Scriptlets
Scriptlets copied to clipboard
Improve 'trusted-replace-xhr-response' and 'prevent-xhr' — randomise thisArg.shouldBePrevented
Currently it's too easy to disable trusted-replace-xhr-response and prevent-xhr by adding <xhr>.shouldBePrevented = false;
Steps to reproduce:
- Add this rule:
example.org#%#//scriptlet('trusted-replace-xhr-response', '*', 'TEST', '/')
- Go to - https://example.org/
- In browser console run:
(() => {
function reqListener() {
alert(this.responseText);
}
const xhr = new XMLHttpRequest();
xhr.addEventListener("load", reqListener);
xhr.open("GET", "/");
xhr.shouldBePrevented = false;
xhr.send();
})();
If scriptlet works correctly there should be an alert with TEST message, but xhr.shouldBePrevented = false; disables scriptlet and content is not replaced.
I guess that adding random part to:
https://github.com/AdguardTeam/Scriptlets/blob/bad388d94ab265ffd61d23b26a8637721fabfc1e/src/scriptlets/trusted-replace-xhr-response.js#L123
something like thisArg.shouldBePrevented_<random> should fixes it.