Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CSP headers prevents the extension from wrapping JS APIs #25

Closed
polcak opened this issue Apr 30, 2019 · 10 comments
Closed

CSP headers prevents the extension from wrapping JS APIs #25

polcak opened this issue Apr 30, 2019 · 10 comments
Labels
browser bug Something isn't working and it would be better if it was fixed in broser(s) rather than this extens help wanted Extra attention is needed wontfix This will not be worked on

Comments

@polcak
Copy link
Owner

polcak commented Apr 30, 2019

CSP like Content-Security-Policy: default-src 'self'; does not allow the wrapping to be executed. So far confirmed in FF.

I see several options that can be applied:

In both cases, we need to make sure that the wrapping code is executed.
@polcak polcak added the bug Something isn't working label Apr 30, 2019
@polcak
Copy link
Owner Author

polcak commented May 4, 2019

It seems that this bug is Firefox-only.

@polcak
Copy link
Owner Author

polcak commented May 6, 2019

window.eval: EvalError: call to eval() blocked by CSP

@polcak
Copy link
Owner Author

polcak commented May 6, 2019

Data encoded URLs are also not an option: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src

@polcak polcak added the research Further research is required label May 6, 2019
@polcak
Copy link
Owner Author

polcak commented May 6, 2019

This is known Firefox bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1267027, unfortunately it does not seem that they are making any progress lately.

@polcak polcak added help wanted Extra attention is needed wontfix This will not be worked on and removed research Further research is required labels May 6, 2019
@polcak
Copy link
Owner Author

polcak commented May 6, 2019

A workaround could be to interact with page objects directly using https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Sharing_objects_with_page_scripts. However, that requires rewrite of the current code. Is window.wrappedJSObject supported in Chrome?

@matogolf
Copy link
Contributor

matogolf commented May 6, 2019

Most probably not. I didn't find any solid evidence that window.wrappedJSObject is supported in Chrome.

@polcak
Copy link
Owner Author

polcak commented Jun 10, 2019

It seems that Firefox needs wrapping such as:

  var text = "var f = () => 100; exportFunction(f, window.Date, {defineAs:'now'});";
  eval(text);

However, such wrapping is incompatible with our current code.

@polcak
Copy link
Owner Author

polcak commented Jun 10, 2019 •
edited
Loading

Proof of concept page https://www.fit.vutbr.cz/~ipolcak/firefox_csp_bug/csp.php

@polcak
Copy link
Owner Author

polcak commented Jun 21, 2019

JSR from c9a9b8b is able to wrap the code but there are some problems with returning code that cannot be accessed by page script.

This was referenced May 18, 2020
Closed
Closed
@polcak polcak added browser bug Something isn't working and it would be better if it was fixed in broser(s) rather than this extens and removed bug Something isn't working labels May 29, 2020
polcak added a commit that referenced this issue Jun 4, 2020
@polcak
Cache wrapping in background script
6b51fa8 
A part of issue #40 handling.

Background script caches the wrapping to be applied and also the
information about CSP presence (#25). The hope is to improve speed and
consequently, apply wrapping before page scripts kick in. Nevertheless,
there the messages between background and page scripts is still
asynchronous. Hence, the possibility to use or store unwrapped objects
by page scripts early reamins. See #40 for more details.
polcak added a commit that referenced this issue Jun 4, 2020
@polcak
Merge branch caching wrapping in background script
28452fa 
This elminates async browser.storage.sync, however, the message passing
is still asynchronous. So #40 is not fixed.

This also helps with #25 because backgound remembers domains afftected
by the CSP bug in Firefox.
polcak added a commit that referenced this issue Jun 4, 2020
@polcak
Handle wrapping of canvas accessed through iframes
ea02f05 
This fixes #34

In environment affected by Firefox bug 1267027 (see also #25), we do not
wrap HTMLIFrameElement.
@polcak polcak mentioned this issue Jun 4, 2020
Closed
@polcak polcak mentioned this issue Jun 11, 2020
Closed
4 tasks
@polcak polcak mentioned this issue Jun 19, 2020
Closed
4 tasks
@hackademix hackademix mentioned this issue Sep 18, 2020
Closed
@polcak
Copy link
Owner Author

polcak commented Aug 20, 2021

This will be fixed in imminent 0.5 using the code by G. Maone

@polcak polcak closed this as completed Aug 20, 2021
polcak added a commit that referenced this issue Sep 15, 2021
@polcak
0.5 release
3cb109d 
* Add fingerprinting defenses based on Farbling developed by the Brave browser (improved or added
        wrappers for Canvas, Audio, Web GL, device memory, hardware concurrency, enumerateDevices). Most
        wrappers support provisioning of white lies that differ between origins and sessions (the
        fingeprint is different across origins and across sessions).
 * We claimed to generate white image fake Canvas value but instead generated fully transparent black image. We now generate the white image as it is more common in other anti-canvas fingerprinting tools (level 3).
 * toDataUrl() no longer destructs the original canvas.
* We use NoScript Commons Library to simplify some tasks like cross-browser support.
 * More reliable early content script configuration.
   * CSP headers no longer prevents the extension from wrapping JS APIs in Firefox (Github issue #25)
   * Wrappers should be injected reliably before page scripts start to operate (Github issue #40)
 * We use NSCL to wrap APIs in iframes and workers
   * It is no longer possible to access unwrapped functions from iframes and workers (Pagure issue #2, Github issue #56)
* Ignore trailing '.' in domain names when selecting appropriate custom level.
* Do not freeze wrappers to prevent fingeprintability of the users of JSR. We wrap the correct function
        in the prototype chain instead.
* navigator.getGamepads() wrapper added
* navigator.activeVRDisplays() and navigator.xr wrappers added
* Limit precision of high resolution timestamps in the Event, VRFrameData, and Gamepad interface to be consistent
        with Date and Performance precision
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
browser bug Something isn't working and it would be better if it was fixed in broser(s) rather than this extens help wanted Extra attention is needed wontfix This will not be worked on
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@polcak @matogolf