Skip to content
Snippets Groups Projects

Compare revisions

Changes are shown as if the source revision was being merged into the target revision. Learn more about comparing revisions.

Source

Select target project
No results found

Target

Select target project
  • Synzvato/decentraleyes
  • gkrishnaks/decentraleyes
  • ExE-Boss/decentraleyes
  • whtsky/decentraleyes
  • grtgarrett/decentraleyes
  • An_dz/decentraleyes
  • Alaska/decentraleyes
  • finn/decentraleyes
  • klippy/decentraleyes
9 results
Show changes
Showing with 1334 additions and 226 deletions
Introduction
------------
This audit script allows any user and extension reviewer to verify the integrity of the bundled resources. It automatically, and transparently, compares all bundled libraries to their original sources.
Usage Instructions (Unix)
------------------
1. Make sure you have Node.js installed on your machine.
2. Open up a terminal and ```cd``` into this directory.
3. Execute ```npm install``` to fetch any dependencies.
4. Run the audit script by executing ```node run```.
**Note:** If you'd like to save the report, run ```node run > report.txt```.
\ No newline at end of file
{
"name": "decentraleyes-audit",
"version": "1.5.0",
"lockfileVersion": 1,
"requires": true,
"dependencies": {
"source-map-url": {
"version": "0.4.0",
"resolved": "https://registry.npmjs.org/source-map-url/-/source-map-url-0.4.0.tgz",
"integrity": "sha1-PpNdfd1zYxuXZZlW1VEo6HtQhKM="
}
}
}
{
"name": "decentraleyes-audit",
"version": "1.4.0",
"version": "1.5.0",
"author": "Thomas Rientjes",
"license": "MPL-2.0",
"description": "Library audit tool for Decentraleyes.",
......
......@@ -15,12 +15,11 @@
* Imports
*/
var fileSystem, crypto, http, path, sourceMappingURL;
var fileSystem, crypto, https, sourceMappingURL;
fileSystem = require('fs');
crypto = require('crypto');
https = require('https');
path = require('path');
sourceMappingURL = require('source-map-url');
......@@ -31,21 +30,18 @@ sourceMappingURL = require('source-map-url');
var localResourceLocation = '../resources';
var localResourceLocationLength = localResourceLocation.length;
var localResourcePaths = [];
var comparedResourceAmount = 0;
var resourceAmount = 0;
/**
* Functions
*/
function _fetchLocalResourcePaths(folderPath) {
function _fetchLocalResourcePaths (folderPath) {
fileSystem.readdirSync(folderPath).forEach(function (resourceName) {
if (resourceName === '_audit') {
return localResourcePaths;
}
var resourcePath = folderPath + '/' + resourceName;
var resourcePath = `${folderPath}/${resourceName}`;
var resourceStatistics = fileSystem.statSync(resourcePath);
if (resourceStatistics && resourceStatistics.isDirectory()) {
......@@ -59,7 +55,7 @@ function _fetchLocalResourcePaths(folderPath) {
return localResourcePaths;
}
function _getLocalResourceContents(fileLocation, callback) {
function _getLocalResourceContents (fileLocation, callback) {
fileSystem.exists(fileLocation, function (exists) {
......@@ -75,7 +71,7 @@ function _getLocalResourceContents(fileLocation, callback) {
var localFileContents = buffer.toString('utf8', 0, buffer.length);
fileSystem.close(fileDescriptor);
fileSystem.close(fileDescriptor, function () {});
callback(localFileContents);
});
});
......@@ -85,16 +81,16 @@ function _getLocalResourceContents(fileLocation, callback) {
});
}
function _getRemoteResourceContents(remoteResourceRoute, callback) {
function _getRemoteResourceContents (remoteResourceRoute, callback) {
var resourceURL = 'https://ajax.googleapis.com/ajax/libs/' + remoteResourceRoute;
var resourceURL = `https://ajax.googleapis.com/ajax/libs/${remoteResourceRoute}`;
https.get(resourceURL, function (response) {
var resourceContents = '';
response.on('data', function (chunk) {
resourceContents = resourceContents + chunk;
resourceContents += chunk;
});
response.on('end', function () {
......@@ -105,20 +101,20 @@ function _getRemoteResourceContents(remoteResourceRoute, callback) {
} else {
resourceURL = 'https://cdnjs.cloudflare.com/ajax/libs/' + remoteResourceRoute;
resourceURL = `https://cdnjs.cloudflare.com/ajax/libs/${remoteResourceRoute}`;
https.get(resourceURL, function (response) {
resourceContents = '';
response.on('data', function (chunk) {
resourceContents = resourceContents + chunk;
resourceContents += chunk;
});
response.on('end', function () {
if (response.statusCode !== 200) {
throw 'Error: Resource ' + remoteResourceRoute + ' could not be fetched.';
throw `Error: Resource ${remoteResourceRoute} could not be fetched.`;
}
callback(resourceContents, resourceURL);
......@@ -133,7 +129,7 @@ function _getRemoteResourceContents(remoteResourceRoute, callback) {
});
}
function _hashFileContents(fileContents) {
function _hashFileContents (fileContents) {
var hash;
......@@ -146,7 +142,27 @@ function _hashFileContents(fileContents) {
return hash.read();
}
function _compareResources(localResourceContents, remoteResourceContents, URL) {
function _showCompletedMessage () {
console.log();
console.log(' *** FILE INTEGRITY CHECKS COMPLETED');
console.log(` *** ${resourceAmount}/${resourceAmount} RESOURCES WERE ANALYZED`);
console.log();
}
function _incrementComparedResourceAmount () {
comparedResourceAmount++;
if (comparedResourceAmount === resourceAmount) {
setTimeout(function () {
_showCompletedMessage();
}, 500);
}
}
function _compareResources (localResourceContents, remoteResourceContents, URL) {
var hasSourceMappingURL = sourceMappingURL.existsIn(remoteResourceContents);
var sourceMappingNotice = '[ ] REMOTE RESOURCE HAD SOURCE MAPPING URL';
......@@ -156,14 +172,11 @@ function _compareResources(localResourceContents, remoteResourceContents, URL) {
sourceMappingNotice = '[X] REMOTE RESOURCE HAD SOURCE MAPPING URL';
}
// Remove the syntax invalidation character from the local contents.
localResourceContents = localResourceContents.substring(1);
var localResourceHash = _hashFileContents(localResourceContents);
var remoteResourceHash = _hashFileContents(remoteResourceContents);
console.log('RESOURCE HASH (SHA512): ' + localResourceHash);
console.log('RESOURCE HASH (SHA512): ' + remoteResourceHash);
console.log(`RESOURCE HASH (SHA512): ${localResourceHash}`);
console.log(`RESOURCE HASH (SHA512): ${remoteResourceHash}`);
var fileHashesMatch = (localResourceHash === remoteResourceHash);
......@@ -176,14 +189,8 @@ function _compareResources(localResourceContents, remoteResourceContents, URL) {
console.log();
console.log('[X] LOCAL AND REMOTE RESOURCE HASHES MATCH');
console.log(sourceMappingNotice);
}
function _showCompletedMessage() {
console.log();
console.log(' *** FILE INTEGRITY CHECKS COMPLETED');
console.log(' *** ' + resourceAmount + '/' + resourceAmount + ' RESOURCES WERE ANALYZED');
console.log();
_incrementComparedResourceAmount();
}
/**
......@@ -197,7 +204,7 @@ resourceAmount = localResourcePaths.length;
* Script
*/
localResourcePaths.forEach(function (resourcePath, index) {
localResourcePaths.forEach(function (resourcePath) {
var resourceRoute = resourcePath.substr(localResourceLocationLength + 1);
resourceRoute = resourceRoute.substring(0, resourceRoute.length - 4);
......@@ -215,13 +222,6 @@ localResourcePaths.forEach(function (resourcePath, index) {
console.log();
console.log('------------------------------------------');
if (index === resourceAmount - 1) {
setTimeout(function () {
_showCompletedMessage();
}, 500);
}
});
});
......
locale decentraleyes bg locale/bg/
locale decentraleyes da locale/da/
locale decentraleyes de locale/de/
locale decentraleyes en-GB locale/en-GB/
locale decentraleyes en-US locale/en-US/
locale decentraleyes eo locale/eo/
locale decentraleyes es locale/es/
locale decentraleyes fi locale/fi/
locale decentraleyes fr locale/fr/
locale decentraleyes id locale/id/
locale decentraleyes it locale/it/
locale decentraleyes ja locale/ja/
locale decentraleyes nl locale/nl/
locale decentraleyes pl locale/pl/
locale decentraleyes pt-PT locale/pt-PT/
locale decentraleyes ru locale/ru/
locale decentraleyes sv-SE locale/sv-SE/
locale decentraleyes zh-CN locale/zh-CN/
locale decentraleyes zh-TW locale/zh-TW/
/**
* Global Constants
* Belongs to Decentraleyes.
*
* @author Thomas Rientjes
* @since 2017-10-27
* @license MPL 2.0
*
* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this file,
* You can obtain one at http://mozilla.org/MPL/2.0/.
*/
'use strict';
/**
* Constants
*/
const Address = {
'ANY': '*://*/*',
'ANY_PATH': '/*',
'ANY_PROTOCOL': '*://',
'CHROME': 'chrome:',
'CHROME_EXTENSION': 'chrome-extension:',
'DECENTRALEYES': 'decentraleyes.org',
'EXAMPLE': 'example.org',
'HTTP': 'http:',
'HTTPS': 'https:',
'RESOURCE_PATH': '/resources',
'ROOT_PATH': '/',
'WWW_PREFIX': 'www.'
};
const Header = {
'COOKIE': 'Cookie',
'ORIGIN': 'Origin',
'REFERER': 'Referer'
};
const MessageResponse = {
'ASYNCHRONOUS': true,
'SYNCHRONOUS': false
};
const Resource = {
'MAPPING_EXPRESSION': /\.map$/i,
'VERSION_EXPRESSION': /(?:\d{1,2}\.){1,3}\d{1,2}/,
'VERSION_PLACEHOLDER': '{version}'
};
const Setting = {
'AMOUNT_INJECTED': 'amountInjected',
'BLOCK_MISSING': 'blockMissing',
'DISABLE_PREFETCH': 'disablePrefetch',
'SHOW_ICON_BADGE': 'showIconBadge',
'SHOW_RELEASE_NOTES': 'showReleaseNotes',
'STRIP_METADATA': 'stripMetadata',
'WHITELISTED_DOMAINS': 'whitelistedDomains',
'XHR_TEST_DOMAIN': 'xhrTestDomain'
};
const WebRequest = {
'GET': 'GET',
'BLOCKING': 'blocking',
'HEADERS': 'requestHeaders'
};
const WebRequestType = {
'MAIN_FRAME': 'main_frame',
'XHR': 'xmlhttprequest'
};
const Whitelist = {
'TRIM_EXPRESSION': /^;+|;+$/g,
'VALUE_SEPARATOR': ';'
};
/**
* File Guard
* Belongs to Decentraleyes.
*
* @see https://git.synz.io/Synzvato/decentraleyes/merge_requests/258
*
* @author Thomas Rientjes
* @since 2018-05-17
* @license MPL 2.0
*
* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this file,
* You can obtain one at http://mozilla.org/MPL/2.0/.
*/
'use strict';
/**
* File Guard
*/
var fileGuard = {};
/**
* Private Methods
*/
fileGuard._startListening = function () {
let randomHexString = helpers.generateRandomHexString(24);
fileGuard.secret = `?_=${randomHexString}`;
chrome.webRequest.onBeforeRequest.addListener(
fileGuard._verifyRequest,
{'urls': [fileGuard.path + Address.ANY_PATH]},
[WebRequest.BLOCKING]
);
};
fileGuard._verifyRequest = function (requestDetails) {
let redirectUrl = chrome.runtime.getURL(Address.ROOT_PATH);
if (!requestDetails.url.endsWith(fileGuard.secret)) {
return {redirectUrl};
}
};
/**
* Initializations
*/
fileGuard.path = chrome.runtime.getURL(Address.RESOURCE_PATH);
fileGuard.secret = '';
if (fileGuard.path.startsWith(Address.CHROME_EXTENSION)) {
fileGuard._startListening();
}
......@@ -260,9 +260,3 @@ var files = {
'resources/webfont/1.5.10/webfont.js.dec': true,
'resources/webfont/1.5.18/webfont.js.dec': true
};
/**
* Exports
*/
module.exports = files;
/**
* Interceptor
* Belongs to Decentraleyes.
*
* @author Thomas Rientjes
* @since 2016-04-06
* @license MPL 2.0
*
* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this file,
* You can obtain one at http://mozilla.org/MPL/2.0/.
*/
'use strict';
/**
* Interceptor
*/
var interceptor = {};
/**
* Public Methods
*/
interceptor.handleRequest = function (requestDetails, tabIdentifier, tab) {
let validCandidate, tabDomain, targetDetails, targetPath;
validCandidate = requestAnalyzer.isValidCandidate(requestDetails, tab);
if (!validCandidate) {
return {
'cancel': false
};
}
tabDomain = helpers.extractDomainFromUrl(tab.url, true);
if (tabDomain === null) {
tabDomain = Address.EXAMPLE;
}
if (requestDetails.type === WebRequestType.XHR) {
if (tabDomain !== interceptor.xhrTestDomain) {
return interceptor._handleMissingCandidate(requestDetails.url);
}
}
// Temporary list of undetectable tainted domains.
let undetectableTaintedDomains = {
'10fastfingers.com': true,
'blog.datawrapper.de': true,
'bundleofholding.com': true,
'cdnjs.com': true,
'dropbox.com': true,
'evoice.com': true,
'freebusy.io': true,
'gazetadopovo.com.br': true,
'glowing-bear.org': true,
'manualslib.com': true,
'meslieux.paris.fr': true,
'mgm.gov.tr': true,
'minigames.mail.ru': true,
'miniquadtestbench.com': true,
'nhm.ac.uk': true,
'openweathermap.org': true,
'poedb.tw': true,
'qwertee.com': true,
'regentgreymouth.co.nz': true,
'report-uri.io': true,
'scan.nextcloud.com': true,
'scotthelme.co.uk': true,
'securityheaders.com': true,
'securityheaders.io': true,
'stefansundin.github.io': true,
'transcend-info.com': true,
'udacity.com': true,
'yadi.sk': true,
'yourvotematters.co.uk': true
};
if (undetectableTaintedDomains[tabDomain] || (/yandex\./).test(tabDomain)) {
return interceptor._handleMissingCandidate(requestDetails.url);
}
targetDetails = requestAnalyzer.getLocalTarget(requestDetails);
targetPath = targetDetails.path;
if (!targetPath) {
return interceptor._handleMissingCandidate(requestDetails.url);
}
if (!files[targetPath]) {
return interceptor._handleMissingCandidate(requestDetails.url);
}
stateManager.requests[requestDetails.requestId] = {
tabIdentifier, targetDetails
};
return {
'redirectUrl': chrome.extension.getURL(targetPath + fileGuard.secret)
};
};
/**
* Private Methods
*/
interceptor._handleMissingCandidate = function (requestUrl) {
if (interceptor.blockMissing === true) {
return {
'cancel': true
};
}
let requestUrlSegments = new URL(requestUrl);
if (requestUrlSegments.protocol === Address.HTTP) {
requestUrlSegments.protocol = Address.HTTPS;
requestUrl = requestUrlSegments.toString();
return {
'redirectUrl': requestUrl
};
} else {
return {
'cancel': false
};
}
};
interceptor._handleStorageChanged = function (changes) {
if (Setting.XHR_TEST_DOMAIN in changes) {
interceptor.xhrTestDomain = changes.xhrTestDomain.newValue;
}
if (Setting.BLOCK_MISSING in changes) {
interceptor.blockMissing = changes.blockMissing.newValue;
}
};
/**
* Initializations
*/
interceptor.amountInjected = 0;
interceptor.xhrTestDomain = Address.DECENTRALEYES;
interceptor.blockMissing = false;
interceptor.relatedSettings = [];
interceptor.relatedSettings.push(Setting.AMOUNT_INJECTED);
interceptor.relatedSettings.push(Setting.XHR_TEST_DOMAIN);
interceptor.relatedSettings.push(Setting.BLOCK_MISSING);
chrome.storage.local.get(interceptor.relatedSettings, function (items) {
interceptor.amountInjected = items.amountInjected || 0;
interceptor.xhrTestDomain = items.xhrTestDomain || Address.DECENTRALEYES;
interceptor.blockMissing = items.blockMissing || false;
});
/**
* Event Handlers
*/
chrome.storage.onChanged.addListener(interceptor._handleStorageChanged);
/**
* Entry Point
* Belongs to Decentraleyes.
*
* @author Thomas Rientjes
* @since 2016-04-04
* @license MPL-2.0
*
* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this file,
* You can obtain one at http://mozilla.org/MPL/2.0/.
*/
'use strict';
/**
* Main
*/
var main = {};
/**
* Private Methods
*/
main._initializeOptions = function () {
let optionDefaults = {
[Setting.XHR_TEST_DOMAIN]: Address.DECENTRALEYES,
[Setting.SHOW_ICON_BADGE]: true,
[Setting.BLOCK_MISSING]: false,
[Setting.DISABLE_PREFETCH]: true,
[Setting.STRIP_METADATA]: true,
[Setting.WHITELISTED_DOMAINS]: {}
};
chrome.storage.local.get(optionDefaults, function (options) {
if (options === null) {
options = optionDefaults;
}
if (options.disablePrefetch !== false) {
chrome.privacy.network.networkPredictionEnabled.set({
'value': false
});
}
chrome.storage.local.set(options);
});
};
main._showReleaseNotes = function (details) {
let location, previousVersion;
location = chrome.extension.getURL('pages/welcome/welcome.html');
if (details.reason === chrome.runtime.OnInstalledReason.INSTALL ||
details.reason === chrome.runtime.OnInstalledReason.UPDATE) {
previousVersion = details.previousVersion;
if (previousVersion && previousVersion.charAt(0) === '2') {
return; // Do not show release notes after minor updates.
}
if (details.temporary !== true) {
chrome.storage.local.get({
[Setting.SHOW_RELEASE_NOTES]: true
}, function (options) {
if (options.showReleaseNotes === true) {
chrome.tabs.create({
'url': location,
'active': false
});
}
});
}
}
};
/**
* Initializations
*/
chrome.runtime.onInstalled.addListener(main._showReleaseNotes);
main._initializeOptions();
wrappers.setBadgeBackgroundColor({
'color': [74, 130, 108, 255]
});
......@@ -13,12 +13,6 @@
'use strict';
/**
* Imports
*/
var resources = require('./resources');
/**
* Mappings
*/
......@@ -41,105 +35,48 @@ var mappings = {
'swfobject/{version}/swfobject.': resources.swfobject,
'webfont/{version}/webfont.': resources.webfont,
// Common Shorthand Notations [Deprecated]
// Basic Shorthand Notations [Deprecated]
'dojo/1/dojo/dojo.': {
path: 'resources/dojo/1.6.1/dojo/dojo.js.dec',
type: 'application/javascript'
'path': 'resources/dojo/1.6.1/dojo/dojo.js.dec',
'type': 'application/javascript'
},
'jquery/1/jquery.': {
path: 'resources/jquery/1.11.1/jquery.min.js.dec',
type: 'application/javascript'
},
'jquery/1.2/jquery.min.js': {
path: 'resources/jquery/1.2.6/jquery.min.js.dec',
type: 'application/javascript'
},
'jquery/1.2/jquery.js': {
path: 'resources/jquery/1.2.6/jquery.min.js.dec',
type: 'application/javascript'
},
'jquery/1.3/jquery.min.js': {
path: 'resources/jquery/1.3.2/jquery.min.js.dec',
type: 'application/javascript'
},
'jquery/1.3/jquery.js': {
path: 'resources/jquery/1.3.2/jquery.min.js.dec',
type: 'application/javascript'
},
'jquery/1.4/jquery.min.js': {
path: 'resources/jquery/1.4.4/jquery.min.js.dec',
type: 'application/javascript'
},
'jquery/1.4/jquery.js': {
path: 'resources/jquery/1.4.4/jquery.min.js.dec',
type: 'application/javascript'
},
'jquery/1.5/jquery.min.js': {
path: 'resources/jquery/1.5.2/jquery.min.js.dec',
type: 'application/javascript'
},
'jquery/1.5/jquery.js': {
path: 'resources/jquery/1.5.2/jquery.min.js.dec',
type: 'application/javascript'
},
'jquery/1.6/jquery.min.js': {
path: 'resources/jquery/1.6.4/jquery.min.js.dec',
type: 'application/javascript'
},
'jquery/1.6/jquery.js': {
path: 'resources/jquery/1.6.4/jquery.min.js.dec',
type: 'application/javascript'
},
'jquery/1.7/jquery.min.js': {
path: 'resources/jquery/1.7.2/jquery.min.js.dec',
type: 'application/javascript'
},
'jquery/1.7/jquery.js': {
path: 'resources/jquery/1.7.2/jquery.min.js.dec',
type: 'application/javascript'
},
'jquery/1.8/jquery.min.js': {
path: 'resources/jquery/1.8.3/jquery.min.js.dec',
type: 'application/javascript'
},
'jquery/1.8/jquery.js': {
path: 'resources/jquery/1.8.3/jquery.min.js.dec',
type: 'application/javascript'
'path': 'resources/jquery/1.11.1/jquery.min.js.dec',
'type': 'application/javascript'
},
'jqueryui/1/jquery-ui.js': {
path: 'resources/jqueryui/1.10.4/jquery-ui.min.js.dec',
type: 'application/javascript'
'path': 'resources/jqueryui/1.10.4/jquery-ui.min.js.dec',
'type': 'application/javascript'
},
'jqueryui/1/jquery-ui.min.js': {
path: 'resources/jqueryui/1.10.4/jquery-ui.min.js.dec',
type: 'application/javascript'
'path': 'resources/jqueryui/1.10.4/jquery-ui.min.js.dec',
'type': 'application/javascript'
},
'mootools/1/mootools-yui-compressed.': {
path: 'resources/mootools/1.1.2/mootools-yui-compressed.js.dec',
type: 'application/javascript'
'path': 'resources/mootools/1.1.2/mootools-yui-compressed.js.dec',
'type': 'application/javascript'
},
'prototype/1/prototype.': {
path: 'resources/prototype/1.7.1.0/prototype.js.dec',
type: 'application/javascript'
'path': 'resources/prototype/1.7.1.0/prototype.js.dec',
'type': 'application/javascript'
},
'scriptaculous/1/scriptaculous.': {
path: 'resources/scriptaculous/1.9.0/scriptaculous.js.dec',
type: 'application/javascript'
'path': 'resources/scriptaculous/1.9.0/scriptaculous.js.dec',
'type': 'application/javascript'
},
'swfobject/2/swfobject.': {
path: 'resources/swfobject/2.2/swfobject.js.dec',
type: 'application/javascript'
'path': 'resources/swfobject/2.2/swfobject.js.dec',
'type': 'application/javascript'
},
'webfont/1/webfont.': {
path: 'resources/webfont/1.5.18/webfont.js.dec',
type: 'application/javascript'
'path': 'resources/webfont/1.5.18/webfont.js.dec',
'type': 'application/javascript'
}
}
},
// Microsoft Ajax CDN
'ajax.aspnetcdn.com': {
'/ajax/': {
'jQuery/jquery-{version}.': resources.jQuery,
'jquery/jquery-{version}.': resources.jQuery,
'modernizr/modernizr-{version}.': resources.modernizr
}
......@@ -147,7 +84,6 @@ var mappings = {
// Microsoft Ajax CDN [Deprecated]
'ajax.microsoft.com': {
'/ajax/': {
'jQuery/jquery-{version}.': resources.jQuery,
'jquery/jquery-{version}.': resources.jQuery,
'modernizr/modernizr-{version}.': resources.modernizr
}
......@@ -180,54 +116,14 @@ var mappings = {
'ui/{version}/jquery-ui.js': resources.jQueryUI,
'ui/{version}/jquery-ui.min.js': resources.jQueryUI,
// Common Shorthand Notations [Deprecated]
// Basic Shorthand Notations [Deprecated]
'jquery-latest.': {
path: 'resources/jquery/1.11.1/jquery.min.js.dec',
type: 'application/javascript'
'path': 'resources/jquery/1.11.1/jquery.min.js.dec',
'type': 'application/javascript'
},
'jquery.': {
path: 'resources/jquery/1.11.1/jquery.min.js.dec',
type: 'application/javascript'
},
'jquery-1.3.min.js': {
path: 'resources/jquery/1.3.0/jquery.min.js.dec',
type: 'application/javascript'
},
'jquery-1.3.js': {
path: 'resources/jquery/1.3.0/jquery.min.js.dec',
type: 'application/javascript'
},
'jquery-1.4.min.js': {
path: 'resources/jquery/1.4.0/jquery.min.js.dec',
type: 'application/javascript'
},
'jquery-1.4.js': {
path: 'resources/jquery/1.4.0/jquery.min.js.dec',
type: 'application/javascript'
},
'jquery-1.5.min.js': {
path: 'resources/jquery/1.5.0/jquery.min.js.dec',
type: 'application/javascript'
},
'jquery-1.5.js': {
path: 'resources/jquery/1.5.0/jquery.min.js.dec',
type: 'application/javascript'
},
'jquery-1.6.min.js': {
path: 'resources/jquery/1.6.0/jquery.min.js.dec',
type: 'application/javascript'
},
'jquery-1.6.js': {
path: 'resources/jquery/1.6.0/jquery.min.js.dec',
type: 'application/javascript'
},
'jquery-1.7.min.js': {
path: 'resources/jquery/1.7.0/jquery.min.js.dec',
type: 'application/javascript'
},
'jquery-1.7.js': {
path: 'resources/jquery/1.7.0/jquery.min.js.dec',
type: 'application/javascript'
'path': 'resources/jquery/1.11.1/jquery.min.js.dec',
'type': 'application/javascript'
}
}
},
......@@ -339,11 +235,35 @@ var mappings = {
'modernizr/modernizr-{version}.': resources.modernizr,
'mootoolscore/mootools.core-{version}.': resources.mootools
}
},
// BootCDN
'cdn.bootcss.com': {
'/': {
'angular.js/{version}/angular.': resources.angular,
'backbone.js/{version}/backbone.': resources.backbone,
'backbone.js/{version}/backbone-min.': resources.backbone,
'dojo/{version}/dojo.': resources.dojo,
'ember.js/{version}/ember.': resources.ember,
'ext-core/{version}/ext-core.': resources.extCore,
'jquery/{version}/jquery.': resources.jQuery,
'jqueryui/{version}/jquery-ui.js': resources.jQueryUI,
'jqueryui/{version}/jquery-ui.min.js': resources.jQueryUI,
'modernizr/{version}/modernizr.': resources.modernizr,
'mootools/{version}/mootools-yui-compressed.': resources.mootools,
'prototype/{version}/prototype.': resources.prototypeJS,
'scriptaculous/{version}/scriptaculous.': resources.scriptaculous,
'swfobject/{version}/swfobject.': resources.swfobject,
'underscore.js/{version}/underscore.': resources.underscore,
'underscore.js/{version}/underscore-min.': resources.underscore,
'webfont/{version}/webfontloader.': resources.webfont
}
}
};
/**
* Exports
*/
// Geekzu Public Service [Mirror]
mappings['sdn.geekzu.org'] = {
'/ajax/ajax/libs/': mappings['ajax.googleapis.com']['/ajax/libs/']
};
module.exports = mappings;
// USTC Linux User Group [Mirror]
mappings['ajax.proxy.ustclug.org'] = mappings['ajax.googleapis.com'];
/**
* Messenger
* Belongs to Decentraleyes.
*
* @author Thomas Rientjes
* @since 2018-05-28
* @license MPL 2.0
*
* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this file,
* You can obtain one at http://mozilla.org/MPL/2.0/.
*/
'use strict';
/**
* Messenger
*/
var messenger = {};
/**
* Private Methods
*/
messenger._handleMessageReceived = function (message, sender, sendResponse) {
let topic, value;
topic = message.topic;
value = message.value;
if (topic === 'tab:fetch-injections') {
sendResponse({'value': stateManager.tabs[value].injections});
return MessageResponse.SYNCHRONOUS;
}
if (topic === 'domain:fetch-is-whitelisted') {
let whitelistRecord = requestAnalyzer.whitelistedDomains[value];
sendResponse({'value': Boolean(whitelistRecord)});
return MessageResponse.SYNCHRONOUS;
}
if (topic === 'whitelist:add-domain') {
stateManager.addDomainToWhitelist(value).then(function () {
sendResponse({'value': true});
});
return MessageResponse.ASYNCHRONOUS;
}
if (topic === 'whitelist:remove-domain') {
stateManager.removeDomainFromWhitelist(value).then(function () {
sendResponse({'value': true});
});
return MessageResponse.ASYNCHRONOUS;
}
};
/**
* Event Handlers
*/
chrome.runtime.onMessage.addListener(messenger._handleMessageReceived);
/**
* Request Analyzer
* Belongs to Decentraleyes.
*
* @author Thomas Rientjes
* @since 2016-04-11
* @license MPL 2.0
*
* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this file,
* You can obtain one at http://mozilla.org/MPL/2.0/.
*/
'use strict';
/**
* Request Analyzer
*/
var requestAnalyzer = {};
/**
* Public Methods
*/
requestAnalyzer.isValidCandidate = function (requestDetails, tabDetails) {
let initiatorDomain, isWhitelisted;
initiatorDomain = helpers.extractDomainFromUrl(tabDetails.url, true);
if (initiatorDomain === null) {
initiatorDomain = Address.EXAMPLE;
}
isWhitelisted = requestAnalyzer.whitelistedDomains[initiatorDomain];
if (isWhitelisted) {
return false;
}
// Only requests of type GET can be valid candidates.
return requestDetails.method === WebRequest.GET;
};
requestAnalyzer.getLocalTarget = function (requestDetails) {
let destinationUrl, destinationHost, destinationPath, hostMappings, basePath, resourceMappings;
destinationUrl = new URL(requestDetails.url);
destinationHost = destinationUrl.host;
destinationPath = destinationUrl.pathname;
// Use the proper mappings for the targeted host.
hostMappings = mappings[destinationHost];
// Resource mapping files are never locally available.
if (Resource.MAPPING_EXPRESSION.test(destinationPath)) {
return false;
}
basePath = requestAnalyzer._matchBasePath(hostMappings, destinationPath);
resourceMappings = hostMappings[basePath];
if (!resourceMappings) {
return false;
}
// Return either the local target's path or false.
return requestAnalyzer._findLocalTarget(resourceMappings, basePath, destinationHost, destinationPath);
};
/**
* Private Methods
*/
requestAnalyzer._matchBasePath = function (hostMappings, channelPath) {
for (let basePath of Object.keys(hostMappings)) {
if (channelPath.startsWith(basePath)) {
return basePath;
}
}
return false;
};
requestAnalyzer._findLocalTarget = function (resourceMappings, basePath, channelHost, channelPath) {
let resourcePath, versionNumber, resourcePattern;
resourcePath = channelPath.replace(basePath, '');
versionNumber = resourcePath.match(Resource.VERSION_EXPRESSION);
resourcePattern = resourcePath.replace(versionNumber, Resource.VERSION_PLACEHOLDER);
for (let resourceMold of Object.keys(resourceMappings)) {
if (resourcePattern.startsWith(resourceMold)) {
let targetPath, hostShorthands, version;
targetPath = resourceMappings[resourceMold].path;
targetPath = targetPath.replace(Resource.VERSION_PLACEHOLDER, versionNumber);
hostShorthands = shorthands[channelHost];
if (hostShorthands && hostShorthands[targetPath]) {
let shorthand = hostShorthands[targetPath];
targetPath = shorthand.path;
version = shorthand.version;
} else {
version = versionNumber && versionNumber[0] || targetPath.match(Resource.VERSION_EXPRESSION);
}
// Prepare and return a local target.
return {
'source': channelHost,
'version': version,
'path': targetPath
};
}
}
return false;
};
requestAnalyzer._applyWhitelistedDomains = function () {
chrome.storage.local.get(Setting.WHITELISTED_DOMAINS, function (items) {
requestAnalyzer.whitelistedDomains = items.whitelistedDomains || {};
});
};
/**
* Initializations
*/
requestAnalyzer.whitelistedDomains = {};
requestAnalyzer._applyWhitelistedDomains();
/**
* Event Handlers
*/
chrome.storage.onChanged.addListener(requestAnalyzer._applyWhitelistedDomains);
/**
* Request Sanitizer
* Belongs to Decentraleyes.
*
* @author Thomas Rientjes
* @since 2018-01-10
* @license MPL 2.0
*
* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this file,
* You can obtain one at http://mozilla.org/MPL/2.0/.
*/
'use strict';
/**
* Request Sanitizer
*/
var requestSanitizer = {};
/**
* Public Methods
*/
requestSanitizer.enable = function () {
let onBeforeSendHeaders = chrome.webRequest.onBeforeSendHeaders;
onBeforeSendHeaders.addListener(requestSanitizer._stripMetadata, {
'urls': stateManager.validHosts
}, [WebRequest.BLOCKING, WebRequest.HEADERS]);
};
requestSanitizer.disable = function () {
let onBeforeSendHeaders = chrome.webRequest.onBeforeSendHeaders;
onBeforeSendHeaders.removeListener(requestSanitizer._stripMetadata, {
'urls': stateManager.validHosts
}, [WebRequest.BLOCKING, WebRequest.HEADERS]);
};
/**
* Private Methods
*/
requestSanitizer._stripMetadata = function (requestDetails) {
let sensitiveHeaders = [Header.COOKIE, Header.ORIGIN, Header.REFERER];
for (let i = 0; i < requestDetails.requestHeaders.length; ++i) {
if (sensitiveHeaders.indexOf(requestDetails.requestHeaders[i].name) > -1) {
requestDetails.requestHeaders.splice(i--, 1);
}
}
return {
[WebRequest.HEADERS]: requestDetails.requestHeaders
};
};
/**
* Initializations
*/
chrome.storage.local.get({[Setting.STRIP_METADATA]: true}, function (options) {
if (options === null || options.stripMetadata !== false) {
requestSanitizer.enable();
}
});
/**
* Resources
* Belongs to Decentraleyes.
*
* @author Thomas Rientjes
* @since 2014-05-30
* @license MPL 2.0
*
* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this file,
* You can obtain one at http://mozilla.org/MPL/2.0/.
*/
'use strict';
/**
* Resources
*/
var resources = {
// AngularJS
'angular': {
'path': 'resources/angularjs/{version}/angular.min.js.dec',
'type': 'application/javascript'
},
// Backbone.js
'backbone': {
'path': 'resources/backbone.js/{version}/backbone-min.js.dec',
'type': 'application/javascript'
},
// Dojo
'dojo': {
'path': 'resources/dojo/{version}/dojo/dojo.js.dec',
'type': 'application/javascript'
},
// Ember.js
'ember': {
'path': 'resources/ember.js/{version}/ember.min.js.dec',
'type': 'application/javascript'
},
// Ext Core
'extCore': {
'path': 'resources/ext-core/{version}/ext-core.js.dec',
'type': 'application/javascript'
},
// jQuery
'jQuery': {
'path': 'resources/jquery/{version}/jquery.min.js.dec',
'type': 'application/javascript'
},
// jQuery UI
'jQueryUI': {
'path': 'resources/jqueryui/{version}/jquery-ui.min.js.dec',
'type': 'application/javascript'
},
// Modernizr
'modernizr': {
'path': 'resources/modernizr/{version}/modernizr.min.js.dec',
'type': 'application/javascript'
},
// MooTools
'mootools': {
'path': 'resources/mootools/{version}/mootools-yui-compressed.js.dec',
'type': 'application/javascript'
},
// Prototype
'prototypeJS': {
'path': 'resources/prototype/{version}/prototype.js.dec',
'type': 'application/javascript'
},
// Scriptaculous
'scriptaculous': {
'path': 'resources/scriptaculous/{version}/scriptaculous.js.dec',
'type': 'application/javascript'
},
// SWFObject
'swfobject': {
'path': 'resources/swfobject/{version}/swfobject.js.dec',
'type': 'application/javascript'
},
// Underscore.js
'underscore': {
'path': 'resources/underscore.js/{version}/underscore-min.js.dec',
'type': 'application/javascript'
},
// Web Font Loader
'webfont': {
'path': 'resources/webfont/{version}/webfont.js.dec',
'type': 'application/javascript'
}
};
/**
* Shorthands
* Belongs to Decentraleyes.
*
* @author Thomas Rientjes
* @since 2018-02-24
* @license MPL 2.0
*
* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this file,
* You can obtain one at http://mozilla.org/MPL/2.0/.
*/
'use strict';
/**
* Shorthands
*/
var shorthands = {
// Google Hosted Libraries [Deprecated]
'ajax.googleapis.com': {
'resources/jquery/1.8/jquery.min.js.dec': {
'path': 'resources/jquery/1.8.3/jquery.min.js.dec',
'version': '1.8.3'
},
'resources/jquery/1.7/jquery.min.js.dec': {
'path': 'resources/jquery/1.7.2/jquery.min.js.dec',
'version': '1.7.2'
},
'resources/jquery/1.6/jquery.min.js.dec': {
'path': 'resources/jquery/1.6.4/jquery.min.js.dec',
'version': '1.6.4'
},
'resources/jquery/1.5/jquery.min.js.dec': {
'path': 'resources/jquery/1.5.2/jquery.min.js.dec',
'version': '1.5.2'
},
'resources/jquery/1.4/jquery.min.js.dec': {
'path': 'resources/jquery/1.4.4/jquery.min.js.dec',
'version': '1.4.4'
},
'resources/jquery/1.3/jquery.min.js.dec': {
'path': 'resources/jquery/1.3.2/jquery.min.js.dec',
'version': '1.3.2'
},
'resources/jquery/1.2/jquery.min.js.dec': {
'path': 'resources/jquery/1.2.6/jquery.min.js.dec',
'version': '1.2.6'
}
},
// jQuery CDN [Deprecated]
'code.jquery.com': {
'resources/jquery/1.7/jquery.min.js.dec': {
'path': 'resources/jquery/1.7.0/jquery.min.js.dec',
'version': '1.7.0'
},
'resources/jquery/1.6/jquery.min.js.dec': {
'path': 'resources/jquery/1.6.0/jquery.min.js.dec',
'version': '1.6.0'
},
'resources/jquery/1.5/jquery.min.js.dec': {
'path': 'resources/jquery/1.5.0/jquery.min.js.dec',
'version': '1.5.0'
},
'resources/jquery/1.4/jquery.min.js.dec': {
'path': 'resources/jquery/1.4.0/jquery.min.js.dec',
'version': '1.4.0'
},
'resources/jquery/1.3/jquery.min.js.dec': {
'path': 'resources/jquery/1.3.0/jquery.min.js.dec',
'version': '1.3.0'
}
}
};
// Geekzu Public Service [Mirror]
shorthands['sdn.geekzu.org'] = shorthands['ajax.googleapis.com'];
// USTC Linux User Group [Mirror]
shorthands['ajax.proxy.ustclug.org'] = shorthands['ajax.googleapis.com'];
/**
* State Manager
* Belongs to Decentraleyes.
*
* @author Thomas Rientjes
* @since 2017-03-10
* @license MPL 2.0
*
* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this file,
* You can obtain one at http://mozilla.org/MPL/2.0/.
*/
'use strict';
/**
* State Manager
*/
var stateManager = {};
/**
* Public Methods
*/
stateManager.registerInjection = function (tabIdentifier, injection) {
let injectionIdentifier, registeredTab, injectionCount;
injectionIdentifier = injection.source + injection.path + injection.version;
registeredTab = stateManager.tabs[tabIdentifier];
registeredTab.injections[injectionIdentifier] = injection;
injectionCount = Object.keys(registeredTab.injections).length || 0;
if (injectionCount > 0) {
chrome.browserAction.setTitle({
'tabId': tabIdentifier,
'title': `Decentraleyes (${injectionCount})`
});
if (stateManager.showIconBadge === true) {
wrappers.setBadgeText({
'tabId': tabIdentifier,
'text': injectionCount.toString()
});
}
}
if (isNaN(interceptor.amountInjected)) {
chrome.storage.local.get(Setting.AMOUNT_INJECTED, function (items) {
interceptor.amountInjected = items.amountInjected;
chrome.storage.local.set({
[Setting.AMOUNT_INJECTED]: ++interceptor.amountInjected
});
});
} else {
chrome.storage.local.set({
[Setting.AMOUNT_INJECTED]: ++interceptor.amountInjected
});
}
};
stateManager.addDomainToWhitelist = function (domain) {
return new Promise((resolve) => {
let whitelistedDomains = requestAnalyzer.whitelistedDomains;
whitelistedDomains[domain] = true;
chrome.storage.local.set({whitelistedDomains}, resolve);
});
};
stateManager.removeDomainFromWhitelist = function (domain) {
return new Promise((resolve) => {
let whitelistedDomains = requestAnalyzer.whitelistedDomains;
delete whitelistedDomains[domain];
chrome.storage.local.set({whitelistedDomains}, resolve);
});
};
/**
* Private Methods
*/
stateManager._createTab = function (tab) {
let tabIdentifier, requestFilters;
tabIdentifier = tab.id;
stateManager.tabs[tabIdentifier] = {
'injections': {}
};
requestFilters = {
'tabId': tabIdentifier,
'urls': stateManager.validHosts
};
chrome.webRequest.onBeforeRequest.addListener(function (requestDetails) {
let tab = stateManager.tabs[tabIdentifier].details || {};
return interceptor.handleRequest(requestDetails, tabIdentifier, tab);
}, requestFilters, [WebRequest.BLOCKING]);
};
stateManager._removeTab = function (tabIdentifier) {
delete stateManager.tabs[tabIdentifier];
};
stateManager._updateTab = function (details) {
let tabDomain, domainIsWhitelisted, frameIdentifier, tabIdentifier;
tabDomain = helpers.extractDomainFromUrl(details.url);
domainIsWhitelisted = stateManager._domainIsWhitelisted(tabDomain);
frameIdentifier = details.frameId;
tabIdentifier = details.tabId;
if (frameIdentifier !== 0 || tabIdentifier === -1) {
return;
}
chrome.browserAction.setTitle({
'tabId': tabIdentifier,
'title': 'Decentraleyes (0)'
});
if (domainIsWhitelisted) {
stateManager._setIconDisabled(tabIdentifier);
chrome.browserAction.setTitle({
'tabId': tabIdentifier,
'title': 'Decentraleyes (–)'
});
}
if (stateManager.showIconBadge === true) {
stateManager._clearBadgeText(tabIdentifier);
}
if (stateManager.tabs[tabIdentifier]) {
stateManager.tabs[tabIdentifier].injections = {};
}
};
stateManager._handleStorageChanged = function (changes) {
if (Setting.SHOW_ICON_BADGE in changes) {
stateManager.showIconBadge = changes.showIconBadge.newValue;
if (changes.showIconBadge.newValue !== true) {
chrome.tabs.query({}, function (tabs) {
tabs.forEach(stateManager._removeIconBadgeFromTab);
});
}
}
if (Setting.STRIP_METADATA in changes) {
requestSanitizer.disable();
if (changes.stripMetadata.newValue !== false) {
requestSanitizer.enable();
}
}
};
stateManager._clearBadgeText = function (tabIdentifier) {
wrappers.setBadgeText({
'tabId': tabIdentifier,
'text': ''
});
};
stateManager._removeIconBadgeFromTab = function (tab) {
stateManager._clearBadgeText(tab.id);
};
stateManager._domainIsWhitelisted = function (domain) {
if (domain !== null) {
let whitelistRecord, isWhitelisted;
whitelistRecord = requestAnalyzer.whitelistedDomains[domain];
isWhitelisted = Boolean(whitelistRecord);
return isWhitelisted;
}
return false;
};
stateManager._setIconDisabled = function (tabIdentifier) {
wrappers.setIcon({
'path': stateManager.disabledIconPath,
'tabId': tabIdentifier
});
};
/**
* Initializations
*/
stateManager.requests = {};
stateManager.tabs = {};
stateManager.disabledIconPath = {
'16': chrome.runtime.getURL('icons/action/icon16-disabled.png'),
'18': chrome.runtime.getURL('icons/action/icon18-disabled.png'),
'19': chrome.runtime.getURL('icons/action/icon19-disabled.png'),
'32': chrome.runtime.getURL('icons/action/icon32-disabled.png'),
'36': chrome.runtime.getURL('icons/action/icon36-disabled.png'),
'38': chrome.runtime.getURL('icons/action/icon38-disabled.png'),
'64': chrome.runtime.getURL('icons/action/icon64-disabled.png')
};
stateManager.validHosts = [];
for (let mapping in mappings) {
let supportedHost = Address.ANY_PROTOCOL + mapping + Address.ANY_PATH;
stateManager.validHosts.push(supportedHost);
}
chrome.tabs.query({}, function (tabs) {
tabs.forEach(stateManager._createTab);
});
chrome.storage.local.get(Setting.SHOW_ICON_BADGE, function (items) {
if (items.showIconBadge === undefined) {
items.showIconBadge = true;
}
stateManager.showIconBadge = items.showIconBadge;
});
/**
* Event Handlers
*/
chrome.tabs.onCreated.addListener(stateManager._createTab);
chrome.tabs.onRemoved.addListener(stateManager._removeTab);
chrome.webRequest.onBeforeRequest.addListener(function (requestDetails) {
if (requestDetails.tabId !== -1) {
stateManager.tabs[requestDetails.tabId].details = {
'url': requestDetails.url
};
}
}, {'types': [WebRequestType.MAIN_FRAME], 'urls': [Address.ANY]});
chrome.webNavigation.onCommitted.addListener(stateManager._updateTab, {
'url': [{'urlContains': ':'}]
});
chrome.webRequest.onErrorOccurred.addListener(function (requestDetails) {
if (stateManager.requests[requestDetails.requestId]) {
delete stateManager.requests[requestDetails.requestId];
}
}, {'urls': [Address.ANY]});
chrome.webRequest.onBeforeRedirect.addListener(function (requestDetails) {
let knownRequest = stateManager.requests[requestDetails.requestId];
if (knownRequest) {
stateManager.registerInjection(knownRequest.tabIdentifier, knownRequest.targetDetails);
delete stateManager.requests[requestDetails.requestId];
}
}, {'urls': [Address.ANY]});
chrome.storage.onChanged.addListener(stateManager._handleStorageChanged);
"project_identifier": "decentraleyes"
"preserve_hierarchy": true
"files":
-
"source": "/_locales/en_US/messages.json"
"translation": "/_locales/%locale_with_underscore%/messages.json"
"languages_mapping":
"locale_with_underscore":
"ar": "ar"
"bg": "bg"
"cs": "cs"
"da": "da"
"de": "de"
"el": "el"
"eo": "eo"
"es-ES": "es"
"et": "et"
"fi": "fi"
"fr": "fr"
"he": "he"
"hu": "hu"
"id": "id"
"is": "is"
"it": "it"
"ja": "ja"
"ko": "ko"
"lb": "lb"
"nl": "nl"
"pl": "pl"
"ro": "ro"
"ru": "ru"
"sr": "sr"
"sv-SE": "sv"
"tl": "tl"
"tr": "tr"
INTRODUCTION
------------
This script (first introduced in Decentraleyes v1.1.5) should make reviewing this extension a lot easier than it used to be. It's open source and open for scrutiny, and it automatically compares the bundled libraries (resources) to their original sources (after removing any source mapping URLs).
FOR NON-LINUX USERS
-------------------
This usage guide is tailored to Linux based operating systems. If you're on a different type of system, the easiest direct solution might be to launch a free Linux box with Node.js pre-installed on Red Hat OpenShift. You can then SSH into it (after adding your own machine's public key to your account).
Having said that, every terminal command in the usage guide below comes with a description, so it should not be too hard to get this done on practically any type of configuration.
USAGE INSTRUCTIONS
------------------
1. Make sure you have Node.js installed on your machine (or install it).
2. Open up a terminal and 'cd' into this directory.
Description: Navigate to this directory.
3. Execute 'npm install' to fetch any dependencies.
4. Run the audit script by executing 'node run'.
Description: Run the script through Node.js and view the output.
Note: If you'd like to store the report, run 'node run > report.txt'.
Note description: It's possible to write the console output to a file.
@(function(){var t=this;var e=t.Backbone;var i=[];var r=i.push;var s=i.slice;var n=i.splice;var a;if(typeof exports!=="undefined"){a=exports}else{a=t.Backbone={}}a.VERSION="1.0.0";var h=t._;if(!h&&typeof require!=="undefined")h=require("underscore");a.$=t.jQuery||t.Zepto||t.ender||t.$;a.noConflict=function(){t.Backbone=e;return this};a.emulateHTTP=false;a.emulateJSON=false;var o=a.Events={on:function(t,e,i){if(!l(this,"on",t,[e,i])||!e)return this;this._events||(this._events={});var r=this._events[t]||(this._events[t]=[]);r.push({callback:e,context:i,ctx:i||this});return this},once:function(t,e,i){if(!l(this,"once",t,[e,i])||!e)return this;var r=this;var s=h.once(function(){r.off(t,s);e.apply(this,arguments)});s._callback=e;return this.on(t,s,i)},off:function(t,e,i){var r,s,n,a,o,u,c,f;if(!this._events||!l(this,"off",t,[e,i]))return this;if(!t&&!e&&!i){this._events={};return this}a=t?[t]:h.keys(this._events);for(o=0,u=a.length;o<u;o++){t=a[o];if(n=this._events[t]){this._events[t]=r=[];if(e||i){for(c=0,f=n.length;c<f;c++){s=n[c];if(e&&e!==s.callback&&e!==s.callback._callback||i&&i!==s.context){r.push(s)}}}if(!r.length)delete this._events[t]}}return this},trigger:function(t){if(!this._events)return this;var e=s.call(arguments,1);if(!l(this,"trigger",t,e))return this;var i=this._events[t];var r=this._events.all;if(i)c(i,e);if(r)c(r,arguments);return this},stopListening:function(t,e,i){var r=this._listeners;if(!r)return this;var s=!e&&!i;if(typeof e==="object")i=this;if(t)(r={})[t._listenerId]=t;for(var n in r){r[n].off(e,i,this);if(s)delete this._listeners[n]}return this}};var u=/\s+/;var l=function(t,e,i,r){if(!i)return true;if(typeof i==="object"){for(var s in i){t[e].apply(t,[s,i[s]].concat(r))}return false}if(u.test(i)){var n=i.split(u);for(var a=0,h=n.length;a<h;a++){t[e].apply(t,[n[a]].concat(r))}return false}return true};var c=function(t,e){var i,r=-1,s=t.length,n=e[0],a=e[1],h=e[2];switch(e.length){case 0:while(++r<s)(i=t[r]).callback.call(i.ctx);return;case 1:while(++r<s)(i=t[r]).callback.call(i.ctx,n);return;case 2:while(++r<s)(i=t[r]).callback.call(i.ctx,n,a);return;case 3:while(++r<s)(i=t[r]).callback.call(i.ctx,n,a,h);return;default:while(++r<s)(i=t[r]).callback.apply(i.ctx,e)}};var f={listenTo:"on",listenToOnce:"once"};h.each(f,function(t,e){o[e]=function(e,i,r){var s=this._listeners||(this._listeners={});var n=e._listenerId||(e._listenerId=h.uniqueId("l"));s[n]=e;if(typeof i==="object")r=this;e[t](i,r,this);return this}});o.bind=o.on;o.unbind=o.off;h.extend(a,o);var d=a.Model=function(t,e){var i;var r=t||{};e||(e={});this.cid=h.uniqueId("c");this.attributes={};h.extend(this,h.pick(e,p));if(e.parse)r=this.parse(r,e)||{};if(i=h.result(this,"defaults")){r=h.defaults({},r,i)}this.set(r,e);this.changed={};this.initialize.apply(this,arguments)};var p=["url","urlRoot","collection"];h.extend(d.prototype,o,{changed:null,validationError:null,idAttribute:"id",initialize:function(){},toJSON:function(t){return h.clone(this.attributes)},sync:function(){return a.sync.apply(this,arguments)},get:function(t){return this.attributes[t]},escape:function(t){return h.escape(this.get(t))},has:function(t){return this.get(t)!=null},set:function(t,e,i){var r,s,n,a,o,u,l,c;if(t==null)return this;if(typeof t==="object"){s=t;i=e}else{(s={})[t]=e}i||(i={});if(!this._validate(s,i))return false;n=i.unset;o=i.silent;a=[];u=this._changing;this._changing=true;if(!u){this._previousAttributes=h.clone(this.attributes);this.changed={}}c=this.attributes,l=this._previousAttributes;if(this.idAttribute in s)this.id=s[this.idAttribute];for(r in s){e=s[r];if(!h.isEqual(c[r],e))a.push(r);if(!h.isEqual(l[r],e)){this.changed[r]=e}else{delete this.changed[r]}n?delete c[r]:c[r]=e}if(!o){if(a.length)this._pending=true;for(var f=0,d=a.length;f<d;f++){this.trigger("change:"+a[f],this,c[a[f]],i)}}if(u)return this;if(!o){while(this._pending){this._pending=false;this.trigger("change",this,i)}}this._pending=false;this._changing=false;return this},unset:function(t,e){return this.set(t,void 0,h.extend({},e,{unset:true}))},clear:function(t){var e={};for(var i in this.attributes)e[i]=void 0;return this.set(e,h.extend({},t,{unset:true}))},hasChanged:function(t){if(t==null)return!h.isEmpty(this.changed);return h.has(this.changed,t)},changedAttributes:function(t){if(!t)return this.hasChanged()?h.clone(this.changed):false;var e,i=false;var r=this._changing?this._previousAttributes:this.attributes;for(var s in t){if(h.isEqual(r[s],e=t[s]))continue;(i||(i={}))[s]=e}return i},previous:function(t){if(t==null||!this._previousAttributes)return null;return this._previousAttributes[t]},previousAttributes:function(){return h.clone(this._previousAttributes)},fetch:function(t){t=t?h.clone(t):{};if(t.parse===void 0)t.parse=true;var e=this;var i=t.success;t.success=function(r){if(!e.set(e.parse(r,t),t))return false;if(i)i(e,r,t);e.trigger("sync",e,r,t)};R(this,t);return this.sync("read",this,t)},save:function(t,e,i){var r,s,n,a=this.attributes;if(t==null||typeof t==="object"){r=t;i=e}else{(r={})[t]=e}if(r&&(!i||!i.wait)&&!this.set(r,i))return false;i=h.extend({validate:true},i);if(!this._validate(r,i))return false;if(r&&i.wait){this.attributes=h.extend({},a,r)}if(i.parse===void 0)i.parse=true;var o=this;var u=i.success;i.success=function(t){o.attributes=a;var e=o.parse(t,i);if(i.wait)e=h.extend(r||{},e);if(h.isObject(e)&&!o.set(e,i)){return false}if(u)u(o,t,i);o.trigger("sync",o,t,i)};R(this,i);s=this.isNew()?"create":i.patch?"patch":"update";if(s==="patch")i.attrs=r;n=this.sync(s,this,i);if(r&&i.wait)this.attributes=a;return n},destroy:function(t){t=t?h.clone(t):{};var e=this;var i=t.success;var r=function(){e.trigger("destroy",e,e.collection,t)};t.success=function(s){if(t.wait||e.isNew())r();if(i)i(e,s,t);if(!e.isNew())e.trigger("sync",e,s,t)};if(this.isNew()){t.success();return false}R(this,t);var s=this.sync("delete",this,t);if(!t.wait)r();return s},url:function(){var t=h.result(this,"urlRoot")||h.result(this.collection,"url")||U();if(this.isNew())return t;return t+(t.charAt(t.length-1)==="/"?"":"/")+encodeURIComponent(this.id)},parse:function(t,e){return t},clone:function(){return new this.constructor(this.attributes)},isNew:function(){return this.id==null},isValid:function(t){return this._validate({},h.extend(t||{},{validate:true}))},_validate:function(t,e){if(!e.validate||!this.validate)return true;t=h.extend({},this.attributes,t);var i=this.validationError=this.validate(t,e)||null;if(!i)return true;this.trigger("invalid",this,i,h.extend(e||{},{validationError:i}));return false}});var v=["keys","values","pairs","invert","pick","omit"];h.each(v,function(t){d.prototype[t]=function(){var e=s.call(arguments);e.unshift(this.attributes);return h[t].apply(h,e)}});var g=a.Collection=function(t,e){e||(e={});if(e.url)this.url=e.url;if(e.model)this.model=e.model;if(e.comparator!==void 0)this.comparator=e.comparator;this._reset();this.initialize.apply(this,arguments);if(t)this.reset(t,h.extend({silent:true},e))};var m={add:true,remove:true,merge:true};var y={add:true,merge:false,remove:false};h.extend(g.prototype,o,{model:d,initialize:function(){},toJSON:function(t){return this.map(function(e){return e.toJSON(t)})},sync:function(){return a.sync.apply(this,arguments)},add:function(t,e){return this.set(t,h.defaults(e||{},y))},remove:function(t,e){t=h.isArray(t)?t.slice():[t];e||(e={});var i,r,s,n;for(i=0,r=t.length;i<r;i++){n=this.get(t[i]);if(!n)continue;delete this._byId[n.id];delete this._byId[n.cid];s=this.indexOf(n);this.models.splice(s,1);this.length--;if(!e.silent){e.index=s;n.trigger("remove",n,this,e)}this._removeReference(n)}return this},set:function(t,e){e=h.defaults(e||{},m);if(e.parse)t=this.parse(t,e);if(!h.isArray(t))t=t?[t]:[];var i,s,a,o,u,l;var c=e.at;var f=this.comparator&&c==null&&e.sort!==false;var d=h.isString(this.comparator)?this.comparator:null;var p=[],v=[],g={};for(i=0,s=t.length;i<s;i++){if(!(a=this._prepareModel(t[i],e)))continue;if(u=this.get(a)){if(e.remove)g[u.cid]=true;if(e.merge){u.set(a.attributes,e);if(f&&!l&&u.hasChanged(d))l=true}}else if(e.add){p.push(a);a.on("all",this._onModelEvent,this);this._byId[a.cid]=a;if(a.id!=null)this._byId[a.id]=a}}if(e.remove){for(i=0,s=this.length;i<s;++i){if(!g[(a=this.models[i]).cid])v.push(a)}if(v.length)this.remove(v,e)}if(p.length){if(f)l=true;this.length+=p.length;if(c!=null){n.apply(this.models,[c,0].concat(p))}else{r.apply(this.models,p)}}if(l)this.sort({silent:true});if(e.silent)return this;for(i=0,s=p.length;i<s;i++){(a=p[i]).trigger("add",a,this,e)}if(l)this.trigger("sort",this,e);return this},reset:function(t,e){e||(e={});for(var i=0,r=this.models.length;i<r;i++){this._removeReference(this.models[i])}e.previousModels=this.models;this._reset();this.add(t,h.extend({silent:true},e));if(!e.silent)this.trigger("reset",this,e);return this},push:function(t,e){t=this._prepareModel(t,e);this.add(t,h.extend({at:this.length},e));return t},pop:function(t){var e=this.at(this.length-1);this.remove(e,t);return e},unshift:function(t,e){t=this._prepareModel(t,e);this.add(t,h.extend({at:0},e));return t},shift:function(t){var e=this.at(0);this.remove(e,t);return e},slice:function(t,e){return this.models.slice(t,e)},get:function(t){if(t==null)return void 0;return this._byId[t.id!=null?t.id:t.cid||t]},at:function(t){return this.models[t]},where:function(t,e){if(h.isEmpty(t))return e?void 0:[];return this[e?"find":"filter"](function(e){for(var i in t){if(t[i]!==e.get(i))return false}return true})},findWhere:function(t){return this.where(t,true)},sort:function(t){if(!this.comparator)throw new Error("Cannot sort a set without a comparator");t||(t={});if(h.isString(this.comparator)||this.comparator.length===1){this.models=this.sortBy(this.comparator,this)}else{this.models.sort(h.bind(this.comparator,this))}if(!t.silent)this.trigger("sort",this,t);return this},sortedIndex:function(t,e,i){e||(e=this.comparator);var r=h.isFunction(e)?e:function(t){return t.get(e)};return h.sortedIndex(this.models,t,r,i)},pluck:function(t){return h.invoke(this.models,"get",t)},fetch:function(t){t=t?h.clone(t):{};if(t.parse===void 0)t.parse=true;var e=t.success;var i=this;t.success=function(r){var s=t.reset?"reset":"set";i[s](r,t);if(e)e(i,r,t);i.trigger("sync",i,r,t)};R(this,t);return this.sync("read",this,t)},create:function(t,e){e=e?h.clone(e):{};if(!(t=this._prepareModel(t,e)))return false;if(!e.wait)this.add(t,e);var i=this;var r=e.success;e.success=function(s){if(e.wait)i.add(t,e);if(r)r(t,s,e)};t.save(null,e);return t},parse:function(t,e){return t},clone:function(){return new this.constructor(this.models)},_reset:function(){this.length=0;this.models=[];this._byId={}},_prepareModel:function(t,e){if(t instanceof d){if(!t.collection)t.collection=this;return t}e||(e={});e.collection=this;var i=new this.model(t,e);if(!i._validate(t,e)){this.trigger("invalid",this,t,e);return false}return i},_removeReference:function(t){if(this===t.collection)delete t.collection;t.off("all",this._onModelEvent,this)},_onModelEvent:function(t,e,i,r){if((t==="add"||t==="remove")&&i!==this)return;if(t==="destroy")this.remove(e,r);if(e&&t==="change:"+e.idAttribute){delete this._byId[e.previous(e.idAttribute)];if(e.id!=null)this._byId[e.id]=e}this.trigger.apply(this,arguments)}});var _=["forEach","each","map","collect","reduce","foldl","inject","reduceRight","foldr","find","detect","filter","select","reject","every","all","some","any","include","contains","invoke","max","min","toArray","size","first","head","take","initial","rest","tail","drop","last","without","indexOf","shuffle","lastIndexOf","isEmpty","chain"];h.each(_,function(t){g.prototype[t]=function(){var e=s.call(arguments);e.unshift(this.models);return h[t].apply(h,e)}});var w=["groupBy","countBy","sortBy"];h.each(w,function(t){g.prototype[t]=function(e,i){var r=h.isFunction(e)?e:function(t){return t.get(e)};return h[t](this.models,r,i)}});var b=a.View=function(t){this.cid=h.uniqueId("view");this._configure(t||{});this._ensureElement();this.initialize.apply(this,arguments);this.delegateEvents()};var x=/^(\S+)\s*(.*)$/;var E=["model","collection","el","id","attributes","className","tagName","events"];h.extend(b.prototype,o,{tagName:"div",$:function(t){return this.$el.find(t)},initialize:function(){},render:function(){return this},remove:function(){this.$el.remove();this.stopListening();return this},setElement:function(t,e){if(this.$el)this.undelegateEvents();this.$el=t instanceof a.$?t:a.$(t);this.el=this.$el[0];if(e!==false)this.delegateEvents();return this},delegateEvents:function(t){if(!(t||(t=h.result(this,"events"))))return this;this.undelegateEvents();for(var e in t){var i=t[e];if(!h.isFunction(i))i=this[t[e]];if(!i)continue;var r=e.match(x);var s=r[1],n=r[2];i=h.bind(i,this);s+=".delegateEvents"+this.cid;if(n===""){this.$el.on(s,i)}else{this.$el.on(s,n,i)}}return this},undelegateEvents:function(){this.$el.off(".delegateEvents"+this.cid);return this},_configure:function(t){if(this.options)t=h.extend({},h.result(this,"options"),t);h.extend(this,h.pick(t,E));this.options=t},_ensureElement:function(){if(!this.el){var t=h.extend({},h.result(this,"attributes"));if(this.id)t.id=h.result(this,"id");if(this.className)t["class"]=h.result(this,"className");var e=a.$("<"+h.result(this,"tagName")+">").attr(t);this.setElement(e,false)}else{this.setElement(h.result(this,"el"),false)}}});a.sync=function(t,e,i){var r=k[t];h.defaults(i||(i={}),{emulateHTTP:a.emulateHTTP,emulateJSON:a.emulateJSON});var s={type:r,dataType:"json"};if(!i.url){s.url=h.result(e,"url")||U()}if(i.data==null&&e&&(t==="create"||t==="update"||t==="patch")){s.contentType="application/json";s.data=JSON.stringify(i.attrs||e.toJSON(i))}if(i.emulateJSON){s.contentType="application/x-www-form-urlencoded";s.data=s.data?{model:s.data}:{}}if(i.emulateHTTP&&(r==="PUT"||r==="DELETE"||r==="PATCH")){s.type="POST";if(i.emulateJSON)s.data._method=r;var n=i.beforeSend;i.beforeSend=function(t){t.setRequestHeader("X-HTTP-Method-Override",r);if(n)return n.apply(this,arguments)}}if(s.type!=="GET"&&!i.emulateJSON){s.processData=false}if(s.type==="PATCH"&&window.ActiveXObject&&!(window.external&&window.external.msActiveXFilteringEnabled)){s.xhr=function(){return new ActiveXObject("Microsoft.XMLHTTP")}}var o=i.xhr=a.ajax(h.extend(s,i));e.trigger("request",e,o,i);return o};var k={create:"POST",update:"PUT",patch:"PATCH","delete":"DELETE",read:"GET"};a.ajax=function(){return a.$.ajax.apply(a.$,arguments)};var S=a.Router=function(t){t||(t={});if(t.routes)this.routes=t.routes;this._bindRoutes();this.initialize.apply(this,arguments)};var $=/\((.*?)\)/g;var T=/(\(\?)?:\w+/g;var H=/\*\w+/g;var A=/[\-{}\[\]+?.,\\\^$|#\s]/g;h.extend(S.prototype,o,{initialize:function(){},route:function(t,e,i){if(!h.isRegExp(t))t=this._routeToRegExp(t);if(h.isFunction(e)){i=e;e=""}if(!i)i=this[e];var r=this;a.history.route(t,function(s){var n=r._extractParameters(t,s);i&&i.apply(r,n);r.trigger.apply(r,["route:"+e].concat(n));r.trigger("route",e,n);a.history.trigger("route",r,e,n)});return this},navigate:function(t,e){a.history.navigate(t,e);return this},_bindRoutes:function(){if(!this.routes)return;this.routes=h.result(this,"routes");var t,e=h.keys(this.routes);while((t=e.pop())!=null){this.route(t,this.routes[t])}},_routeToRegExp:function(t){t=t.replace(A,"\\$&").replace($,"(?:$1)?").replace(T,function(t,e){return e?t:"([^/]+)"}).replace(H,"(.*?)");return new RegExp("^"+t+"$")},_extractParameters:function(t,e){var i=t.exec(e).slice(1);return h.map(i,function(t){return t?decodeURIComponent(t):null})}});var I=a.History=function(){this.handlers=[];h.bindAll(this,"checkUrl");if(typeof window!=="undefined"){this.location=window.location;this.history=window.history}};var N=/^[#\/]|\s+$/g;var P=/^\/+|\/+$/g;var O=/msie [\w.]+/;var C=/\/$/;I.started=false;h.extend(I.prototype,o,{interval:50,getHash:function(t){var e=(t||this).location.href.match(/#(.*)$/);return e?e[1]:""},getFragment:function(t,e){if(t==null){if(this._hasPushState||!this._wantsHashChange||e){t=this.location.pathname;var i=this.root.replace(C,"");if(!t.indexOf(i))t=t.substr(i.length)}else{t=this.getHash()}}return t.replace(N,"")},start:function(t){if(I.started)throw new Error("Backbone.history has already been started");I.started=true;this.options=h.extend({},{root:"/"},this.options,t);this.root=this.options.root;this._wantsHashChange=this.options.hashChange!==false;this._wantsPushState=!!this.options.pushState;this._hasPushState=!!(this.options.pushState&&this.history&&this.history.pushState);var e=this.getFragment();var i=document.documentMode;var r=O.exec(navigator.userAgent.toLowerCase())&&(!i||i<=7);this.root=("/"+this.root+"/").replace(P,"/");if(r&&this._wantsHashChange){this.iframe=a.$('<iframe src="javascript:0" tabindex="-1" />').hide().appendTo("body")[0].contentWindow;this.navigate(e)}if(this._hasPushState){a.$(window).on("popstate",this.checkUrl)}else if(this._wantsHashChange&&"onhashchange"in window&&!r){a.$(window).on("hashchange",this.checkUrl)}else if(this._wantsHashChange){this._checkUrlInterval=setInterval(this.checkUrl,this.interval)}this.fragment=e;var s=this.location;var n=s.pathname.replace(/[^\/]$/,"$&/")===this.root;if(this._wantsHashChange&&this._wantsPushState&&!this._hasPushState&&!n){this.fragment=this.getFragment(null,true);this.location.replace(this.root+this.location.search+"#"+this.fragment);return true}else if(this._wantsPushState&&this._hasPushState&&n&&s.hash){this.fragment=this.getHash().replace(N,"");this.history.replaceState({},document.title,this.root+this.fragment+s.search)}if(!this.options.silent)return this.loadUrl()},stop:function(){a.$(window).off("popstate",this.checkUrl).off("hashchange",this.checkUrl);clearInterval(this._checkUrlInterval);I.started=false},route:function(t,e){this.handlers.unshift({route:t,callback:e})},checkUrl:function(t){var e=this.getFragment();if(e===this.fragment&&this.iframe){e=this.getFragment(this.getHash(this.iframe))}if(e===this.fragment)return false;if(this.iframe)this.navigate(e);this.loadUrl()||this.loadUrl(this.getHash())},loadUrl:function(t){var e=this.fragment=this.getFragment(t);var i=h.any(this.handlers,function(t){if(t.route.test(e)){t.callback(e);return true}});return i},navigate:function(t,e){if(!I.started)return false;if(!e||e===true)e={trigger:e};t=this.getFragment(t||"");if(this.fragment===t)return;this.fragment=t;var i=this.root+t;if(this._hasPushState){this.history[e.replace?"replaceState":"pushState"]({},document.title,i)}else if(this._wantsHashChange){this._updateHash(this.location,t,e.replace);if(this.iframe&&t!==this.getFragment(this.getHash(this.iframe))){if(!e.replace)this.iframe.document.open().close();this._updateHash(this.iframe.location,t,e.replace)}}else{return this.location.assign(i)}if(e.trigger)this.loadUrl(t)},_updateHash:function(t,e,i){if(i){var r=t.href.replace(/(javascript:|#).*$/,"");t.replace(r+"#"+e)}else{t.hash="#"+e}}});a.history=new I;var j=function(t,e){var i=this;var r;if(t&&h.has(t,"constructor")){r=t.constructor}else{r=function(){return i.apply(this,arguments)}}h.extend(r,i,e);var s=function(){this.constructor=r};s.prototype=i.prototype;r.prototype=new s;if(t)h.extend(r.prototype,t);r.__super__=i.prototype;return r};d.extend=g.extend=S.extend=b.extend=I.extend=j;var U=function(){throw new Error('A "url" property or function must be specified')};var R=function(t,e){var i=e.error;e.error=function(r){if(i)i(t,r,e);t.trigger("error",t,r,e)}}}).call(this);