feat(desktop): enforce declarativeNetRequest so content blockers block

Merged
KI
6d ago
+3259-29

Stacked on #9327. Enforces chrome.declarativeNetRequest, so content blockers block.

Why

Electron registers the DNR API but never applies its rules. uBlock Origin Lite installed and showed its popup but blocked nothing: 44/100 on adblock-tester.com, against 41 with no blocker.

Changes

  • Engine: an engine in main (extension-host/declarative-net-request/) applies each extension's rules to persist:browser only, never the agent or app sessions:
    • rules: static rulesets (with enable/disable), dynamic rules (saved to disk) and session rules
    • actions: block, allow, allowAllRequests, upgradeScheme, redirect and modifyHeaders
    • matching: Chrome's urlFilter syntax, regexFilter, domains, resource types, methods, and first/third party via the public suffix list (tldts)
    • precedence follows Chrome's
    • host-permission rules for redirect and headers
  • Lookup: rules are indexed by domain and rare token. uBlock Origin Lite's 18,870 rules index in about 60–160 ms, and a request is matched in a few µs.
  • Extension side: the extension shim replaces chrome.declarativeNetRequest, keeping Chrome's constants, and calls main over IPC.
  • Shared listeners: web-request-hub.ts lets several hooks share a session's webRequest listeners. Electron allows one per event, and the Google sign-in user-agent swap now goes through it.

Testing

  • Unit: matching, precedence, block, the allowAllRequests frame exception, host access, headers, redirects, persistence, and a performance guard.
  • Dev app: uBlock Origin Lite scores 100/100 on adblock-tester.com, up from 44.

Not done

  • the action-count badge
  • onRuleMatchedDebug
  • getMatchedRules quota
  • holding requests until rulesets load at startup

Summary by cubic

Enforces chrome.declarativeNetRequest so content blockers actually block. Electron registers the API but never applies its rules, so uBlock Origin Lite showed its popup while blocking nothing; rules now run in main and apply to persist:browser requests only, and uBO Lite scores 100/100 on adblock-tester.com, up from 44.

Notes

  • Covers static rulesets (enable/disable and per-rule toggles), dynamic rules persisted to disk, and session rules; static state resets on extension update, as in Chrome.
  • Matching follows Chrome's urlFilter and regexFilter syntax, resource types, methods, first/third-party via tldts, and Chrome's precedence; redirect and modifyHeaders need host permissions.
  • Rules are indexed by domain and rare URL token: uBO Lite's 18,870 rules index in about 60–160 ms and a request matches in a few µs.
  • The extension shim replaces chrome.declarativeNetRequest with an IPC-backed version that keeps Chrome's constants, and only takes over when Electron's is present.
  • Electron allows one webRequest listener per event per session, so a new web-request-hub composes hooks; the Google sign-in user-agent swap now goes through it.
  • Dynamic rules and enabled-ruleset state are deleted when the extension is removed; failed calls surface via runtime.lastError, and unreadable saved rules are left alone.

Not included

  • The action-count badge, onRuleMatchedDebug, and the getMatchedRules quota.
  • Requests are not held until rulesets finish loading at startup.

Summary by CodeRabbit

  • New Features
    • Added support for browser extensions’ declarative network request rules, including blocking and redirecting requests, modifying headers, and managing static, dynamic, and session rules.
    • Request handling now respects extension permissions, and saved rules are cleared when an extension is uninstalled.
    • Improved compatibility with extension request hooks, including Google sign-in request handling.
  • Tests
    • Added coverage for rule matching and precedence, request handling, rule management, and extension API behavior.