-
Notifications
You must be signed in to change notification settings - Fork 33
Enhance stealth about Object.prototype.hasOwnProperty.call of XMLHttpRequest related scriptlets #576
Open
Assignees
Labels
Description
const Req = new XMLHttpRequest() Req.open('OPTIONS', 'https://example.com') Req.send() const CleanReq = new XMLHttpRequest() const Properties = ['status', 'statusText', 'readyState', 'response', 'responseURL', 'responseXML', 'setRequestHeader'] as const Properties.forEach(Key => { // 'call' indicates Function.prototype.call console.log(`Object.prototype.hasOwnProperty.call(Req, ${Key})`, Object.prototype.hasOwnProperty.call(Req, Key)) console.log(`Compares XMLHttpReqeust.prototype with clean one ${Key}`, Req[Key] === CleanReq[Key]) })
const Properties = ['status', 'statusText', 'readyState', 'response', 'responseURL', 'responseXML', 'setRequestHeader'] as const const Req = new XMLHttpRequest() Req.timeout = 1000 Req.onerror = () => { Func() } Req.onabort = () => {} Req.onload = () => { Func() } Req.ontimeout = () => {} Req.open('OPTIONS', 'https://example.com/', true) Req.send() const CleanReq = new XMLHttpRequest() function Func() { Properties.forEach(Key => { // 'call' indicates Function.prototype.call console.log(`Object.prototype.hasOwnProperty.call(Req, ${Key})`, Object.prototype.hasOwnProperty.call(Req, Key)) console.log(`Compares XMLHttpReqeust.prototype with clean one ${Key}`, Req[Key] === CleanReq[Key]) }) }
Compares execution result in DevTool of the above Typescript code snippet with and without example.com#%#//scriptlet('prevent-xhr', 'example.com method:OPTIONS').
Related to uBlockOrigin/uAssets#34177