# NOTE: This patch file is generated automatically and is not used, it is only for documentation. The driver is actually patched using [patchright_driver_patch](https://github.com/Kaliiiiiiiiii-Vinyzu/patchright/blob/main/patchright_driver_patch.js), see [the workflow](https://github.com/Kaliiiiiiiiii-Vinyzu/patchright/blob/main/.github/workflows/patchright_workflow.yml) diff -ruN playwright/node_modules/playwright-core/src/server/browserContext.ts patchright/node_modules/playwright-core/src/server/browserContext.ts --- +++ @@ -146,7 +146,7 @@ `); } if (this._options.serviceWorkers === 'block') - await this.addInitScript(undefined, `\nif (navigator.serviceWorker) navigator.serviceWorker.register = async () => { console.warn('Service Worker registration blocked by Playwright'); };\n`); + await this.addInitScript(undefined, `navigator.serviceWorker.register = async () => { };`); if (this._options.permissions) await this.grantPermissions(this._options.permissions); @@ -326,27 +326,19 @@ if (page.getBinding(name)) throw new Error(`Function "${name}" has been already registered in one of the pages`); } - await progress.race(this.exposePlaywrightBindingIfNeeded()); const binding = new PageBinding(name, playwrightBinding, needsHandle); binding.forClient = forClient; this._pageBindings.set(name, binding); - try { - await progress.race(this.doAddInitScript(binding.initScript)); - await progress.race(this.safeNonStallingEvaluateInAllFrames(binding.initScript.source, 'main')); - return binding; - } catch (error) { - this._pageBindings.delete(name); - throw error; - } + await this.doExposeBinding(binding); } async removeExposedBindings(bindings: PageBinding[]) { - bindings = bindings.filter(binding => this._pageBindings.get(binding.name) === binding); - for (const binding of bindings) - this._pageBindings.delete(binding.name); - await this.doRemoveInitScripts(bindings.map(binding => binding.initScript)); - const cleanup = bindings.map(binding => `{ ${binding.cleanupScript} };\n`).join(''); - await this.safeNonStallingEvaluateInAllFrames(cleanup, 'main'); + + for (const key of this._pageBindings.keys()) { + if (!key.startsWith('__pw')) this._pageBindings.delete(key); + } + await this.doRemoveExposedBindings(); + } async grantPermissions(permissions: string[], origin?: string) { @@ -463,9 +455,10 @@ } async removeInitScripts(initScripts: InitScript[]) { - const set = new Set(initScripts); - this.initScripts = this.initScripts.filter(script => !set.has(script)); - await this.doRemoveInitScripts(initScripts); + + this.initScripts.splice(0, this.initScripts.length); + await this.doRemoveInitScripts(); + } async addRequestInterceptor(progress: Progress, handler: network.RouteHandler): Promise { diff -ruN playwright/node_modules/playwright-core/src/server/chromium/chromiumSwitches.ts patchright/node_modules/playwright-core/src/server/chromium/chromiumSwitches.ts --- +++ @@ -47,26 +47,16 @@ '--disable-field-trial-config', // https://source.chromium.org/chromium/chromium/src/+/main:testing/variations/README.md '--disable-background-networking', '--disable-background-timer-throttling', - '--disable-backgrounding-occluded-windows', - '--disable-back-forward-cache', // Avoids surprises like main request not being intercepted during page.goBack(). - '--disable-breakpad', - '--disable-client-side-phishing-detection', - '--disable-component-extensions-with-background-pages', - '--disable-component-update', // Avoids unneeded network activity after startup. + '--disable-backgrounding-occluded-windows', // Avoids surprises like main request not being intercepted during page.goBack(). + '--disable-breakpad', // Avoids unneeded network activity after startup. '--no-default-browser-check', - '--disable-default-apps', '--disable-dev-shm-usage', - '--disable-extensions', '--disable-features=' + disabledFeatures(assistantMode).join(','), channel === 'chromium-tip-of-tree' ? '--enable-features=CDPScreenshotNewSurface' : '', - '--allow-pre-commit-input', '--disable-hang-monitor', - '--disable-ipc-flooding-protection', - '--disable-popup-blocking', '--disable-prompt-on-repost', '--disable-renderer-backgrounding', '--force-color-profile=srgb', - '--metrics-recording-only', '--no-first-run', '--password-store=basic', '--use-mock-keychain', @@ -75,9 +65,7 @@ '--export-tagged-pdf', // https://chromium-review.googlesource.com/c/chromium/src/+/4853540 '--disable-search-engine-choice-screen', - // https://issues.chromium.org/41491762 - '--unsafely-disable-devtools-self-xss-warnings', // Edge can potentially restart on Windows (msRelaunchNoCompatLayer) which looses its file descriptors (stdout/stderr) and CDP (3/4). Disable until fixed upstream. '--edge-skip-compat-layer-relaunch', - assistantMode ? '' : '--enable-automation', + '--disable-blink-features=AutomationControlled' ].filter(Boolean); diff -ruN playwright/node_modules/playwright-core/src/server/chromium/crBrowser.ts patchright/node_modules/playwright-core/src/server/chromium/crBrowser.ts --- +++ @@ -509,8 +509,9 @@ } async doRemoveInitScripts(initScripts: InitScript[]) { - for (const page of this.pages()) - await (page.delegate as CRPage).removeInitScripts(initScripts); + + for (const page of this.pages()) await (page.delegate as CRPage).removeInitScripts(); + } async doUpdateRequestInterception(): Promise { @@ -620,4 +621,16 @@ const rootSession = await this._browser._clientRootSession(); return rootSession.attachToTarget(targetId); } + + async doExposeBinding(binding: PageBinding) { + + for (const page of this.pages()) await (page.delegate as CRPage).exposeBinding(binding); + + } + + async doRemoveExposedBindings() { + + for (const page of this.pages()) await (page.delegate as CRPage).removeExposedBindings(); + + } } diff -ruN playwright/node_modules/playwright-core/src/server/chromium/crDevTools.ts patchright/node_modules/playwright-core/src/server/chromium/crDevTools.ts --- +++ @@ -67,7 +67,6 @@ }).catch(e => null); }); Promise.all([ - session.send('Runtime.enable'), session.send('Runtime.addBinding', { name: kBindingName }), session.send('Page.enable'), session.send('Page.addScriptToEvaluateOnNewDocument', { source: ` diff -ruN playwright/node_modules/playwright-core/src/server/chromium/crNetworkManager.ts patchright/node_modules/playwright-core/src/server/chromium/crNetworkManager.ts --- +++ @@ -1,3 +1,5 @@ +// patchright - custom imports +import crypto from 'crypto'; /** * Copyright 2017 Google Inc. All rights reserved. * Modifications copyright (c) Microsoft Corporation. @@ -156,7 +158,7 @@ const enabled = this._protocolRequestInterceptionEnabled; if (initial && !enabled) return; - const cachePromise = info.session.send('Network.setCacheDisabled', { cacheDisabled: enabled }); + const cachePromise = info.session.send('Network.setCacheDisabled', { cacheDisabled: false }); let fetchPromise = Promise.resolve(undefined); if (!info.workerFrame) { if (enabled) @@ -238,6 +240,7 @@ } _onRequestPaused(sessionInfo: SessionInfo, event: Protocol.Fetch.requestPausedPayload) { + if (this._alreadyTrackedNetworkIds.has(event.networkId)) return; if (!event.networkId) { // Fetch without networkId means that request was not recognized by inspector, and // it will never receive Network.requestWillBeSent. Continue the request to not affect it. @@ -276,6 +279,7 @@ } _onRequest(requestWillBeSentSessionInfo: SessionInfo, requestWillBeSentEvent: Protocol.Network.requestWillBeSentPayload, requestPausedSessionInfo: SessionInfo | undefined, requestPausedEvent: Protocol.Fetch.requestPausedPayload | undefined) { + if (this._alreadyTrackedNetworkIds.has(requestWillBeSentEvent.initiator.requestId)) return; if (requestWillBeSentEvent.request.url.startsWith('data:')) return; let redirectedFrom: InterceptableRequest | null = null; @@ -342,7 +346,7 @@ headersOverride = redirectedFrom?._originalRequestRoute?._alreadyContinuedParams?.headers; requestPausedSessionInfo!.session._sendMayFail('Fetch.continueRequest', { requestId: requestPausedEvent.requestId, headers: headersOverride }); } else { - route = new RouteImpl(requestPausedSessionInfo!.session, requestPausedEvent.requestId); + route = new RouteImpl(requestPausedSessionInfo!.session, requestPausedEvent.requestId, this._page, requestPausedEvent.networkId, this); } } const isNavigationRequest = requestWillBeSentEvent.requestId === requestWillBeSentEvent.loaderId && requestWillBeSentEvent.type === 'Document'; @@ -553,6 +557,8 @@ if (request.session !== sessionInfo.session && !sessionInfo.isMain && (request._documentId === request._requestId || sessionInfo.workerFrame)) request.session = sessionInfo.session; } + + _alreadyTrackedNetworkIds: Set = new Set(); } class InterceptableRequest { @@ -612,38 +618,189 @@ _alreadyContinuedParams: Protocol.Fetch.continueRequestParameters | undefined; _fulfilled: boolean = false; - constructor(session: CRSession, interceptionId: string) { + constructor(session: CRSession, interceptionId: string, page, networkId, sessionManager) { + this._sessionManager = void 0; + this._networkId = void 0; + this._page = void 0; this._session = session; this._interceptionId = interceptionId; + this._page = page; + this._networkId = networkId; + this._sessionManager = sessionManager; + eventsHelper.addEventListener(this._session, 'Fetch.requestPaused', async e => await this._networkRequestIntercepted(e)); } async continue(overrides: types.NormalizedContinueOverrides): Promise { - this._alreadyContinuedParams = { - requestId: this._interceptionId!, - url: overrides.url, - headers: overrides.headers, - method: overrides.method, - postData: overrides.postData ? overrides.postData.toString('base64') : undefined - }; - await catchDisallowedErrors(async () => { - await this._session.send('Fetch.continueRequest', this._alreadyContinuedParams); - }); + + this._alreadyContinuedParams = { + requestId: this._interceptionId, + url: overrides.url, + headers: overrides.headers, + method: overrides.method, + postData: overrides.postData ? overrides.postData.toString('base64') : undefined, + }; + if (overrides.url && (overrides.url === 'http://patchright-init-script-inject.internal/' || overrides.url === 'https://patchright-init-script-inject.internal/')) { + await catchDisallowedErrors(async () => { + this._sessionManager._alreadyTrackedNetworkIds.add(this._networkId); + this._session._sendMayFail('Fetch.continueRequest', { requestId: this._interceptionId, interceptResponse: true }); + }); + } else { + await catchDisallowedErrors(async () => { + await this._session._sendMayFail('Fetch.continueRequest', this._alreadyContinuedParams); + }); + } + } async fulfill(response: types.NormalizedFulfillResponse) { - this._fulfilled = true; - const body = response.isBase64 ? response.body : Buffer.from(response.body).toString('base64'); - const responseHeaders = splitSetCookieHeader(response.headers); - await catchDisallowedErrors(async () => { - await this._session.send('Fetch.fulfillRequest', { - requestId: this._interceptionId!, - responseCode: response.status, - responsePhrase: network.statusText(response.status), - responseHeaders, - body, - }); - }); + const isTextHtml = response.headers.some((header) => header.name.toLowerCase() === "content-type" && header.value.includes("text/html")); + var allInjections = [...this._page.delegate._mainFrameSession._evaluateOnNewDocumentScripts]; + for (const binding of this._page.delegate._browserContext._pageBindings.values()) { + if (!allInjections.includes(binding)) allInjections.push(binding); + } + if (isTextHtml && allInjections.length) { + let useNonce = false; + let scriptNonce = null; + // Decode body if needed + if (response.isBase64) { + response.isBase64 = false; + response.body = Buffer.from(response.body, "base64").toString("utf-8"); + } + // === CSP Detection and Fixing === + const cspHeaderNames = ["content-security-policy", "content-security-policy-report-only"]; + // Fix CSP in headers + for (let i = 0; i < response.headers.length; i++) { + const headerName = response.headers[i].name.toLowerCase(); + if (cspHeaderNames.includes(headerName)) { + const originalCsp = response.headers[i].value || ""; + // Extract nonce if present + if (!useNonce) { + const nonceMatch = originalCsp.match(/script-src[^;]*'nonce-([^'"\s;]+)'/i); + if (nonceMatch && nonceMatch[1]) { + scriptNonce = nonceMatch[1]; + useNonce = true; + } + } + + const fixedCsp = this._fixCSP(originalCsp, scriptNonce); + response.headers[i].value = fixedCsp; + } + } + + // Fix CSP in meta tags + if (typeof response.body === "string" && response.body.length) { + response.body = response.body.replace( + /]*http-equiv=(?:"|')?Content-Security-Policy(?:"|')?[^>]*>/gi, + (match) => { + const contentMatch = match.match(/content=(?:"|')([^"']*)(?:"|')/i); + if (contentMatch && contentMatch[1]) { + let originalCsp = contentMatch[1]; + + // Decode HTML entities + originalCsp = originalCsp.replace(/&/g, '&') // Must be first! + .replace(/</g, '<') + .replace(/>/g, '>') + .replace(/"/g, '"') + .replace(/'/g, "'") + .replace(/"/g, '"') + .replace(/ /g, ' ') + .replace(/&#(d+);/g, (match, dec) => String.fromCharCode(dec)) + .replace(/&#x([0-9a-fA-F]+);/g, (match, hex) => String.fromCharCode(parseInt(hex, 16))); + + // Extract nonce if not already found + if (!useNonce) { + const nonceMatch = originalCsp.match(/script-src[^;]*'nonce-([^'"\s;]+)'/i); + if (nonceMatch && nonceMatch[1]) { + scriptNonce = nonceMatch[1]; + useNonce = true; + } + } + + const fixedCsp = this._fixCSP(originalCsp, scriptNonce); + // Re-encode for HTML + const encodedCsp = fixedCsp.replace(/'/g, ''').replace(/"/g, '"'); + return match.replace(contentMatch[1], encodedCsp); + } + return match; + } + ); + } + + // Build injection HTML - only use nonce if one was found in existing CSP + let injectionHTML = ""; + allInjections.forEach((script) => { + let scriptId = crypto.randomBytes(22).toString("hex"); + let scriptSource = script.source || script; + const nonceAttr = useNonce ? `nonce="${scriptNonce}"` : ''; + injectionHTML += ``; + }); + + // Inject at END of + const lower = response.body.toLowerCase(); + const headStartIndex = lower.indexOf("", headStartIndex); + if (headEndTagIndex !== -1) { + // Find the head opening tag end + const headOpenEnd = response.body.indexOf(">", headStartIndex) + 1; + const headContent = response.body.slice(headOpenEnd, headEndTagIndex); + const headContentLower = headContent.toLowerCase(); + + // Look for the first `; + }); + + // Inject at END of + const lower = response.body.toLowerCase(); + const headStartIndex = lower.indexOf("", headStartIndex); + if (headEndTagIndex !== -1) { + // Find the head opening tag end + const headOpenEnd = response.body.indexOf(">", headStartIndex) + 1; + const headContent = response.body.slice(headOpenEnd, headEndTagIndex); + const headContentLower = headContent.toLowerCase(); + + // Look for the first