fix script rules applying in ff. AG-5799

AdguardTeam/AdguardBrowserExtension#1733 Squashed commit of the following: commit c88fe90 Author: Slava Leleka <[email protected]> Date: Mon Apr 15 15:01:32 2024 +0400 fix comment commit b6947c5 Merge: f156e6a cb4a3a6 Author: Slava Leleka <[email protected]> Date: Mon Apr 15 15:00:03 2024 +0400 merge master into the branch, resolve conflicts commit f156e6a Author: Slava Leleka <[email protected]> Date: Mon Apr 15 14:58:32 2024 +0400 fix script rules applying in ff
AdguardTeam · Apr 15, 2024 · 454b260 · 454b260
1 parent cb4a3a6
commit 454b260
Show file tree

Hide file tree

Showing 3 changed files with 42 additions and 8 deletions.
diff --git a/packages/tswebextension/CHANGELOG.md b/packages/tswebextension/CHANGELOG.md
@@ -8,11 +8,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 <!-- TODO: manually add compare links for version changes -->
 <!-- e.g. [0.1.2]: https://github.com/AdguardTeam/tsurlfilter/compare/tswebextension-v0.1.1...tswebextension-v0.1.2 -->
 
+## [1.0.24] - 2024-04-15
+
+### Fixed
+
+- Script rules are not applied in Firefox due to CSP [AdguardBrowserExtension#1733].
+
+[1.0.24]: https://github.com/AdguardTeam/tsurlfilter/releases/tag/tswebextension-v1.0.24
+[AdguardBrowserExtension#1733]: https://github.com/AdguardTeam/AdguardBrowserExtension/issues/1733
+
 ## [1.0.23] - 2024-04-15
 
 ### Changed
 
-- Error logging level on setting cookie with mismatched domain and request URL [AdguardBrowserExtension#2683]
+- Error logging level on setting cookie with mismatched domain and request URL [AdguardBrowserExtension#2683].
 
 [1.0.23]: https://github.com/AdguardTeam/tsurlfilter/releases/tag/tswebextension-v1.0.23
 [AdguardBrowserExtension#2683]: https://github.com/AdguardTeam/AdguardBrowserExtension/issues/2683
@@ -38,7 +47,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 [AdguardBrowserExtension#2620]: https://github.com/AdguardTeam/AdguardBrowserExtension/issues/2620
 [AdguardBrowserExtension#2728]: https://github.com/AdguardTeam/AdguardBrowserExtension/issues/2728
 
-
 ## [1.0.18] - 2024-03-25
 
 ### Fixed
@@ -47,7 +55,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 [1.0.18]: https://github.com/AdguardTeam/tsurlfilter/releases/tag/tswebextension-v1.0.18
 
-
 ## [1.0.17] - 2024-03-25
 
 ### Fixed
@@ -57,7 +64,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 [1.0.17]: https://github.com/AdguardTeam/tsurlfilter/releases/tag/tswebextension-v1.0.17
 [AdguardBrowserExtension#1848]: https://github.com/AdguardTeam/AdguardBrowserExtension/issues/1848
 
-
 ## [1.0.16] - 2024-03-01
 
 ### Changed

diff --git a/packages/tswebextension/src/lib/mv2/background/injection-helper.ts b/packages/tswebextension/src/lib/mv2/background/injection-helper.ts
@@ -56,14 +56,27 @@ export const buildScriptText = (scriptText: string): string => {
      * injection. So script waits for them. But if a quantity of frame-requests reaches FRAME_REQUESTS_LIMIT then
      * script stops waiting with the error.
      * Description of the issue: @see {@link https://github.com/AdguardTeam/AdguardBrowserExtension/issues/1004}.
+     *
+     * CSP may prevent script execution in Firefox if script.textContent is used.
+     * That's why script.src is used as a primary way, and script.textContent is used as a fallback.
+     * @see {@link https://github.com/AdguardTeam/AdguardBrowserExtension/issues/1733}.
      */
     return `(function() {\
                 if (window.${variableName}) {\
                     return;\
                 }\
                 var script = document.createElement("script");\
-                script.setAttribute("type", "text/javascript");\
-                script.textContent = "${scriptText.replace(reJsEscape, escapeJs)}";\
+                var preparedScriptText = "${scriptText.replace(reJsEscape, escapeJs)}";\
+                var blob;\
+                var url;\
+                try {\
+                    blob = new Blob([preparedScriptText], { type: "text/javascript; charset=utf-8" });\
+                    url = URL.createObjectURL(blob);\
+                    script.src = url;\
+                } catch (e) {\
+                    script.setAttribute("type", "text/javascript");\
+                    script.textContent = preparedScriptText;\
+                }\
                 var FRAME_REQUESTS_LIMIT = 500;\
                 var frameRequests = 0;\
                 function waitParent () {\
@@ -72,6 +85,9 @@ export const buildScriptText = (scriptText: string): string => {
                     if (parent) {\
                         try {\
                             parent.appendChild(script);\
+                            if (url) {\
+                                URL.revokeObjectURL(url);\
+                            }\
                             parent.removeChild(script);\
                         } catch (e) {\
                         } finally {\

diff --git a/packages/tswebextension/test/lib/mv2/background/injection-helper.test.ts b/packages/tswebextension/test/lib/mv2/background/injection-helper.test.ts
@@ -11,8 +11,17 @@ const expectedScriptTemplate = (text: string): string => `(function() {\
         return;\
     }\
     var script = document.createElement("script");\
-    script.setAttribute("type", "text/javascript");\
-    script.textContent ="${text}";\
+    var preparedScriptText = "${text}";\
+    var blob;\
+        var url;\
+        try {\
+            blob = new Blob([preparedScriptText], { type: "text/javascript; charset=utf-8" });\
+            url = URL.createObjectURL(blob);\
+            script.src = url;\
+        } catch (e) {\
+            script.setAttribute("type", "text/javascript");\
+            script.textContent = preparedScriptText;\
+        }\
     var FRAME_REQUESTS_LIMIT = 500;\
     var frameRequests = 0;\
     function waitParent () {\
@@ -21,6 +30,9 @@ const expectedScriptTemplate = (text: string): string => `(function() {\
         if (parent) {\
             try {\
                 parent.appendChild(script);\
+                if (url) {\
+                    URL.revokeObjectURL(url);\
+                }\
                 parent.removeChild(script);\
             } catch (e) {\
             } finally {\