diff --git a/build/patches/00Eyeo-Adblock-Remove-Privacy-Issues.patch b/build/patches/00Eyeo-Adblock-Remove-Privacy-Issues.patch index bcb475ed..f94b7062 100644 --- a/build/patches/00Eyeo-Adblock-Remove-Privacy-Issues.patch +++ b/build/patches/00Eyeo-Adblock-Remove-Privacy-Issues.patch @@ -47,6 +47,7 @@ suit Bromite logic components/adblock/content/browser/BUILD.gn | 16 +- .../browser/adblock_webcontents_observer.cc | 25 +- .../browser/adblock_webcontents_observer.h | 5 +- + .../content_security_policy_injector_impl.cc | 1 + components/adblock/core/BUILD.gn | 39 - .../activeping_telemetry_topic_provider.cc | 242 -- .../activeping_telemetry_topic_provider.h | 84 - @@ -66,10 +67,13 @@ suit Bromite logic .../configuration/filtering_configuration.h | 3 + .../persistent_filtering_configuration.cc | 10 + .../persistent_filtering_configuration.h | 3 + + .../core/converter/flatbuffer_converter.cc | 2 +- .../adblock/core/converter/parser/metadata.cc | 10 +- - .../core/converter/parser/url_filter.cc | 4 + - .../serializer/flatbuffer_serializer.cc | 4 +- - .../adblock/core/sitekey_storage_impl.cc | 6 + + .../core/converter/parser/test/test_rules.txt | 21 + + .../core/converter/parser/url_filter.cc | 10 +- + .../converter/parser/url_filter_options.cc | 21 +- + .../serializer/flatbuffer_serializer.cc | 75 +- + .../adblock/core/sitekey_storage_impl.cc | 7 + .../core/subscription/conversion_executors.h | 1 + .../filtering_configuration_maintainer.h | 4 + ...filtering_configuration_maintainer_impl.cc | 31 +- @@ -78,8 +82,9 @@ suit Bromite logic .../preloaded_subscription_provider_impl.cc | 4 +- .../adblock/core/subscription/subscription.cc | 19 + .../adblock/core/subscription/subscription.h | 3 + - .../core/subscription/subscription_config.cc | 16 +- - .../core/subscription/subscription_config.h | 4 +- + .../subscription_collection_impl.cc | 1 + + .../core/subscription/subscription_config.cc | 20 +- + .../core/subscription/subscription_config.h | 6 +- .../subscription_downloader_impl.cc | 21 +- .../subscription_persistent_metadata.h | 1 + .../subscription_persistent_metadata_impl.cc | 7 + @@ -103,7 +108,7 @@ suit Bromite logic .../blink/renderer/core/css/style_engine.h | 1 + .../renderer/core/exported/web_document.cc | 13 +- .../definitions/adblock_private.d.ts | 14 + - 98 files changed, 4930 insertions(+), 1277 deletions(-) + 103 files changed, 5041 insertions(+), 1296 deletions(-) delete mode 100644 chrome/browser/adblock/adblock_telemetry_service_factory.cc delete mode 100644 chrome/browser/adblock/adblock_telemetry_service_factory.h create mode 100644 chrome/browser/resources/settings/adblock_page/adblock_page.html @@ -113,6 +118,7 @@ suit Bromite logic delete mode 100644 components/adblock/core/activeping_telemetry_topic_provider.h delete mode 100644 components/adblock/core/adblock_telemetry_service.cc delete mode 100644 components/adblock/core/adblock_telemetry_service.h + create mode 100644 components/adblock/core/converter/parser/test/test_rules.txt delete mode 100644 components/adblock/features.gni create mode 100755 components/resources/adblocking/snippets/dist/isolated-first.jst create mode 100755 components/resources/adblocking/snippets/dist/isolated-first.source.jst @@ -2248,6 +2254,17 @@ diff --git a/components/adblock/content/browser/adblock_webcontents_observer.h b + raw_ptr settings_map_ = nullptr; }; #endif // COMPONENTS_ADBLOCK_CONTENT_BROWSER_ADBLOCK_WEBCONTENTS_OBSERVER_H_ +diff --git a/components/adblock/content/browser/content_security_policy_injector_impl.cc b/components/adblock/content/browser/content_security_policy_injector_impl.cc +--- a/components/adblock/content/browser/content_security_policy_injector_impl.cc ++++ b/components/adblock/content/browser/content_security_policy_injector_impl.cc +@@ -36,6 +36,7 @@ std::set GetCspInjections( + const std::vector frame_hierarchy_chain) { + TRACE_EVENT1("eyeo", "GetCspInjection", "url", request_url.spec()); + std::set injections; ++ if ((true)) return injections; + for (const auto& collection : subscription_collections) { + const auto injection = + collection->GetCspInjections(request_url, frame_hierarchy_chain); diff --git a/components/adblock/core/BUILD.gn b/components/adblock/core/BUILD.gn --- a/components/adblock/core/BUILD.gn +++ b/components/adblock/core/BUILD.gn @@ -3382,6 +3399,18 @@ diff --git a/components/adblock/core/configuration/persistent_filtering_configur void AddFilterList(GURL url) final; void RemoveFilterList(GURL url) final; std::vector GetFilterLists() const final; +diff --git a/components/adblock/core/converter/flatbuffer_converter.cc b/components/adblock/core/converter/flatbuffer_converter.cc +--- a/components/adblock/core/converter/flatbuffer_converter.cc ++++ b/components/adblock/core/converter/flatbuffer_converter.cc +@@ -125,7 +125,7 @@ void FlatbufferConverter::ConvertFilter( + std::string(filter_str.data(), filter_str.size()))) { + flatbuffer_serializer.SerializeUrlFilter(std::move(url_filter.value())); + } else { +- VLOG(1) << "[eyeo] Invalid url filter: " << line; ++ LOG(INFO) << "[eyeo] Invalid url filter: " << line; + } + break; + } diff --git a/components/adblock/core/converter/parser/metadata.cc b/components/adblock/core/converter/parser/metadata.cc --- a/components/adblock/core/converter/parser/metadata.cc +++ b/components/adblock/core/converter/parser/metadata.cc @@ -3416,6 +3445,32 @@ diff --git a/components/adblock/core/converter/parser/metadata.cc b/components/a << ". Will use default value of " << kDefaultExpirationInterval.InDays() << " days."; return kDefaultExpirationInterval; +diff --git a/components/adblock/core/converter/parser/test/test_rules.txt b/components/adblock/core/converter/parser/test/test_rules.txt +new file mode 100644 +--- /dev/null ++++ b/components/adblock/core/converter/parser/test/test_rules.txt +@@ -0,0 +1,21 @@ ++! gn gen --args="is_component_build=false is_debug=false target_os=\"linux\"" --filters="//components/adblock/core/converter/parser" out/linux ++! date && autoninja -C out/linux components/adblock/core/converter:adblock_flatbuffer_converter && date ++! out/linux/adblock_flatbuffer_converter components/adblock/core/converter/parser/test/test_rules.txt http://localhost b ++! ++$csp=script-src: 'none',domain=example.org|~example.com ++$csp=base-uri,domain=example.org|~example.com ++$csp=script-src 'self' '*' 'unsafe-inline',domain=pirateproxy.live|thehiddenbay.com|downloadpirate.com|thepiratebay10.org|ukpass.co|linksmore.site ++$csp=worker-src 'none',domain=torlock.com|alltube.pl|alltube.tv|centrum-dramy.pl|coinfaucet.eu|crictime.com|crictime.is|doodcdn.com|estream.to|flashx.co|flashx.to|flashx.tv|gomo.to|hdvid.fun|hdvid.tv|hitomi.la|kinox.to|lewd.ninja|assia1.tv|nflbite.com|pirateproxy.live|plytv.me|potomy.ru|powvideo.cc|powvideo.net|putlocker.to|reactor.cc|rojadirecta.watch|sickrage.ca|streamtape.com|thehiddenbay.com|thepiratebay.org|thepiratebay10.org|tpb.party|uptomega.me|ustream.to|vidoza.co|vidoza.net|wallpoper.com|wearesaudis.net|yazilir.com ++@@1337x.to^$csp=script-src 'self' 'unsafe-inline' 'unsafe-eval' data: ++||bodysize.org^$csp=child-src * ++||convertfiles.com^$csp=script-src 'self' '*' 'unsafe-inline' ++||gelbooru.com^$csp=script-src 'self' '*' 'unsafe-inline' *.gstatic.com *.google.com *.googleapis.com *.bootstrapcdn.com ++||moviewatcher.is^$csp=script-src 'self' '*' 'unsafe-inline' ++||pirateiro.com^$csp=script-src 'self' 'unsafe-inline' https://hcaptcha.com *.hcaptcha.com ++! CSP Yavli ++||activistpost.com^$csp=script-src *.leadpages.net *.gstatic.com *.google.com *.googleapis.com *.playwire.com *.facebook.com *.bootstrapcdn.com ++! kinox ++$csp=script-src 'self' 'unsafe-inline' 'unsafe-eval' data: *.cloudflare.com *.google.com *.addthis.com *.addthisedge.com *.facebook.net *.twitter.com *.jquery.com,domain=kinos.to|kinox.am|kinox.bz|kinox.click|kinox.cloud|kinox.club|kinox.digital|kinox.direct|kinox.express|kinox.fun|kinox.fyi|kinox.gratis|kinox.io|kinox.lol|kinox.me|kinox.mobi|kinox.pub|kinox.sh|kinox.sx|kinox.to|kinox.tube|kinox.tv|kinox.wtf|kinoz.to,~third-party ++parenting.pl,echirurgia.pl,dobreprogramy.pl,abczdrowie.pl,wp.pl#$#override-property-read rekid 0 ++parenting.pl,echirurgia.pl,dobreprogramy.pl,abczdrowie.pl,wp.pl#$#override-property-read ++parenting.pl,echirurgia.pl,dobreprogramy.pl,abczdrowie.pl,wp.pl#$#override-property-read 1 pippo diff --git a/components/adblock/core/converter/parser/url_filter.cc b/components/adblock/core/converter/parser/url_filter.cc --- a/components/adblock/core/converter/parser/url_filter.cc +++ b/components/adblock/core/converter/parser/url_filter.cc @@ -3430,10 +3485,158 @@ diff --git a/components/adblock/core/converter/parser/url_filter.cc b/components piece.remove_suffix(1); } if (piece.find('|') == base::StringPiece::npos) { +@@ -108,21 +112,21 @@ absl::optional UrlFilter::FromString(std::string filter_str) { + + if (options->Csp().has_value() && options->Csp().value().empty() && + !is_allowing) { +- VLOG(1) << "[eyeo] Invalid CSP filter. Blocking CSP filter requires " ++ LOG(INFO) << "[eyeo] Invalid CSP filter. Blocking CSP filter requires " + "directives"; + return {}; + } + + if (options->Headers().has_value() && options->Headers().value().empty() && + !is_allowing) { +- VLOG(1) << "[eyeo] Invalid header filter. Blocking header filter " ++ LOG(INFO) << "[eyeo] Invalid header filter. Blocking header filter " + "requires directives"; + return {}; + } + + if (!options->IsSubresource() && !options->ExceptionTypes().empty() && + !is_allowing) { +- VLOG(1) << "[eyeo] Exception options can only be used with allowing " ++ LOG(INFO) << "[eyeo] Exception options can only be used with allowing " + "filters"; + return {}; + } +diff --git a/components/adblock/core/converter/parser/url_filter_options.cc b/components/adblock/core/converter/parser/url_filter_options.cc +--- a/components/adblock/core/converter/parser/url_filter_options.cc ++++ b/components/adblock/core/converter/parser/url_filter_options.cc +@@ -88,20 +88,14 @@ absl::optional UrlFilterOptions::FromString( + } + domains = DomainOption::FromString(value, kDomainOrSitekeySeparator); + } else if (key == "sitekey") { +- if (value.empty()) { +- VLOG(1) << "[eyeo] Sitekey option has to have a value."; +- return {}; +- } +- sitekeys = ParseSitekeys(value); ++ // not supported ++ return {}; + } else if (key == "csp") { +- if (!IsValidCsp(value)) { +- VLOG(1) << "[eyeo] Invalid CSP filter directives: " << value; +- return {}; +- } +- csp = value; ++ // not supported ++ return {}; + } else if (key == "header") { +- ParseHeaders(value); +- headers = value; ++ // not supported ++ return {}; + } else { + ContentType content_type = ContentTypeFromString(key); + if (content_type != ContentType::Unknown) { +@@ -184,6 +178,7 @@ absl::optional UrlFilterOptions::ParseRewrite( + // static + SiteKeys UrlFilterOptions::ParseSitekeys(const std::string& sitekey_value) { + SiteKeys sitekeys; ++ if ((true)) return sitekeys; + for (auto& sitekey : base::SplitString( + base::ToUpperASCII(sitekey_value), kDomainOrSitekeySeparator, + base::KEEP_WHITESPACE, base::SPLIT_WANT_NONEMPTY)) { +@@ -195,6 +190,7 @@ SiteKeys UrlFilterOptions::ParseSitekeys(const std::string& sitekey_value) { + + // static + bool UrlFilterOptions::IsValidCsp(const std::string& csp_value) { ++ if ((true)) return false; + static re2::RE2 invalid_csp( + "(;|^) " + "?(base-uri|referrer|report-to|report-uri|upgrade-insecure-requests)\\b"); +@@ -205,6 +201,7 @@ bool UrlFilterOptions::IsValidCsp(const std::string& csp_value) { + + // static + void UrlFilterOptions::ParseHeaders(std::string& headers_value) { ++ if ((true)) return; + // replace \x2c with actual , + static re2::RE2 r1("([^\\\\])\\\\x2c"); + re2::RE2::GlobalReplace(&headers_value, r1, "\\1,"); diff --git a/components/adblock/core/converter/serializer/flatbuffer_serializer.cc b/components/adblock/core/converter/serializer/flatbuffer_serializer.cc --- a/components/adblock/core/converter/serializer/flatbuffer_serializer.cc +++ b/components/adblock/core/converter/serializer/flatbuffer_serializer.cc -@@ -119,7 +119,7 @@ void FlatbufferSerializer::SerializeContentFilter( +@@ -21,6 +21,7 @@ + #include "base/notreached.h" + #include "base/strings/string_piece.h" + #include "base/strings/string_util.h" ++#include "base/strings/utf_string_conversions.h" + #include "components/adblock/core/common/adblock_constants.h" + #include "components/adblock/core/common/regex_filter_pattern.h" + #include "components/adblock/core/converter/parser/filter_classifier.h" +@@ -28,6 +29,60 @@ + + namespace adblock { + ++namespace { ++ const char16_t* kAllowedSnippets[] = { ++ // Debugging Snippets ++ u"log", u"debug", u"trace", ++ ++ // Performance Snippets ++ u"race", ++ ++ // Conditional Hiding Snippets ++ u"hide-if-contains", ++ u"hide-if-contains-image", ++ u"hide-if-contains-similar-text", ++ u"hide-if-contains-visible-text", ++ u"hide-if-contains-and-matches-style", ++ u"hide-if-matches-computed-xpath", ++ u"hide-if-graph-matches", ++ u"hide-if-has-and-matches-style", ++ u"hide-if-labelled-by", ++ u"hide-if-matches-xpath", ++ u"hide-if-shadow-contains", ++ ++ // Behavioral Snippets ++ u"abort-current-inline-script", ++ u"abort-on-property-read", ++ u"abort-on-property-write", ++ u"abort-on-iframe-property-read", ++ u"abort-on-iframe-property-write", ++ u"cookie-remover", ++ u"freeze-element", ++ // u"json-override", // unsupported ++ u"json-prune", ++ u"override-property-read", ++ // u"simulate-event-poc", (deprecated) ++ // u"simulate-mouse-event", // unsupported ++ u"prevent-listener", ++ u"strip-fetch-query-parameter" ++ }; ++ ++ const char16_t* kAllowedPropertyReadValues[] = { ++ u"false", u"true", u"null", u"noopFunc", ++ u"trueFunc", u"falseFunc", u"emptyArray", ++ u"emptyObj", u"undefined", ++ u"0", u"1" ++ }; ++ ++ template ++ bool IsInList(const std::u16string& command, const char16_t*(&list)[N]) { ++ for(int t = 0; t < N; ++t) ++ if (base::EqualsCaseInsensitiveASCII(command, list[t])) ++ return true; ++ return false; ++ } ++} ++ + class Buffer : public FlatbufferData { + public: + explicit Buffer(flatbuffers::DetachedBuffer&& buffer) +@@ -119,9 +174,25 @@ void FlatbufferSerializer::SerializeContentFilter( void FlatbufferSerializer::SerializeSnippetFilter( const SnippetFilter snippet_filter) { if (!allow_privileged_) { @@ -3441,8 +3644,26 @@ diff --git a/components/adblock/core/converter/serializer/flatbuffer_serializer. + LOG(INFO) << "[eyeo] Snippet filters not allowed"; return; } ++ for (const auto& cur : snippet_filter.snippet_script) { ++ auto command = base::UTF8ToUTF16(cur.front()); ++ if (!IsInList(command, kAllowedSnippets)) { ++ LOG(INFO) << "[eyeo] Snippet filter command not allowed: " << command; ++ return; ++ } ++ if (base::EqualsCaseInsensitiveASCII(command, "override-property-read")) { ++ for (auto it = cur.begin()+2; it != cur.end(); ++it) { ++ auto p = base::UTF8ToUTF16(*it); ++ if (!IsInList(p, kAllowedPropertyReadValues)) { ++ LOG(INFO) << "[eyeo] Snippet override-property-read param not allowed: " << *it; ++ return; ++ } ++ } ++ } ++ } -@@ -143,7 +143,7 @@ void FlatbufferSerializer::SerializeSnippetFilter( + std::vector> offsets; + offsets.reserve(snippet_filter.snippet_script.size()); +@@ -143,7 +214,7 @@ void FlatbufferSerializer::SerializeSnippetFilter( void FlatbufferSerializer::SerializeUrlFilter(const UrlFilter url_filter) { const auto& options = url_filter.options; if (!allow_privileged_ && options.Headers().has_value()) { @@ -3463,7 +3684,15 @@ diff --git a/components/adblock/core/sitekey_storage_impl.cc b/components/adbloc if (user_agent.empty()) { LOG(WARNING) << "[eyeo] No user agent info"; return; -@@ -66,6 +68,8 @@ SitekeyStorageImpl::FindSiteKeyForAnyUrl(const std::vector& urls) const { +@@ -53,6 +55,7 @@ void SitekeyStorageImpl::ProcessResponseHeaders( + + absl::optional> + SitekeyStorageImpl::FindSiteKeyForAnyUrl(const std::vector& urls) const { ++ if ((true)) return {}; + DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_); + for (const auto& url : urls) { + auto elem = url_to_sitekey_map_.find(url); +@@ -66,6 +69,8 @@ SitekeyStorageImpl::FindSiteKeyForAnyUrl(const std::vector& urls) const { void SitekeyStorageImpl::ProcessSiteKey(const GURL& request_url, const SiteKey& site_key, const std::string& user_agent) { @@ -3472,7 +3701,7 @@ diff --git a/components/adblock/core/sitekey_storage_impl.cc b/components/adbloc DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_); DCHECK(!site_key.value().empty()); auto site_key_pair = FindSiteKeyForAnyUrl({request_url}); -@@ -116,6 +120,8 @@ bool SitekeyStorageImpl::IsSitekeySignatureValid( +@@ -116,6 +121,8 @@ bool SitekeyStorageImpl::IsSitekeySignatureValid( const std::string& public_key_b64, const std::string& signature_b64, const std::string& data) const { @@ -3760,10 +3989,21 @@ diff --git a/components/adblock/core/subscription/subscription.h b/components/ad protected: friend class base::RefCountedThreadSafe; virtual ~Subscription(); +diff --git a/components/adblock/core/subscription/subscription_collection_impl.cc b/components/adblock/core/subscription/subscription_collection_impl.cc +--- a/components/adblock/core/subscription/subscription_collection_impl.cc ++++ b/components/adblock/core/subscription/subscription_collection_impl.cc +@@ -426,6 +426,7 @@ std::set SubscriptionCollectionImpl::GetHeaderFilters( + ContentType content_type, + FilterCategory category) const { + std::set filters{}; ++ if ((true)) return filters; + for (const auto& subscription : subscriptions_) { + subscription->FindHeaderFilters( + request_url, content_type, DocumentDomain(request_url, frame_hierarchy), diff --git a/components/adblock/core/subscription/subscription_config.cc b/components/adblock/core/subscription/subscription_config.cc --- a/components/adblock/core/subscription/subscription_config.cc +++ b/components/adblock/core/subscription/subscription_config.cc -@@ -221,16 +221,16 @@ const std::vector& config::GetKnownSubscriptions() { +@@ -221,17 +221,17 @@ const std::vector& config::GetKnownSubscriptions() { SubscriptionFirstRunBehavior::SubscribeIfLocaleMatch, SubscriptionPrivilegedFilterStatus::Forbidden}, {AcceptableAdsUrl(), @@ -3779,11 +4019,13 @@ diff --git a/components/adblock/core/subscription/subscription_config.cc b/compo {}, - SubscriptionUiVisibility::Visible, - SubscriptionFirstRunBehavior::Subscribe, +- SubscriptionPrivilegedFilterStatus::Allowed}, + SubscriptionUiVisibility::Invisible, + SubscriptionFirstRunBehavior::Ignore, - SubscriptionPrivilegedFilterStatus::Allowed}, ++ SubscriptionPrivilegedFilterStatus::AllowedAndChecked}, {GURL(GetHost() + "i_dont_care_about_cookies.txt"), "I don't care about cookies", + {}, @@ -262,13 +262,13 @@ const std::vector& config::GetKnownSubscriptions() { {}, SubscriptionUiVisibility::Invisible, @@ -3800,6 +4042,15 @@ diff --git a/components/adblock/core/subscription/subscription_config.cc b/compo // You can customize subscriptions available on first run and in settings // here. Items are displayed in settings in order declared here. See +@@ -297,7 +297,7 @@ bool config::AllowPrivilegedFilters(const GURL& url) { + for (const auto& cur : GetKnownSubscriptions()) { + if (cur.url == url) { + return cur.privileged_status == +- SubscriptionPrivilegedFilterStatus::Allowed; ++ SubscriptionPrivilegedFilterStatus::AllowedAndChecked; + } + } + @@ -307,9 +307,7 @@ bool config::AllowPrivilegedFilters(const GURL& url) { const std::vector& config::GetPreloadedSubscriptionConfiguration() { @@ -3823,6 +4074,15 @@ diff --git a/components/adblock/core/subscription/subscription_config.h b/compon // Download and install as soon as possible but only if the device's region // matches one of the |languages| defined in KnownSubscriptionInfo. SubscribeIfLocaleMatch, +@@ -48,7 +48,7 @@ enum class SubscriptionFirstRunBehavior { + // Privileged filters include: + // - Snippet filters + // - Header filters +-enum class SubscriptionPrivilegedFilterStatus { Allowed, Forbidden }; ++enum class SubscriptionPrivilegedFilterStatus { AllowedAndChecked, Forbidden }; + + // Description of a subscription that's known to exist in the Internet. + // Can be used to populate a list of proposed or recommended subscriptions in @@ -72,7 +72,7 @@ struct KnownSubscriptionInfo { std::vector languages; SubscriptionUiVisibility ui_visibility = SubscriptionUiVisibility::Visible;