Skip to content
Navigation Menu
{{ message }}
forked from EFForg/https-everywhere
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathupdate.js
More file actions
280 lines (234 loc) · 8.77 KB
/
Copy pathupdate.js
File metadata and controls
280 lines (234 loc) · 8.77 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
/* global pako */
"use strict";
let combined_update_channels;
const { update_channels } = require('./update_channels');
// Determine if we're in the tests. If so, define some necessary components.
if (typeof window === "undefined") {
var WebCrypto = require("node-webcrypto-ossl"),
crypto = new WebCrypto(),
atob = require("atob"),
btoa = require("btoa"),
pako = require('../external/pako-1.0.5/pako_inflate.min.js'),
{ TextDecoder } = require('text-encoding'),
chrome = require("sinon-chrome"),
window = { atob, btoa, chrome, crypto, pako, TextDecoder };
combined_update_channels = update_channels;
}
(function(exports) {
const util = require('./util');
let store,
background_callback;
// how often we should check for new rulesets
const periodicity = 86400;
let imported_keys;
// update channels are loaded from `background-scripts/update_channels.js` as well as the storage api
async function loadUpdateChannelsKeys() {
util.log(util.NOTE, 'Loading update channels and importing associated public keys.');
const stored_update_channels = await store.get_promise('update_channels', []);
const combined_update_channels_preflight = update_channels.concat(stored_update_channels);
imported_keys = {};
combined_update_channels = [];
for(let update_channel of combined_update_channels_preflight){
try{
imported_keys[update_channel.name] = await window.crypto.subtle.importKey(
"jwk",
update_channel.jwk,
{
name: "RSA-PSS",
hash: {name: "SHA-256"},
},
false,
["verify"]
);
combined_update_channels.push(update_channel);
} catch(err) {
util.log(util.WARN, update_channel.name + ': Could not import key. Aborting.');
}
}
}
// Determine the time until we should check for new rulesets
async function timeToNextCheck() {
const last_checked = await store.local.get_promise('last-checked', false);
if(last_checked) {
const current_timestamp = Date.now() / 1000;
const secs_since_last_checked = current_timestamp - last_checked;
return Math.max(0, periodicity - secs_since_last_checked);
} else {
return 0;
}
}
// Check for new rulesets. If found, return the timestamp. If not, return false
async function checkForNewRulesets(update_channel) {
let timestamp_result = await fetch(update_channel.update_path_prefix + "/latest-rulesets-timestamp");
if(timestamp_result.status == 200) {
let rulesets_timestamp = Number(await timestamp_result.text());
if((await store.local.get_promise('rulesets-timestamp: ' + update_channel.name, 0)) < rulesets_timestamp){
return rulesets_timestamp;
}
}
return false;
}
// Retrieve the timestamp for when a stored ruleset bundle was published
async function getRulesetTimestamps(){
let timestamp_promises = [];
for(let update_channel of combined_update_channels){
timestamp_promises.push(new Promise(async resolve => {
let timestamp = await store.local.get_promise('rulesets-stored-timestamp: ' + update_channel.name, 0);
resolve([update_channel.name, timestamp]);
}));
}
let timestamps = await Promise.all(timestamp_promises);
return timestamps;
}
// Download and return new rulesets
async function getNewRulesets(rulesets_timestamp, update_channel) {
store.local.set_promise('rulesets-timestamp: ' + update_channel.name, rulesets_timestamp);
let signature_promise = fetch(update_channel.update_path_prefix + "/rulesets-signature." + rulesets_timestamp + ".sha256");
let rulesets_promise = fetch(update_channel.update_path_prefix + "/default.rulesets." + rulesets_timestamp + ".gz");
let responses = await Promise.all([
signature_promise,
rulesets_promise
]);
let resolutions = await Promise.all([
responses[0].arrayBuffer(),
responses[1].arrayBuffer()
]);
return {
signature_array_buffer: resolutions[0],
rulesets_array_buffer: resolutions[1]
};
}
// Returns a promise which verifies that the rulesets have a valid EFF
// signature, and if so, stores them and returns true.
// Otherwise, it throws an exception.
function verifyAndStoreNewRulesets(new_rulesets, rulesets_timestamp, update_channel){
return new Promise((resolve, reject) => {
window.crypto.subtle.verify(
{
name: "RSA-PSS",
saltLength: 32
},
imported_keys[update_channel.name],
new_rulesets.signature_array_buffer,
new_rulesets.rulesets_array_buffer
).then(async isvalid => {
if(isvalid) {
util.log(util.NOTE, update_channel.name + ': Downloaded ruleset signature checks out. Storing rulesets.');
const rulesets_gz = util.ArrayBufferToString(new_rulesets.rulesets_array_buffer);
const rulesets_byte_array = pako.inflate(rulesets_gz);
const rulesets = new TextDecoder("utf-8").decode(rulesets_byte_array);
const rulesets_json = JSON.parse(rulesets);
if(rulesets_json.timestamp != rulesets_timestamp){
reject(update_channel.name + ': Downloaded ruleset had an incorrect timestamp. This may be an attempted downgrade attack. Aborting.');
} else {
await store.local.set_promise('rulesets: ' + update_channel.name, window.btoa(rulesets_gz));
resolve(true);
}
} else {
reject(update_channel.name + ': Downloaded ruleset signature is invalid. Aborting.');
}
}).catch(() => {
reject(update_channel.name + ': Downloaded ruleset signature could not be verified. Aborting.');
});
});
}
// Unzip and apply the rulesets we have stored.
async function applyStoredRulesets(rulesets_obj){
let rulesets_promises = [];
for(let update_channel of combined_update_channels){
rulesets_promises.push(new Promise(resolve => {
const key = 'rulesets: ' + update_channel.name;
chrome.storage.local.get(key, root => {
if(root[key]){
util.log(util.NOTE, update_channel.name + ': Applying stored rulesets.');
const rulesets_gz = window.atob(root[key]);
const rulesets_byte_array = pako.inflate(rulesets_gz);
const rulesets = new TextDecoder("utf-8").decode(rulesets_byte_array);
const rulesets_json = JSON.parse(rulesets);
resolve(rulesets_json);
} else {
resolve();
}
});
}));
}
const rulesets_jsons = await Promise.all(rulesets_promises);
if(rulesets_jsons.join("").length > 0){
for(let rulesets_json of rulesets_jsons){
if(typeof(rulesets_json) != 'undefined'){
rulesets_obj.addFromJson(rulesets_json.rulesets);
}
}
} else {
rulesets_obj.addFromJson(util.loadExtensionFile('rules/default.rulesets', 'json'));
}
}
// basic workflow for periodic checks
async function performCheck() {
util.log(util.NOTE, 'Checking for new rulesets.');
const current_timestamp = Date.now() / 1000;
store.local.set_promise('last-checked', current_timestamp);
let num_updates = 0;
for(let update_channel of combined_update_channels){
let new_rulesets_timestamp = await checkForNewRulesets(update_channel);
if(new_rulesets_timestamp){
util.log(util.NOTE, update_channel.name + ': A new ruleset bundle has been released. Downloading now.');
let new_rulesets = await getNewRulesets(new_rulesets_timestamp, update_channel);
try{
await verifyAndStoreNewRulesets(new_rulesets, new_rulesets_timestamp, update_channel);
store.local.set_promise('rulesets-stored-timestamp: ' + update_channel.name, new_rulesets_timestamp);
num_updates++;
} catch(err) {
util.log(util.WARN, update_channel.name + ': ' + err);
}
}
}
if(num_updates > 0){
background_callback();
}
};
chrome.storage.onChanged.addListener(async function(changes, areaName) {
if (areaName === 'sync' || areaName === 'local') {
if ('autoUpdateRulesets' in changes) {
if (changes.autoUpdateRulesets.newValue) {
await createTimer();
} else {
destroyTimer();
}
}
}
if ('update_channels' in changes) {
await loadUpdateChannelsKeys();
}
});
let initialCheck,
subsequentChecks;
async function createTimer(){
const time_to_next_check = await timeToNextCheck();
initialCheck = setTimeout(() => {
performCheck();
subsequentChecks = setInterval(performCheck, periodicity * 1000);
}, time_to_next_check * 1000);
}
function destroyTimer(){
if (initialCheck) {
clearTimeout(initialCheck);
}
if (subsequentChecks) {
clearInterval(subsequentChecks);
}
}
async function initialize(store_param, cb){
store = store_param;
background_callback = cb;
await loadUpdateChannelsKeys();
if (await store.get_promise('autoUpdateRulesets', true)) {
await createTimer();
}
}
Object.assign(exports, {
applyStoredRulesets,
initialize,
getRulesetTimestamps
});
})(typeof exports == 'undefined' ? require.scopes.update = {} : exports);
You can’t perform that action at this time.