AdguardTeam / Scriptlets

AdGuard scriptlets library
GNU General Public License v3.0
148 stars 29 forks source link

Improve 'trusted-replace-node-text' — add 'trustedTypes.createPolicy' #457

Open AdamWr opened 2 days ago

AdamWr commented 2 days ago

It's similar issue like - https://github.com/AdguardTeam/AdguardBrowserExtension/issues/2980 On websites which use a Trusted Types, trusted-replace-node-text doesn't work.

Steps to reproduce:

  1. Add this rule:
    youtube.com#%#//scriptlet('trusted-replace-node-text', 'script', 'if (window.ytcsi) {ytcsi', 'if (window.ytcsi) {ytcsi', 'debugger; alert(1);if (window.ytcsi) {ytcsi')
  2. Go to - https://www.youtube.com/

Alert message should be displayed but modifying a script is blocked by Trusted Types.

Screenshot ![image](https://github.com/user-attachments/assets/2b00e407-1cd3-42f7-aaaa-7c80f2547ad2)

Adding trustedTypes.createPolicy to scriptlet probably should fixes it.

Issue occurs in Chromium based browsers but doesn't occur in Firefox because it doesn't support Trusted Types API.