diff options
Diffstat (limited to 'js/contentscript-start.js')
-rw-r--r-- | js/contentscript-start.js | 72 |
1 files changed, 31 insertions, 41 deletions
diff --git a/js/contentscript-start.js b/js/contentscript-start.js index 3096023..4c320f8 100644 --- a/js/contentscript-start.js +++ b/js/contentscript-start.js @@ -23,40 +23,34 @@ 'use strict'; -/******************************************************************************/ -/******************************************************************************/ - // Injected into content pages - -(function() { - - if ( typeof vAPI !== 'object' ) { return; } +(function () { + if (typeof vAPI !== 'object') { + return; + } vAPI.selfWorkerSrcReported = vAPI.selfWorkerSrcReported || false; var reGoodWorkerSrc = /(?:frame|worker)-src[^;,]+?'none'/; var handler = function(ev) { - if ( - ev.isTrusted !== true || - ev.originalPolicy.includes('report-uri about:blank') === false - ) { + if (ev.isTrusted !== true + || ev.originalPolicy.includes('report-uri about:blank') === false) { return false; } // Firefox and Chromium differs in how they fill the // 'effectiveDirective' property. - if ( - ev.effectiveDirective.startsWith('worker-src') === false && - ev.effectiveDirective.startsWith('frame-src') === false - ) { + // ηMatrix: what does Pale Moon/Basilisk do? + if (ev.effectiveDirective.startsWith('worker-src') === false + && ev.effectiveDirective.startsWith('frame-src') === false) { return false; } - // Further validate that the policy violation is relevant to uMatrix: + // Further validate that the policy violation is relevant to ηMatrix: // the event still could have been fired as a result of a CSP header - // not injected by uMatrix. - if ( reGoodWorkerSrc.test(ev.originalPolicy) === false ) { + // not injected by ηMatrix. + if (reGoodWorkerSrc.test(ev.originalPolicy) === false) { return false; } @@ -64,35 +58,31 @@ // However, we do want to report external resources each time. // TODO: this could eventually lead to duplicated reports for external // resources if another extension uses the same approach as - // uMatrix. Think about what could be done to avoid duplicate + // ηMatrix. Think about what could be done to avoid duplicate // reports. - if ( ev.blockedURI.includes('://') === false ) { - if ( vAPI.selfWorkerSrcReported ) { return true; } + if (ev.blockedURI.includes('://') === false) { + if (vAPI.selfWorkerSrcReported) { + return true; + } vAPI.selfWorkerSrcReported = true; } - vAPI.messaging.send( - 'contentscript.js', - { - what: 'securityPolicyViolation', - directive: 'worker-src', - blockedURI: ev.blockedURI, - documentURI: ev.documentURI, - blocked: ev.disposition === 'enforce' - } - ); + vAPI.messaging.send('contentscript.js', { + what: 'securityPolicyViolation', + directive: 'worker-src', + blockedURI: ev.blockedURI, + documentURI: ev.documentURI, + blocked: ev.disposition === 'enforce' + }); return true; }; - document.addEventListener( - 'securitypolicyviolation', - function(ev) { - if ( !handler(ev) ) { return; } - ev.stopPropagation(); - ev.preventDefault(); - }, - true - ); - + document.addEventListener('securitypolicyviolation', function (ev) { + if (!handler(ev)) { + return; + } + ev.stopPropagation(); + ev.preventDefault(); + }, true); })(); |