Release build 4.4.0 [ci release]

Author: jonathanKingston

Sources/ContentScopeScripts/dist/contentScope.js

@@ -44,7 +44,7 @@ describe('Runtime checks: should allow element modification', () => {
                 scriptElement.id = 'scripty'
                 scriptElement.setAttribute('type', 'application/evilscript')
                 document.body.appendChild(scriptElement)
-                const hadInspectorNode = !!document.querySelector('ddg-runtime-checks')
+                const hadInspectorNode = scriptElement === document.querySelector('ddg-runtime-checks')
                 // Continue to modify the script element after it has been added to the DOM
                 scriptElement.integrity = 'sha256-123'
                 // @ts-expect-error https://app.asana.com/0/1201614831475344/1203979574128023/f
@@ -101,7 +101,7 @@ describe('Runtime checks: should allow element modification', () => {
                 scriptElement.id = 'scripty2'
                 scriptElement.setAttribute('type', 'application/javascript')
                 document.body.appendChild(scriptElement)
-                const hadInspectorNode = !!document.querySelector('ddg-runtime-checks')
+                const hadInspectorNode = scriptElement === document.querySelector('ddg-runtime-checks')
                 // Continue to modify the script element after it has been added to the DOM
                 // @ts-expect-error https://app.asana.com/0/1201614831475344/1203979574128023/f
                 scriptElement.madeUpProp = 'val'
@@ -174,7 +174,7 @@ describe('Runtime checks: should allow element modification', () => {
                 document.body.appendChild(scriptElement)
                 await Promise.all([promise, promise2])
 
-                const hadInspectorNode = !!document.querySelector('ddg-runtime-checks')
+                const hadInspectorNode = scriptElement === document.querySelector('ddg-runtime-checks')
                 // Continue to modify the script element after it has been added to the DOM
                 // @ts-expect-error https://app.asana.com/0/1201614831475344/1203979574128023/f
                 scriptElement.madeUpProp = 'val'
@@ -224,7 +224,6 @@ describe('Runtime checks: should allow element modification', () => {
                 }
             }
         })
-        // And now with a script that will execute
         const scriptResult4 = await page.evaluate(
             () => {
                 function getAttributeValues (el) {
@@ -254,7 +253,7 @@ describe('Runtime checks: should allow element modification', () => {
                 scriptElement.setAttribute('madeUpAttr1', '1')
                 scriptElement.setAttribute('madeUpAttr2', '2')
                 document.body.appendChild(scriptElement)
-                const hadInspectorNode = !!document.querySelector('ddg-runtime-checks')
+                const hadInspectorNode = scriptElement === document.querySelector('ddg-runtime-checks')
                 // Continue to modify the script element after it has been added to the DOM
                 // @ts-expect-error made up prop is unknown to TS
                 scriptElement.madeUpProp1 = 'val'
@@ -295,4 +294,142 @@ describe('Runtime checks: should allow element modification', () => {
             nodeAndFakeNodeMatch: false
         })
     })
+
+    it('Script that should filter props and attributes', async () => {
+        const port = server.address().port
+        const page = await browser.newPage()
+        await gotoAndWait(page, `http://localhost:${port}/blank.html`, {
+            site: {
+                enabledFeatures: ['runtimeChecks']
+            },
+            featureSettings: {
+                runtimeChecks: {
+                    taintCheck: 'enabled',
+                    matchAllDomains: 'enabled',
+                    matchAllStackDomains: 'enabled',
+                    overloadInstanceOf: 'enabled'
+                }
+            }
+        })
+        const scriptResult5 = await page.evaluate(
+            () => {
+                // @ts-expect-error Undefined property for testing
+                window.scripty5Ran = false
+                const myScript = document.createElement('script')
+                myScript.innerText = 'window.scripty5Ran = true'
+                Object.setPrototypeOf(myScript, HTMLScriptElement.prototype)
+                document.body.appendChild(myScript)
+                // @ts-expect-error Undefined property for testing
+                return window.scripty5Ran
+            })
+        expect(scriptResult5).toBe(true)
+    })
+
+    it('Script should support trusted types', async () => {
+        const port = server.address().port
+        const page = await browser.newPage()
+        await gotoAndWait(page, `http://localhost:${port}/blank.html`, {
+            site: {
+                enabledFeatures: ['runtimeChecks']
+            },
+            featureSettings: {
+                runtimeChecks: {
+                    taintCheck: 'enabled',
+                    matchAllDomains: 'enabled',
+                    matchAllStackDomains: 'enabled',
+                    overloadInstanceOf: 'enabled'
+                }
+            }
+        })
+        const scriptResult6 = await page.evaluate(
+            () => {
+                // @ts-expect-error Trusted types are not defined on all browsers
+                const policy = window.trustedTypes.createPolicy('test', {
+                    createScriptURL: (url) => url
+                })
+                const myScript = document.createElement('script')
+                myScript.src = policy.createScriptURL('http://example.com')
+                const srcVal = myScript.src
+
+                myScript.setAttribute('src', policy.createScriptURL('http://example2.com'))
+                const srcVal2 = myScript.getAttribute('src')
+                const srcVal3 = myScript.src
+
+                document.body.appendChild(myScript)
+
+                // After append
+                myScript.setAttribute('src', policy.createScriptURL('http://example3.com'))
+                const srcVal4 = myScript.getAttribute('src')
+                const srcVal5 = myScript.src
+
+                myScript.src = policy.createScriptURL('http://example4.com')
+                const srcVal6 = myScript.getAttribute('src')
+                const srcVal7 = myScript.src
+                return {
+                    srcVal,
+                    srcVal2,
+                    srcVal3,
+                    srcVal4,
+                    srcVal5,
+                    srcVal6,
+                    srcVal7
+                }
+            })
+        expect(scriptResult6).toEqual({
+            srcVal: 'http://example.com',
+            srcVal2: 'http://example2.com',
+            srcVal3: 'http://example2.com',
+            srcVal4: 'http://example3.com/',
+            srcVal5: 'http://example3.com/',
+            srcVal6: 'http://example4.com/',
+            srcVal7: 'http://example4.com/'
+        })
+    })
+
+    it('Script using parent prototype should execute checking', async () => {
+        const port = server.address().port
+        const page = await browser.newPage()
+        await gotoAndWait(page, `http://localhost:${port}/blank.html`, {
+            site: {
+                enabledFeatures: ['runtimeChecks']
+            },
+            featureSettings: {
+                runtimeChecks: {
+                    taintCheck: 'enabled',
+                    matchAllDomains: 'enabled',
+                    matchAllStackDomains: 'enabled',
+                    overloadInstanceOf: 'enabled'
+                }
+            }
+        })
+        // And now with a script that will execute
+        const scriptResult = await page.evaluate(
+            () => {
+                // @ts-expect-error https://app.asana.com/0/1201614831475344/1203979574128023/f
+                window.scriptDocumentPrototypeRan = false
+                const scriptElement = Document.prototype.createElement.call(window.document, 'script')
+                scriptElement.innerText = 'window.scriptDocumentPrototypeRan = true'
+                scriptElement.id = 'scriptDocumentPrototype'
+                scriptElement.setAttribute('type', 'application/javascript')
+                document.body.appendChild(scriptElement)
+                const hadInspectorNode = scriptElement === document.querySelector('ddg-runtime-checks')
+                const instanceofResult = scriptElement instanceof HTMLScriptElement
+                const scripty = document.querySelector('script#scriptDocumentPrototype')
+
+                return {
+                    // @ts-expect-error https://app.asana.com/0/1201614831475344/1203979574128023/f
+                    scriptRan: window.scriptDocumentPrototypeRan,
+                    hadInspectorNode,
+                    instanceofResult,
+                    type: scripty.getAttribute('type')
+                }
+            }
+        )
+        expect(scriptResult).toEqual({
+            scriptRan: true,
+            hadInspectorNode: true,
+            instanceofResult: true,
+            type: 'application/javascript'
+        })
+    })
 })