[FR] better aeld event defuser

[anonghuser]

Prerequisites

• I verified that this is not a filter list issue. Report any issues with filter lists or broken website functionality in the uAssets issue tracker.
• This is NOT a YouTube, Facebook or Twitch report. These sites MUST be reported by clicking their respective links.
• This is not a support issue or a question. For support, questions, or help, visit /r/uBlockOrigin.
• I performed a cursory search of the issue tracker to avoid opening a duplicate issue.
• The issue is not present after disabling uBO in the browser.
• I checked the documentation to understand that the issue I am reporting is not normal behavior.

I tried to reproduce the issue when...

• uBO is the only extension.
• uBO uses default lists and settings.
• using a new, unmodified browser profile.

Description

currently, the aeld scriptlet does not stop events set with onxxxx attribute/property
can we please get another version or a flag which instead of monkey-patching addEventListener just sets a capture phase event handler on the window which calls stopImmediatePropagation to block all other handlers no matter how they are set?
if it is the first such handler that is set it is guaranteed to be the first executed too, so seems like a more reliable approach, except for the few rare events that don't bubble.

A specific URL where the issue occurs.

-

Steps to Reproduce

Expected behavior

Actual behavior

uBO version

Browser name and version

Operating System and version

[krystian3w]

not stop events set with onXxxx attribute

Try in Firefox:

foo.bar##[onXxxxx*="foo"]:remove-attr(onXxxxx)

Try in Chromium (and hard cases only for Firefox):

foo.bar##+js(ra, onXxxxx, [onXxxxx*="foo"], asap stay)

[gorhill]

Provide actual real world cases please, I prefer to not spend time on code which has no real world use case -- that is why we ask for "specific URL where the issue occurs".

[krystian3w]

To me, the only thing that comes to mind is masking events with e.g. jQuery, but that's something even AdGuard developers don't want to touch.

AdguardTeam/Scriptlets#362 (comment)

In addition, for uBO perhaps a selector (gorhill/uBlock@060f9d6) will also help for such accidents:

#%#//scriptlet('prevent-addEventListener', 'click', '/window.open|adsdomain.com|countdownDownload|btn-download/', 'elements', '#btn-download')
! or
#%#//scriptlet('prevent-addEventListener', 'click', '/.*/', 'elements', '#btn-download')

Unfortunately, that request there is also a PoC and not a real threat, where we need to find another method to neutralize the problem.

[anonghuser]

hi, @krystian3w @gorhill

a sample url of my specific issue is https://www.foxteller.com/novel/643/1/the-witch-and-the-mercenary/001
i am actually able to remove the oncopy/oncut/oncontextmenu attributes with i.e. [nocopy]:remove-attr(nocopy) but the console keeps showing event listeners on the element - without looking at the site's script my guess is it sets them as properties, not just as attributes

i didn't provide the specifics since i didn't want to turn this into a support request, just a generally useful feature request. the approach with capture phase stopImmediatePropagation works rather well from my experience - i actually have a userscript for it for the contextmenu event. i would have solved the copy/cut with a userscript as well if it bothered me too much, but uBO was more convenient for a few other annoyances on the site - css for unstickying the header and allowing user selection, disabling console.log since they spam it, defusing selectionchange event which works fine, etc., so i thought i'd try to tack on the copy/cut things to that too.

[stephenhawk8054]

Which browser are you using?

[anonghuser]

edge

[stephenhawk8054]

foxteller.com##[oncontextmenu]:remove-attr(/oncontextmenu|oncopy|oncut/) works better on Firefox. For chromium, you'll need

foxteller.com##+js(ra, oncontextmenu|oncopy|oncut, [id^="chapter"], stay)

Browser name and version

That's why please always provide all information in the template, even for Feature request. Different browsers can have different behaviors.

[anonghuser]

indeed, that solved the issue, thanks. i didn't try it since the docs were suggesting the newer approach.