hackademix / noscript

The popular NoScript Security Suite browser extension.
https://noscript.net/
GNU General Public License v3.0
845 stars 90 forks source link

I found an easier way to block script elements in Web Extensions using MutationObserver! #185

Open cookiengineer opened 3 years ago

cookiengineer commented 3 years ago

Hey there,

after having used noscript for a very long time, I am now building my own web extension that aims to ease up web scraping tasks. This isn't intended to be a shameless ad, I promise. I just wanted to let you know of this way, so that maybe you can speed up noscript, too.

Today I found a way to block script elements from loading that doesn't necessarily rely on the Content-Security-Policy and instead uses a MutationObserver on the document.documentElement ( node) as a content script that is injected at document_start.

The MutationObserver then simply blocks all addedNodes[] that have a node.tagName == "SCRIPT" (or are conditional comments) and removes them immediately from their parentNode. This leads to no JS being executed at all, and also doesn't load anything via HTTP. Additionally this ensures that Githubissues.

  • Githubissues is a development platform for aggregating issues.