filedescriptor / untrusted-types Goto Github PK

View Code? Open in Web Editor NEW

642.0 642.0 69.0 266 KB

License: Apache License 2.0

JavaScript 3.49% CSS 3.69% HTML 1.77% TypeScript 33.91% Svelte 57.14%

untrusted-types's Introduction

filedescriptor

untrusted-types's People

Contributors

Stargazers

Watchers

Forkers

attacker-codeninja asdyxcyxc sulaimanzai rooteval tolgadevsec bbhunter 0xhelloworld-dev heartway hatchetxuexi lyhistory elamaran619 ravindranathrl bananabr rutviiik ltidi2000 godfuzz3r wayc0des-land debox78 tamjid0x01 faisalrathore cyal1 affilares morentharia yunus96 prongedfork tr1ckyturt1e aasicq bbhunt-2020 c0deur binhan98 disco0 kid-joe zeroc00i slooppe caioluders seqrity chmodx magnologan dskrish bijaysilwal xceptioncode subzer0-cpu shreateh domaincontroller pynpy actorexpose prettyrecon 0xjson graspkey 5l1v3r1 tahaboulehmi gprime31 othaime-en kaal18 dev0x41 securitystuffbackup paulinhoneto 0xblackbird 0xgodson mylong mamaiamhacking 0xsojalsec wargg excloudx6 inosec2 hacker0x011111111 4nemfreddo re13orn

untrusted-types's Issues

[bug] This document requires 'TrustedScript' assignment.

when you browser some websites. which contains an iframe dynamically loaded by javascript. It will throw an error This document requires 'TrustedScript' assignment.

Errors when web workers use importScripts()

Hey, I stumbled upon a similar issue as #1 (This document requires 'TrustedScriptURL' assignment.) for websites that leverage web workers. It seems that Chrome isn't using the default policy as a fallback in case strings are passed to importScripts() resulting in errors since the CSP enforces trusted types.

The minimal POC to reproduce this is:

index.html

<!doctype html>
<html>
<head>
    <meta http-equiv="Content-Security-Policy" content="require-trusted-types-for 'script'">
</head>
<body>
<script>
trustedTypes.createPolicy('default', {
  createHTML: string => string,
  createScript: string => string,
  createScriptURL: string => string
});

var worker = new Worker("script1.js");

</script>

script1.js

console.log('hi, from script1.js');
importScripts('script2.js');

script2.js

console.log('hi, from script2.js');

Here's a live version http://165.227.165.4/web-worker-trusted-types/index.html

I couldn't find much information regarding this behaviour, however, my gut feeling tells me this might be a bug in Chrome, but I'm not too familiar with web workers (and how they work with trusted types). Just thought that I'll mention it here if others run into it (not sure there is anything the extension could do in these cases).

Untrusted Types for DevTools

Hey, first of all, thanks for making this extension.
While using it I found that on some websites the console gets cluttered and sometimes it's easy to get lost in the logs. I thought it'd nice if there was a panel in DevTools where you could filter or search the logs, just like the Network panel.
I initially wanted to do a PR, but I kept adding more stuff and added Svelte+TypeScript for the UI, so I thought it might be better if I publish it into a separate repo, or let me know what you think...

The new features are:
Panel in DevTools, where you can:

filter by sink type
filter by code in the input
choose to preserve log after navigation/reload
clear the log
modify settings (which are saved in chrome.storage)
- all the original settings (list of keywords, list of source/any call stack substrings to ignore, trace limit, only log highlighted) +
- highlighting options (it uses Document.execCommand hiliteColor for highlighting, which is slow, but works)
- group the console.trace/logs in console using console.group to keep the console a bit more tidy
view found sinks
- with syntax highlighted input code
- or open the code in a popup window
- the href url
- the stack trace
  - The stack trace is a bit unfortunate since it can't be formatted nicely with clickable links (as console.trace does), but as an alternative I've given each stack trace a unique ID which you can copy by clicking it, and then just filter by the ID in console to find it. Obviously that won't work if you clear the console, but other than that is should work fine.

Injected script
Since the chrome.storage are all asynchronous I thought it wouldn't be possible to fetch the settings in the injected script, but it's actually possible to intercept the settings.json XMLHttpRequest, and redirect the request to data:application/json,{settings:...}, will gives us synchronous access to the dynamic settings directly in the injected script.
The injected script <> extension communication is via postMessages, which is also not ideal, but seems to be the only possible way.

Here's a screenshot of the DevTools panel:

The repository can be found at: https://github.com/ThomasOrlita/untrusted-types-devtools

Thanks!

Notifications when a keyword is found

Hello

I've been using this tool for quite a while now, and one thing that I feel is missing, is a notification once one of the predefined keywords are detected by untrusted-types.
It would be extremely helpful, since untrusted-types only has an interface located in the developer tools. That way, I won't have to keep checking, or leave the developer tools open while looking for potential dom-based cross-site scripting issues.

Thanks!

error in console: Uncaught ReferenceError: trustedTypes is not defined

UNTRUSTED_TYPES_CHECK_STACK_BELOW:27 Uncaught ReferenceError: trustedTypes is not defined
at UNTRUSTED_TYPES_CHECK_STACK_BELOW:27
at UNTRUSTED_TYPES_CHECK_STACK_BELOW:36
(anonymous) @ UNTRUSTED_TYPES_CHECK_STACK_BELOW:27
(anonymous) @ UNTRUSTED_TYPES_CHECK_STACK_BELOW:36
content.js:53 Unrecognized Content-Security-Policy directive 'require-trusted-types-for'.

URL encoding of settings

The following should be URL encoded:
https://github.com/filedescriptor/untrusted-types/blob/main/src/background.ts#L24

Otherwise if you have a setting with %22 it would break the JSON .parse.

Keyword highlighting is not working

First of all, congrats on the impressive and creative use of Trusted Types!

I noticed, while trying to follow along your video here, specifically the part on where you're demoing using the keyword d0mxss in the input field on http://prompt.ml/1, that the functionality described here doesn't seem to be working for me.

I have no errors in my console and even tried with all other extensions disabled .

Chrome version: 87.0.4280.67 (Official Build) (x86_64)
Untrusted-types version: 0.0.1

Use console's debug() to log navigation sinks

Currently, Trusted Types only covers location = 'javascript:' + user_input but not location = user_input and other similar things that trigger navigation. I believe they are common sinks so we don't want to miss them.

It is not possible to hook into the assignment call either. location.__defineSetter__() doesn't work because most properties are read-only. However, it is possible to use the debug() function from DevTools' console (monitor() doesn't work, sadly).

I will see if introducing this change would break anything.

d0mxss doing nothing

ive tried many sites i use the d0mxss input and see nothing

filedescriptor / untrusted-types Goto Github PK

untrusted-types's Introduction

filedescriptor

untrusted-types's People

Contributors

Stargazers

Watchers

Forkers

untrusted-types's Issues

[bug] This document requires 'TrustedScript' assignment.

Errors when web workers use importScripts()

Untrusted Types for DevTools

Notifications when a keyword is found

error in console: Uncaught ReferenceError: trustedTypes is not defined

URL encoding of settings

Keyword highlighting is not working

Use console's debug() to log navigation sinks

d0mxss doing nothing

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent