Scriptlets don't work on websites using Content-Security-Policy (CSP)

[charlessuh]

Please answer the following questions for yourself before submitting an issue

• Filters were updated before reproducing an issue
• I checked the knowledge base and found no answer
• I checked to make sure that this issue has not already been filed

AdGuard version

4.5.5

Environment

• OS: 17.5.1
• Device: iPhone XS

Ad Blocking

No response

Privacy

No response

Social

No response

Annoyances

No response

Security

No response

Other

No response

Language-specific

No response

Advanced protection for Safari

• yes, I do

Which DNS server do you use?

DNS protection disabled

DNS protocol

DNS protection disabled

Custom DNS

No response

DNS filtering

• yes, I do

Custom DNS filter

No response

DNS implementation

DNS protection disabled

Tunnel mode

DNS protection disabled

Low-level settings

Bootstrap server:
Fallback server:
Blocking mode, etc:

Issue Details

This was (partially) fixed in the Safari repo:

• CSP prevents advanced rules AdGuardForSafari#917
• AdguardTeam/AdGuardForSafari@f102b09

Expected Behavior

No response

Actual Behavior

The following code doesn't work on a website using CSP to restrict inline scripts:

AdguardForiOS/AdguardExtension/SafariWebExtension/extension/src/pages/content/content.ts

Lines 40 to 56 in 25f8f10

	const executeScripts = (scripts: string[]) => {
	// Wrap with try catch
	const start = '( function () { try {';
	const end = "} catch (ex) { console.error('Error executing AG js: ' + ex); } })();";
	const updated = [start, ...scripts, end];
	const scriptTag = document.createElement('script');
	scriptTag.setAttribute('type', 'text/javascript');
	scriptTag.textContent = updated.join('\r\n');
	const parent = document.head || document.documentElement;
	parent.appendChild(scriptTag);
	if (scriptTag.parentNode) {
	scriptTag.parentNode.removeChild(scriptTag);
	}
	};

Screenshots

No response

Additional Information

No response

[charlessuh]

One interesting strategy I noticed Noir is using is to embed a helper script like <script id="noir-helper" class="noir noir-helper" src="safari-web-extension://E0D31760-3AB2-4B4D-B79D-58B41AF2DEFD/dist/noirhelper.js"></script>, which seems to get around CSP.

Maybe you could communicate from the content script <-> page helper script using a custom event or some other mechanism.

[Versty]

@charlessuh Thank you for reporting!
Could you please provide examples of problematic websites?

[Versty]

@charlessuh Any updates?

[Versty]

@charlessuh We have discussed this issue with development team.
We are currently working towards this direction, will do our best to improve this behaviour in future versions.