duckduckgo · kdzwinel · Mar 11, 2021 · Mar 3, 2021 · Mar 4, 2021 · Mar 4, 2021
diff --git a/index.html b/index.html
@@ -49,6 +49,7 @@ <h2>Privacy Protections Tests</h2>
 	<li><a href='https://privacy-test-pages.glitch.me/privacy-protections/referrer-trimming/'>Referrer trimming</a></li>
 	<li><a href='http://privacy-test-pages.glitch.me/privacy-protections/https-upgrades/'>HTTPS upgrades</a></li>
 	<li><a href='http://privacy-test-pages.glitch.me/privacy-protections/click-to-load/'>Facebook click to load</a></li>
+	<li><a href='http://privacy-test-pages.glitch.me/privacy-protections/surrogates/'>Surrogates</a></li>
 </ul>
 
 <h2>Other</h2>

diff --git a/privacy-protections/index.html b/privacy-protections/index.html
@@ -17,7 +17,8 @@ <h1>Privacy Protections Tests</h1>
         <li><a href='https://privacy-test-pages.glitch.me/privacy-protections/referrer-trimming/'>Referrer trimming</a></li>
         <li><a href='http://privacy-test-pages.glitch.me/privacy-protections/https-upgrades/'>HTTPS upgrades</a></li>
         <li><a href='http://privacy-test-pages.glitch.me/privacy-protections/click-to-load/'>Facebook click to load</a></li>
+        <li><a href='http://privacy-test-pages.glitch.me/privacy-protections/surrogates/'>Surrogates</a></li>
     </ul>
 
 </body>
-</html>
+</html>
diff --git a/privacy-protections/surrogates/index.html b/privacy-protections/surrogates/index.html
@@ -0,0 +1,36 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width">
+  <title>Tracker surrogates</title>
+  <style>
+#results-table {
+  font-family: Arial, Helvetica, sans-serif;
+  border-collapse: collapse;
+  width: 70%;
+}
+
+#results-table td, #results-table th {
+  border: 1px solid #ddd;
+  padding: 8px;
+}
+
+#results-table th {
+  padding-top: 12px;
+  padding-bottom: 12px;
+  text-align: left;
+  background-color: #f2f2f2;
+  color: black;
+}
+</style>
+</head>
+<p><a href="../index.html">[Home]</a></p>
+
+<p><b>Test blocking and redirecting to a surrogate</b></p>
+<table id='results-table'>
+    <tr><th>Surrogate</th><th>Loaded</th><th>Passed Test</th><th>Notes</th></tr>
+</table>
+</body>
+<script src='./main.js'></script>
+</html>
diff --git a/privacy-protections/surrogates/main.js b/privacy-protections/surrogates/main.js
@@ -0,0 +1,96 @@
+const results = {};
+
+function updateTable ({ name, testData, error }) {
+    const table = document.getElementById('results-table');
+    const row = table.insertRow(-1);
+    const testName = row.insertCell(0);
+    const loaded = row.insertCell(1);
+    const passed = row.insertCell(2);
+    const note = row.insertCell(3);
+
+    // set default values and colors
+    testName.innerText = name;
+    loaded.innerText = 'failed';
+    passed.innerText = 'failed';
+    row.style.backgroundColor = '#f97268';
+    note.style.backgroundColor = '#ffff';
+
+    results[name] = { pass: true };
+
+    let testPassed = true;
+
+    if (!error && testData.shouldFail) {
+        testPassed = false;
+    }
+
+    if (testPassed) {
+        loaded.innerText = 'pass';
+
+        const result = testData.test();
+        if (result) {
+            passed.innerText = 'pass';
+            row.style.backgroundColor = '#71bf69';
+        } else {
+            results[name].pass = false;
+            loaded.innerText = 'failed';
+        }
+    }
+
+    if (testData.notes) {
+        results[name].notes = testData.notes;
+        note.innerText = testData.notes;
+    }
+
+    if (testData.cleanUp) {
+        testData.cleanUp();
+    }
+}
+
+const surrogates = {
+    'google-analytics.com/analytics.js, crossOrigin': {
+        url: 'https://google-analytics.com/analytics.js',
+        crossOrigin: 'anonymous',
+        notes: 'Test loading with crossOrigin set on element (should fail on Firefox) https://bugzilla.mozilla.org/show_bug.cgi?id=1694679',
+        shouldFail: false,
+        test: () => { return !!(window.ga && Object.keys(window.ga.create()).length === 0); },
+        cleanUp: () => { delete window.ga; }
+    },
+    'google-analytics.com/analytics.js': {
+        url: 'https://google-analytics.com/analytics.js',
+        shouldFail: false,
+        test: () => { return !!(window.ga && Object.keys(window.ga.create()).length === 0); },
+        cleanUp: () => { delete window.ga; }
+    },
+    'Directly accessing a web resouce': {
+        url: 'chrome-extension://bkdgflcldnnnapblkhphbgpggdiikppg/web_accessible_resources/analytics.js',
+        notes: 'Chromium browsers Only: need access key for web resources',
+        shouldFail: true,
+        test: () => { return true; }
+    }
+};
+
+(async function loadSurrogates () {
+    for (const [name, testData] of Object.entries(surrogates)) {
+        await new Promise((resolve, reject) => {
+            const s = document.createElement('script');
+
+            if (testData.crossOrigin) {
+                s.crossOrigin = testData.crossOrigin;
+            }
+
+            s.onload = () => {
+                updateTable({ name, testData });
+                resolve();
+            };
+
+            s.onerror = (error) => {
+                updateTable({ name, testData, error });
+                resolve();
+            };
+
+            s.src = testData.url;
+
+            document.body.appendChild(s);
+        });
+    }
+})();