-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
12 changed files
with
558 additions
and
76 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,40 +1,36 @@ | ||
| let savedData = localStorage.getItem("EngineDATA"); | ||
| import { checkIfSafe } from "./sanitizer.js"; | ||
|
|
||
| if (savedData) { | ||
| let data = JSON.parse(savedData); | ||
| let loadURL = data.EngineURL; | ||
|
|
||
| // Create an iframe element | ||
| let iframe = document.createElement("iframe"); | ||
| iframe.style.display = "none"; // Hide the iframe | ||
| iframe.src = loadURL; | ||
| function getCookie(name) { | ||
| const nameEq = name + "="; | ||
| const cookies = document.cookie.split(';'); | ||
|
|
||
| iframe.onload = function() { | ||
| try { | ||
| // When the iframe has loaded, get its content | ||
| let iframeDocument = iframe.contentDocument || iframe.contentWindow.document; | ||
|
|
||
| // Extract all scripts in the iframe | ||
| let scripts = iframeDocument.getElementsByTagName('script'); | ||
| let jsCode = ''; | ||
|
|
||
| for (let script of scripts) { | ||
| if (script.src) { | ||
| // If it's an external script, you can get the URL | ||
| console.log(`External script: ${script.src}`); | ||
| } else { | ||
| // Inline script: Extract the content | ||
| jsCode += script.innerText || script.textContent; | ||
| } | ||
| } | ||
|
|
||
| // Now jsCode holds the JS code of the iframe | ||
| console.log("Extracted JS code:", jsCode); | ||
| } catch (error) { | ||
| console.error("Error accessing iframe content:", error); | ||
| for (let i = 0; i < cookies.length; i++) { | ||
| let cookie = cookies[i].trim(); | ||
| if (cookie.indexOf(nameEq) === 0) { | ||
| return decodeURIComponent(cookie.substring(nameEq.length)); | ||
| } | ||
| }; | ||
| } | ||
|
|
||
| return null; | ||
| } | ||
|
|
||
| // Append the iframe to the body | ||
| document.body.appendChild(iframe); | ||
| function injectScript(content) { | ||
| let result = checkIfSafe(content) | ||
| if (result === false) { | ||
| console.error("Aborted loading the plugin due to suspicious code") | ||
| return | ||
| } | ||
| const scriptElement = document.createElement('script'); | ||
| scriptElement.type = 'text/javascript'; | ||
| scriptElement.textContent = content; | ||
| document.head.appendChild(scriptElement); | ||
| } | ||
|
|
||
| let cookieValue = getCookie('engine_plugin'); | ||
|
|
||
| if (cookieValue) { | ||
| injectScript(cookieValue); | ||
| console.log("Script injected successfully."); | ||
| } else { | ||
| console.log("Cookie not found."); | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,30 @@ | ||
| const unsafePatterns = [ | ||
| { pattern: /import\s+[^\n]*/, replacement: '' }, | ||
| { pattern: /export\s+[^\n]*/, replacement: '' }, | ||
| { pattern: /fetch\s*\([^\)]*\)/, replacement: '' }, | ||
| { pattern: /XMLHttpRequest\s*\([^\)]*\)/, replacement: '' }, | ||
| { pattern: /eval\s*\([^\)]*\)/, replacement: '' }, | ||
| { pattern: /new\s+Function\s*\([^\)]*\)/, replacement: '' }, | ||
| { pattern: /window\.location\s*=\s*[^\n]*/, replacement: '' }, | ||
| { pattern: /window\.open\s*\([^\)]*\)/, replacement: '' }, | ||
| { pattern: /document\.write\s*\([^\)]*\)/, replacement: '' }, | ||
| { pattern: /document\.cookie\s*=\s*[^\n]*/, replacement: '' }, | ||
| { pattern: /localStorage\s*\.[a-zA-Z0-9]+\s*=\s*[^\n]*/, replacement: '' }, | ||
| { pattern: /FileReader\s*\([^\)]*\)/, replacement: '' }, | ||
| { pattern: /WebSocket\s*\([^\)]*\)/, replacement: '' }, | ||
| { pattern: /localStorage\.setItem\s*\([^\)]*\)/, replacement: '' }, | ||
| ]; | ||
|
|
||
| function checkIfSafe(code) { | ||
| for (let { pattern } of unsafePatterns) { | ||
| if (pattern.test(code)) { | ||
| console.error("PLUGIN is SUS"); | ||
| return false; | ||
| } | ||
| } | ||
|
|
||
| console.log("Plugin seems safe (not 100% accurate)"); | ||
| return true; | ||
| } | ||
|
|
||
| export { checkIfSafe } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.