From 1f0ce1cd447770b981032152cf13276968350f0a Mon Sep 17 00:00:00 2001
From: hackademix <giorgio@maone.net>
Date: Feb 12 2019 20:11:20 +0000
Subject: [PATCH 1/2] UI: contextual view-source links for inline scripts and intrinsic events.


---

diff --git a/html/display_panel/content/main_panel.js b/html/display_panel/content/main_panel.js
index 2509545..f662b35 100644
--- a/html/display_panel/content/main_panel.js
+++ b/html/display_panel/content/main_panel.js
@@ -111,11 +111,16 @@ function createList(data, group){
    container.classList.add("empty");
  }
  // generate list
+ let viewSourceToHuman = /^view-source:(.*)#line(\d+)\(([^)]*)\)/;
  for (let entry of entries) {
    let [scriptId, reason] = entry;
 	 let li = liTemplate.cloneNode(true);
 	 let a = li.querySelector("a");
 	 a.href = scriptId.split("(")[0];
+   if (scriptId.startsWith("view-source:")) {
+     a.target ="LibreJS-ViewSource";
+     scriptId = scriptId.replace(viewSourceToHuman, "$3 at line $2 of $1");
+   }
    a.textContent = scriptId;
 	 li.querySelector(".reason").textContent = reason;
    let bySite = !!reason.match(/https?:\/\/[^/]+\/\*/);
diff --git a/main_background.js b/main_background.js
index b62788a..3da5bc3 100644
--- a/main_background.js
+++ b/main_background.js
@@ -1055,16 +1055,21 @@ async function editHtml(html, documentUrl, tabId, frameId, whitelisted){
 		// Do not process inline scripts
 		scripts = [];
 	} else {
+		let findLine = finder => finder.test(html) && html.substring(0, finder.lastIndex).split(/\n/).length || 0;
 		let modified = false;
-
 		// Deal with intrinsic events
 		let intrinsecindex = 0;
+		let intrinsicFinder = /<[a-z][^>]*\b(on\w+|href\s*=\s*['"]?javascript:)/gi;
 		for (let element of html_doc.all) {
-			for (let attr of element.attributes){
-				if (attr.name.startsWith("on") || (attr.name === "href" && attr.value.startsWith("javascript:"))){
+			let line = -1;
+			for (let attr of element.attributes) {
+				if (attr.name.startsWith("on") || (attr.name === "href" && attr.value.toLowerCase().startsWith("javascript:"))){
 					intrinsecindex++;
+					if (line === -1) {
+						line = findLine(intrinsicFinder);
+					}
 					try {
-						let url = `${documentUrl}# Intrinsic event ${intrinsecindex} [${attr.name}]`;
+						let url = `view-source:${documentUrl}#line${line}(<${element.tagName} ${attr.name}>)`;
 						let edited = await get_script(attr.value, url, tabId, whitelist.contains(url));
 							if (edited) {
 								let value = edited;
@@ -1081,14 +1086,17 @@ async function editHtml(html, documentUrl, tabId, frameId, whitelisted){
 		}
 
 		let modifiedInline = false;
+		let scriptFinder = /<script\b/ig;
 		for(let i = 0, len = scripts.length; i < len; i++) {
 			let script = scripts[i];
-			let url = `${documentUrl}# script ${i}`;
+			let line = findLine(scriptFinder);
 			if (!script.src && !(script.type && script.type !== "text/javascript")) {
-				let edited = await get_script(script.textContent, url, tabId, whitelisted, i);
+				let source = script.textContent;
+				let url = `view-source:${documentUrl}#line${line}(<SCRIPT>)`;
+				let edited = await get_script(source, url, tabId, whitelisted, i);
 				if (edited) {
 					let edited_source = edited[0];
-					let unedited_source = script.textContent.trim();
+					let unedited_source = source.trim();
 					if (edited_source.trim() !== unedited_source) {
 						script.textContent = edited_source;
 						modified = modifiedInline = true;

From 77e9a691e7930adf2a776dc6a85bdf122b2ff511 Mon Sep 17 00:00:00 2001
From: hackademix <giorgio@maone.net>
Date: Feb 12 2019 23:05:00 +0000
Subject: [PATCH 2/2] Fixed regression hiding some inline scripts and global license ref from UI reports.


---

diff --git a/html/display_panel/content/main_panel.js b/html/display_panel/content/main_panel.js
index f662b35..7934fee 100644
--- a/html/display_panel/content/main_panel.js
+++ b/html/display_panel/content/main_panel.js
@@ -111,7 +111,7 @@ function createList(data, group){
    container.classList.add("empty");
  }
  // generate list
- let viewSourceToHuman = /^view-source:(.*)#line(\d+)\(([^)]*)\)/;
+ let viewSourceToHuman = /^view-source:(.*)#line(\d+)\(([^)]*)\).*/;
  for (let entry of entries) {
    let [scriptId, reason] = entry;
 	 let li = liTemplate.cloneNode(true);
diff --git a/main_background.js b/main_background.js
index 3da5bc3..65ffe60 100644
--- a/main_background.js
+++ b/main_background.js
@@ -1039,7 +1039,7 @@ async function editHtml(html, documentUrl, tabId, frameId, whitelisted){
 	// get the potential inline source that can contain a license
 	for (let script of scripts) {
 		// The script must be in-line and exist
-		if(script && !script.src){
+		if(script && !script.src) {
 			first_script_src = script.textContent;
 			break;
 		}
@@ -1049,13 +1049,21 @@ async function editHtml(html, documentUrl, tabId, frameId, whitelisted){
 	if (first_script_src != "") {
 		license = legacy_license_lib.check(first_script_src);
 	}
+
+	let findLine = finder => finder.test(html) && html.substring(0, finder.lastIndex).split(/\n/).length || 0;
 	if (read_metadata(meta_element) || license) {
 		console.log("Valid license for intrinsic events found");
-		addReportEntry(tabId, url, {url, "accepted":[url, `Global license for the page: ${license}`]});
+		let line = 0;
+		if (meta_element) {
+		  line = findLine(/id\s*=\s*['"]?LibreJS-info\b/gi);
+		} else if (license) {
+			line = html.substring(0, html.indexOf(first_script_src)).split(/\n/).length;
+		}
+		let viewUrl = line ? `view-source:${documentUrl}#line${line}(<${meta_element ? meta_element.tagName : "SCRIPT"}>)(0)` : url;
+		addReportEntry(tabId, url, {url, "accepted":[viewUrl, `Global license for the page: ${license}`]});
 		// Do not process inline scripts
 		scripts = [];
 	} else {
-		let findLine = finder => finder.test(html) && html.substring(0, finder.lastIndex).split(/\n/).length || 0;
 		let modified = false;
 		// Deal with intrinsic events
 		let intrinsecindex = 0;
@@ -1069,7 +1077,7 @@ async function editHtml(html, documentUrl, tabId, frameId, whitelisted){
 						line = findLine(intrinsicFinder);
 					}
 					try {
-						let url = `view-source:${documentUrl}#line${line}(<${element.tagName} ${attr.name}>)`;
+						let url = `view-source:${documentUrl}#line${line}(<${element.tagName} ${attr.name}>)(${intrinsicIndex})`;
 						let edited = await get_script(attr.value, url, tabId, whitelist.contains(url));
 							if (edited) {
 								let value = edited;
@@ -1092,7 +1100,7 @@ async function editHtml(html, documentUrl, tabId, frameId, whitelisted){
 			let line = findLine(scriptFinder);
 			if (!script.src && !(script.type && script.type !== "text/javascript")) {
 				let source = script.textContent;
-				let url = `view-source:${documentUrl}#line${line}(<SCRIPT>)`;
+				let url = `view-source:${documentUrl}#line${line}(<SCRIPT>)(${i})`;
 				let edited = await get_script(source, url, tabId, whitelisted, i);
 				if (edited) {
 					let edited_source = edited[0];

