uBo implemented regex, if someone trust something like:
/bad-js.$domain=/[a-z-]{18}\.[\w]{2,20}/
/[a-z-]{18}\.[\w]{2,20}/##.bad-class
!
! regex in the dumb version - rather, the webmaster fell how to avoid falling into a safe regex.
but fail for , in cosmetic/scriptlet filters and | in network filters if gorhill rejected repair:
In theory, network filtering can be unprotected by domain=/from= and cosmetic filtering can be based on the site's permanent DOM tree (No match to 99% of the rest of the sites on the Internet).
The scriptlet is also still possible to run all over the Internet in uBo, but there have been considerations for years whether to secure this with a minimum of "I am an advanced user" activation.
uBo implemented regex, if someone trust something like:
but fail for
,
in cosmetic/scriptlet filters and|
in network filters if gorhill rejected repair:https://github.com/uBlockOrigin/uBlock-issues/discussions/2234#discussioncomment-5403472
In theory, network filtering can be unprotected by
domain=
/from=
and cosmetic filtering can be based on the site's permanent DOM tree (No match to 99% of the rest of the sites on the Internet).The scriptlet is also still possible to run all over the Internet in uBo, but there have been considerations for years whether to secure this with a minimum of "I am an advanced user" activation.
Also voe is covered sometimes: https://github.com/uBlockOrigin/uAssets/commit/5a660a989b0e836e47bb4886b9a28bf19136783a
(Unfortunately, I don't see how to turn these 36 domains into which regex - The site appears to have no fixed pattern (diffrent words, number order).)
Originally posted by @krystian3w in https://github.com/AdguardTeam/CoreLibs/issues/1550#issuecomment-1553743192