AdguardTeam / Scriptlets

AdGuard scriptlets library
GNU General Public License v3.0
148 stars 29 forks source link

Improve trusted-replace-xhr-response and prevent-xhr — randomise thisArg.shouldBePrevented #386

Open AdamWr opened 10 months ago

AdamWr commented 10 months ago

Currently it's too easy to disable trusted-replace-xhr-response and prevent-xhr by adding <xhr>.shouldBePrevented = false;

Steps to reproduce:

  1. Add this rule:
    example.org#%#//scriptlet('trusted-replace-xhr-response', '*', 'TEST', '/')
  2. Go to - https://example.org/
  3. In browser console run:
    (() => {
    function reqListener() {
    alert(this.responseText);
    }
    const xhr = new XMLHttpRequest();
    xhr.addEventListener("load", reqListener);
    xhr.open("GET", "/");
    xhr.shouldBePrevented = false;
    xhr.send();
    })();

If scriptlet works correctly there should be an alert with TEST message, but xhr.shouldBePrevented = false; disables scriptlet and content is not replaced.

I guess that adding random part to: https://github.com/AdguardTeam/Scriptlets/blob/bad388d94ab265ffd61d23b26a8637721fabfc1e/src/scriptlets/trusted-replace-xhr-response.js#L123 something like thisArg.shouldBePrevented_<random> should fixes it.