Skip to content

Commit

Permalink
Let content script inject failsafe CSP in the DOM.
Browse files Browse the repository at this point in the history
  • Loading branch information
hackademix committed Aug 27, 2018
1 parent e82e961 commit 6e80d3f
Show file tree
Hide file tree
Showing 3 changed files with 38 additions and 2 deletions.
26 changes: 26 additions & 0 deletions src/content/DocumentCSP.js
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
'use strict';

class DocumentCSP {
constructor(document) {
this.document = document;
this.builder = new CapsCSP();
}

apply(capabilities) {
let csp = this.builder;
let blocker = csp.buildFromCapabilities(capabilities);
if (!blocker) return;

let document = this.document;
let header = csp.asHeader(blocker);
let meta = document.createElementNS("http://www.w3.org/1999/xhtml", "meta");
meta.setAttribute("http-equiv", header.name);
meta.setAttribute("content", header.value);
let parent = document.head || document.documentElement;
try {
parent.insertBefore(meta, parent.firstChild);
} catch (e) {
error(e, "Error inserting CSP %s in the DOM", header && header.value);
}
}
}
11 changes: 9 additions & 2 deletions src/content/content.js
Original file line number Diff line number Diff line change
Expand Up @@ -61,14 +61,21 @@

if (!this.perms.DEFAULT || this.perms.tabInfo.unrestricted) {
this.allows = () => true;
this.capabilities = Object.assign(
new Set(["script"]), { has() { return true; } });
} else {
let perms = this.perms.CURRENT || this.perms.DEFAULT;
this.capabilities = new Set(perms.capabilities);
new DocumentCSP(document).apply(this.capabilities);
}
ns.fire("perms");
},
perms: { DEFAULT: null, CURRENT: null, tabInfo: {}, MARKER: "" },

allows(cap) {
let perms = this.perms.CURRENT;
return perms && perms.capabilities.includes(cap);
return this.capabilities && this.capabilities.has(cap);
},

getWindowName() {
return top !== window || !this.perms.MARKER ? window.name
: window.name.split(this.perms.MARKER + ",").pop();
Expand Down
3 changes: 3 additions & 0 deletions src/manifest.json
Original file line number Diff line number Diff line change
Expand Up @@ -67,6 +67,9 @@
"js": [
"lib/log.js",
"lib/Messages.js",
"lib/CSP.js",
"common/CapsCSP.js",
"content/DocumentCSP.js",
"content/onScriptDisabled.js",
"content/content.js",
"content/webglHook.js",
Expand Down

0 comments on commit 6e80d3f

Please sign in to comment.