Forcibly neutralize lazy loading attributes when scripting is disabled.

This commit is contained in:
hackademix 2024-08-22 21:55:23 +02:00
parent 039003e94c
commit f5cf60b4a9
No known key found for this signature in database
GPG Key ID: 231A83AFDA9C2434
1 changed files with 37 additions and 0 deletions

View File

@ -46,6 +46,43 @@ function onScriptDisabled() {
}
}
{
// Force loading attributes to "eager", since CSP-based script blocking
// does not disable lazy loading as it should to address the privacy
// concerns mentioned in the specification.
// See https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/42805
const toEager = el => el.setAttribute("loading", "eager");
const toEagerAll = parent => [... parent.querySelectorAll("[loading=lazy]")].forEach(toEager);
toEagerAll(document);
if (document.readyState === "loading") {
const observer = new MutationObserver(records => {
for (const r of records) {
console.log(r);
switch(r.type) {
case "attributes":
if (r.attributeName === "loading") {
toEager(r.target);
}
break;
case "subtree":
toEagerAll(r.target);
break;
}
}
});
observer.observe(document.documentElement, {subtree: true, attributeFilter: ["loading"]});
addEventListener("DOMContentLoaded", e => {
toEagerAll(document);
observer.disconnect();
});
}
}
let eraser = {
tapped: null,
delKey: false,