From 7d8eee860757ca0d544e1f4fccc7cc106f1d224c Mon Sep 17 00:00:00 2001
From: Thomas Rientjes <synzvato@protonmail.com>
Date: Fri, 12 Feb 2016 03:00:28 +0100
Subject: [PATCH] Refactor domain tainting code

---
 lib/interceptor.js  | 44 ++++++++----------------------------
 lib/load-watcher.js | 55 +++++++++++++--------------------------------
 2 files changed, 25 insertions(+), 74 deletions(-)

diff --git a/lib/interceptor.js b/lib/interceptor.js
index 0ae3d10..c8dad4b 100644
--- a/lib/interceptor.js
+++ b/lib/interceptor.js
@@ -27,6 +27,12 @@ var { Cc, Ci, Cr } = require('chrome');
  */
 var simplePreferences = require('sdk/simple-prefs');
 
+/**
+ * Retains data across Firefox restarts.
+ * @var {object} simpleStorage
+ */
+var simpleStorage = require('sdk/simple-storage');
+
 //noinspection JSUnresolvedFunction
 var observerService = Cc['@mozilla.org/observer-service;1']
     .getService(Ci.nsIObserverService);
@@ -34,30 +40,12 @@ var observerService = Cc['@mozilla.org/observer-service;1']
 var requestAnalyzer = require('./request-analyzer');
 var dataHandler = require('./data-handler');
 
-/**
- * Constants
- */
-
-const VALUE_SEPARATOR = ';';
-
 /**
  * Variables
  */
 
-var preferences = require('sdk/simple-prefs').prefs;
-var taintedDomains = {};
-
-/**
- * Initializations
- */
-
-_applyTaintPreference();
-
-/**
- * Event Handlers
- */
-
-simplePreferences.on('taintedDomainList', _applyTaintPreference);
+var preferences = simplePreferences.prefs;
+var storage = simpleStorage.storage;
 
 /**
  * Interceptor Class
@@ -119,7 +107,7 @@ var Interceptor = new Class({
             httpChannel.loadInfo && httpChannel.loadInfo.loadingDocument && httpChannel.loadInfo.loadingDocument.domain ||
             httpChannel.referrer && httpChannel.referrer.host;
 
-        if (taintedDomains[initiatorDomain] === true) {
+        if (storage.taintedDomains[initiatorDomain]) {
             return this.handleMissingCandidate(httpChannel);
         }
 
@@ -143,20 +131,6 @@ var Interceptor = new Class({
     }
 });
 
-/**
- * Private Methods
- */
-
-function _applyTaintPreference() {
-
-    taintedDomains = {};
-
-    //noinspection JSUnresolvedVariable
-    preferences.taintedDomainList.split(VALUE_SEPARATOR).forEach(function (domain) {
-        taintedDomains[domain] = true;
-    });
-}
-
 /**
  * Exports
  */
diff --git a/lib/load-watcher.js b/lib/load-watcher.js
index eae1bea..64f6d19 100644
--- a/lib/load-watcher.js
+++ b/lib/load-watcher.js
@@ -30,10 +30,10 @@ var xpcom = require('sdk/platform/xpcom');
 var mappings = require('./mappings');
 
 /**
- * Gets and sets add-on specific preferences.
- * @var {object} simplePreferences
+ * Retains data across Firefox restarts.
+ * @var {object} simpleStorage
  */
-var simplePreferences = require('sdk/simple-prefs');
+var simpleStorage = require('sdk/simple-storage');
 
 //noinspection JSUnresolvedFunction
 var categoryManager = Cc['@mozilla.org/categorymanager;1']
@@ -45,24 +45,21 @@ var categoryManager = Cc['@mozilla.org/categorymanager;1']
 
 const CONTRACT_ID = '@decentraleyes.org/load-watcher;1';
 const SCRIPT_CONTENT_TYPE = Ci.nsIContentPolicy.TYPE_SCRIPT;
-
-const SCRIPT_ELEMENT = Ci.nsIDOMHTMLScriptElement;
 const HTML_DOCUMENT = Ci.nsIDOMHTMLDocument;
-
-const VALUE_SEPARATOR = ';';
+const SCRIPT_ELEMENT = Ci.nsIDOMHTMLScriptElement;
+const REQUEST_ACCEPTATION = Ci.nsIContentPolicy.ACCEPT;
 
 /**
  * Variables
  */
 
-var preferences = simplePreferences.prefs;
-var taintedDomains = {};
+var storage = simpleStorage.storage;
 
 /**
  * Initializations
  */
 
-_applyTaintPreference();
+storage.taintedDomains = storage.taintedDomains || {};
 
 /**
  * Load Watcher Class
@@ -76,7 +73,7 @@ var LoadWatcher = new Class({
 
     register: function () {
 
-        categoryManager.deleteCategoryEntry('content-policy', '@decentraleyes.org/load-watcher;1', false);
+        categoryManager.deleteCategoryEntry('content-policy', CONTRACT_ID, false);
         categoryManager.addCategoryEntry('content-policy', CONTRACT_ID, CONTRACT_ID, false, true);
     },
 
@@ -89,30 +86,24 @@ var LoadWatcher = new Class({
                 if (node.hasAttribute('crossorigin') || node.hasAttribute('integrity')) {
 
                     // Add corresponding origin domain to the list of tainted domains.
-                    this.saveTaintedDomain(requestOrigin.host);
+                    storage.taintedDomains[requestOrigin.host] = true;
                 }
 
             } else if (node instanceof HTML_DOCUMENT) {
 
-                if (node.defaultView && node.defaultView.frameElement && node.defaultView.frameElement.tagName === 'IFRAME') {
+                if (node.defaultView && node.defaultView.frameElement) {
 
-                    // Add corresponding origin domain to the list of tainted domains.
-                    this.saveTaintedDomain(requestOrigin.host);
+                    if (node.defaultView.frameElement.tagName === 'IFRAME') {
+
+                        // Add corresponding origin domain to the list of tainted domains.
+                        storage.taintedDomains[requestOrigin.host] = true;
+                    }
                 }
             }
         }
 
         // Accept the resource load request.
-        return Ci.nsIContentPolicy.ACCEPT;
-    },
-
-    saveTaintedDomain: function (taintedDomain) {
-
-        if (taintedDomains[taintedDomain] !== true) {
-
-            taintedDomains[taintedDomain] = true;
-            preferences.taintedDomainList = Object.keys(taintedDomains).join(VALUE_SEPARATOR);
-        }
+        return REQUEST_ACCEPTATION;
     }
 });
 
@@ -154,20 +145,6 @@ unload.when(function () {
     }
 });
 
-/**
- * Private Methods
- */
-
-function _applyTaintPreference() {
-
-    taintedDomains = {};
-
-    //noinspection JSUnresolvedVariable
-    preferences.taintedDomainList.split(VALUE_SEPARATOR).forEach(function (domain) {
-        taintedDomains[domain] = true;
-    });
-}
-
 /**
  * Exports
  */
-- 
GitLab