Add vararg `throttle, n` where `n` is the time to wait in ms before
returning a response from proxied `fetch()`.
As discussed with filter list maintainers.
The `uritransform=` option will now be converted to a proper DNR
rule when the following condition are fulfilled:
- The value of the `uritransform` option matches `//[replacement]/`,
i.e. the pattern to match is empty, and only the replacement part is
provided.
- The filter pattern is a regex.
Is such case, the DNR rule will be a `redirect` making use of the
`regexSubstitution` property.
In case the above conditions are not fulfilled, the filter will
be discarded as incompatible with DNR syntax (as was the case
before).
This is potentially a breaking change, in cases where a filter
assumed that the part to match was the start of the path part of
a URL.
A reminder that `uritransform` is an option which requires a
trusted source, otherwise it is rejected.
As discussed with filter list maintainers.
Examples of usage:
$ => result is `null`
$+={"modifyOrCreate": "..."}
These expressions were not working with previous version.
As discussed with filter list maintainers.
Examples of JSON path expression to replace a pattern within a string
value:
..book.*.author=repl({"pattern": "Melville", "replacement": "Toto"})
..book.*.author=repl({"regex": "e", "replacement": "o"})
..book.*.author=repl({"regex": "e", "flags": "g", "replacement": "o"})
If the target value is not a string, no modification will occur.
As discussed with filter list maintainers.
@scriptlet edit-inbound-object.js
@description
Prune properties from an object passed as argument to a specific method.
Properties can only be removed.
@param propChain
Property chain of the method to trap.
@param argPos
0-based position of the argument. Use negative integer for position relative
to the end.
@param jsonq
A uBO-flavored JSONPath query.
@scriptlet trusted-edit-inbound-object.js
@description
Edit properties of an object passed as argument to a specific method.
Properties can be assigned new values.
@param propChain
Property chain of the method to trap.
@param argPos
0-based position of the argument. Use negative integer for position relative
to the end.
@param jsonq
A uBO-flavored JSONPath query.
edit-outbound-object-.js
@description
Prune properties from an object returned by a specific method.
Properties can only be removed.
@param jsonq
A uBO-flavored JSONPath query.
trusted-edit-outbound-object.js
@description
Edit properties from an object returned by a specific method.
Properties can be assigned new values.
@param jsonq
A uBO-flavored JSONPath query.
json-edit-xhr-request.js
@description
Edit the object sent as the body in a XHR instance.
Properties can only be removed.
@param jsonq
A uBO-flavored JSONPath query.
@param [propsToMatch, value]
An optional vararg detailing the arguments to match when xhr.open() is
called.
trusted-json-edit-xhr-request.js
@description
Edit the object sent as the body in a XHR instance.
Properties can be assigned new values.
@param jsonq
A uBO-flavored JSONPath query.
@param [propsToMatch, value]
An optional vararg detailing the arguments to match when xhr.open() is
called.
json-edit-fetch-request.js
@description
Edit the request body sent through the fetch API.
Properties can only be removed.
@param jsonq
A uBO-flavored JSONPath query.
@param [propsToMatch, value]
An optional vararg detailing the arguments to match when fetch() is
called.
trusted-json-edit-fetch-request.js
@description
Edit the request body sent through the fetch API.
Properties can be assigned new values.
@param jsonq
A uBO-flavored JSONPath query.
@param [propsToMatch, value]
An optional vararg detailing the arguments to match when fetch() is
called.
Related issue:
https://github.com/uBlockOrigin/uBOL-home/issues/157
The `header=` option will be converted into DNR's `responseHeaders`
condition.
There will be an attempt to convert regex-based values into DNR-
compatible syntax. Not all regex-based patterns can be converted to
use DNR's patterns with `*` and `?` special characters.
The implementation of `header=` option in uBO has been revisited to
improve compatibility with DNR syntax to minimize burden for list
maintainers when creating `header=` filters compatible with both
uBO and uBOL.
The changes:
- Header names are now case-insensitive by default
- Occurrences of `*` in non-regex-based header values now mean
"matches any number of characters"
- Occurrences of `?` in non-regex-based header values now mean
"matches zero or one character"
At time of commit, and as per MDN, only Chromium-based browsers
currently support filtering on repsonse headers:
https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/declarativeNetRequest/HeaderInfo
Also as per MDN, Chromium 121-127 silently ignore the `responseHeaders`
condition, potentially causing undue blocking of network requests.
Currently uBOL support Chromium 122 and later, meaning we need to mind
potential false positives in Chromium 122-127 for filters using
`header=` option.
The quoted email below was sent to ubo-security at raymondhill dot net:
=====
Dear Raymond,
I am writing to report a potential Regular Expression Denial of Service (ReDoS)
vulnerability in the 1p-filters.js script of uBlock Origin. The vulnerability
occurs due to the use of the regular expression /\s+$/, which is used to remove
trailing whitespace. This issue can lead to a denial of service when processing
strings with a large number of trailing spaces, potentially causing a browser to
freeze.
Affected file(s)
js/1p-filters.js
Vulnerable pattern(s)
Lines 131 and 167: /\s+$/
Description of the issue
The regular expression /\s+$/ is applied to remove trailing whitespace in user‑
provided content. However, when the content has a large number of spaces
(e.g., ~100,000), this pattern causes excessive backtracking in the regular
expression engine, resulting in performance degradation and UI freezing. This is
a classic ReDoS attack vector.
Steps to reproduce
1. Open the uBlock Origin dashboard and navigate to the My filters tab.
2. Run the following code in the browser's DevTools Console or as a bookmarklet.
3. Observe the UI freezing for several seconds or even longer, depending on the
number of spaces used.
PoC (Proof of Concept)
/**
* poc.js — triggers ReDoS in 1p-filters.js
* Expected: <1 ms; Actual: several seconds – UI freeze
*/
(() => {
const payload = " ".repeat(100000) + "!"; // 100,000 spaces + sentinel
const run = () => {
if (!window.cmEditor) {
console.error("cmEditor not ready");
return;
}
// Inject payload into the editor
cmEditor.setValue(payload);
console.time("ReDoS");
// Call the vulnerable function (mirroring getEditorText)
cmEditor.getValue().replace(/\s+$/, '');
// Alternatively, simulate a realistic user flow:
// document.querySelector('#userFiltersApply').click();
console.timeEnd("ReDoS");
};
if (document.readyState === "complete") {
run();
} else {
window.addEventListener("load", run, { once: true });
}
})();
Impact
This issue can significantly degrade the user experience, causing the page to
become unresponsive. If an attacker can inject this malicious string into the
page (for example, through XSS or other attacks), it could lead to a denial of
service (DoS). This vulnerability can be triggered repeatedly, causing the
browser to hang indefinitely.
Suggested fix
The issue can be mitigated by replacing /\s+$/ with a more efficient solution,
such as a look‑behind assertion /(?<=\S)\s+$/ (available in modern browsers)
which ensures no backtracking occurs, or using trimEnd() for legacy support:
// Example of using look-behind:
cmEditor.setValue(text.replace(/(?<=\S)\s+$/, '') + '\n\n');
// Alternatively, using trimEnd():
cmEditor.setValue(text.trimEnd() + '\n\n');
Additional information
If required, I am happy to assist in testing or provide more information.
Please feel free to contact me for further clarification.
Best regards,
[redacted]
=====
