@ai-ecoverse/slicc-browsers 1.3.0 → 1.5.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +7 -5
- package/catalog.json +14 -4
- package/package.json +4 -2
- package/protected.json +549 -121
- package/protected.mjs +2 -1
- package/schema/catalog.schema.json +18 -1
- package/seven.mjs +6 -0
package/README.md
CHANGED
|
@@ -82,14 +82,14 @@ Every feature builds for `wasm32-wasip1`.
|
|
|
82
82
|
- `names`: an endpoint's name when it isn't from a known browser's user-data dir: `electron` when the user agent contains `electronUserAgent`, else `products[<product>]` for the product before the `/` in `/json/version`'s `Browser`, else that product, else `fallback`;
|
|
83
83
|
- `process`: the process scan, see [The process source](#the-process-source).
|
|
84
84
|
- `seven`:
|
|
85
|
-
- `originScheme` and `originHostPattern`: a seven origin is `https://<host>` with a host matching the pattern, except for the `excludedLabels` (`www`). An origin is compared without the scheme's default port (443 for `https`, 80 for `http`), so `https://seven.sliccy.ai:443` is seven and `https://seven.sliccy.ai:8443` is not. The same goes for extra seven origins;
|
|
85
|
+
- `originScheme` and `originHostPattern`: a seven origin is `https://<host>` with a host matching the pattern, except for the `excludedLabels` (`www`, `vault`, `vault-preview`, `get`, `mcpcat`) and the `excludedLabelPrefixes` (`vault-`, which excludes `vault-feature-x` and any other vault branch preview). The bare apex (`sliccy.ai`, i.e. an empty label) never matches. An origin is compared without the scheme's default port (443 for `https`, 80 for `http`), so `https://seven.sliccy.ai:443` is seven and `https://seven.sliccy.ai:8443` is not. The same goes for extra seven origins;
|
|
86
86
|
- `sitePattern` (`[*.]sliccy.ai`);
|
|
87
87
|
- `switches` and `disabledFeatures`: the seven flags, all `--disable-features` values merged into one switch;
|
|
88
88
|
- `prefs`: values merged into a profile's `Default/Preferences` at the `path` of keys;
|
|
89
89
|
- `discardExceptions`: where the site pattern and the extra origins' hosts go, as a `list` of strings or as a `chrome-time-map`, a map from site to the time it was added (microseconds since 1601-01-01 UTC, as a decimal string);
|
|
90
90
|
- `cleanExit`: values that mark the last exit clean;
|
|
91
91
|
- `form` says where a key comes from: `six` (SLICC six's keys) or `chrome-154` (what Chrome 154 reads).
|
|
92
|
-
- `protectedOrigins`: what browser control must never reach, see [Protected origins](#protected-origins). `domains` (`sliccy.ai`), `schemes` (`https`, `http`), `innerSchemes` (`blob`, `filesystem`, `view-source`), `anySchemes` (`devtools`), `inheriting` (`about:blank`, `about:srcdoc`), and `refusal`, the text of a refusal.
|
|
92
|
+
- `protectedOrigins`: what browser control must never reach, see [Protected origins](#protected-origins). `domains` (`sliccy.ai`), `hosts` (`vault.sliccy.ai`), `schemes` (`https`, `http`), `innerSchemes` (`blob`, `filesystem`, `view-source`), `anySchemes` (`devtools`), `inheriting` (`about:blank`, `about:srcdoc`), and `refusal`, the text of a refusal.
|
|
93
93
|
- `profiles`: SLICC profiles live in `<config dir>/<root>/<name>`, and a snap's in `~/snap/<snap>/common/<snapRoot>/<name>`. `legacyRoot` is the old root, never scanned; on macOS's case-insensitive volume it is SLICC six's root too. `sixProfilePattern` matches six's profile names, case-insensitively. `namePattern` is a valid profile name. `six` describes SLICC six's Chrome profiles (see [SLICC six's profiles](#slicc-sixs-profiles)):
|
|
94
94
|
- `roots`: six's profile root per OS (`macos`, `linux`, `windows`), a `base` location followed by the `path` segments. The base is its `env` when that is set and not empty (any value, as six takes it), else `home` under the home dir.
|
|
95
95
|
- `defaultName` (`browser-coding-agent-chrome`), `defaultPort` (5710) and `portSuffix` (`-{port}`): six's profile for its serve port `<port>` is `<root>/<defaultName>`, with `portSuffix` added for any port other than `defaultPort`.
|
|
@@ -104,16 +104,18 @@ Browser control must never navigate to, open or attach to a target on seven's ow
|
|
|
104
104
|
**URLs.** A URL is parsed the way the WHATWG URL Standard (and so the browser) parses it, so `https:\\seven.sliccy.ai`, a tab or newline inside the URL, `%2E`, `。` and full-width letters all reach seven. In Go and Rust that takes a WHATWG parser, not `net/url`. A URL that doesn't parse isn't protected; the browser doesn't load it either. Then:
|
|
105
105
|
1. While its scheme is one of `innerSchemes`, the rest of the URL after `<scheme>:` takes its place, at most 8 times: `blob:https://seven.sliccy.ai/<uuid>` is `https://seven.sliccy.ai/<uuid>`.
|
|
106
106
|
2. A scheme in `anySchemes` is protected whatever follows: a DevTools front end (`devtools://`) can be inspecting seven.
|
|
107
|
-
3. A scheme in `schemes` is protected when its host is one of `domains` or under one, at any depth and on any port. The host is lower-cased, and one trailing dot is dropped.
|
|
107
|
+
3. A scheme in `schemes` is protected when its host is one of `hosts`, or one of `domains` or under one, at any depth and on any port. The host is lower-cased, and one trailing dot is dropped.
|
|
108
108
|
4. Any other URL is protected when its origin is one of the program's **extra origins**: the seven origins it accepts besides `sliccy.ai` (slicc-cli's `--origin` and `--page` origins), compared as `scheme://host[:port]` without the scheme's default port, with the host as in 3.
|
|
109
109
|
|
|
110
|
-
This is wider than the rule for finding seven (`seven.originHostPattern`, which leaves out `www`). Every `sliccy.ai` host shares the `sliccy.ai` cookies, and cookies ignore the port and, without `Secure`, the scheme. SLICC six lives on `www.sliccy.ai` and the apex, and its cookies matter. `*.kernel.localhost` is not protected: each port is its own origin, and the agent's own servers live there. An extra origin is matched exactly, so `http://127.0.0.1:5710` doesn't protect `http://127.0.0.1:5711`.
|
|
110
|
+
This is wider than the rule for finding seven (`seven.originHostPattern`, which leaves out the `excludedLabels` and `excludedLabelPrefixes`—`www`, `vault`, `vault-preview`, `get`, `mcpcat`, and any `vault-*` prefix). Every `sliccy.ai` host shares the `sliccy.ai` cookies, and cookies ignore the port and, without `Secure`, the scheme. SLICC six lives on `www.sliccy.ai` and the apex, and its cookies matter. `*.kernel.localhost` is not protected: each port is its own origin, and the agent's own servers live there. An extra origin is matched exactly, so `http://127.0.0.1:5710` doesn't protect `http://127.0.0.1:5711`.
|
|
111
|
+
|
|
112
|
+
**The vault.** `vault.sliccy.ai` is in `hosts` by name, and vault branch previews (`vault-preview.sliccy.ai`, `vault-*.sliccy.ai`) are covered by the `sliccy.ai` domain rule. `sliccy.ai` already covers them all, but vault must stay protected even if `domains` ever changes: the vault must never be a CDP target for agent tools. The one exception is slicc-cli's own pairing attach for the vault, which is the CLI's own connection and not browser control handed to the agent.
|
|
111
113
|
|
|
112
114
|
**Targets.** A target's effective origin is its URL's (`TargetInfo.url`), except when the URL inherits the origin of whoever made the document: the empty URL, and `inheriting` with any query or fragment. Such a target is protected when it was protected before this URL (a seven tab that went to `about:blank` keeps seven's origin), or when its opener (`openerId`, else `openerFrameId`) is protected or unknown, for an opener closed before the program saw it. The URL, `openerFrameId` and `browserContextId` alone can't tell: a blank popup that seven opens has seven's origin and the URL `about:blank`. A program that holds a session to the target also has the document's real origin: the main frame's `securityOrigin` in `Page.frameNavigated`, and the default context's `origin` in `Runtime.executionContextCreated`. When one of those is protected, the target is protected too, until a URL with an origin of its own replaces it.
|
|
113
115
|
|
|
114
116
|
A same-site frame shares its parent's process and has no target of its own. Every `sliccy.ai` host is protected, and site isolation gives a seven frame inside any other site its own target, so this only matters for an extra origin whose site has other origins (another port of `127.0.0.1`, say).
|
|
115
117
|
|
|
116
|
-
**Cookies.** A cookie domain, lower-cased and without a leading or trailing dot, is protected when it is one of `domains` or under one, or when it is the host of a protected domain or an extra origin, or a parent of one: a cookie on `.example.test` reaches `https://seven.example.test`.
|
|
118
|
+
**Cookies.** A cookie domain, lower-cased and without a leading or trailing dot, is protected when it is one of `domains` or under one, or when it is one of `hosts`, the host of a protected domain or an extra origin, or a parent of one: a cookie on `.example.test` reaches `https://seven.example.test`.
|
|
117
119
|
|
|
118
120
|
**Storage keys** (`Storage`, `IndexedDB`, `CacheStorage` and `FileSystem` in CDP): a key is protected when its origin (up to the first `^`) or its top-level site (a part after `^0`) is a protected URL.
|
|
119
121
|
|
package/catalog.json
CHANGED
|
@@ -642,7 +642,8 @@
|
|
|
642
642
|
"seven": {
|
|
643
643
|
"originScheme": "https",
|
|
644
644
|
"originHostPattern": "^([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)\\.sliccy\\.ai$",
|
|
645
|
-
"excludedLabels": ["www"],
|
|
645
|
+
"excludedLabels": ["www", "vault", "vault-preview", "get", "mcpcat"],
|
|
646
|
+
"excludedLabelPrefixes": ["vault-"],
|
|
646
647
|
"sitePattern": "[*.]sliccy.ai",
|
|
647
648
|
"switches": [
|
|
648
649
|
"--disable-background-timer-throttling",
|
|
@@ -703,6 +704,7 @@
|
|
|
703
704
|
},
|
|
704
705
|
"protectedOrigins": {
|
|
705
706
|
"domains": ["sliccy.ai"],
|
|
707
|
+
"hosts": ["vault.sliccy.ai"],
|
|
706
708
|
"schemes": ["https", "http"],
|
|
707
709
|
"innerSchemes": ["blob", "filesystem", "view-source"],
|
|
708
710
|
"anySchemes": ["devtools"],
|
|
@@ -718,15 +720,23 @@
|
|
|
718
720
|
"six": {
|
|
719
721
|
"roots": {
|
|
720
722
|
"macos": {
|
|
721
|
-
"base": {
|
|
723
|
+
"base": {
|
|
724
|
+
"home": ["Library", "Application Support"]
|
|
725
|
+
},
|
|
722
726
|
"path": ["Slicc", "profiles"]
|
|
723
727
|
},
|
|
724
728
|
"linux": {
|
|
725
|
-
"base": {
|
|
729
|
+
"base": {
|
|
730
|
+
"env": "XDG_STATE_HOME",
|
|
731
|
+
"home": [".local", "state"]
|
|
732
|
+
},
|
|
726
733
|
"path": ["slicc", "profiles"]
|
|
727
734
|
},
|
|
728
735
|
"windows": {
|
|
729
|
-
"base": {
|
|
736
|
+
"base": {
|
|
737
|
+
"env": "LOCALAPPDATA",
|
|
738
|
+
"home": ["AppData", "Local"]
|
|
739
|
+
},
|
|
730
740
|
"path": ["Slicc", "profiles"]
|
|
731
741
|
}
|
|
732
742
|
},
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@ai-ecoverse/slicc-browsers",
|
|
3
|
-
"version": "1.
|
|
3
|
+
"version": "1.5.0",
|
|
4
4
|
"description": "SLICC's shared browser catalog, JSON schemas and discovery conformance corpus",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"license": "Apache-2.0",
|
|
@@ -27,6 +27,7 @@
|
|
|
27
27
|
"./corpus.json": "./corpus.json",
|
|
28
28
|
"./protected.json": "./protected.json",
|
|
29
29
|
"./protected.mjs": "./protected.mjs",
|
|
30
|
+
"./seven.mjs": "./seven.mjs",
|
|
30
31
|
"./schema/catalog.schema.json": "./schema/catalog.schema.json",
|
|
31
32
|
"./schema/browsers.schema.json": "./schema/browsers.schema.json",
|
|
32
33
|
"./schema/corpus.schema.json": "./schema/corpus.schema.json",
|
|
@@ -38,6 +39,7 @@
|
|
|
38
39
|
"corpus.json",
|
|
39
40
|
"protected.json",
|
|
40
41
|
"protected.mjs",
|
|
42
|
+
"seven.mjs",
|
|
41
43
|
"schema"
|
|
42
44
|
],
|
|
43
45
|
"scripts": {
|
|
@@ -54,7 +56,7 @@
|
|
|
54
56
|
"release": "semantic-release"
|
|
55
57
|
},
|
|
56
58
|
"devDependencies": {
|
|
57
|
-
"@ai-ecoverse/slicc-shared-web": "1.13.
|
|
59
|
+
"@ai-ecoverse/slicc-shared-web": "1.13.1",
|
|
58
60
|
"@biomejs/biome": "2.5.15",
|
|
59
61
|
"ajv": "8.20.0",
|
|
60
62
|
"ajv-formats": "3.0.1",
|
package/protected.json
CHANGED
|
@@ -2,140 +2,568 @@
|
|
|
2
2
|
"schema": 1,
|
|
3
3
|
"origins": ["http://127.0.0.1:5710", "https://seven.example.test"],
|
|
4
4
|
"urls": [
|
|
5
|
-
{
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
{
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
{
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
{
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
{
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
{
|
|
26
|
-
|
|
5
|
+
{
|
|
6
|
+
"url": "https://seven.sliccy.ai/",
|
|
7
|
+
"protected": true
|
|
8
|
+
},
|
|
9
|
+
{
|
|
10
|
+
"url": "https://seven.sliccy.ai",
|
|
11
|
+
"protected": true
|
|
12
|
+
},
|
|
13
|
+
{
|
|
14
|
+
"url": "https://seven.sliccy.ai/index.html?x=1#y",
|
|
15
|
+
"protected": true
|
|
16
|
+
},
|
|
17
|
+
{
|
|
18
|
+
"url": "https://SEVEN.SLICCY.AI/",
|
|
19
|
+
"protected": true
|
|
20
|
+
},
|
|
21
|
+
{
|
|
22
|
+
"url": "https://seven.sliccy.ai:443/",
|
|
23
|
+
"protected": true
|
|
24
|
+
},
|
|
25
|
+
{
|
|
26
|
+
"url": "https://seven.sliccy.ai:8443/",
|
|
27
|
+
"protected": true
|
|
28
|
+
},
|
|
29
|
+
{
|
|
30
|
+
"url": "http://seven.sliccy.ai/",
|
|
31
|
+
"protected": true
|
|
32
|
+
},
|
|
33
|
+
{
|
|
34
|
+
"url": "https://main--seven.sliccy.ai/",
|
|
35
|
+
"protected": true
|
|
36
|
+
},
|
|
37
|
+
{
|
|
38
|
+
"url": "https://www.sliccy.ai/",
|
|
39
|
+
"protected": true
|
|
40
|
+
},
|
|
41
|
+
{
|
|
42
|
+
"url": "https://vault.sliccy.ai/",
|
|
43
|
+
"protected": true
|
|
44
|
+
},
|
|
45
|
+
{
|
|
46
|
+
"url": "https://VAULT.sliccy.ai:443/unlock?x=1",
|
|
47
|
+
"protected": true
|
|
48
|
+
},
|
|
49
|
+
{
|
|
50
|
+
"url": "http://vault.sliccy.ai./",
|
|
51
|
+
"protected": true
|
|
52
|
+
},
|
|
53
|
+
{
|
|
54
|
+
"url": "blob:https://vault.sliccy.ai/0b9e0f6c",
|
|
55
|
+
"protected": true
|
|
56
|
+
},
|
|
57
|
+
{
|
|
58
|
+
"url": "https://vault.sliccy.ai.example/",
|
|
59
|
+
"protected": false
|
|
60
|
+
},
|
|
61
|
+
{
|
|
62
|
+
"url": "https://vault-sliccy.ai/",
|
|
63
|
+
"protected": false
|
|
64
|
+
},
|
|
65
|
+
{
|
|
66
|
+
"url": "https://sliccy.ai/",
|
|
67
|
+
"protected": true
|
|
68
|
+
},
|
|
69
|
+
{
|
|
70
|
+
"url": "https://a.b.sliccy.ai/",
|
|
71
|
+
"protected": true
|
|
72
|
+
},
|
|
73
|
+
{
|
|
74
|
+
"url": "https://seven.sliccy.ai./",
|
|
75
|
+
"protected": true
|
|
76
|
+
},
|
|
77
|
+
{
|
|
78
|
+
"url": "https://user:secret@seven.sliccy.ai/",
|
|
79
|
+
"protected": true
|
|
80
|
+
},
|
|
81
|
+
{
|
|
82
|
+
"url": "https:\\\\seven.sliccy.ai\\x",
|
|
83
|
+
"protected": true
|
|
84
|
+
},
|
|
85
|
+
{
|
|
86
|
+
"url": " https://seven.sliccy.ai/ ",
|
|
87
|
+
"protected": true
|
|
88
|
+
},
|
|
89
|
+
{
|
|
90
|
+
"url": "ht\ttps://seven.sli\nccy.ai/",
|
|
91
|
+
"protected": true
|
|
92
|
+
},
|
|
93
|
+
{
|
|
94
|
+
"url": "https:seven.sliccy.ai",
|
|
95
|
+
"protected": true
|
|
96
|
+
},
|
|
97
|
+
{
|
|
98
|
+
"url": "https:///seven.sliccy.ai/",
|
|
99
|
+
"protected": true
|
|
100
|
+
},
|
|
101
|
+
{
|
|
102
|
+
"url": "https://seven%2Esliccy%2Eai/",
|
|
103
|
+
"protected": true
|
|
104
|
+
},
|
|
105
|
+
{
|
|
106
|
+
"url": "https://seven。sliccy。ai/",
|
|
107
|
+
"protected": true
|
|
108
|
+
},
|
|
109
|
+
{
|
|
110
|
+
"url": "https://ｓｅｖｅｎ.sliccy.ai/",
|
|
111
|
+
"protected": true
|
|
112
|
+
},
|
|
113
|
+
{
|
|
114
|
+
"url": "https://seven.sliccy.ai/",
|
|
115
|
+
"protected": true
|
|
116
|
+
},
|
|
27
117
|
{
|
|
28
118
|
"url": "blob:https://seven.sliccy.ai/0b9e0f6c-1f0e-4c1a-9a43-5d3f6e2c7a10",
|
|
29
119
|
"protected": true
|
|
30
120
|
},
|
|
31
|
-
{
|
|
32
|
-
|
|
33
|
-
|
|
121
|
+
{
|
|
122
|
+
"url": "filesystem:https://seven.sliccy.ai/temporary/notes.txt",
|
|
123
|
+
"protected": true
|
|
124
|
+
},
|
|
125
|
+
{
|
|
126
|
+
"url": "view-source:https://seven.sliccy.ai/",
|
|
127
|
+
"protected": true
|
|
128
|
+
},
|
|
129
|
+
{
|
|
130
|
+
"url": "view-source:blob:https://seven.sliccy.ai/0b9e0f6c",
|
|
131
|
+
"protected": true
|
|
132
|
+
},
|
|
34
133
|
{
|
|
35
134
|
"url": "devtools://devtools/bundled/inspector.html?ws=127.0.0.1:5711/devtools/page/AB12",
|
|
36
135
|
"protected": true
|
|
37
136
|
},
|
|
38
|
-
{
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
{
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
{
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
{
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
{
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
{
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
{
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
{
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
{
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
{
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
{
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
137
|
+
{
|
|
138
|
+
"url": "http://127.0.0.1:5710/",
|
|
139
|
+
"protected": true
|
|
140
|
+
},
|
|
141
|
+
{
|
|
142
|
+
"url": "http://127.0.0.1:5710",
|
|
143
|
+
"protected": true
|
|
144
|
+
},
|
|
145
|
+
{
|
|
146
|
+
"url": "http://2130706433:5710/",
|
|
147
|
+
"protected": true
|
|
148
|
+
},
|
|
149
|
+
{
|
|
150
|
+
"url": "http://0x7f.1:5710/",
|
|
151
|
+
"protected": true
|
|
152
|
+
},
|
|
153
|
+
{
|
|
154
|
+
"url": "blob:http://127.0.0.1:5710/0b9e0f6c",
|
|
155
|
+
"protected": true
|
|
156
|
+
},
|
|
157
|
+
{
|
|
158
|
+
"url": "https://seven.example.test/",
|
|
159
|
+
"protected": true
|
|
160
|
+
},
|
|
161
|
+
{
|
|
162
|
+
"url": "https://SEVEN.example.test:443/x",
|
|
163
|
+
"protected": true
|
|
164
|
+
},
|
|
165
|
+
{
|
|
166
|
+
"url": "https://seven.example.test./",
|
|
167
|
+
"protected": true
|
|
168
|
+
},
|
|
169
|
+
{
|
|
170
|
+
"url": "http://localhost:5710/",
|
|
171
|
+
"protected": false
|
|
172
|
+
},
|
|
173
|
+
{
|
|
174
|
+
"url": "http://127.0.0.1:5711/",
|
|
175
|
+
"protected": false
|
|
176
|
+
},
|
|
177
|
+
{
|
|
178
|
+
"url": "https://127.0.0.1:5710/",
|
|
179
|
+
"protected": false
|
|
180
|
+
},
|
|
181
|
+
{
|
|
182
|
+
"url": "http://127.0.0.1/",
|
|
183
|
+
"protected": false
|
|
184
|
+
},
|
|
185
|
+
{
|
|
186
|
+
"url": "http://seven.example.test/",
|
|
187
|
+
"protected": false
|
|
188
|
+
},
|
|
189
|
+
{
|
|
190
|
+
"url": "https://seven.example.test:8443/",
|
|
191
|
+
"protected": false
|
|
192
|
+
},
|
|
193
|
+
{
|
|
194
|
+
"url": "https://x.seven.example.test/",
|
|
195
|
+
"protected": false
|
|
196
|
+
},
|
|
197
|
+
{
|
|
198
|
+
"url": "https://example.test/",
|
|
199
|
+
"protected": false
|
|
200
|
+
},
|
|
201
|
+
{
|
|
202
|
+
"url": "https://sliccy.ai.example.com/",
|
|
203
|
+
"protected": false
|
|
204
|
+
},
|
|
205
|
+
{
|
|
206
|
+
"url": "https://notsliccy.ai/",
|
|
207
|
+
"protected": false
|
|
208
|
+
},
|
|
209
|
+
{
|
|
210
|
+
"url": "https://seven.sliccy.ai.example/",
|
|
211
|
+
"protected": false
|
|
212
|
+
},
|
|
213
|
+
{
|
|
214
|
+
"url": "https://sliccy.aix/",
|
|
215
|
+
"protected": false
|
|
216
|
+
},
|
|
217
|
+
{
|
|
218
|
+
"url": "https://sliccy-ai.example/",
|
|
219
|
+
"protected": false
|
|
220
|
+
},
|
|
221
|
+
{
|
|
222
|
+
"url": "https://example.com/?next=https://seven.sliccy.ai/",
|
|
223
|
+
"protected": false
|
|
224
|
+
},
|
|
225
|
+
{
|
|
226
|
+
"url": "https://example.com/#https://seven.sliccy.ai/",
|
|
227
|
+
"protected": false
|
|
228
|
+
},
|
|
229
|
+
{
|
|
230
|
+
"url": "https://seven.sliccy.ai@example.com/",
|
|
231
|
+
"protected": false
|
|
232
|
+
},
|
|
233
|
+
{
|
|
234
|
+
"url": "wss://seven.sliccy.ai/",
|
|
235
|
+
"protected": false
|
|
236
|
+
},
|
|
237
|
+
{
|
|
238
|
+
"url": "ftp://seven.sliccy.ai/",
|
|
239
|
+
"protected": false
|
|
240
|
+
},
|
|
241
|
+
{
|
|
242
|
+
"url": "http://5173.kernel.localhost/",
|
|
243
|
+
"protected": false
|
|
244
|
+
},
|
|
245
|
+
{
|
|
246
|
+
"url": "http://seven.sliccy.ai.kernel.localhost/",
|
|
247
|
+
"protected": false
|
|
248
|
+
},
|
|
249
|
+
{
|
|
250
|
+
"url": "https://example.com/",
|
|
251
|
+
"protected": false
|
|
252
|
+
},
|
|
253
|
+
{
|
|
254
|
+
"url": "about:blank",
|
|
255
|
+
"protected": false
|
|
256
|
+
},
|
|
257
|
+
{
|
|
258
|
+
"url": "about:srcdoc",
|
|
259
|
+
"protected": false
|
|
260
|
+
},
|
|
261
|
+
{
|
|
262
|
+
"url": "data:text/html,<a href=https://seven.sliccy.ai/>x</a>",
|
|
263
|
+
"protected": false
|
|
264
|
+
},
|
|
265
|
+
{
|
|
266
|
+
"url": "blob:null/0b9e0f6c",
|
|
267
|
+
"protected": false
|
|
268
|
+
},
|
|
269
|
+
{
|
|
270
|
+
"url": "blob:https://example.com/0b9e0f6c",
|
|
271
|
+
"protected": false
|
|
272
|
+
},
|
|
273
|
+
{
|
|
274
|
+
"url": "filesystem:https://example.com/temporary/x",
|
|
275
|
+
"protected": false
|
|
276
|
+
},
|
|
277
|
+
{
|
|
278
|
+
"url": "view-source:https://example.com/",
|
|
279
|
+
"protected": false
|
|
280
|
+
},
|
|
281
|
+
{
|
|
282
|
+
"url": "javascript:location='https://seven.sliccy.ai/'",
|
|
283
|
+
"protected": false
|
|
284
|
+
},
|
|
285
|
+
{
|
|
286
|
+
"url": "chrome://version/",
|
|
287
|
+
"protected": false
|
|
288
|
+
},
|
|
289
|
+
{
|
|
290
|
+
"url": "chrome-extension://abcdefghijklmnopabcdefghijklmnop/page.html",
|
|
291
|
+
"protected": false
|
|
292
|
+
},
|
|
293
|
+
{
|
|
294
|
+
"url": "file:///tmp/seven.sliccy.ai/index.html",
|
|
295
|
+
"protected": false
|
|
296
|
+
},
|
|
297
|
+
{
|
|
298
|
+
"url": "",
|
|
299
|
+
"protected": false
|
|
300
|
+
},
|
|
301
|
+
{
|
|
302
|
+
"url": "https://",
|
|
303
|
+
"protected": false
|
|
304
|
+
},
|
|
305
|
+
{
|
|
306
|
+
"url": "seven.sliccy.ai",
|
|
307
|
+
"protected": false
|
|
308
|
+
},
|
|
309
|
+
{
|
|
310
|
+
"url": "not a url",
|
|
311
|
+
"protected": false
|
|
312
|
+
},
|
|
313
|
+
{
|
|
314
|
+
"url": "https://vault-preview.sliccy.ai/",
|
|
315
|
+
"protected": true
|
|
316
|
+
},
|
|
317
|
+
{
|
|
318
|
+
"url": "https://vault-feature-x.sliccy.ai/",
|
|
319
|
+
"protected": true
|
|
320
|
+
}
|
|
82
321
|
],
|
|
83
322
|
"targets": [
|
|
84
|
-
{
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
{
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
|
|
92
|
-
{
|
|
93
|
-
|
|
94
|
-
|
|
95
|
-
|
|
96
|
-
|
|
97
|
-
{
|
|
98
|
-
|
|
99
|
-
|
|
100
|
-
|
|
101
|
-
{
|
|
102
|
-
|
|
103
|
-
|
|
104
|
-
|
|
105
|
-
|
|
323
|
+
{
|
|
324
|
+
"url": "https://seven.sliccy.ai/",
|
|
325
|
+
"protected": true
|
|
326
|
+
},
|
|
327
|
+
{
|
|
328
|
+
"url": "https://vault.sliccy.ai/",
|
|
329
|
+
"protected": true
|
|
330
|
+
},
|
|
331
|
+
{
|
|
332
|
+
"url": "about:blank",
|
|
333
|
+
"opener": "protected",
|
|
334
|
+
"protected": true
|
|
335
|
+
},
|
|
336
|
+
{
|
|
337
|
+
"url": "https://example.com/",
|
|
338
|
+
"protected": false
|
|
339
|
+
},
|
|
340
|
+
{
|
|
341
|
+
"url": "https://example.com/",
|
|
342
|
+
"previous": true,
|
|
343
|
+
"protected": false
|
|
344
|
+
},
|
|
345
|
+
{
|
|
346
|
+
"url": "https://example.com/",
|
|
347
|
+
"opener": "protected",
|
|
348
|
+
"protected": false
|
|
349
|
+
},
|
|
350
|
+
{
|
|
351
|
+
"url": "about:blank",
|
|
352
|
+
"protected": false
|
|
353
|
+
},
|
|
354
|
+
{
|
|
355
|
+
"url": "about:blank",
|
|
356
|
+
"opener": "unprotected",
|
|
357
|
+
"protected": false
|
|
358
|
+
},
|
|
359
|
+
{
|
|
360
|
+
"url": "about:blank",
|
|
361
|
+
"opener": "protected",
|
|
362
|
+
"protected": true
|
|
363
|
+
},
|
|
364
|
+
{
|
|
365
|
+
"url": "about:blank",
|
|
366
|
+
"opener": "unknown",
|
|
367
|
+
"protected": true
|
|
368
|
+
},
|
|
369
|
+
{
|
|
370
|
+
"url": "about:blank",
|
|
371
|
+
"previous": true,
|
|
372
|
+
"protected": true
|
|
373
|
+
},
|
|
374
|
+
{
|
|
375
|
+
"url": "about:blank",
|
|
376
|
+
"previous": true,
|
|
377
|
+
"opener": "unprotected",
|
|
378
|
+
"protected": true
|
|
379
|
+
},
|
|
380
|
+
{
|
|
381
|
+
"url": "about:blank#top",
|
|
382
|
+
"previous": true,
|
|
383
|
+
"protected": true
|
|
384
|
+
},
|
|
385
|
+
{
|
|
386
|
+
"url": "about:blank?x=1",
|
|
387
|
+
"opener": "protected",
|
|
388
|
+
"protected": true
|
|
389
|
+
},
|
|
390
|
+
{
|
|
391
|
+
"url": "about:srcdoc",
|
|
392
|
+
"previous": true,
|
|
393
|
+
"protected": true
|
|
394
|
+
},
|
|
395
|
+
{
|
|
396
|
+
"url": "about:srcdoc",
|
|
397
|
+
"opener": "unprotected",
|
|
398
|
+
"protected": false
|
|
399
|
+
},
|
|
400
|
+
{
|
|
401
|
+
"url": "",
|
|
402
|
+
"opener": "protected",
|
|
403
|
+
"protected": true
|
|
404
|
+
},
|
|
405
|
+
{
|
|
406
|
+
"url": "",
|
|
407
|
+
"protected": false
|
|
408
|
+
},
|
|
409
|
+
{
|
|
410
|
+
"url": "about:version",
|
|
411
|
+
"previous": true,
|
|
412
|
+
"protected": false
|
|
413
|
+
},
|
|
414
|
+
{
|
|
415
|
+
"url": "data:text/html,x",
|
|
416
|
+
"previous": true,
|
|
417
|
+
"protected": false
|
|
418
|
+
},
|
|
419
|
+
{
|
|
420
|
+
"url": "blob:https://seven.sliccy.ai/0b9e0f6c",
|
|
421
|
+
"protected": true
|
|
422
|
+
},
|
|
423
|
+
{
|
|
424
|
+
"url": "devtools://devtools/bundled/devtools_app.html",
|
|
425
|
+
"protected": true
|
|
426
|
+
},
|
|
427
|
+
{
|
|
428
|
+
"url": "http://127.0.0.1:5710/index.html",
|
|
429
|
+
"protected": true
|
|
430
|
+
},
|
|
431
|
+
{
|
|
432
|
+
"url": "http://127.0.0.1:5711/index.html",
|
|
433
|
+
"previous": true,
|
|
434
|
+
"protected": false
|
|
435
|
+
}
|
|
106
436
|
],
|
|
107
437
|
"cookieDomains": [
|
|
108
|
-
{
|
|
109
|
-
|
|
110
|
-
|
|
111
|
-
|
|
112
|
-
{
|
|
113
|
-
|
|
114
|
-
|
|
115
|
-
|
|
116
|
-
{
|
|
117
|
-
|
|
118
|
-
|
|
119
|
-
|
|
120
|
-
{
|
|
121
|
-
|
|
122
|
-
|
|
123
|
-
|
|
124
|
-
{
|
|
125
|
-
|
|
126
|
-
|
|
438
|
+
{
|
|
439
|
+
"domain": "sliccy.ai",
|
|
440
|
+
"protected": true
|
|
441
|
+
},
|
|
442
|
+
{
|
|
443
|
+
"domain": ".sliccy.ai",
|
|
444
|
+
"protected": true
|
|
445
|
+
},
|
|
446
|
+
{
|
|
447
|
+
"domain": "seven.sliccy.ai",
|
|
448
|
+
"protected": true
|
|
449
|
+
},
|
|
450
|
+
{
|
|
451
|
+
"domain": "vault.sliccy.ai",
|
|
452
|
+
"protected": true
|
|
453
|
+
},
|
|
454
|
+
{
|
|
455
|
+
"domain": ".www.sliccy.ai",
|
|
456
|
+
"protected": true
|
|
457
|
+
},
|
|
458
|
+
{
|
|
459
|
+
"domain": "SLICCY.AI",
|
|
460
|
+
"protected": true
|
|
461
|
+
},
|
|
462
|
+
{
|
|
463
|
+
"domain": "sliccy.ai.",
|
|
464
|
+
"protected": true
|
|
465
|
+
},
|
|
466
|
+
{
|
|
467
|
+
"domain": "a.b.sliccy.ai",
|
|
468
|
+
"protected": true
|
|
469
|
+
},
|
|
470
|
+
{
|
|
471
|
+
"domain": "127.0.0.1",
|
|
472
|
+
"protected": true
|
|
473
|
+
},
|
|
474
|
+
{
|
|
475
|
+
"domain": "seven.example.test",
|
|
476
|
+
"protected": true
|
|
477
|
+
},
|
|
478
|
+
{
|
|
479
|
+
"domain": ".example.test",
|
|
480
|
+
"protected": true
|
|
481
|
+
},
|
|
482
|
+
{
|
|
483
|
+
"domain": "x.seven.example.test",
|
|
484
|
+
"protected": false
|
|
485
|
+
},
|
|
486
|
+
{
|
|
487
|
+
"domain": "other.example.test",
|
|
488
|
+
"protected": false
|
|
489
|
+
},
|
|
490
|
+
{
|
|
491
|
+
"domain": "notsliccy.ai",
|
|
492
|
+
"protected": false
|
|
493
|
+
},
|
|
494
|
+
{
|
|
495
|
+
"domain": "sliccy.ai.example",
|
|
496
|
+
"protected": false
|
|
497
|
+
},
|
|
498
|
+
{
|
|
499
|
+
"domain": "localhost",
|
|
500
|
+
"protected": false
|
|
501
|
+
},
|
|
502
|
+
{
|
|
503
|
+
"domain": "5173.kernel.localhost",
|
|
504
|
+
"protected": false
|
|
505
|
+
},
|
|
506
|
+
{
|
|
507
|
+
"domain": "example.com",
|
|
508
|
+
"protected": false
|
|
509
|
+
},
|
|
510
|
+
{
|
|
511
|
+
"domain": "",
|
|
512
|
+
"protected": false
|
|
513
|
+
},
|
|
514
|
+
{
|
|
515
|
+
"domain": ".",
|
|
516
|
+
"protected": false
|
|
517
|
+
}
|
|
127
518
|
],
|
|
128
519
|
"storageKeys": [
|
|
129
|
-
{
|
|
130
|
-
|
|
131
|
-
|
|
132
|
-
|
|
133
|
-
{
|
|
134
|
-
|
|
135
|
-
|
|
136
|
-
|
|
137
|
-
{
|
|
138
|
-
|
|
139
|
-
|
|
520
|
+
{
|
|
521
|
+
"key": "https://seven.sliccy.ai/",
|
|
522
|
+
"protected": true
|
|
523
|
+
},
|
|
524
|
+
{
|
|
525
|
+
"key": "https://sliccy.ai/",
|
|
526
|
+
"protected": true
|
|
527
|
+
},
|
|
528
|
+
{
|
|
529
|
+
"key": "https://vault.sliccy.ai/",
|
|
530
|
+
"protected": true
|
|
531
|
+
},
|
|
532
|
+
{
|
|
533
|
+
"key": "http://127.0.0.1:5710/",
|
|
534
|
+
"protected": true
|
|
535
|
+
},
|
|
536
|
+
{
|
|
537
|
+
"key": "https://widget.example/^0https://sliccy.ai",
|
|
538
|
+
"protected": true
|
|
539
|
+
},
|
|
540
|
+
{
|
|
541
|
+
"key": "https://seven.sliccy.ai/^31",
|
|
542
|
+
"protected": true
|
|
543
|
+
},
|
|
544
|
+
{
|
|
545
|
+
"key": "https://seven.sliccy.ai/^112345^267890",
|
|
546
|
+
"protected": true
|
|
547
|
+
},
|
|
548
|
+
{
|
|
549
|
+
"key": "https://example.com/",
|
|
550
|
+
"protected": false
|
|
551
|
+
},
|
|
552
|
+
{
|
|
553
|
+
"key": "https://example.com/^0https://example.org",
|
|
554
|
+
"protected": false
|
|
555
|
+
},
|
|
556
|
+
{
|
|
557
|
+
"key": "https://example.com/^112345^2https://sliccy.ai",
|
|
558
|
+
"protected": false
|
|
559
|
+
},
|
|
560
|
+
{
|
|
561
|
+
"key": "http://127.0.0.1:5711/",
|
|
562
|
+
"protected": false
|
|
563
|
+
},
|
|
564
|
+
{
|
|
565
|
+
"key": "",
|
|
566
|
+
"protected": false
|
|
567
|
+
}
|
|
140
568
|
]
|
|
141
569
|
}
|
package/protected.mjs
CHANGED
|
@@ -39,6 +39,7 @@ export function protectedOrigins(rules, extraOrigins = []) {
|
|
|
39
39
|
if (!u) return false;
|
|
40
40
|
const s = scheme(u);
|
|
41
41
|
if (rules.anySchemes.includes(s)) return true;
|
|
42
|
+
if (rules.schemes.includes(s) && rules.hosts.includes(hostOf(u))) return true;
|
|
42
43
|
if (rules.schemes.includes(s) && rules.domains.some((d) => under(hostOf(u), d))) return true;
|
|
43
44
|
const o = originOf(u);
|
|
44
45
|
return o !== null && extra.includes(o);
|
|
@@ -65,7 +66,7 @@ export function protectedOrigins(rules, extraOrigins = []) {
|
|
|
65
66
|
if (d.endsWith('.')) d = d.slice(0, -1);
|
|
66
67
|
if (d === '') return false;
|
|
67
68
|
if (rules.domains.some((x) => under(d, x))) return true;
|
|
68
|
-
return [...rules.domains, ...extraHosts].some((h) => under(h, d));
|
|
69
|
+
return [...rules.domains, ...rules.hosts, ...extraHosts].some((h) => under(h, d));
|
|
69
70
|
};
|
|
70
71
|
|
|
71
72
|
const storageKey = (key) => {
|
|
@@ -150,6 +150,7 @@
|
|
|
150
150
|
"originScheme": { "const": "https" },
|
|
151
151
|
"originHostPattern": { "type": "string", "format": "regex" },
|
|
152
152
|
"excludedLabels": { "$ref": "#/$defs/names" },
|
|
153
|
+
"excludedLabelPrefixes": { "$ref": "#/$defs/names", "default": [] },
|
|
153
154
|
"sitePattern": { "$ref": "#/$defs/name" },
|
|
154
155
|
"switches": { "type": "array", "items": { "type": "string", "pattern": "^--" } },
|
|
155
156
|
"disabledFeatures": { "$ref": "#/$defs/names" },
|
|
@@ -173,7 +174,15 @@
|
|
|
173
174
|
"protectedOrigins": {
|
|
174
175
|
"type": "object",
|
|
175
176
|
"additionalProperties": false,
|
|
176
|
-
"required": [
|
|
177
|
+
"required": [
|
|
178
|
+
"domains",
|
|
179
|
+
"hosts",
|
|
180
|
+
"schemes",
|
|
181
|
+
"innerSchemes",
|
|
182
|
+
"anySchemes",
|
|
183
|
+
"inheriting",
|
|
184
|
+
"refusal"
|
|
185
|
+
],
|
|
177
186
|
"properties": {
|
|
178
187
|
"domains": {
|
|
179
188
|
"type": "array",
|
|
@@ -184,6 +193,14 @@
|
|
|
184
193
|
"pattern": "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+$"
|
|
185
194
|
}
|
|
186
195
|
},
|
|
196
|
+
"hosts": {
|
|
197
|
+
"type": "array",
|
|
198
|
+
"uniqueItems": true,
|
|
199
|
+
"items": {
|
|
200
|
+
"type": "string",
|
|
201
|
+
"pattern": "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+$"
|
|
202
|
+
}
|
|
203
|
+
},
|
|
187
204
|
"schemes": { "$ref": "#/$defs/schemes", "type": "array", "minItems": 1 },
|
|
188
205
|
"innerSchemes": { "$ref": "#/$defs/schemes" },
|
|
189
206
|
"anySchemes": { "$ref": "#/$defs/schemes" },
|