Switch to headless mode, implement dynamic list selection #26

mschfh · 2024-07-26T00:16:32Z

Resolves https://github.com/brave/devops/issues/12120

github-actions · 2024-08-01T10:27:06Z

src/lib.mjs

+    // check if valid component id and not in keeplist
+    if (isValidChromeComponentId({ id: fileName }) && !isKeeplistedComponentId({ id: fileName, additionalComponentList: adblockComponents })) {
+      console.log('patching component: ', fileName)
+      const extensionDir = path.join(tmpProfile, fileName)


_{reported by reviewdog 🐶}
[semgrep] Detected possible user input going into a path.join or path.resolve function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.

Source: https://semgrep.dev/r/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

Cc @thypon @bcaller

github-actions · 2024-08-01T10:27:06Z

src/lib.mjs

+      console.log('patching component: ', fileName)
+      const extensionDir = path.join(tmpProfile, fileName)
+      const versionDir = getExtensionVersion(extensionDir)
+      const srcManifest = path.join(extensionDir, versionDir, 'manifest.json')


_{reported by reviewdog 🐶}
[semgrep] Detected possible user input going into a path.join or path.resolve function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.

Source: https://semgrep.dev/r/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

Cc @thypon @bcaller

github-actions · 2024-08-01T10:27:06Z

src/lib.mjs

+      const extensionDir = path.join(tmpProfile, fileName)
+      const versionDir = getExtensionVersion(extensionDir)
+      const srcManifest = path.join(extensionDir, versionDir, 'manifest.json')
+      const destPath = path.join(templateProfile, fileName, '999.999')


_{reported by reviewdog 🐶}
[semgrep] Detected possible user input going into a path.join or path.resolve function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.

Source: https://semgrep.dev/r/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

Cc @thypon @bcaller

github-actions · 2024-08-01T10:27:06Z

src/lib.mjs

+      mkdirSync(destPath, { recursive: true })
+      if (fileName === 'gkboaolpopklhgplhaaiboijnklogmbc') {
+        // copy List Catalog files after modifying version
+        cpSync(path.join(extensionDir, versionDir), destPath, { recursive: true })


_{reported by reviewdog 🐶}
[semgrep] Detected possible user input going into a path.join or path.resolve function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.

Source: https://semgrep.dev/r/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

Cc @thypon @bcaller

github-actions · 2024-08-01T10:27:06Z

src/lib.mjs

+        cpSync(path.join(extensionDir, versionDir), destPath, { recursive: true })
+      } else {
+        // only copy the manifest for all other components
+        cpSync(srcManifest, path.join(destPath, 'manifest.json'))


_{reported by reviewdog 🐶}
[semgrep] Detected possible user input going into a path.join or path.resolve function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.

Source: https://semgrep.dev/r/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

Cc @thypon @bcaller

github-actions · 2024-08-01T10:27:06Z

src/util.mjs

+}
+
+export const parseListCatalogComponentIds = ({ profileDir }) => {
+  const extensionDir = path.join(profileDir, 'gkboaolpopklhgplhaaiboijnklogmbc')


_{reported by reviewdog 🐶}
[semgrep] Detected possible user input going into a path.join or path.resolve function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.

Source: https://semgrep.dev/r/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

Cc @thypon @bcaller

github-actions · 2024-08-01T10:27:07Z

src/util.mjs

+  const extensionDir = path.join(profileDir, 'gkboaolpopklhgplhaaiboijnklogmbc')
+  const versionDir = getExtensionVersion(extensionDir)
+  // gkboaolpopklhgplhaaiboijnklogmbc/1.0.60/list_catalog.json
+  const data = readFileSync(path.join(extensionDir, versionDir, 'list_catalog.json'), 'utf8')


_{reported by reviewdog 🐶}
[semgrep] Detected possible user input going into a path.join or path.resolve function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.

Source: https://semgrep.dev/r/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

Cc @thypon @bcaller

github-actions · 2024-08-01T10:27:07Z

src/util.mjs

+}
+
+export const getAdblockUuids = ({ profileDir }) => {
+  const extensionDir = path.join(profileDir, 'gkboaolpopklhgplhaaiboijnklogmbc')


_{reported by reviewdog 🐶}
[semgrep] Detected possible user input going into a path.join or path.resolve function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.

Source: https://semgrep.dev/r/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

Cc @thypon @bcaller

github-actions · 2024-08-01T10:27:07Z

src/util.mjs

+  const extensionDir = path.join(profileDir, 'gkboaolpopklhgplhaaiboijnklogmbc')
+  const versionDir = getExtensionVersion(extensionDir)
+  // gkboaolpopklhgplhaaiboijnklogmbc/1.0.60/list_catalog.json
+  const data = readFileSync(path.join(extensionDir, versionDir, 'list_catalog.json'), 'utf8')


_{reported by reviewdog 🐶}
[semgrep] Detected possible user input going into a path.join or path.resolve function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.

Source: https://semgrep.dev/r/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

Cc @thypon @bcaller

github-actions · 2024-08-01T10:27:07Z

src/util.mjs

+  listCatalog.forEach(item => {
+    if (item.uuid in adblockLists) {
+      item.default_enabled = Boolean(adblockLists[item.uuid])
+    }


_{reported by reviewdog 🐶}
[semgrep] This allows item.uuid to be __proto__ or toString. To prevent prototype access use Object.prototype.hasOwnProperty.call(adblockLists, item.uuid) or use a Map.

Source: https://github.com/brave/security-action/blob/main/assets/semgrep_rules/services/not-using-hasownproperty-proto-access.yaml

Cc @thypon @bcaller

koa bodyparser uses co-body, which throws an error by default if a object contains __proto__:

onProtoPoisoning Defines what action the co-body lib must take when parsing a JSON object with __proto__. This functionality is provided by [bourne](https://github.com/hapijs/bourne). See [Prototype-Poisoning](https://fastify.dev/docs/latest/Guides/Prototype-Poisoning/) for more details about prototype poisoning attacks. Possible values are 'error', 'remove' and 'ignore'. Default to 'error', it will throw a SyntaxError when Prototype-Poisoning happen.

Dockerfile

antonok-edm · 2024-08-01T18:44:29Z

src/lib.mjs

+  const buttons = await page.$$('.button-check-update')
+  for (const button of buttons) {
+    const buttonId = await page.evaluate(el => el.getAttribute('id'), button)
+    if (buttonId) {
+      console.log('Updating component:', buttonId)
+      await button.click()
+      await setTimeout(50) // Wait for 50ms between clicks
+    }
+  }


there is a Update lists button in brave://settings/shields/filters` which will do the same with 1 click, btw.

src/page.html

src/util.mjs

antonok-edm · 2024-08-01T19:14:32Z

also, how is adblock_lists.json intended to be populated? should we fetch it in npm run setup?

package.json

mschfh · 2024-08-01T20:44:27Z

also, how is adblock_lists.json intended to be populated? should we fetch it in npm run setup?

yes, the content is extracted from list_catalog.json during setup:
https://github.com/brave/cookiemonster/pull/26/files#diff-925fe95ca95b8e7cddc6826a2803dfc14ed9e1654299dec29b4c78e203dfdf25R174-R175

mschfh self-assigned this Jul 26, 2024

mschfh temporarily deployed to production July 27, 2024 11:27 — with GitHub Actions Inactive

mschfh temporarily deployed to production July 27, 2024 11:35 — with GitHub Actions Inactive

mschfh temporarily deployed to production July 27, 2024 11:47 — with GitHub Actions Inactive

mschfh temporarily deployed to production July 27, 2024 11:59 — with GitHub Actions Inactive

mschfh temporarily deployed to production July 29, 2024 20:44 — with GitHub Actions Inactive

mschfh temporarily deployed to production July 29, 2024 23:23 — with GitHub Actions Inactive

mschfh temporarily deployed to production July 31, 2024 21:58 — with GitHub Actions Inactive

mschfh temporarily deployed to production July 31, 2024 22:19 — with GitHub Actions Inactive

mschfh temporarily deployed to production August 1, 2024 00:25 — with GitHub Actions Inactive

mschfh temporarily deployed to production August 1, 2024 00:34 — with GitHub Actions Inactive

mschfh temporarily deployed to production August 1, 2024 00:48 — with GitHub Actions Inactive

mschfh force-pushed the mschfh-dynamic-lists branch from 7c46acc to 45ed478 Compare August 1, 2024 01:19

mschfh temporarily deployed to production August 1, 2024 01:19 — with GitHub Actions Inactive

mschfh temporarily deployed to production August 1, 2024 08:49 — with GitHub Actions Inactive

mschfh temporarily deployed to production August 1, 2024 08:54 — with GitHub Actions Inactive

mschfh had a problem deploying to production August 1, 2024 09:04 — with GitHub Actions Failure

mschfh temporarily deployed to production August 1, 2024 09:07 — with GitHub Actions Inactive

mschfh temporarily deployed to production August 1, 2024 09:19 — with GitHub Actions Inactive

mschfh had a problem deploying to production August 1, 2024 09:54 — with GitHub Actions Error

mschfh temporarily deployed to production August 1, 2024 09:57 — with GitHub Actions Inactive

mschfh requested a review from antonok-edm August 1, 2024 10:06

mschfh force-pushed the mschfh-dynamic-lists branch from d7e2a7b to 4ba9963 Compare August 1, 2024 10:07

mschfh temporarily deployed to production August 1, 2024 10:07 — with GitHub Actions Inactive

mschfh changed the title ~~[WIP] Improve adblock list handling~~ Switch to headless mode, implement dynamic list selection Aug 1, 2024

mschfh marked this pull request as ready for review August 1, 2024 10:07

Switch to headless mode, implement dynamic list selection

9d252e7

mschfh force-pushed the mschfh-dynamic-lists branch from 4ba9963 to 9d252e7 Compare August 1, 2024 10:23

github-actions bot reviewed Aug 1, 2024

View reviewed changes

github-actions bot added the needs-security-review label Aug 1, 2024

github-actions bot assigned bcaller and thypon Aug 1, 2024

antonok-edm approved these changes Aug 1, 2024

View reviewed changes

mihaiplesa reviewed Aug 1, 2024

View reviewed changes

package.json Show resolved Hide resolved

mschfh added 2 commits August 1, 2024 20:27

fixes

bd3a890

disable/re-enable checkboxes

10aa9c9

mschfh requested a review from antonok-edm August 2, 2024 01:30

antonok-edm approved these changes Aug 2, 2024

View reviewed changes

mschfh merged commit bfe2c70 into main Aug 3, 2024
5 checks passed

mschfh deleted the mschfh-dynamic-lists branch August 3, 2024 01:21

SWB90 unassigned bcaller Aug 15, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Switch to headless mode, implement dynamic list selection #26

Switch to headless mode, implement dynamic list selection #26

mschfh commented Jul 26, 2024 •

edited by mihaiplesa

Loading

github-actions bot Aug 1, 2024

github-actions bot Aug 1, 2024

github-actions bot Aug 1, 2024

github-actions bot Aug 1, 2024

github-actions bot Aug 1, 2024

github-actions bot Aug 1, 2024

github-actions bot Aug 1, 2024

github-actions bot Aug 1, 2024

github-actions bot Aug 1, 2024

github-actions bot Aug 1, 2024

mschfh Aug 3, 2024

antonok-edm Aug 1, 2024

antonok-edm commented Aug 1, 2024

mschfh commented Aug 1, 2024

Switch to headless mode, implement dynamic list selection #26

Switch to headless mode, implement dynamic list selection #26

Conversation

mschfh commented Jul 26, 2024 • edited by mihaiplesa Loading

github-actions bot Aug 1, 2024

Choose a reason for hiding this comment

github-actions bot Aug 1, 2024

Choose a reason for hiding this comment

github-actions bot Aug 1, 2024

Choose a reason for hiding this comment

github-actions bot Aug 1, 2024

Choose a reason for hiding this comment

github-actions bot Aug 1, 2024

Choose a reason for hiding this comment

github-actions bot Aug 1, 2024

Choose a reason for hiding this comment

github-actions bot Aug 1, 2024

Choose a reason for hiding this comment

github-actions bot Aug 1, 2024

Choose a reason for hiding this comment

github-actions bot Aug 1, 2024

Choose a reason for hiding this comment

github-actions bot Aug 1, 2024

Choose a reason for hiding this comment

mschfh Aug 3, 2024

Choose a reason for hiding this comment

antonok-edm Aug 1, 2024

Choose a reason for hiding this comment

antonok-edm commented Aug 1, 2024

mschfh commented Aug 1, 2024

mschfh commented Jul 26, 2024 •

edited by mihaiplesa

Loading