Merge branch 'master' of https://github.com/hoothin/UserScripts

Author: hoothin

Picviewer CE+/dist.user.js

@@ -12458,32 +12458,39 @@ ImgOps | https://imgops.com/#b#`;
 
     function parseTrustedTypes(cspString) {
         const policies = new Set();
+        let allowDuplicates = false;
+        let ttDirectiveFound = false;
         const ttRegex = /trusted-types\s+([^;]+)/gi;
         let match;
+
         while ((match = ttRegex.exec(cspString)) !== null) {
+            ttDirectiveFound = true;
             match[1].trim().split(/\s+/)
                 .forEach(name => {
-                    if (name !== "'allow-duplicates'" && name !== "'none'") {
-                        policies.add(name.replace(/'/g, ''));
-                    }
-                });
+                if (name === "'allow-duplicates'") {
+                    allowDuplicates = true;
+                } else if (name !== "'none'") {
+                    policies.add(name.replace(/'/g, ''));
+                }
+            });
         }
-        return Array.from(policies);
+        return { names: policies, allowDuplicates: allowDuplicates, ttDirectiveFound: ttDirectiveFound };
     }
 
-    async function getAvailablePolicyNamesOptimized() {
-        if (unsafeWindow.trustedTypes && unsafeWindow.trustedTypes.getPolicyNames) {
-            const existingNames = unsafeWindow.trustedTypes.getPolicyNames();
-            if (existingNames.length > 0) {
-                return new Set(existingNames);
-            }
-        }
+    async function getCspTrustedTypesInfo() {
+        const combinedPolicies = new Set();
+        let combinedAllowDuplicates = false;
+        let combinedTtDirectiveFound = false;
 
         const meta = document.querySelector('meta[http-equiv="Content-Security-Policy"]');
         if (meta) {
-            const metaNames = parseTrustedTypes(meta.content);
-            if (metaNames.length > 0) {
-                return new Set(metaNames);
+            const metaResult = parseTrustedTypes(meta.content);
+            metaResult.names.forEach(name => combinedPolicies.add(name));
+            if (metaResult.allowDuplicates) {
+                combinedAllowDuplicates = true;
+            }
+            if (metaResult.ttDirectiveFound) {
+                combinedTtDirectiveFound = true;
             }
         }
 
@@ -12493,19 +12500,31 @@ ImgOps | https://imgops.com/#b#`;
                 url: window.location.href,
                 onload: function(response) {
                     const cspHeader = response.responseHeaders.split('\r\n')
-                        .filter(h => h.toLowerCase().startsWith('content-security-policy:'))
-                        .map(h => h.substring(26).trim())
-                        .join('; ');
-
-                    const headerNames = parseTrustedTypes(cspHeader);
-                    if (headerNames.length > 0) {
-                        resolve(new Set(headerNames));
-                    } else {
-                        resolve(new Set());
+                    .filter(h => h.toLowerCase().startsWith('content-security-policy:'))
+                    .map(h => h.substring(26).trim())
+                    .join('; ');
+
+                    const headerResult = parseTrustedTypes(cspHeader);
+                    headerResult.names.forEach(name => combinedPolicies.add(name));
+                    if (headerResult.allowDuplicates) {
+                        combinedAllowDuplicates = true;
                     }
+                    if (headerResult.ttDirectiveFound) {
+                        combinedTtDirectiveFound = true;
+                    }
+
+                    resolve({
+                        names: combinedPolicies,
+                        allowDuplicates: combinedAllowDuplicates,
+                        ttDirectiveFound: combinedTtDirectiveFound
+                    });
                 },
                 onerror: function(error) {
-                    resolve(new Set());
+                    resolve({
+                        names: combinedPolicies,
+                        allowDuplicates: combinedAllowDuplicates,
+                        ttDirectiveFound: combinedTtDirectiveFound
+                    });
                 }
             });
         });
@@ -12521,33 +12540,48 @@ ImgOps | https://imgops.com/#b#`;
     }
 
     async function createPolicy() {
-        if (unsafeWindow.trustedTypes && unsafeWindow.trustedTypes.createPolicy && isTrustedTypesEnforced()) {
-            const allowedNames = await getAvailablePolicyNamesOptimized();
+        if (!(unsafeWindow.trustedTypes && unsafeWindow.trustedTypes.createPolicy && isTrustedTypesEnforced())) {
+            return;
+        }
+
+        const { names: allowedNames, allowDuplicates, ttDirectiveFound } = await getCspTrustedTypesInfo();
+
+        if (ttDirectiveFound && !allowDuplicates) {
+            debug("CSP Trusted Types is enforced without 'allow-duplicates'. " +
+                         "Skipping policy creation to avoid conflicts with the page.");
+            return;
+        }
 
-            if (allowedNames.size === 0) {
-                escapeHTMLPolicy = unsafeWindow.trustedTypes.createPolicy('pvcep_default', {
+        const MY_POLICY_NAME = 'pvcep_default';
+
+        try {
+            escapeHTMLPolicy = unsafeWindow.trustedTypes.createPolicy(MY_POLICY_NAME, {
+                createHTML: (string, sink) => string,
+                createScriptURL: string => string,
+                createScript: string => string
+            });
+            return;
+        } catch (e) {
+        }
+
+        const existingPolicies = new Set(unsafeWindow.trustedTypes.getPolicyNames());
+        for (const name of allowedNames) {
+            if (name === '*' || existingPolicies.has(name)) {
+                continue;
+            }
+
+            try {
+                escapeHTMLPolicy = unsafeWindow.trustedTypes.createPolicy(name, {
                     createHTML: (string, sink) => string,
                     createScriptURL: string => string,
                     createScript: string => string
                 });
                 return;
-            }
-
-            for (const name of allowedNames) {
-                if (name === '*') continue;
-                try {
-                    escapeHTMLPolicy = unsafeWindow.trustedTypes.createPolicy(name, {
-                        createHTML: (string, sink) => string,
-                        createScriptURL: string => string,
-                        createScript: string => string
-                    });
-                    break;
-                } catch (e) {
-                    console.warn(`create '${name}' failed`);
-                    return;
-                }
+            } catch (e) {
+                debug(`create '${name}' failed, trying next...`);
             }
         }
+        debug("Could not create any trusted types policy.");
     }
 
     let escapeHTMLPolicy = null;