Problem Description
One of the most commonly reported issues with DOMLogger++ is its inability to natively hook sinks that appear very early in the DOM, such as within the tag. This is due to a race condition in how browser extensions inject and initialize their scripts. There is a small, but critical, delay during which the page's own scripts can execute before DOMLogger++ is fully operational, leading to missed sinks.
The "It doesn't works..." challenge was a prime example of this "blind spot," where a console.warn() call was missed because it executed before the extension could hook it. This problem requires a workaround using tools like Burp Suite or Caido, which is less than ideal for a native solution.
Proposed Solution for DOMLogger++ Firefox Extension
I propose leveraging the contentScripts.register() API, which is unique to Firefox. Unlike static content script declarations, this API allows an extension to programmatically register scripts at runtime with a runAt: "document_start" property. This can be used to pass configuration data without an async call, effectively eliminating the race condition.
Implementing this API would enable DOMLogger++ to inject its hooks and configuration synchronously, ensuring that the hooking mechanism is in place before any of the target page's scripts have a chance to run. This would allow the extension to natively catch sinks that currently fall within the "blind spot" and improve its overall reliability and completeness.
Acknowledgement
This solution was inspired by a technical blog post on client-side JavaScript instrumentation by Dennis Goodlett of Doyensec. The post highlighted the specific capabilities of Firefox's contentScripts.register() API as a way to avoid these common race conditions in web extensions. A great example of this principle in practice is his own Eval Villain Firefox extension, which uses this very API.
Blog Post: https://blog.doyensec.com/2023/09/25/clientside-javascript-instrumentation.html
Eval Villain Extension: https://addons.mozilla.org/en-US/firefox/addon/eval-villain/
Eval Villain GitHub: https://github.com/swoops/eval_villain
Problem Description
One of the most commonly reported issues with DOMLogger++ is its inability to natively hook sinks that appear very early in the DOM, such as within the tag. This is due to a race condition in how browser extensions inject and initialize their scripts. There is a small, but critical, delay during which the page's own scripts can execute before DOMLogger++ is fully operational, leading to missed sinks.
The "It doesn't works..." challenge was a prime example of this "blind spot," where a console.warn() call was missed because it executed before the extension could hook it. This problem requires a workaround using tools like Burp Suite or Caido, which is less than ideal for a native solution.
Proposed Solution for DOMLogger++ Firefox Extension
I propose leveraging the contentScripts.register() API, which is unique to Firefox. Unlike static content script declarations, this API allows an extension to programmatically register scripts at runtime with a runAt: "document_start" property. This can be used to pass configuration data without an async call, effectively eliminating the race condition.
Implementing this API would enable DOMLogger++ to inject its hooks and configuration synchronously, ensuring that the hooking mechanism is in place before any of the target page's scripts have a chance to run. This would allow the extension to natively catch sinks that currently fall within the "blind spot" and improve its overall reliability and completeness.
Acknowledgement
This solution was inspired by a technical blog post on client-side JavaScript instrumentation by Dennis Goodlett of Doyensec. The post highlighted the specific capabilities of Firefox's contentScripts.register() API as a way to avoid these common race conditions in web extensions. A great example of this principle in practice is his own Eval Villain Firefox extension, which uses this very API.
Blog Post: https://blog.doyensec.com/2023/09/25/clientside-javascript-instrumentation.html
Eval Villain Extension: https://addons.mozilla.org/en-US/firefox/addon/eval-villain/
Eval Villain GitHub: https://github.com/swoops/eval_villain