Improve abort-current-script scriptlet

gorhill · gorhill · commit fef50e59f231 · 2025-07-20T10:26:31.000-04:00
Prevent webpages from tampering with `textContent`. Borrow solution from: https://github.com/AdguardTeam/Scriptlets/blob/c2d7378e4de8ed79fcd7cc17c0e883e48dcd2f2a/src/scriptlets/abort-current-inline-script.js#L98-L99
diff --git a/src/js/resources/scriptlets.js b/src/js/resources/scriptlets.js
@@ -77,8 +77,8 @@ function shouldDebug(details) {
 /******************************************************************************/
 
 builtinScriptlets.push({
-    name: 'abort-current-script-core.fn',
-    fn: abortCurrentScriptCore,
+    name: 'abort-current-script.fn',
+    fn: abortCurrentScriptFn,
     dependencies: [
         'get-exception-token.fn',
         'safe-self.fn',
@@ -87,7 +87,7 @@ builtinScriptlets.push({
 });
 // Issues to mind before changing anything:
 //  https://github.com/uBlockOrigin/uBlock-issues/issues/2154
-function abortCurrentScriptCore(
+function abortCurrentScriptFn(
     target = '',
     needle = '',
     context = ''
@@ -122,8 +122,9 @@ function abortCurrentScriptCore(
     const debug = shouldDebug(extraArgs);
     const exceptionToken = getExceptionTokenFn();
     const scriptTexts = new WeakMap();
+    const textContentGetter = Object.getOwnPropertyDescriptor(Node.prototype, 'textContent').get;
     const getScriptText = elem => {
-        let text = elem.textContent;
+        let text = textContentGetter.call(elem);
         if ( text.trim() !== '' ) { return text; }
         if ( scriptTexts.has(elem) ) { return scriptTexts.get(elem); }
         const [ , mime, content ] =
@@ -596,15 +597,15 @@ builtinScriptlets.push({
     ],
     fn: abortCurrentScript,
     dependencies: [
-        'abort-current-script-core.fn',
+        'abort-current-script.fn',
         'run-at-html-element.fn',
     ],
 });
 // Issues to mind before changing anything:
 //  https://github.com/uBlockOrigin/uBlock-issues/issues/2154
 function abortCurrentScript(...args) {
     runAtHtmlElementFn(( ) => {
-        abortCurrentScriptCore(...args);
+        abortCurrentScriptFn(...args);
     });
 }
 
