Scriptlets: inject quoted arguments without quotes (#3559)

ghostery · Oct 30, 2023 · 240308d · 240308d
1 parent 611c702
commit 240308d
Show file tree

Hide file tree

Showing 2 changed files with 24 additions and 3 deletions.
diff --git a/packages/adblocker/src/filters/cosmetic.ts b/packages/adblocker/src/filters/cosmetic.ts
@@ -748,7 +748,17 @@ export default class CosmeticFilter implements IFilter {
       return undefined;
     }
 
-    return { name: parts[0], args: parts.slice(1) };
+    const args = parts.slice(1).map((part) => {
+      if (
+        (part.startsWith(`'`) && part.endsWith(`'`)) ||
+        (part.startsWith(`"`) && part.endsWith(`"`))
+      ) {
+        return part.substring(1, part.length - 1);
+      }
+      return part;
+    });
+
+    return { name: parts[0], args };
   }
 
   public getScript(js: Map<string, string>): string | undefined {

diff --git a/packages/adblocker/test/parsing.test.ts b/packages/adblocker/test/parsing.test.ts
@@ -2023,11 +2023,11 @@ describe('scriptlets arguments parsing', () => {
         { name: 'acis', args: ['document.createElement', '/break;case $.|popunder/'] },
       ],
       ['acs, atob, -0x1', { name: 'acs', args: ['atob', '-0x1'] }],
-      ["acs, atob, 'shift'", { name: 'acs', args: ['atob', "'shift'"] }],
+      ["acs, atob, 'shift'", { name: 'acs', args: ['atob', 'shift'] }],
       ["acs, Date, ='\\x", { name: 'acs', args: ['Date', "='\\x"] }],
       [
         `acs, decodeURIComponent, "'shift'"`,
-        { name: 'acs', args: ['decodeURIComponent', `"'shift'"`] },
+        { name: 'acs', args: ['decodeURIComponent', `'shift'`] },
       ],
       [
         `acs, document.getElementById, /\\$\\('body'\\)|\\$\\("body"\\)/`,
@@ -2057,6 +2057,17 @@ describe('scriptlets arguments parsing', () => {
     });
   });
 
+  it('removes wrapping quotes', () => {
+    expect(CosmeticFilter.parse('foo.com##+js(script-name, "a")')?.parseScript()).to.eql({
+      name: 'script-name',
+      args: ['a'],
+    });
+    expect(CosmeticFilter.parse("foo.com##+js(script-name, 'a')")?.parseScript()).to.eql({
+      name: 'script-name',
+      args: ['a'],
+    });
+  });
+
   it('handles escaping of comas', () => {
     expect(CosmeticFilter.parse('foo.com##+js(script-name, foo \\,bar)')?.parseScript()).to.eql({
       name: 'script-name',