Scriptlet argument escaping

packages/adblocker/src/filters/cosmetic.ts

@@ -748,16 +748,22 @@ export default class CosmeticFilter implements IFilter {
       return undefined;
     }
 
-    const args = parts.slice(1).map((part) => {
-      if (
-        (part.startsWith(`'`) && part.endsWith(`'`)) ||
-        (part.startsWith(`"`) && part.endsWith(`"`))
-      ) {
-        return part.substring(1, part.length - 1);
-      }
-      return part;
-    });
-
+    const args = parts
+      .slice(1)
+      .map((part) => {
+        if (
+          (part.startsWith(`'`) && part.endsWith(`'`)) ||
+          (part.startsWith(`"`) && part.endsWith(`"`))
+        ) {
+          return part.substring(1, part.length - 1);
+        }
+        return part;
+      })
+      .map((part: string) => {
+        return part
+          .replace(new RegExp(/\\u002C/, 'g'), ',')
+          .replace(new RegExp(/\\u005C/, 'g'), '\\');
+      });
     return { name: parts[0], args };
   }
 
@@ -772,7 +778,9 @@ export default class CosmeticFilter implements IFilter {
     let script = js.get(name);
     if (script !== undefined) {
       for (let i = 0; i < args.length; i += 1) {
-        script = script.replace(`{{${i + 1}}}`, args[i]);
+        // escape some characters so they wont get evaluated with escape characters during script injection
+        const arg = args[i].replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+        script = script.replace(`{{${i + 1}}}`, arg);
       }
 
       return script;

packages/adblocker/test/parsing.test.ts

@@ -1855,16 +1855,58 @@ describe('Cosmetic filters', () => {
   //   expect(CosmeticFilter.parse('###.selector /invalid/')).to.be.null;
   // });
 
-  it('#getScript', () => {
-    const parsed = CosmeticFilter.parse('foo.com##+js(script.js, arg1, arg2, arg3)');
-    expect(parsed).not.to.be.null;
-    if (parsed !== null) {
-      expect(parsed.getScript(new Map([['script.js', '{{1}},{{2}},{{3}}']]))).to.equal(
-        'arg1,arg2,arg3',
-      );
+  describe('#getScript', () => {
+    const simpleScriptlet = CosmeticFilter.parse('foo.com##+js(script.js, arg1, arg2, arg3)');
 
-      expect(parsed.getScript(new Map())).to.be.undefined;
-    }
+    it('returns undefined if script does not exist', () => {
+      expect(simpleScriptlet?.getScript(new Map())).to.be.undefined;
+    });
+
+    it('returns a script if one exists', () => {
+      expect(simpleScriptlet?.getScript(new Map([['script.js', 'test']]))).to.equal('test');
+    });
+
+    context('with arguments', () => {
+      it('inject values', () => {
+        expect(simpleScriptlet?.getScript(new Map([['script.js', '{{1}},{{2}},{{3}}']]))).to.equal(
+          'arg1,arg2,arg3',
+        );
+      });
+
+      it('escapes special characters', () => {
+        for (const character of [
+          '.',
+          '*',
+          '+',
+          '?',
+          '^',
+          '$',
+          '{',
+          '}',
+          '(',
+          ')',
+          '|',
+          '[',
+          ']',
+          '\\',
+        ]) {
+          const scriptlet = CosmeticFilter.parse(`foo.com##+js(script.js, ${character})`);
+          expect(scriptlet?.getScript(new Map([['script.js', '{{1}}']]))).to.equal(
+            `\\${character}`,
+          );
+        }
+      });
+
+      it('handles complex cases', () => {
+        for (const example of [
+          [String.raw`'\(a\)'`, String.raw`\\\(a\\\)`],
+          [String.raw`foo\*`, String.raw`foo\\\*`],
+        ]) {
+          const scriptlet = CosmeticFilter.parse(`foo.com##+js(script.js, ${example[0]})`);
+          expect(scriptlet?.getScript(new Map([['script.js', '{{1}}']]))).to.equal(example[1]);
+        }
+      });
+    });
   });
 
   describe('#getTokens', () => {
@@ -2361,4 +2403,27 @@ describe('scriptlets arguments parsing', () => {
       );
     }
   });
+
+  it('unescapes escaped scriptlets', () => {
+    for (const [scriptlet, expected] of [
+      [
+        String.raw`script-name, \u005C(a\u005C)`,
+        {
+          name: 'script-name',
+          args: [String.raw`\(a\)`],
+        },
+      ],
+      [
+        String.raw`script-name, {"a":1\u002C"b":2}`,
+        {
+          name: 'script-name',
+          args: [String.raw`{"a":1,"b":2}`],
+        },
+      ],
+    ] as const) {
+      expect(CosmeticFilter.parse(`foo.com##+js(${scriptlet})`)?.parseScript(), scriptlet).to.eql(
+        expected,
+      );
+    }
+  });
 });