2 ms·

If it's trivial but nonfree, it still runs. What is meant by non-trivial, and how do you programmatically determine that a script is non-trivial? Like this: htt

If it's trivial but nonfree, it still runs. What is meant by non-trivial, and how do you programmatically determine that a script is non-trivial? Like this: https://git.savannah.gnu.org/cgit/librejs.git/tree/common/checks.js#n144 https://git.savannah.gnu.org/cgit/librejs.git/tree/common/ch... * If an identifier on the banned list exists, it is non-trivial. The list is here: https://git.savannah.gnu.org/cgit/librejs.git/tree/common/fname_data.json https://git.savannah.gnu.org/cgit/librejs.git/tree/common/fn... * If an identifier is ever followed by the square bracket indexing operator, it's non-trivial. (Looking at Stallman's requirement, it looks like this should only apply to accessing properties on an object, but the authors don't seem to have found a way to differentiate using [] on an object's identifier and [] on an array's identifier) * If there are more than three loops, it's non-trivial. * If it uses fetch(), chrome, browser, XMLHttpRequest, or eval(), it's non-trivial. Oddly, referencing "document" is commented out, even though Stallman explicitly said any DOM modification makes a script non-trivial. I wonder what broke (outside of what they expected to break).

ryan-c 2y ago
I expect this bullshit still works: https://rya.nc/files/librejs-poc.html https://rya.nc/files/librejs-poc.html <script id="harmlessNullScript" type="text/javascript"></script> <skript id="derp" style="display:none;"> /** * @license Proprietary * @copyright Copyright 2018 Ryan Castellucci, All Rights Reserved */ // WARNING: Code here needs to avoid the "less than" symbol. (function(){ // LibreJS modifies the text of script tags onced they've been // checked, which offers a very convienant way to detect it. if (harmlessNullScript.textContent.indexOf("LibreJS: ") > 0) { eval("alert('LibreJS detected, but non-free eval works');"); } })(); </skript> <script type="text/javascript"> /** * @license Proprietary * @copyright Copyright 2018 Ryan Castellucci, All Rights Reserved */ // An eval that works in the WebExtension port of LibreJS. // Untested on the original XPI version. Function(derp.textContent)(); </script> In any event, there are a lot of ways to eval code...
xigoi 2y ago
Does this mean that any JSFuck code would be considered trivial, even though JSFuck can do anything JavaScript can?

ryan-c 2y ago

I expect this bullshit still works: https://rya.nc/files/librejs-poc.html https://rya.nc/files/librejs-poc.html <script id="harmlessNullScript" type="text/javascript"></script> <skript id="derp" style="display:none;"> /** * @license Proprietary * @copyright Copyright 2018 Ryan Castellucci, All Rights Reserved */ // WARNING: Code here needs to avoid the "less than" symbol. (function(){ // LibreJS modifies the text of script tags onced they've been // checked, which offers a very convienant way to detect it. if (harmlessNullScript.textContent.indexOf("LibreJS: ") > 0) { eval("alert('LibreJS detected, but non-free eval works');"); } })(); </skript> <script type="text/javascript"> /** * @license Proprietary * @copyright Copyright 2018 Ryan Castellucci, All Rights Reserved */ // An eval that works in the WebExtension port of LibreJS. // Untested on the original XPI version. Function(derp.textContent)(); </script> In any event, there are a lot of ways to eval code...

xigoi 2y ago

Does this mean that any JSFuck code would be considered trivial, even though JSFuck can do anything JavaScript can?