Skip to content

Commit a767169

Browse files
t2ymt2ym
committed
0.1.13-stack.19 with Issue #266 Block access to hook.utils.createHash/HTMLParser via automation
1 parent 235ea2c commit a767169

18 files changed

+427
-330
lines changed

‎bower.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "thin-hook",
3-
"version": "0.1.13-stack.18",
3+
"version": "0.1.13-stack.19",
44
"description": "Thin Hook Preprocessor",
55
"main": "hook.min.js",
66
"authors": [

‎demo/cache-bundle.js

+2-1
Original file line numberDiff line numberDiff line change
@@ -196,6 +196,7 @@ if (enableCacheBundle) {
196196
cacheBundle();
197197
}
198198
else if (self.constructor.name === 'Window' && top === self) {
199+
const createHash = hook.utils.createHash;
199200
const CACHE_STATUS_PSEUDO_URL = 'https://thin-hook.localhost.localdomain/cache-status.json';
200201
const AUTOMATION_PSEUDO_URL = 'https://thin-hook.localhost.localdomain/automation.json';
201202
const PSEUDO_URL_PREFIX = 'https://thin-hook.localhost.localdomain/';
@@ -219,7 +220,7 @@ if (enableCacheBundle) {
219220
*/
220221
const scriptURL = new URL(currentScript.src, href);
221222
const authorization = scriptURL.searchParams.get('authorization');
222-
let hash = hook.utils.createHash('sha256');
223+
let hash = createHash('sha256');
223224
hash.update(status.serverSecret + status.script);
224225
let digest = hash.digest('hex');
225226
if (digest === authorization) {

‎demo/cache-bundle.json

+8-8
Large diffs are not rendered by default.

‎demo/cacheBundleGeneration.js

-299
Original file line numberDiff line numberDiff line change
@@ -127,303 +127,4 @@ default:
127127
console.log(cacheBundlePath, 'version = ', cacheBundle.version,' length = ', cacheBundleJSON.length, ' bytes with ', keys.length, ' files = \n', JSON.stringify(keys, null, 2));
128128

129129
browser.close();
130-
131-
await new Promise(resolve => setTimeout(resolve, 4000));
132-
console.log('wait 4000');
133-
134-
browser = await puppeteer.launch({ headless: true, args: [ '--disable-gpu' ], executablePath: chromePath });
135-
page = await browser.newPage();
136-
await page.setViewport({ width: 1200, height: 800 });
137-
138-
// tests
139-
await page.goto(targetURL);
140-
console.log('goto', targetURL);
141-
await page.waitFor(15000);
142-
console.log('waitFor(15000)');
143-
result = await page.evaluate(function getNavigatorViaHook() {
144-
try {
145-
return __hook__('.', this, ['navigator'], 'context').constructor.name + ' at ' + location.href;
146-
}
147-
catch (error) {
148-
return error.message;
149-
}
150-
});
151-
console.log('test: getNavigatorViaHook:', result);
152-
chai.assert.equal(result, '__hook__: invalid context', 'cannot access navigator via __hook__');
153-
result = await page.evaluate(function getNavigatorViaHook2() {
154-
try {
155-
return __hook__('.', this, ['navigator'], Symbol.for('context')).constructor.name + ' at ' + location.href;
156-
}
157-
catch (error) {
158-
return error.message;
159-
}
160-
});
161-
console.log('test: getNavigatorViaHook2:', result);
162-
chai.assert.equal(result, 'Cannot read property \'for\' of undefined', 'cannot access navigator via __hook__');
163-
await page.waitFor(1000);
164-
result = await page.evaluate(function checkLocation() {
165-
try {
166-
return location.href;
167-
}
168-
catch (error) {
169-
return error.message;
170-
}
171-
});
172-
console.log('test: checkLocation:', result);
173-
chai.assert.equal(result, 'about:blank', 'location is about:blank');
174-
175-
await page.goto(targetURL);
176-
console.log('goto', targetURL);
177-
await page.waitFor(15000);
178-
console.log('waitFor(15000)');
179-
result = await page.evaluate(function getGoogleCharts() {
180-
try {
181-
return typeof google.charts + ' at ' + location.href;
182-
}
183-
catch (error) {
184-
return error.message;
185-
}
186-
});
187-
console.log('test: getGoogleCharts:', result);
188-
chai.assert.equal(result, 'Cannot read property \'charts\' of undefined', 'cannot access caches');
189-
await page.waitFor(1000);
190-
result = await page.evaluate(function checkLocation() {
191-
try {
192-
return location.href;
193-
}
194-
catch (error) {
195-
return error.message;
196-
}
197-
});
198-
console.log('test: checkLocation:', result);
199-
chai.assert.equal(result, 'about:blank', 'location is about:blank');
200-
201-
await page.goto(targetURL);
202-
console.log('goto', targetURL);
203-
await page.waitFor(15000);
204-
console.log('waitFor(15000)');
205-
result = await page.evaluate(function getCaches() {
206-
try {
207-
return caches.constructor.name + ' at ' + location.href;
208-
}
209-
catch (error) {
210-
return error.message;
211-
}
212-
});
213-
console.log('test: getCaches:', result);
214-
chai.assert.equal(result, 'Cannot read property \'constructor\' of undefined', 'cannot access caches');
215-
await page.waitFor(1000);
216-
result = await page.evaluate(function checkLocation() {
217-
try {
218-
return location.href;
219-
}
220-
catch (error) {
221-
return error.message;
222-
}
223-
});
224-
console.log('test: checkLocation:', result);
225-
chai.assert.equal(result, 'about:blank', 'location is about:blank');
226-
227-
await page.goto(targetURL);
228-
console.log('goto', targetURL);
229-
await page.waitFor(15000);
230-
console.log('waitFor(15000)');
231-
result = await page.evaluate(function getObjectIndirect() {
232-
try {
233-
let result = this.__proto__.__proto__.__proto__.__proto__.constructor.name;
234-
return result + ' at ' + location.href;
235-
}
236-
catch (error) {
237-
return error.message;
238-
}
239-
});
240-
console.log('test: getObjectIndirect:', result);
241-
chai.assert.equal(result, 'Cannot read property \'__proto__\' of undefined', 'cannot access Object via prototype chain');
242-
await page.waitFor(1000);
243-
result = await page.evaluate(function checkLocation() {
244-
try {
245-
return location.href;
246-
}
247-
catch (error) {
248-
return error.message;
249-
}
250-
});
251-
console.log('test: checkLocation:', result);
252-
chai.assert.equal(result, 'about:blank', 'location is about:blank');
253-
254-
await page.goto(targetURL);
255-
console.log('goto', targetURL);
256-
await page.waitFor(15000);
257-
console.log('waitFor(15000)');
258-
result = await page.evaluate(function getPolymer() {
259-
try {
260-
return Polymer.name + ' at ' + location.href;
261-
}
262-
catch (error) {
263-
return error.message;
264-
}
265-
});
266-
console.log('test: getPolymer:', result);
267-
chai.assert.equal(result, 'Cannot read property \'name\' of undefined', 'cannot access non-native global property Polymer');
268-
await page.waitFor(1000);
269-
result = await page.evaluate(function checkLocation() {
270-
try {
271-
return location.href;
272-
}
273-
catch (error) {
274-
return error.message;
275-
}
276-
});
277-
console.log('test: checkLocation:', result);
278-
chai.assert.equal(result, 'about:blank', 'location is about:blank');
279-
280-
await page.goto(targetURL);
281-
console.log('goto', targetURL);
282-
await page.waitFor(15000);
283-
console.log('waitFor(15000)');
284-
result = await page.evaluate(function getLookupGetter() {
285-
try {
286-
return __lookupGetter__.name + ' at ' + location.href;
287-
}
288-
catch (error) {
289-
return error.message;
290-
}
291-
});
292-
console.log('test: getLookupGetter:', result);
293-
chai.assert.equal(result, 'Cannot read property \'name\' of undefined', 'cannot access __lookupGetter__');
294-
await page.waitFor(1000);
295-
result = await page.evaluate(function checkLocation() {
296-
try {
297-
return location.href;
298-
}
299-
catch (error) {
300-
return error.message;
301-
}
302-
});
303-
console.log('test: checkLocation:', result);
304-
chai.assert.equal(result, 'about:blank', 'location is about:blank');
305-
306-
await page.goto(targetURL);
307-
console.log('goto', targetURL);
308-
await page.waitFor(15000);
309-
console.log('waitFor(15000)');
310-
result = await page.evaluate(function getAddEventListener() {
311-
try {
312-
return addEventListener.name + ' at ' + location.href;
313-
}
314-
catch (error) {
315-
return error.message;
316-
}
317-
});
318-
console.log('test: getAddEventListener:', result);
319-
chai.assert.equal(result, 'Cannot read property \'name\' of undefined', 'cannot access addEventListener from EventTarget.prototype');
320-
await page.waitFor(1000);
321-
result = await page.evaluate(function checkLocation() {
322-
try {
323-
return location.href;
324-
}
325-
catch (error) {
326-
return error.message;
327-
}
328-
});
329-
console.log('test: checkLocation:', result);
330-
chai.assert.equal(result, 'about:blank', 'location is about:blank');
331-
332-
await page.goto(targetURL);
333-
console.log('goto', targetURL);
334-
await page.waitFor(15000);
335-
console.log('waitFor(15000)');
336-
result = await page.evaluate(async function getPrototypeLookupGetter() {
337-
try {
338-
return this.__proto__.__proto__.__proto__.__proto__.__lookupGetter__.name + ' at ' + location.href;
339-
}
340-
catch (error) {
341-
return error.message;
342-
}
343-
});
344-
console.log('test: getPrototypeLookupGetter:', result);
345-
chai.assert.equal(result, 'Cannot read property \'__proto__\' of undefined', 'cannot access __lookupGetter__ via __proto__');
346-
await page.waitFor(1000);
347-
result = await page.evaluate(function checkLocation() {
348-
try {
349-
return location.href;
350-
}
351-
catch (error) {
352-
return error.message;
353-
}
354-
});
355-
console.log('test: checkLocation:', result);
356-
chai.assert.equal(result, 'about:blank', 'location is about:blank');
357-
358-
await page.goto(targetURL);
359-
console.log('goto', targetURL);
360-
await page.waitFor(15000);
361-
console.log('waitFor(15000)');
362-
result = await page.evaluate(async function getMathLookupGetter() {
363-
try {
364-
return Math.__lookupGetter__.name + ' at ' + location.href;
365-
}
366-
catch (error) {
367-
return error.message;
368-
}
369-
});
370-
console.log('test: getMathLookupGetter:', result);
371-
chai.assert.equal(result, 'Cannot read property \'name\' of undefined', 'cannot access __lookupGetter__ via Math');
372-
await page.waitFor(1000);
373-
result = await page.evaluate(function checkLocation() {
374-
try {
375-
return location.href;
376-
}
377-
catch (error) {
378-
return error.message;
379-
}
380-
});
381-
console.log('test: checkLocation:', result);
382-
chai.assert.equal(result, 'about:blank', 'location is about:blank');
383-
384-
await page.goto(targetURL);
385-
console.log('goto', targetURL);
386-
await page.waitFor(15000);
387-
console.log('waitFor(15000)');
388-
result = await page.evaluate(async function getMathAbsLookupGetter() {
389-
try {
390-
return Math.abs.__lookupGetter__.name + ' at ' + location.href;
391-
}
392-
catch (error) {
393-
return error.message;
394-
}
395-
});
396-
console.log('test: getMathAbsLookupGetter:', result);
397-
chai.assert.equal(result, 'Cannot read property \'name\' of undefined', 'cannot access __lookupGetter__ via Math.abs');
398-
await page.waitFor(1000);
399-
result = await page.evaluate(function checkLocation() {
400-
try {
401-
return location.href;
402-
}
403-
catch (error) {
404-
return error.message;
405-
}
406-
});
407-
console.log('test: checkLocation:', result);
408-
chai.assert.equal(result, 'about:blank', 'location is about:blank');
409-
410-
await page.goto(targetURL);
411-
console.log('goto', targetURL);
412-
await page.waitFor(15000);
413-
console.log('waitFor(15000)');
414-
result = await page.evaluate(async function getEvalObject() {
415-
try {
416-
return hook.eval('__hook__')('Object').name + ' at ' + location.href;
417-
}
418-
catch (error) {
419-
return error.message;
420-
}
421-
});
422-
console.log('test: getEvalObject:', result);
423-
chai.assert.equal(result, 'unknown error', 'cannot access Object via hook.eval');
424-
425-
// end of tests
426-
427-
browser.close();
428-
429130
})();

‎demo/empty-document.html

+1-1
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
<html>
77
<head>
88
<meta charset="utf-8">
9-
<script src="../../thin-hook/hook.min.js?no-hook=true&hook-name=__hook__&context-generator-name=method&discard-hook-errors=false&fallback-page=index-fb.html&hook-property=true&hook-global=true&hook-prefix=_uNpREdiC4aB1e_&compact=true&no-hook-authorization=e0caf52b9fdf38d3fc4e2d0a42772b663c2cdfa1e4760f2f4e8e91df27eeb01e,log-no-hook-authorization"></script>
9+
<script src="../../thin-hook/hook.min.js?no-hook=true&hook-name=__hook__&context-generator-name=method&discard-hook-errors=false&fallback-page=index-fb.html&hook-property=true&hook-global=true&hook-prefix=_uNpREdiC4aB1e_&compact=true&no-hook-authorization=081933c56ca58fd683f5d64b7ebc949777a16481c564f6760497aae63e658360,log-no-hook-authorization"></script>
1010
<script context-generator src="no-hook-authorization.js?no-hook=true"></script>
1111
<script context-generator src="context-generator.js?no-hook=true"></script>
1212
<script context-generator src="bootstrap.js?no-hook=true"></script>

‎demo/hook-callback.js

+4-1
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,8 @@ Copyright (c) 2017, 2018, Tetsuya Mori <[email protected]>. All rights reserv
3535
const Symbol = self.Symbol;
3636
const JSON = self.JSON;
3737
const URL = self.URL;
38+
const createHash = hook.utils.createHash;
39+
const HTMLParser = hook.utils.HTMLParser;
3840
let wrapGlobalProperty; // = function (object, property, objectName); assigned at the bottom of this script
3941
class Stack {
4042
constructor(stack) {
@@ -1743,7 +1745,7 @@ Copyright (c) 2017, 2018, Tetsuya Mori <[email protected]>. All rights reserv
17431745
if (result) {
17441746
if (opType === 'w') {
17451747
//console.log('set innerHTML: context = ' + hookArgs[3]);
1746-
let stream = new hook.utils.HTMLParser.WritableStream({
1748+
let stream = new HTMLParser.WritableStream({
17471749
onopentag(name, attributes) {
17481750
//console.log('set innerHTML: tagName = ' + name);
17491751
// TODO: Apply ACL for attributes as well with normalization of attributes to properties (mostly identical)
@@ -7898,6 +7900,7 @@ Copyright (c) 2017, 2018, Tetsuya Mori <[email protected]>. All rights reserv
78987900
'removeEventListener',
78997901
'dispatchEvent',
79007902
], 'window', _window ],
7903+
[ hook.utils, '*', 'hook.utils' ],
79017904
].forEach(wrapGlobalProperty);
79027905
}
79037906
}

‎demo/index.html

+2-2
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@
1515
<html lang="en">
1616
<head>
1717
<meta charset="utf-8">
18-
<script src="../../thin-hook/hook.min.js?version=496&no-hook-authorization=e0caf52b9fdf38d3fc4e2d0a42772b663c2cdfa1e4760f2f4e8e91df27eeb01e,a578e741369d927f693fedc88c75b1a90f1a79465e2bb9774a3f68ffc6e011e6,log-no-hook-authorization&sw-root=/&no-hook=true&hook-name=__hook__&context-generator-name=method&discard-hook-errors=false&fallback-page=index-fb.html&hook-property=true&hook-global=true&hook-prefix=_uNpREdiC4aB1e_&compact=true&service-worker-ready=false"></script></head></html>
18+
<script src="../../thin-hook/hook.min.js?version=496&no-hook-authorization=081933c56ca58fd683f5d64b7ebc949777a16481c564f6760497aae63e658360,a578e741369d927f693fedc88c75b1a90f1a79465e2bb9774a3f68ffc6e011e6,log-no-hook-authorization&sw-root=/&no-hook=true&hook-name=__hook__&context-generator-name=method&discard-hook-errors=false&fallback-page=index-fb.html&hook-property=true&hook-global=true&hook-prefix=_uNpREdiC4aB1e_&compact=true&service-worker-ready=false"></script></head></html>
1919
<script context-generator src="no-hook-authorization.js?no-hook=true"></script>
2020
<script context-generator src="disable-devtools.js?no-hook=true"></script>
2121
<script context-generator src="context-generator.js?no-hook=true"></script>
@@ -48,7 +48,7 @@
4848
};
4949
}
5050
</script>
51-
<script context-generator src="cache-bundle.js?no-hook=true&authorization=3d0b8b8f73016346c8485cd76c2ad0a32194a7cf32fe355618f6787763c468de"></script>
51+
<script context-generator src="cache-bundle.js?no-hook=true&authorization=37a313e0afc31af75a8acf38436218aa77e4567a894ceb1c307235b215f17e56"></script>
5252
<script src="hook-callback.js?no-hook=true"></script><!--<C!-- end of mandatory no-hook scripts --C>
5353
<script src="../../webcomponentsjs/webcomponents-lite.js"></script>
5454
<C!-- <script no-hook>

0 commit comments

Comments
 (0)