { 47 | const tblData = getTableData(tblName); 48 | const saved = saveData[tblName]; 49 | if (saved.length !== tblData.length) { 50 | markSaved(false); 51 | return; 52 | } 53 | 54 | for (let i=0; i unsavedTable(tblName); 134 | 135 | const slider = document.createElement("div"); 136 | slider.className = "slider"; 137 | 138 | label.appendChild(input); 139 | label.appendChild(slider); 140 | div.appendChild(label); 141 | return div; 142 | } 143 | 144 | const row = document.createElement("div"); 145 | row.className = "row"; 146 | const cols = []; 147 | 148 | for (const cls of ["col-sm", "col-md", "col-lg"]) { 149 | const div = document.createElement("div"); 150 | div.className = cls; 151 | cols.push(div); 152 | } 153 | 154 | cols[0].appendChild(createSwitch()); 155 | cols[1].appendChild(createField("name", ex.name, tblName == "globals")); 156 | cols[2].appendChild(createField("pattern", ex.pattern)); 157 | 158 | cols.forEach(c => row.appendChild(c)); 159 | 160 | document.getElementById(`${tblName}-form`).appendChild(row); 161 | if (tblName != "globals") { 162 | addDelete(); 163 | } 164 | if (focus) { 165 | row.getElementsByTagName("input")[1].focus(); 166 | } 167 | } 168 | 169 | 170 | function rowFromName(tbl, rowName) { 171 | const nodes = tbl.querySelector(`input[name=${rowName}]`) 172 | ?.parentElement 173 | .parentElement 174 | .parentElement 175 | .querySelectorAll("input"); 176 | return nodes? Array.from(nodes): undefined; 177 | } 178 | 179 | function *genFormatPairs(tblName, res) { 180 | const saved = res.formats; 181 | const tbl = document.getElementById(`${tblName}-form`); 182 | if (!tbl) { 183 | throw "Uknown table name"; 184 | } 185 | 186 | for (const save of saved) { 187 | const cols = rowFromName(tbl, save.name); 188 | if (cols && cols.shift().name == save.name) { 189 | for (const val of cols) { 190 | const {name, value} = val; 191 | yield [save, name, value]; 192 | } 193 | } 194 | } 195 | } 196 | 197 | async function formatsSave(tblName) { 198 | const res = await browser.storage.local.get("formats"); 199 | 200 | for ([save, nm, value] of genFormatPairs(tblName, res)) { 201 | if (typeof(save[nm]) == "number") { 202 | save[nm] = Number(value); 203 | } else { 204 | save[nm] = value; 205 | } 206 | } 207 | 208 | browser.storage.local.set(res) 209 | .then(updateBackground) 210 | .then(() => unsavedTable(tblName)); 211 | } 212 | 213 | function getDefElements(form) { 214 | const all = []; 215 | let i = 0; 216 | for (const input of form.elements) { 217 | if (input.name === "enabled") { 218 | all.push({"enabled" : input.checked}); 219 | } else if (input.name === "name") { 220 | all[i]["name"] = input.value; 221 | } else if (input.name === "pattern") { 222 | all[i]["pattern"] = input.value; 223 | i++; 224 | } 225 | } 226 | return all; 227 | } 228 | 229 | async function saveTable(tblName) { 230 | if (!validateTable(tblName)) { 231 | return; 232 | } 233 | 234 | const tbl = document.getElementById(`${tblName}-form`); 235 | const data = {}; 236 | data[tblName] = getDefElements(tbl); 237 | 238 | await browser.storage.local.set(data); 239 | return updateBackground(); 240 | } 241 | 242 | function onLoad() { 243 | function appendDefault(tblName) { 244 | const example = { "name" : "", "enabled" : true, "pattern" : "" } 245 | defAddRow(tblName, example, focus=true); 246 | } 247 | 248 | function writeDOM(res) { 249 | for (const sub of configList) { 250 | if (!res[sub]) { 251 | console.error("Could not get: " + sub); 252 | } 253 | 254 | for (const itr of res[sub]) { 255 | defAddRow(sub, itr); 256 | } 257 | } 258 | for (const sub of configList) { 259 | validateTable(sub); 260 | unsavedTable(sub); // really should never change anything 261 | } 262 | } 263 | 264 | // set onclick events to default buttons 265 | for (const i of configList) { 266 | if (i != "globals") { 267 | document.getElementById(`add-${i}`).onclick = function() { 268 | appendDefault(i); 269 | unsavedTable(i); 270 | } 271 | } 272 | document.getElementById(`save-${i}`).onclick = function() { 273 | saveTable(i) 274 | .then(() => unsavedTable(i)); // fix formating, should clear 275 | } 276 | } 277 | 278 | // TODO await and simplify 279 | const result = browser.storage.local.get(configList); 280 | result.then( 281 | writeDOM, 282 | err => console.error("failed to get storage: " + err) 283 | ); 284 | // TODO better DB in future, sipler code 285 | populateFormats(); 286 | 287 | setCopyHandlers(); 288 | } 289 | 290 | // formats and limits are different table types, so handled seperatly 291 | async function populateFormats() { 292 | // class for each column of input 293 | 294 | function createInptCol(name, value, xl, disabled=false) { 295 | const col = document.createElement("div"); 296 | // col.className = "col-md"; 297 | col.className = xl? "col-xl" : "col-md"; 298 | const field = createField(name, value, disabled); 299 | col.appendChild(field); 300 | return col; 301 | } 302 | 303 | function createFmtRow(fmt) { 304 | const row = document.createElement("div"); 305 | row.className = "row"; 306 | row.appendChild(createInptCol(fmt.name, fmt.pretty, false, true)); 307 | row.appendChild(createInptCol("default", fmt.default, false)); 308 | row.appendChild(createInptCol("highlight", fmt.highlight, false)); 309 | return row; 310 | } 311 | 312 | function createLimitRow(fmt) { 313 | const row = document.createElement("div"); 314 | row.className = "row"; 315 | row.appendChild(createInptCol(fmt.name, fmt.pretty, true)); 316 | row.appendChild(createInptCol("limit", fmt.limit, true)); 317 | return row; 318 | } 319 | 320 | // set save button 321 | document.getElementById("save-formats").onclick = () => formatsSave("formats"); 322 | document.getElementById("test-formats").onclick = colorTest; 323 | document.getElementById("save-limits").onclick = () => formatsSave("limits"); 324 | 325 | const {formats} = await browser.storage.local.get("formats"); 326 | if (!formats) { 327 | console.err("could not get color formats from storage"); 328 | return false; 329 | } 330 | 331 | const fmtTbl = document.getElementById("formats-form"); 332 | const limitTbl = document.getElementById("limits-form"); 333 | formats.forEach(i => { 334 | if (i.open !== null) { 335 | fmtTbl.appendChild(createFmtRow(i)); 336 | } 337 | 338 | if (i.limit) { 339 | limitTbl.appendChild(createLimitRow(i)); 340 | } 341 | 342 | }); 343 | } 344 | 345 | // Should reflect switcheroo.js printing 346 | function colorTest() { 347 | browser.storage.local.get("formats").then(x => { 348 | for (const i of x.formats) { 349 | console.log("[%s] %cDefault %chighlighted", 350 | i.name, i.default, i.highlight 351 | ); 352 | } 353 | }); 354 | } 355 | 356 | async function getConfig() { 357 | const conf = await browser.runtime.sendMessage("getScriptInfo"); 358 | return JSON.stringify(conf[0], null, 2); 359 | } 360 | 361 | 362 | async function getInjection() { 363 | const conf = await getConfig(); 364 | const func = rewriter.toString(); 365 | return `(${func})(${conf});`; 366 | } 367 | 368 | function clipit(x, nm) { 369 | navigator.clipboard.writeText(x) 370 | .then(() => alert(`${nm} put in clipbaord`)) 371 | } 372 | 373 | function setCopyHandlers() { 374 | // sets up copy config and copy injection buttons 375 | document.getElementById('copyconfig').onclick = function() { 376 | getConfig().then(x => clipit(x, "Config")); 377 | } 378 | document.getElementById('copyinjec').onclick = function() { 379 | getInjection().then(x => clipit(x, "Injection")); 380 | } 381 | 382 | } 383 | 384 | self.addEventListener('load', onLoad); 385 | -------------------------------------------------------------------------------- /src/pages/config/validate.js: -------------------------------------------------------------------------------- 1 | const errors = { 2 | targets: [], 3 | needles: [], 4 | blacklist: [], 5 | functions: [], 6 | globals: [], 7 | formats: [], 8 | limits: [] 9 | }; 10 | 11 | // used by config.js 12 | function validateTable(tblName) { 13 | let erCount = 0; 14 | let form = document.getElementById(`${tblName}-form`); 15 | for (let input of form.getElementsByTagName("input")) { 16 | if (input.type === "text") { 17 | if (!validate(input)) { 18 | erCount++; 19 | } 20 | } 21 | } 22 | let names = new Set(); 23 | for (let name of form.querySelectorAll("input[name=name]")) { 24 | if (names.has(name.value)) { 25 | gotError(name, tblName, `Duplicate name "${name.value}"`); 26 | erCount++; 27 | } else { 28 | names.add(name.value); 29 | } 30 | } 31 | 32 | if (erCount > 0) { 33 | errors[tblName][0].dom.focus(); 34 | return false; 35 | } 36 | return true; 37 | } 38 | 39 | function validate(dom, tblName=null) { 40 | // should validate every single possible field 41 | let v = { 42 | targets: { 43 | name: validateName, 44 | pattern: validateTargetPattern 45 | }, 46 | needles: { 47 | name: validateName, 48 | pattern: validateNeedlesPattern 49 | }, 50 | blacklist: { 51 | name: validateName, 52 | pattern: validateNeedlesPattern 53 | }, 54 | functions: { 55 | name: validateName, 56 | pattern: validateFunctionsPattern 57 | }, 58 | globals: { 59 | name: () => false, 60 | pattern: validateName 61 | }, 62 | formats: { 63 | default: validateColor, 64 | highlight: validateColor 65 | }, 66 | limits: { 67 | limit: validateNumber 68 | } 69 | } 70 | if (!tblName) 71 | tblName = dom.closest("form").id.split("-")[0]; 72 | 73 | const paramName = dom.name; 74 | 75 | if (!v[tblName]) { 76 | throw `unknown table '${tblName}'`; 77 | } 78 | 79 | const res = v[tblName][paramName](dom); 80 | 81 | if (res) { 82 | gotError(dom, tblName, `${paramName}:[${dom.value}]: ${res}`); 83 | return false; 84 | } else { 85 | removeFromErrorArray(dom, tblName); 86 | return true; 87 | } 88 | } 89 | 90 | function removeFromErrorArray(dom, tblName) { 91 | errors[tblName] = errors[tblName].filter(function(er) { 92 | if (er.dom === dom) { 93 | er.msg.remove(); // remove coresponding text 94 | return false; // remove this one 95 | } 96 | return true; // if it is not our element, it stays 97 | }); 98 | } 99 | 100 | function gotError(dom, tblName, err) { 101 | // add error text to dom 102 | let htmlErr = document.createElement("div"); 103 | htmlErr.innerText = err; 104 | htmlErr.onclick = function() {dom.focus()}; 105 | document.getElementById(`${tblName}-errors`).appendChild(htmlErr); 106 | 107 | // errors 108 | removeFromErrorArray(dom, tblName); // remove last error if there 109 | var obj = {}; 110 | obj.dom = dom; 111 | obj.msg = htmlErr; 112 | errors[tblName].push(obj); 113 | } 114 | 115 | function strCheck(str) { 116 | if (typeof(str) !== "string") { 117 | return "must be a string"; 118 | } 119 | 120 | if (str.length <= 0) { 121 | return "can't be empty" 122 | } 123 | return false; 124 | } 125 | 126 | function validateNumber(dom) { 127 | const {value} = dom; 128 | if (/^\d+$/.test(value)) { 129 | if (Number(value) <= 0) { 130 | return "Limit must be greater then 0"; 131 | } 132 | return false; 133 | } 134 | return "Limit must be a number"; 135 | 136 | } 137 | 138 | function validateName(dom) { 139 | let name = dom.value; 140 | let strRet = strCheck(name); 141 | if (strRet) return strRet; 142 | 143 | if (/^[A-Za-z0-9 _.']+$/.test(name) === false) { 144 | return "can't have special characters ([A-Za-z0-9 _.] allowed)"; 145 | } 146 | } 147 | 148 | function validateNeedlesPattern(dom) { 149 | let val = dom.value; 150 | let strRet = strCheck(val); 151 | if (strRet) return strRet; 152 | 153 | let match = /^\/(.*)\/(i|g|gi|ig)?$/.exec(val); 154 | if (match) { // regex needle 155 | let regex = new RegExp(match[1], match[2] === undefined ? "" : match[2]); 156 | if (regex) { 157 | dom.className = "regex"; 158 | return false; 159 | } else { 160 | return "failed to create valid regular expression" 161 | } 162 | } 163 | dom.className = ""; 164 | return false; 165 | } 166 | 167 | function validateTargetPattern(dom) { 168 | let target = dom.value; 169 | let strRet = strCheck(target); 170 | if (strRet) return strRet; 171 | 172 | if (!/^(https?|wss?|file|ftp|\*):/.test(target)) { 173 | return "must start with (https|http|wss|file|ftp|*)"; 174 | }else if (!/^(https?|wss?|file|ftp|\*):\/\//.test(target)) { 175 | return "schema must contain '://'"; 176 | } 177 | 178 | let reTest = /^(https?|wss?|file|ftp|\*):\/\/(\*|\*\.[^*/]+|[^*/]+)\/.*$/; 179 | if (!reTest.test(target)) { 180 | if (/^(https?|wss?|file|ftp|\*):\/\/(\*|\*\.[^*/]+|[^*/]+)$/.test(target)) { 181 | return "must terminate domain by a slash '/'"; 182 | }else if (/^(https?|wss?|file|ftp|\*):\/\/(\*|\*\.[^/]+|[^/]+)\/.*$/) { 183 | return "domain/subdomain can not contain a wildcard within a string"; 184 | } 185 | // I don't know what they did... 186 | return `must match ${reTest.toString()}`; 187 | } 188 | 189 | return false; 190 | } 191 | 192 | /* 193 | * heavily inspired by switcheroo.js, update one, update the other 194 | */ 195 | function validateFunctionsPattern(dom) { 196 | function getFunc(n) { 197 | let ret = {} 198 | ret.where = window; 199 | let groups = n.split("."); 200 | let i = 0; // outside for loop for a reason 201 | for (i=0; i 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 |
12 |
13 | Configuration Page 14 |
15 |
16 | This version of Eval Villain was provided through the support of Doyensec

17 | 18 |
19 |
20 | 21 | 22 | 23 | 24 | -------------------------------------------------------------------------------- /src/pages/popup/menu.css: -------------------------------------------------------------------------------- 1 | * { 2 | margin: 0; 3 | padding: 0; 4 | } 5 | 6 | html { 7 | overflow-x: hidden; 8 | overflow-y: auto; 9 | } 10 | 11 | body { 12 | width: 248px; 13 | padding: 24px 24px 32px 24px; 14 | background: #111; 15 | color: #859900; 16 | border: 1px solid #bbb; 17 | font-size: 16px; 18 | font-family: 'Open Sans',arial,helvetica,sans-serif; 19 | font-weight: 400; 20 | } 21 | 22 | h1 { 23 | font-size: 18px; 24 | font-weight: 400; 25 | cursor: pointer; 26 | margin: 18px 0 2px; 27 | padding-top: 16px; 28 | border-top: 1px dotted #ccc; 29 | } 30 | 31 | ul { 32 | list-style-type: none; 33 | padding: 8px; 34 | } 35 | 36 | li { margin: 6px; } 37 | .closed { display: none; } 38 | .open { display: block; } 39 | 40 | .configure { 41 | cursor: pointer; 42 | } 43 | 44 | /* ============== 45 | SWITCH 46 | ============== */ 47 | 48 | .toggle { position: relative; } 49 | 50 | span.label { 51 | position: absolute; 52 | top: -3px; 53 | left: 42px; 54 | } 55 | 56 | .switch.main + span.label { 57 | top: 5px; 58 | right: 0; 59 | left: auto; 60 | } 61 | 62 | .switch { 63 | position: relative; 64 | display: inline-block; 65 | width: 30px; 66 | height: 17px; 67 | } 68 | 69 | .switch.main { 70 | width: 60px; 71 | height: 34px; 72 | } 73 | 74 | .switch input {display:none;} 75 | 76 | .slider { 77 | position: absolute; 78 | cursor: pointer; 79 | top: 0; 80 | left: 0; 81 | right: 0; 82 | bottom: 0; 83 | background-color: #555; 84 | -webkit-transition: .4s; 85 | transition: .4s; 86 | border-radius: 17px; 87 | } 88 | 89 | .switch.main .slider { border-radius: 34px; } 90 | 91 | .slider:before { 92 | position: absolute; 93 | content: ""; 94 | height: 13px; 95 | width: 13px; 96 | left: 2px; 97 | bottom: 2px; 98 | background-color: #ccc; 99 | -webkit-transition: .4s; 100 | transition: .4s; 101 | border-radius: 50%; 102 | } 103 | 104 | .switch.main .slider:before { 105 | height: 26px; 106 | width: 26px; 107 | left: 4px; 108 | bottom: 4px; 109 | } 110 | 111 | input:checked + .slider { background-color: #859900; } 112 | input:focus + .slider { box-shadow: 0 0 1px #859900; } 113 | 114 | input:checked + .slider:before { 115 | -webkit-transform: translateX(13px); 116 | -ms-transform: translateX(13px); 117 | transform: translateX(13px); 118 | } 119 | 120 | .switch.main input:checked + .slider:before { 121 | -webkit-transform: translateX(26px); 122 | -ms-transform: translateX(26px); 123 | transform: translateX(26px); 124 | } 125 | -------------------------------------------------------------------------------- /src/pages/popup/menu.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | Eval Villain Configuration 4 | 5 | 6 | 7 | 8 | 9 | 10 |
11 | 12 |
13 | 17 | Villain is OFF 18 |
19 | 20 | 21 |

Needles

22 | 27 | 28 |

Blacklist

29 | 34 | 35 |

Targets

36 | 41 | 42 |

Functions

43 | 48 | 49 |

Enable/Disable

50 | 55 | 56 |

Auto Open

57 | 62 | 63 |

Types

64 | 69 | 70 |

Configure

71 |
72 | 73 | 74 | 75 | 76 | -------------------------------------------------------------------------------- /src/pages/popup/menu.js: -------------------------------------------------------------------------------- 1 | var configList = ["targets", "needles", "blacklist", "functions", "autoOpen", "onOff", "types"]; 2 | function updateToggle(on) { 3 | if (typeof(on) !== "boolean") { 4 | console.error("unexpected message type"); 5 | return; 6 | } 7 | let d = document.getElementById("toggle"); 8 | d.checked = on; 9 | 10 | d = document.getElementById("toggle-label"); 11 | d.innerText = "Villain is " + (on ? "ON" : "OFF"); 12 | } 13 | 14 | async function update_if_on() { 15 | const on = await amIOn(); 16 | updateToggle(on); 17 | } 18 | 19 | function createCheckBox(name, checked, subMenu) { 20 | var d = document; 21 | var li = d.createElement("li"); 22 | li.className = "toggle"; 23 | 24 | // first child of li 25 | var label = d.createElement("label"); 26 | label.className = "switch"; 27 | 28 | // first child of label 29 | var input = d.createElement("input"); 30 | input.type = "checkbox"; 31 | input.name = subMenu; 32 | input.value = name; 33 | input.checked = checked; 34 | input.id = name; 35 | label.appendChild(input); 36 | 37 | // second child of label 38 | let div = d.createElement("div"); 39 | div.className = "slider"; 40 | label.appendChild(div); 41 | li.appendChild(label); 42 | 43 | // second child of li 44 | var span = d.createElement("span"); 45 | span.className = "label"; 46 | span.innerText = name; 47 | 48 | li.appendChild(span); 49 | return li; 50 | } 51 | 52 | async function getSections() { 53 | const all = await browser.storage.local.get(["targets", "needles", "blacklist", "functions", "types", "formats"]); 54 | const autoOpen = []; 55 | const onOff = []; 56 | for (let k of all.formats) { 57 | autoOpen.push({ 58 | name: k.pretty, 59 | pattern: k.name, 60 | enabled: k.open, 61 | }); 62 | onOff.push({ 63 | name: k.pretty, 64 | pattern: k.name, 65 | enabled: k.use, 66 | }); 67 | } 68 | all.autoOpen = autoOpen; 69 | all.onOff = onOff; 70 | delete all.formats; 71 | return all; 72 | } 73 | 74 | async function populateSubMenus() { 75 | const res = await getSections(); 76 | for (let sub of configList) { 77 | if (!res[sub]) { 78 | console.error("Could not get: " + sub); 79 | } 80 | 81 | var where = document.getElementById(`${sub}-sub`); 82 | for (let itr of res[sub]) { 83 | if (typeof(itr.enabled) === 'boolean') { 84 | const inpt = createCheckBox(itr.name, itr.enabled, sub); 85 | where.appendChild(inpt); 86 | } 87 | } 88 | 89 | if (res[sub].length == 0) { 90 | const em = document.createElement("em"); 91 | em.innerText = "Nothing Configured"; 92 | em.className = "configure"; 93 | em.onclick = () => goToConfig(); 94 | where.appendChild(em); 95 | } 96 | } 97 | } 98 | 99 | async function updateSubmenu(target) { 100 | let name = target.name; 101 | const {checked, id} = target; 102 | let chg = "enabled"; 103 | let ident = "name"; 104 | 105 | if (name === "autoOpen") { 106 | chg = "open"; 107 | ident = "pretty"; 108 | } else if (name === "onOff") { 109 | chg = "use"; 110 | ident = "pretty"; 111 | } 112 | 113 | if (["autoOpen", "onOff"].includes(name)) { 114 | name = "formats"; 115 | } 116 | 117 | const res = await browser.storage.local.get(name); 118 | for (let k of res[name]) { 119 | if (k[ident] === id && typeof(k[chg]) === 'boolean') { 120 | k[chg] = checked; 121 | break; 122 | } 123 | } 124 | if (id === "User Sources") { 125 | const {globals} = await browser.storage.local.get("globals"); 126 | globals.forEach(x => { 127 | if (x.name == "sourcer") 128 | x.enabled = checked; 129 | }); 130 | res.globals = globals; 131 | } 132 | 133 | return browser.storage.local.set(res) 134 | .then(updateBackground) 135 | .then(update_if_on) 136 | .catch(err => console.error("failed to get storage: " + err)); 137 | } 138 | 139 | function listener(ev) { 140 | let node = ev.target.nodeName; 141 | let id = ev.target.id; 142 | let name = ev.target.name; 143 | 144 | if (node === "INPUT") { 145 | if (id === "toggle") { // on off button 146 | toggleBackground() 147 | .then(update_if_on) 148 | .catch(err => { 149 | console.error(`toggle error: ${err}`); 150 | updateToggle(false); 151 | }); 152 | } else if (configList.includes(name)) { // submenu checkbox? 153 | updateSubmenu(ev.target); 154 | } 155 | return 156 | } 157 | 158 | if (["h1-functions", "h1-targets", "h1-enable", "h1-autoOpen", "h1-onOff", "h1-blacklist", "h1-needles", "h1-types"].includes(id)) { 159 | let sub = id.substr(3); 160 | let formats = document.getElementById(sub); 161 | formats.classList.toggle('closed'); 162 | formats.classList.toggle('open'); 163 | return 164 | } 165 | if (id == "h1-config" ) { 166 | goToConfig(); 167 | return; 168 | } 169 | } 170 | 171 | function goToConfig() { 172 | let confUrl = browser.runtime.getURL("/pages/config/config.html"); 173 | let tab = browser.tabs.create({url:confUrl}); 174 | tab.then(() => window.close()); 175 | return; 176 | } 177 | 178 | update_if_on(); 179 | document.addEventListener("click", listener); 180 | populateSubMenus(); 181 | -------------------------------------------------------------------------------- /ss.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swoops/eval_villain/9c5eadc46bd9f8d2199577b93d2d3a98ad69ba74/ss.png -------------------------------------------------------------------------------- /test/init.js: -------------------------------------------------------------------------------- 1 | const storekey = "somekey"; 2 | const storekeyfind = "0d9jlfk2j309jflaksjd0fasoekjr2398rjfalkjsdf"; 3 | 4 | // ensure we have parameters to play with 5 | { 6 | let jsdata = btoa(JSON.stringify( 7 | { 8 | "firstProperty" : "firstPropans", 9 | "secondArray" : [ "firstinarray", "secondinarray" ], 10 | "bool" : true, 11 | "small" : "a" 12 | } 13 | )); 14 | 15 | let gotourl = `?one=1&json=${jsdata}¶m_zxcv=zxcv&encoded=%27%20%2b%20%3c&bool=true` 16 | let frag = "fragment_value"; 17 | let url = new URL(location.href); 18 | 19 | // localStorage test 20 | let storeRefresh = false; 21 | if (!localStorage.getItem(storekey)) { 22 | storeRefresh = true; 23 | const inner = { 24 | foo: { 25 | foo: { 26 | ar: [ 27 | storekeyfind 28 | ] 29 | } 30 | } 31 | } 32 | localStorage.setItem(storekey, btoa(btoa(JSON.stringify(inner)))); 33 | } 34 | if (url.search != gotourl || url.hash != frag || storeRefresh) { 35 | url.search = gotourl; 36 | url.hash = frag; 37 | location.href = url; 38 | } 39 | 40 | } 41 | 42 | const cl = console.log; 43 | const ct = console.trace; 44 | const cg = console.group; 45 | const cgc = console.groupCollapsed; 46 | const cge = console.groupEnd; 47 | 48 | const allCalls = []; 49 | function addToCalls() { 50 | allCalls.push(arguments); 51 | } 52 | 53 | // replace native functions we use for testing 54 | console.log = addToCalls; 55 | console.group = addToCalls; 56 | console.groupCollapsed = addToCalls; 57 | 58 | // empty these to be less ugly 59 | console.trace = () => {}; 60 | document.write = () => {}; 61 | document.writeln = () => {}; 62 | console.groupEnd = () => {}; 63 | 64 | 65 | function fail(x) { 66 | console.error(`[%cXX%c] ${x}`, "color:red", "color:None"); 67 | } 68 | 69 | function argsToPrintable(args) { 70 | const ret = []; 71 | for (const i in args) { 72 | ret.push(args[i]); 73 | } 74 | return JSON.stringify(ret, null, 2); 75 | } 76 | 77 | function printNextArgs() { 78 | cl(argsToPrintable(allCalls[0])); 79 | } 80 | 81 | /** 82 | * Tests each `args` against each `test` 83 | */ 84 | function argsIs(args, test) { 85 | if (args.length != test.length) { 86 | return {off: [`arg.length ${args.length} != ${test.length} test.length`], expect: test, got: args}; 87 | } 88 | let c = 0; 89 | const off = [] 90 | for (const i of args) { 91 | if (i !== test[c]) { 92 | off.push(`arg[${c}] '${i}' !== '${test[c]}'`) 93 | } 94 | c++; 95 | } 96 | if (off.length > 0) { 97 | return {expect: test, got: args, off: off}; 98 | } 99 | return true; 100 | } 101 | 102 | /** 103 | * Pops msg from `allCalls` and checks if it matches `test` 104 | */ 105 | function chckNArg(test, msg) { 106 | const why = argsIs(allCalls.shift(), test); 107 | if (why === true) { 108 | cgc(`[%c**%c] ${msg}`, "color:green", "color:None"); 109 | cl(...test); 110 | cge(); 111 | } else { 112 | fail(msg); 113 | const erinfo = "Error Info:"; 114 | cg(erinfo) 115 | for (const i of why.off) { 116 | cl(i); 117 | } 118 | 119 | const got = "got: "; 120 | cg(got); 121 | cl(argsToPrintable(why.got)); 122 | cl(...why.got); 123 | cge(); 124 | 125 | const exp = "expected: " 126 | cg(exp); 127 | cl("expected: ", JSON.stringify(why.expect, null, 2)); 128 | cl(...why.expect); 129 | cge(exp); 130 | cge(erinfo) 131 | }; 132 | } 133 | 134 | function checkStackBanner(msg) { 135 | chckNArg(["%cstack: ","color:None"], `${msg} stack banner`); 136 | } 137 | function checkArg(msg, value) { 138 | const type = typeof(value); 139 | chckNArg(["%carg(%s):",colNone, type], `${msg} arg test`); 140 | chckNArg(["%c%s", colGreen, value], `${msg} Interesting args`); 141 | } 142 | 143 | function testInterset(msg, name, reason, needle, line, decoded) { 144 | const value = line.join(""); 145 | chckNArg(["%c[EV] %c%s%c %s", colRed, colGreen, name, colRed, location.href], `${msg} Interesting Banner`); 146 | checkArg(msg, value); 147 | 148 | const ban = decoded 149 | ? ['%c%s%c%s%c%s%c%s', colNone, `${reason}: `, 150 | colGreen, needle, colNone, " found", colGreen, " [Decoded]"] 151 | : ["%c%s%c%s%c%s", colNone,`${reason}: `, colGreen, needle, colNone, " found"]; 152 | 153 | chckNArg(ban, `${msg} Interesting highlight`); 154 | if (decoded) { 155 | chckNArg(["Encoder function:"], `${msg} Encoder Highlight`); 156 | const encoder = allCalls.shift(); 157 | if (encoder.length != 1) { 158 | fail("Encoder not a single arg"); 159 | cl(JSON.stringify(encoder, null, 2)); 160 | } else { 161 | cl("TODO: Check if encoder makes sense:"); 162 | cl(encoder[0]); 163 | } 164 | new Function 165 | } 166 | 167 | const test = ["%c%s".repeat(line.length)]; 168 | const colors = [colGreen, colNone]; 169 | let ci = line.length % 2; 170 | for (const f of line) { 171 | test.push(colors[ci]); 172 | test.push(f); 173 | ci = (ci+1)%2; 174 | } 175 | chckNArg(test, `${msg} Interesting highlight`); 176 | checkStackBanner(msg); 177 | if (allCalls.length != 0) { 178 | fail ("msg: extra args left over") 179 | while (allCalls.length > 0) { 180 | printNextArgs(); 181 | allCalls.shift(); 182 | } 183 | } 184 | } 185 | 186 | function pushHistoryParam(key, value, clear=true) { 187 | const url = new URL(location.href); 188 | if (clear) { 189 | Array.from(url.searchParams.keys() ).forEach(x => url.searchParams.delete(x)); 190 | } 191 | url.searchParams.set(key, value); 192 | history.pushState({}, null, url); 193 | } 194 | 195 | function testNormal(msg, name, value) { 196 | chckNArg(["%c[EV] %c%s%c %s", colNone, colGreen, name, colNone, location.href], `${msg} Normal Banner`); 197 | checkArg(msg, value); 198 | checkStackBanner(msg); 199 | if (allCalls.length != 0) { 200 | fail ("msg: extra args left over") 201 | while (allCalls.length > 0) { 202 | printNextArgs(); 203 | allCalls.shift(); 204 | } 205 | } 206 | } 207 | 208 | 209 | const colNone = "color:None"; 210 | const colGreen = "color:#088" 211 | const colRed = "color:red" 212 | var config = { 213 | "formats" : { 214 | "title" : { 215 | "pretty" : "Normal Results", 216 | "use" : true, 217 | "open" : true, 218 | "default" : colNone, 219 | "highlight" : colGreen 220 | }, 221 | "interesting" : { 222 | "pretty" : "Interesting Results", 223 | "use" : true, 224 | "open" : true, 225 | "default" : colRed, 226 | "highlight" : colGreen 227 | }, 228 | "args" : { 229 | "pretty" : "Args Display", 230 | "use" : true, 231 | "open" : true, 232 | "default" : colNone, 233 | "highlight" : colGreen 234 | }, 235 | "needle" : { 236 | "pretty" : "Needles Search", 237 | "use" : true, 238 | "open" : true, 239 | "default" : colNone, 240 | "highlight" : colGreen 241 | }, 242 | "query" : { 243 | "pretty" : "Query Search", 244 | "use" : true, 245 | "limit": 32, 246 | "open" : true, 247 | "default" : colNone, 248 | "highlight" : colGreen 249 | }, 250 | "fragment" : { 251 | "pretty" : "Fragment Search", 252 | "use" : true, 253 | "limit": 32, 254 | "open" : true, 255 | "default" : colNone, 256 | "highlight" : colGreen 257 | }, 258 | "winname" : { 259 | "pretty" : "window.name Search", 260 | "use" : true, 261 | "limit": 32, 262 | "open" : true, 263 | "default" : colNone, 264 | "highlight" : colGreen 265 | }, 266 | "path": { 267 | "pretty": "Path Search", 268 | "use": false, 269 | "limit": 32, 270 | "open": true, 271 | "default": "color: none", 272 | "highlight": "color: #088" 273 | }, 274 | "referrer": { 275 | "pretty": "Referrer Search", 276 | "use": false, 277 | "limit": 32, 278 | "open": true, 279 | "default": "color: none", 280 | "highlight": "color: #088" 281 | }, 282 | "cookie" : { 283 | "pretty" : "Cookie Search", 284 | "use" : true, 285 | "limit": 32, 286 | "open" : true, 287 | "default" : "color: none", 288 | "highlight" : "color: colGreen" 289 | }, 290 | "localStore" : { 291 | "pretty" : "localStorage", 292 | "limit": 32, 293 | "use" : true, 294 | "open" : true, 295 | "default" : colNone, 296 | "highlight" : colGreen 297 | }, 298 | "userSource" : { 299 | "pretty" : "User Source", 300 | "use" : true, 301 | "limit" : 32, 302 | "open" : true, 303 | "default" : colNone, 304 | "highlight" : colGreen 305 | }, 306 | "stack" : { 307 | "pretty" : "Stack Display", 308 | "use" : true, 309 | "open" : true, 310 | "default" : colNone, 311 | "highlight" : colGreen 312 | }, 313 | "logReroute": { 314 | "pretty": "Log Reroute", 315 | "use": true, 316 | "open": null, 317 | "default": "N/A", 318 | "highlight": "N/A" 319 | } 320 | }, 321 | "needles" : ["asdf"], 322 | "blacklist" : [ 323 | "/^\\s*\\S{0,3}\\s*$/", 324 | "/^s*(?:true|false)s*$/gi" 325 | ], 326 | "functions" : [ 327 | "eval", 328 | "set(Element.innerHTML)", 329 | "set(Element.outerHTML)", 330 | "document.write", 331 | "document.writeln" 332 | ], 333 | "types" : ["string"], 334 | }; 335 | 336 | -------------------------------------------------------------------------------- /test/test.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | switcheroo.js test 5 |

Visit this page without Eval Villain on to test the switcheroo.js code

6 | 7 | 8 | 9 | 10 |