Skip to content

Commit 4345083

Browse files
HainishHainish
authored
Forbid HTTPS rewrites in relaxng (EFForg#17088)
1 parent ff44ff1 commit 4345083

File tree

4 files changed

+3545
-3643
lines changed

4 files changed

+3545
-3643
lines changed

‎test/validations/relaxng/run.py‎

Lines changed: 13 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -3,62 +3,43 @@
33

44
import argparse
55
import glob
6-
import hashlib
76
import os
87

98
from lxml import etree
109

10+
# commandline arguments parsing (nobody use it, though)
1111
parser = argparse.ArgumentParser(description="Validate rulesets against relaxng schema.xml")
1212
parser.add_argument("--source_dir", default="src/chrome/content/rules")
13-
parser.add_argument("--https2https_whitelist", default="utils/ruleset-whitelist.csv")
1413

1514
args = parser.parse_args()
1615

16+
# XML ruleset files
1717
files = glob.glob(os.path.join(args.source_dir, "*.xml"))
1818

19-
relaxng_doc = etree.parse("test/validations/relaxng/schema.xml")
19+
# read the schema file
20+
relaxng_doc = etree.parse('test/validations/relaxng/schema.xml')
2021
relaxng = etree.RelaxNG(relaxng_doc)
2122

22-
relaxng_doc_https2https = etree.parse("test/validations/relaxng/schema_https2https.xml")
23-
relaxng_https2https = etree.RelaxNG(relaxng_doc_https2https)
24-
25-
https2https_whitelist = {}
26-
27-
with open(args.https2https_whitelist) as f:
28-
f.readline()
29-
for line in f:
30-
fileHash, _, _, fileSkip, fileName = line.strip().split(",")
31-
if fileSkip == "1":
32-
https2https_whitelist[fileName] = fileHash
33-
3423
exit_code = 0
3524

3625
print("Validation of rulesets against relaxng schema.xml begins...")
3726

3827
for filename in sorted(files):
3928
tree = etree.parse(filename)
4029

41-
basename = os.path.basename(filename)
42-
43-
ruleset_relaxng = relaxng
44-
45-
if basename in https2https_whitelist:
46-
with open(filename, "rb") as file:
47-
if hashlib.sha256(file.read()).hexdigest() == https2https_whitelist[basename]:
48-
ruleset_relaxng = relaxng_https2https
49-
50-
if not ruleset_relaxng.validate(tree):
30+
if not relaxng.validate(tree):
5131
exit_code = 1
52-
e = ruleset_relaxng.error_log.last_error
32+
e = relaxng.error_log.last_error
5333
print("{} {}:{}:{}: {}".format(e.level_name, e.filename, e.line, e.column, e.message))
5434

5535
if exit_code == 0:
56-
print("Validation of rulesets against relaxng schema.xml succeeded.")
36+
message = "Validation of rulesets against relaxng schema.xml succeeded."
5737
else:
58-
print("Validation of rulesets against relaxng schema.xml failed.\n\n" \
59-
"Two very common reasons for this are the following:\n" \
60-
" - missing caret (^) in \"from\" attribute: it should be \"^http:\" and not \"http:\"\n" \
61-
" - missing trailing slashes in \"from\" or \"to\" when specifying full hostnames: \n" \
62-
" it should be \"https://eff.org/\" and not \"https://eff.org\"\n")
38+
message = "\nTwo very common reasons for this are the following:\n" \
39+
" - missing caret (^) in 'from' attribute: it should be \"^http:\" and not \"http:\"\n" \
40+
" - missing trailing slashes in 'from' or 'to' when specifying full hostnames: \n" \
41+
" it should be \"https://eff.org/\" and not \"https://eff.org\"\n\n" \
42+
"Validation of rulesets against relaxng schema.xml failed."
6343

44+
print(message)
6445
exit(exit_code)

‎test/validations/relaxng/schema_https2https.xml‎

Lines changed: 0 additions & 79 deletions
This file was deleted.

‎utils/ruleset-whitelist-cleanup.sh‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -17,20 +17,20 @@ cd src/chrome/content/rules
1717
WLIST=../../../../utils/ruleset-whitelist.csv
1818
DELIM=","
1919

20-
(read; while IFS=$DELIM read listed_hash coverage_flag fetch_flag https_flag file; do
20+
(read; while IFS=$DELIM read listed_hash coverage_flag fetch_flag file; do
2121
display_hash=$(echo $listed_hash | cut -c-7)
2222
# Remove those that no longer exist
2323
if [ ! -f $file ]; then
24-
sed -i "/$listed_hash$DELIM$coverage_flag$DELIM$fetch_flag$DELIM$https_flag$DELIM$file/d" $WLIST
24+
sed -i "/$listed_hash$DELIM$coverage_flag$DELIM$fetch_flag$DELIM$file/d" $WLIST
2525
echo >&2 "Removed $file ($display_hash): file no longer exists"
26-
elif [ "$coverage_flag" == "0" -a "$fetch_flag" == "0" -a "$https_flag" == "0" ]; then
27-
sed -i "/$listed_hash$DELIM$coverage_flag$DELIM$fetch_flag$DELIM$https_flag$DELIM$file/d" $WLIST
26+
elif [ "$coverage_flag" == "0" -a "$fetch_flag" == "0" ]; then
27+
sed -i "/$listed_hash$DELIM$coverage_flag$DELIM$fetch_flag$DELIM$file/d" $WLIST
2828
echo >&2 "Removed $file ($display_hash): obsolete, all flags set to false"
2929
else
3030
actual_hash=$(sha256sum $file | cut -c-64)
3131
# Remove those whose hashes do not match
3232
if [ "$listed_hash" != "$actual_hash" ]; then
33-
sed -i "/$listed_hash$DELIM$coverage_flag$DELIM$fetch_flag$DELIM$https_flag$DELIM$file/d" $WLIST
33+
sed -i "/$listed_hash$DELIM$coverage_flag$DELIM$fetch_flag$DELIM$file/d" $WLIST
3434
echo >&2 "Removed $file ($display_hash): listed hash does not match actual hash"
3535
fi
3636
fi

0 commit comments

Comments
 (0)