brave / brave-browser

Brave browser for Android, iOS, Linux, macOS, Windows.
https://brave.com
Mozilla Public License 2.0
17.63k stars 2.3k forks source link

Allow users to load custom adblock scriptlets #25586

Open antonok-edm opened 2 years ago

antonok-edm commented 2 years ago

Sometimes, websites have features that cannot be blocked by network request blocking or through CSS. Some of these are dealt with by using scriptlets. We currently use uBlock Origin's resource library for scriptlets, as well as a few custom ones in the https://github.com/brave/adblock-resources repository.

One of Brave's core principles is to put the user back in control of their browsing experience, so we should also allow users to upload their own custom scriptlets, probably from brave://settings/shields/filters. It would be a feature specifically for advanced users, so it's ok to have it hidden at first. The UI would allow users to view a list of scriptlets they've added, to edit or remove entries, and to add a new one. A scriptlet consists of arbitrary JavaScript code and can be given a name for reference in custom filter rules, e.g. brave-fix.

Note that this is a security sensitive feature. If users paste untrusted code into a scriptlet, attackers may be able to inject arbitrary code on certain websites that they browse, leading to significant privacy/security risks - UI should be adjusted accordingly.

ghost commented 8 months ago

This is really needed. For example, Brave depending on a 3p for the scriptlets is just not good, because if uBlock doesn't want to add a scriptlet they don't find 'user cases to implement it', that means, we as Brave users are just restricted to what uBlock wants to do or not, we depend on them, and there is nothing we can do to make Brave browser better. Since uBlock doesn't want to support trusted-set-attr, that means, we Brave users can't have it, it is so easy to implement, just remove the restricted values and done, but since we can't load them on our own, that means we only depend on uBlock, especially on mobile where there is no extensions support. If tomorrow uBlock decided to remove their remove attribute, remove class scriptlets because they are already marked as Deprecated by the action operators :remove-attr() and :remove-class() then Brave will be at loss.

Also, we have examples of TwitchAdSolutions scriptlets being a great example for this, video-swap-new and vaft exist, and can reduce quality of a Twitch stream while an ad is playing to avoid it, but we can't use them in Brave, because they are hit and miss, they might work one day and not the next, but at least testing and loading them on our own, would truly extend the capabilities of Brave as a whole. Or something like a Twitter/X to Nitter redirector can be achieved easily through JS without the use of extensions, or anything else.

Brave needs to invest and work more in the Adblocker, put more money to it, Brave already chose the path to follow uBlock development and their features and even use their lists, and these are the consequences of that, they add the alias "from" and then they make those rules incompatible with Brave, they created the include in lists, and ifs and all that in their lists, and a lot of stuff gets messy for Brave users. At least Brave can break some dependency by allowing the users to use our own scriptlets, and then being able to feel a little more free, because right now we can't even turn Default lists off, even if they break X or Y.

ShivanKaul commented 2 weeks ago

We should have this under a feature flag, default disabled.