pharpend/Vanillae
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

all this time i thought that it was the browser that was mentally disabled it turned out the mental disability was inside me all along

Browse Source 
======================
NACL mental disability
======================

NACL is mentally disabled and can't be loaded as an ES6 module. That is, it can't be
"imported" using

```js
import * as nacl from './path/to/nacl.js';
```

Instead you have to include it in a page. So we have a page called
`background.html`.

I naively tried this

```html
<script src="dist/jex_include/local-nacl-1.0.3/nacl.js"></script>
```

That of course didn't work because we live in hell.

I initially thought the problem was an invalid hash. No. Notes as I figure it
out:

    Trying to figure out why TweetNaCl isn't loading

    ok so the problem is not an invalid hash, it's something specific
    to nacl

    to have an inline script, its hash must be specified in
    manifest.json

    example (integrity key is not necessary, it is there purely for
    comment purposes)

         beginning of line
        V
        |        <script integrity="sha256-8T3dvQxHPNQvgxzCemw3KGUCM5RhknpCQF6pCcTdFTw=">console.log('bg-test-inline.js line 1!');
        |</script>

    newline is there for hash purposes

    this works if and only if
    'sha256-8T3dvQxHPNQvgxzCemw3KGUCM5RhknpCQF6pCcTdFTw=' is included
    in the manifest.json

    example (top level key):

         "content_security_policy" : "script-src 'self' 'sha256-8T3dvQxHPNQvgxzCemw3KGUCM5RhknpCQF6pCcTdFTw='; object-src 'self'",

    Absent that explicit allow, I get this error from Firefox:

        Content Security Policy: The page’s settings blocked the loading of a resource at inline (“script-src”).

    Refs:
        1. https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/content_security_policy
        2. https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Content_Security_Policy#inline_javascript

    If I include the same script as a file,

        <script src="bg-test-inline.js"></script>

    this works irrespective of if I specify it as allowable in the manifest

    nacl is just refusing to load

        Loading failed for the <script> with source “moz-extension://eafd6a74-b75b-4312-9a34-8087b68395e7/dist/jex_include/local-nacl-1.0.3/nacl.js”.

    I initially thought it was a hash problem, but it is not

    TweetNaCL doesn't work as an ES6 module, it works by destructively
    updating the window namespace.  This I think was necessary before
    ES6, and that behavior is retained either because of laziness or
    because of backward compatibility reasons.

    hmm

    so this just plainly doesn't work and i cannot figure out why

        <script src="dist/jex_include/local-nacl-1.0.3/nacl.js"></script>

I think it works if I do it in the popup window instead. Let's try

oh no

no

oh my god

i am so stupid

the problem was that i typed the url wrong

the package is "tweetnacl" not "nacl", and i also need /dist/ too

    <script src="dist/jex_include/local-tweetnacl-1.0.3/dist/nacl.js"></script>

that works

all this time i thought that it was the browser that was mentally disabled

it turned out the mental disability was inside me all along

alright well I discovered a potential future pitfall at least
This commit is contained in:
pharpend
2023-07-26 17:21:17 -06:00
parent d41f29aa1f
commit b680336ba4
10 changed files with 302 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
jrx/background.html
+77 -2
View File
@@ -5,8 +5,83 @@
<meta charset="utf-8"> <meta charset="utf-8">
</head> </head>
<body> <body>
<!-- including nacl here --> <!--
Trying to figure out why TweetNaCl isn't loading
ok so the problem is not an invalid hash, it's something specific
to nacl
to have an inline script, its hash must be specified in
manifest.json
example (integrity key is not necessary, it is there purely for
comment purposes)
beginning of line
V
| <script integrity="sha256-8T3dvQxHPNQvgxzCemw3KGUCM5RhknpCQF6pCcTdFTw=">console.log('bg-test-inline.js line 1!');
|</script>
newline is there for hash purposes
this works if and only if
'sha256-8T3dvQxHPNQvgxzCemw3KGUCM5RhknpCQF6pCcTdFTw=' is included
in the manifest.json
example (top level key):
"content_security_policy" : "script-src 'self' 'sha256-8T3dvQxHPNQvgxzCemw3KGUCM5RhknpCQF6pCcTdFTw='; object-src 'self'",
Absent that explicit allow, I get this error from Firefox:
Content Security Policy: The page’s settings blocked the loading of a resource at inline (“script-src”).
Refs:
1. https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/content_security_policy
2. https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Content_Security_Policy#inline_javascript
If I include the same script as a file,
<script src="bg-test-inline.js"></script>
this works irrespective of if I specify it as allowable in the manifest
nacl is just refusing to load
Loading failed for the <script> with source “moz-extension://eafd6a74-b75b-4312-9a34-8087b68395e7/dist/jex_include/local-nacl-1.0.3/nacl.js”.
I initially thought it was a hash problem, but it is not
TweetNaCL doesn't work as an ES6 module, it works by destructively
updating the window namespace. This I think was necessary before
ES6, and that behavior is retained either because of laziness or
because of backward compatibility reasons.
hmm
so this just plainly doesn't work and i cannot figure out why
<script src="dist/jex_include/local-nacl-1.0.3/nacl.js"></script> <script src="dist/jex_include/local-nacl-1.0.3/nacl.js"></script>
<script type="module" src="dist/background.js"></script>
oh my god
<script src="dist/jex_include/local-tweetnacl-1.0.3/dist/nacl.js"></script>
i got the url wrong
i hate myself
ok well glad we got that sorted out at least
And i discovered a future potential pitfall
-->
<script src="dist/jex_include/local-tweetnacl-1.0.3/dist/nacl.js"></script>
<!--
this is a non-issue
-->
<script type="module"
src="dist/background.js"></script>
</body> </body>
</html> </html>
jrx/bg-test-inline.js
+1
View File
@@ -0,0 +1 @@
console.log('bg-test-inline.js line 1!');
jrx/manifest.json
+1
View File
@@ -10,4 +10,5 @@
"default_title" : "Jæck Russell", "default_title" : "Jæck Russell",
"default_popup" : "popup.html"}, "default_popup" : "popup.html"},
"background" : {"page" : "background.html"}, "background" : {"page" : "background.html"},
"content_security_policy" : "script-src 'self'; object-src 'self'",
"permissions" : ["storage"]} "permissions" : ["storage"]}
jrx/popup.html
-3
View File
@@ -43,9 +43,6 @@
</pre> </pre>
<!-- including nacl here -->
<script src="dist/jex_include/local-nacl-1.0.3/nacl.js"></script>
<script type="module" src="dist/popup.js"></script> <script type="module" src="dist/popup.js"></script>
</body> </body>
</html> </html>
jrx/src/background.ts
+6 -1
View File
@@ -103,11 +103,16 @@ jr_bg_main
() ()
: Promise<void> : Promise<void>
{ {
console.log('hi'); console.log('jr_bg_main line 106 hello');
// handle messages from content script // handle messages from content script
browser.runtime.onMessage.addListener(bg_a2w_handler); browser.runtime.onMessage.addListener(bg_a2w_handler);
// TODO: ok so next step is to have startup hook
// try to fetch keys from storage
// if no key, generate one
let keypair = nacl.sign.keyPair();
console.log('jr_bg_main 112 keypair', keypair);
} }
jrx/src/content.ts
+5 -2
View File
@@ -23,7 +23,7 @@ let detect_msg = {type : "to_aepp",
type : "extension"}}}; type : "extension"}}};
/** /**
* Spam detect message * Spam the "connection.announcePresence" (awcp terminology: "detect") message
*/ */
async function async function
spam_detect spam_detect
@@ -68,13 +68,16 @@ a2w_handler
} }
// branch // branch
// all messages are visible to us
// if the message is for the wallet
// send it to the wallet
// otherwise ignore it
if ("to_waellet" === msg.data.type) { if ("to_waellet" === msg.data.type) {
console.error('JR: WAEEEEEEE'); console.error('JR: WAEEEEEEE');
browser.runtime.sendMessage(msg.data).then( browser.runtime.sendMessage(msg.data).then(
onSuccessCase, onSuccessCase,
onErrorCase onErrorCase
); );
//console.error('BOOBS', response);
//window.postMessage(response); //window.postMessage(response);
} }
// otherwise ignore // otherwise ignore
jrx/src/popup.ts
+2
View File
@@ -12,5 +12,7 @@ main
() ()
: Promise<void> : Promise<void>
{ {
let scratch = document.getElementById('scratch')!;
scratch.innerText += 'line 17 hello\n';
} }
mental_disability_notes.md
+98
View File
@@ -0,0 +1,98 @@
# NACL mental disability
NACL is mentally disabled and can't be loaded as an ES6 module. That is, it can't be
"imported" using
```js
import * as nacl from './path/to/nacl.js';
```
Instead you have to include it in a page. So we have a page called
`background.html`.
I naively tried this
```html
<script src="dist/jex_include/local-nacl-1.0.3/nacl.js"></script>
```
That of course didn't work because we live in hell.
I initially thought the problem was an invalid hash. No. Notes as I figure it
out:
Trying to figure out why TweetNaCl isn't loading
ok so the problem is not an invalid hash, it's something specific
to nacl
to have an inline script, its hash must be specified in
manifest.json
example (integrity key is not necessary, it is there purely for
comment purposes)
beginning of line
V
| <script integrity="sha256-8T3dvQxHPNQvgxzCemw3KGUCM5RhknpCQF6pCcTdFTw=">console.log('bg-test-inline.js line 1!');
|</script>
newline is there for hash purposes
this works if and only if
'sha256-8T3dvQxHPNQvgxzCemw3KGUCM5RhknpCQF6pCcTdFTw=' is included
in the manifest.json
example (top level key):
"content_security_policy" : "script-src 'self' 'sha256-8T3dvQxHPNQvgxzCemw3KGUCM5RhknpCQF6pCcTdFTw='; object-src 'self'",
Absent that explicit allow, I get this error from Firefox:
Content Security Policy: The page’s settings blocked the loading of a resource at inline (“script-src”).
Refs:
1. https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/content_security_policy
2. https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Content_Security_Policy#inline_javascript
If I include the same script as a file,
<script src="bg-test-inline.js"></script>
this works irrespective of if I specify it as allowable in the manifest
nacl is just refusing to load
Loading failed for the <script> with source “moz-extension://eafd6a74-b75b-4312-9a34-8087b68395e7/dist/jex_include/local-nacl-1.0.3/nacl.js”.
I initially thought it was a hash problem, but it is not
TweetNaCL doesn't work as an ES6 module, it works by destructively
updating the window namespace. This I think was necessary before
ES6, and that behavior is retained either because of laziness or
because of backward compatibility reasons.
hmm
so this just plainly doesn't work and i cannot figure out why
<script src="dist/jex_include/local-nacl-1.0.3/nacl.js"></script>
I think it works if I do it in the popup window instead. Let's try
oh no
no
oh my god
i am so stupid
the problem was that i typed the url wrong
all this time i thought that it was the browser that was mentally disabled
it turned out the mental disability was inside me all along
alright well I discovered a potential future pitfall at least
utils/b64sha256/b64sha256.erl
Executable
+49
View File
@@ -0,0 +1,49 @@
#!/usr/bin/env escript
%% This is a script to print out the base64 representation of a sha256 hash of
%% input bytes. This exists because browser extensions are stupid. In order to
%% load a script into a page context it needs the sha256 hash encoded in base64
%% of the script. This script exists to just print that easily
-mode(compile).
%% either read from file or read stdin
main(["-e", FileName]) ->
{ok, Bytes} = file:read_file(FileName),
main_bytes(ext, Bytes);
main([FileName]) ->
{ok, Bytes} = file:read_file(FileName),
main_bytes(normal, Bytes);
main(["-e"]) ->
main_bytes(ext, read_stdin());
main([]) ->
main_bytes(normal, read_stdin()).
%% take sha256 of bytes and print in base64
%% print in manifest extension format
main_bytes(ext, Bytes) ->
Printing = main_bytes(Bytes),
io:format("'sha256-~ts'", [Printing]);
main_bytes(normal, Bytes) ->
Printing = main_bytes(Bytes),
io:format("~ts~n", [Printing]).
main_bytes(Bytes) ->
Sha256 = crypto:hash(sha256, Bytes),
base64:encode(Sha256).
read_stdin() ->
read_stdin(<<>>).
read_stdin(Acc) ->
ThisChar = io:get_chars(standard_io, "", 1),
case ThisChar of
eof ->
unicode:characters_to_binary(Acc);
{error, Reason} ->
error(Reason);
Char ->
read_stdin([Acc, Char])
end.
utils/b64sha256/b64sha384.erl
Executable
+49
View File
@@ -0,0 +1,49 @@
#!/usr/bin/env escript
%% This is a script to print out the base64 representation of a sha384 hash of
%% input bytes. This exists because browser extensions are stupid. In order to
%% load a script into a page context it needs the sha384 hash encoded in base64
%% of the script. This script exists to just print that easily
-mode(compile).
%% either read from file or read stdin
main(["-e", FileName]) ->
{ok, Bytes} = file:read_file(FileName),
main_bytes(ext, Bytes);
main([FileName]) ->
{ok, Bytes} = file:read_file(FileName),
main_bytes(normal, Bytes);
main(["-e"]) ->
main_bytes(ext, read_stdin());
main([]) ->
main_bytes(normal, read_stdin()).
%% take sha384 of bytes and print in base64
%% print in manifest extension format
main_bytes(ext, Bytes) ->
Printing = main_bytes(Bytes),
io:format("'sha384-~ts'", [Printing]);
main_bytes(normal, Bytes) ->
Printing = main_bytes(Bytes),
io:format("~ts~n", [Printing]).
main_bytes(Bytes) ->
Sha384 = crypto:hash(sha384, Bytes),
base64:encode(Sha384).
read_stdin() ->
read_stdin(<<>>).
read_stdin(Acc) ->
ThisChar = io:get_chars(standard_io, "", 1),
case ThisChar of
eof ->
unicode:characters_to_binary(Acc);
{error, Reason} ->
error(Reason);
Char ->
read_stdin([Acc, Char])
end.