diff --git a/Inline-script-tag-filtering.md b/Inline-script-tag-filtering.md index b9c73ea..efcf035 100644 --- a/Inline-script-tag-filtering.md +++ b/Inline-script-tag-filtering.md @@ -4,10 +4,7 @@ Back to [Static filter syntax](./Static-filter-syntax). - [Caveats](#caveats) - [Overview](#overview) -- [Compatibility with Adblock Plus](#compatibility-with-adblock-plus) - [Concrete examples of usefulness](#concrete-examples-of-usefulness) -- [Why is the new inline script tag filter a cosmetic one?](#why-is-the-new-inline-script-tag-filter-a-cosmetic-one) -- [Does Adblock Plus support this filter syntax?](#does-adblock-plus-support-this-filter-syntax) *** @@ -33,7 +30,7 @@ There are many ways to block script tags from executing in uBlock Origin: - Block external script resources: these are taken care by network filtering. - Block all inline script tags embedded in a page at once.[1] -Inline script tags are those blocks of javascript code which are embedded in the main page: they can not be blocked from downloading unless the whole page itself is blocked, which is not very useful. Here is a example of a web page's HTML code with two inline script tags: +Inline script tags are those blocks of JavaScript code which are embedded in the main page: they can not be blocked from downloading unless the whole page itself is blocked, which is not very useful. Here is a example of a web page's HTML code with two inline script tags: ```html @@ -62,19 +59,17 @@ Inline script tags are those blocks of javascript code which are embedded in the In this example, blocking inline script tags wholesale would not be a good solution because both script tags would be blocked and we would lose the `usefulCode` function as well. -uBlock Origin 1.2.0 introduces a new way to block **specific** inline script tag in a web page through the script tag cosmetic filter: +uBlock Origin 1.15.0 introduces [HTML filtering](./Static-filter-syntax#html-filters), which can be used to remove specific inline script tags from a web page _before_ the browser parses the HTML response from the server: - example.com##script:contains(...) + example.com##^script:has-text(...) -Please note that with the introduction of [HTML filtering](./Static-filter-syntax#html-filters), the `script:contains(...)` syntax is now deprecated and internally converted into an equivalent `##^script:has-text(...)` HTML filter. +Where the value inside the parenthesis in `has-text(...)` can be a plain string or a literal JavaScript regular expression (`/.../`). -Where the value inside the parenthesis in `contains(...)` can be a plain string or a literal javascript regular expression (`/.../`). A script tag cosmetic filter will prevent the execution of whatever javascript inside a **specific** script tag when there is a match, i.e. when the plain text or the regular expression is found inside the script tag. +So we can use HTML filtering for our above example to specifically remove one of the script tags (assuming the page's URL is `https://foo.example/bar.html`): -So we can use script tag filtering for our above example to specifically disable one of the script tag (assuming the page's URL is `https://foo.example/bar.html`): + foo.example##^script:has-text(nuisanceCode) - foo.example##script:contains(nuisanceCode) - -This filter means: for any web pages from the `foo.example` web site, disable all inline script tags which contains the string `nuisanceCode`. +This filter means: for any web pages from the `foo.example` web site, remove all inline script tags which contains the string `nuisanceCode`. In the cat and mouse game between web sites and blockers, the new script tag filter is a welcomed new tool on the user side, to foil attempt by site to work around blockers. @@ -82,19 +77,9 @@ The big advantage of this new filter is that it can fix _at the source_ many of For example, the web site at `http://focus.de/` will resort to deface itself with ridiculous ads when the site detects that the user is using a blocker, and using _EasyList_ + _EasyList Germany_ does not work, as the images pulled by the page are randomly named, defeating pattern-based network filters and cosmetic filters as well. -Wholesale blocking of inline script tags does prevent the self-defacing, but possibly at the cost of disabling other possible useful functionalities on the page. However, a script tag filter to block the specific inline script tag which contains the self-defacement javascript code allows a more targeted approach: prevent the undesirable inline javascript code from executing while keeping the desirable inline javascript code intact. At time of writing, this script tag filter worked for the site: +Wholesale blocking of inline script tags does prevent the self-defacing, but possibly at the cost of disabling other possible useful functionalities on the page. However, a script tag filter to block the specific inline script tag which contains the self-defacement JavaScript code allows a more targeted approach: prevent the undesirable inline JavaScript code from executing while keeping the desirable inline JavaScript code intact. At time of writing, this script tag filter worked for the site: - www.focus.de##script:contains(uabInject) - -*** - -#### Compatibility with Adblock Plus - -It appears inline script tag cosmetic filters can be used in filter lists which are also meant to be used for Adblock Plus ("ABP") -- ABP will ignore the `[...]##script:contains([...])` filters. This makes it possible for maintainers of filter lists to make use of this new filter syntax for the benefit of uBlock Origin users while not causing problem for users of ABP. - -The compatibility was verified for the Firefox version of ABP however, I did not check for the Chromium version of ABP. This will need confirmation for whether using the new filter on a Chromium version of ABP has no negative consequences. - -**Update:** Compatibility was verified with the Chromium version of ABP, and unfortunately this new filter syntax breaks ABP, as it fails to discard invalid CSS selectors. + www.focus.de##^script:has-text(uabInject) *** @@ -110,48 +95,3 @@ With an appropriate inline script tag filter:
The _uBlock filters_ list, which is selected by default, already contains a couple of inline script tag filters to take care of some of these annoyances. -*** - -#### Why is the new inline script tag filter a cosmetic one? - -Because blocking inline script tags are conceptually closer to cosmetic filtering than network filtering: inline script tags are embedded in a web page, so if the web page is downloaded, the inline script tags are downloaded -- there is no way around this. - -Whatever can't be blocked using a network request filter can be taken care by a cosmetic filter, which is the hiding of DOM elements in a web page. Hence inline script tag filtering is implemented using the cosmetic filter syntax -- the only difference is that when blocked, inline script tags are not removed from view (they are already invisible) but instead the execution of the javascript code inside the script tag is blocked. - -*** - -#### Does Adblock Plus support this filter syntax? - -No. And apparently, they won't -- [Wladimir Palant ("trev") on Adblock Plus issue tracker](https://issues.adblockplus.org/ticket/748#comment:9): - -> Not quite the same thing - he is "blocking" individual scripts (something that inevitably causes a massive performance overhead). Not that it is significantly more useful as a result, anti-adblock messages can easily be combined with required website functionality in the same `