uBlock Origin questions

[LCF-AT]

Hi guys,

I'am a fan of using that uBO extension for my browsers for years and its really a very good one which has tons of features.So in my case I would say I'am a Newbie+ user but I would like to use that extension more in a advanced way and I have some diffrent questions I would like to ask to you who are maybe more advanced as I'am.Otherwise lets use this topic to ask all about uBO & filter stuff questions etc.Below 3 links of basic filter syntax & Resources-Library.

https://github.com/gorhill/uBlock/wiki/Static-filter-syntax

https://github.com/DandelionSprout/adfilt/blob/master/Wiki/SyntaxMeaningsThatAreActuallyHumanReadable.md

https://github.com/gorhill/uBlock/wiki/Resources-Library

I'am using uBO to prevent ADS / AndiADS-Blocker / Tracking etc.All stuff nobody needs and wants to see or deal with in best case ("Clean is Beautiful"). Some people will say "HeyHo but we need to run ADS'n stuff to make some little money etc" but this I will not accept for hardcore ADS warrior where pages are paved with ADS & Popups & websockets & other BS you know.

Question: How to get started to analyze what requests a webpage does / does nothing what has to do with the main webpage content itself (ADS/TRACKING/ETC)?Normaly I can check the requests in browser console to see what it is / comming from but of course not all is maked as ADS or Track etc.Just would like to know how you do it & analyse the whole request content.What are you looking for to find all unnecessary dung you want to clean out?Would be nice if you could tell me/us/all how you do manage that.

What is CSP (Content-Security-Policy) / How to find it and use it?So in the filterlists of uBO I can find some filters using that "csp" command to prevet/set rules.I'am still unsure about that filter so till now I could not found some CSP anyhow.If I check this right then CSP is in the response header to find if pages who using it.In the uBO filterlist I found for example this one.

! https://github.com/uBlockOrigin/uAssets/issues/2951
game-dna.de##+js(acis, document.getElementById, TVGuideUd)
||game-dna.de^$csp=worker-src 'none'

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy

The filter above sais "Won't allow loading of any resources" with paramter 'none'.Now when I disable uBO and check the network tab then I can't find any info about any workers in any response header of main page or other loaded pages.Where to find it?The only info about service worker I can see into console tab (uBO disabled).

Registrieren/aktualisieren eines ServiceWorker für Gültigkeitsbereich 'https://game-dna.de/' ist fehlgeschlagen: 
Es besteht in diesem Kontext nur eingeschränkter Zugriff auf Storage, entweder durch Benutzereinstellungen oder den Privaten Modus.

Now if I enable that filter / uBO then I get this...

Content Security Policy: Die Einstellungen der Seite haben das Laden einer Ressource auf 
https://game-dna.de/sw.js blockiert ("worker-src").

What does it mean / diffrent?In both cases there wasn't logged any script called sw.js.Why?Somehow I don't check this filter yet (how to find / use it).

So another CSP filter I found is that one.."script-src"

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src

||uppit.com^$csp=script-src 'self' 'unsafe-eval' 'unsafe-inline' data: *.googletagservices.com *.google-analytics.com

If I use this filter above then there getting 2 URLs blocked with the info CSP in network tab...

ajax.googleapis.com/ajax/libs/jquery/1.4.1/jquery.min.js
googletagmanager.com/gtag/js

...in this case I just allow script requests from own host & the URLs set at data sheme.My question in this case is whats the diffrent to using just a direct block filter?Also not pretty sure how I have to understand this filter you know.

Another filters I don't check yet & how to use them are those..."no-fetch-if.js / no-xhr-if.js".The examples showing this...

https://github.com/gorhill/uBlock/wiki/Resources-Library#no-fetch-ifjs-

https://github.com/gorhill/uBlock/wiki/Resources-Library#no-xhr-ifjs-

Examples:

    example.com##+js(no-fetch-if, method:HEAD)
    example.com##+js(no-fetch-if, adsbygoogle.js)
    example.com##+js(no-fetch-if, adsbygoogle.js method:HEAD)
    example.com##+js(no-fetch-if, /adsbygoogle.js$/ method:/HEAD|POST/)

Examples:

    example.com##+js(no-xhr-if, method:HEAD)
    example.com##+js(no-xhr-if, adsbygoogle.js)
    example.com##+js(no-xhr-if, adsbygoogle.js method:HEAD)
    example.com##+js(no-xhr-if, /adsbygoogle.js$/ method:/HEAD|POST/)

I found some of them in uBO filterlists but could not check/verify that on fly.So what does this filter mean exactly?The description sais it does Defuses calls to fetch() (function right?) which are found / executed in any JS file / html code?Also not sure about that so maybe anyone of you could explain that to me/us + having a example page to test it anyhow to see the action.Thank you.

greetz

[LCF-AT]

Hi again,

I still have many question about How to use own filter from Resources-Library function.The bad thing is that on this page are not postet any detail samples to understand them better and I just can try to text some filter from any list and check out that webpages and debug them.

My first question is how to inspect the whole content at once when using the browser dev tools (network / debugger) tabs?Lets say I wanna check every content to find specific names.So in the debugger tab I have to select any entry / html / script to check it whether something was found (strg+F enabled in middle pane).This is really bad to handle this manually each time.I found no option to search all at once (if there is any option).Is that possible or not when using brower dev tools?Otherwise I have to find it manually.

Lets talk about the first scriptlet of uBO called: abort-current-inline-script / acis.js

https://github.com/gorhill/uBlock/wiki/Resources-Library#acisjs-

acis.js /
abort-current-inline-script.js ↪

Aborts execution of inline script (throws ReferenceError) when attempts to access specified property when content 
of <script> element matches specified text or regular expression.

Parameters:

    required, property (chain of properties joined by .) attached to window object accessed inside <script> tag we want to break
    optional, string/regular expression matching in <script> element content

Examples:

    weristdeinfreund.de##+js(acis, Number.isNaN)
    tichyseinblick.de##+js(acis, Math, /\}\s*\(.*?\b(self|this|window)\b.*?\)/)

In the filterlist I found this one..

linkneverdie.net##+js(acis, DetecAdBlockByLoadJsFile2)

...in the dev tools debugger tab of the index page I can find that string with a other value 3...

<script>
.......DetecAdBlockByLoadJsFile3(arrayAd[Math[c0b2c6c13(0xc4)](Math[c0b2c6c13(0xc9)]() *.....
</script>

...seems that this webpage did change the value only and this filter isn't working anymore and some AdBlock popups after few seconds.To make it work again I have to set the value of 3...

linkneverdie.net##+js(acis, DetecAdBlockByLoadJsFile3)

...but I wanted to make it work with a dynamic value X but with * it wasn't working.After some testing I found this out...

linkneverdie.net##+js(acis,$ , DetecAdBlockByLoadJsFile)

....using the $ sign in the middle paramter and without value at the string.This works but I don't understand why.Do you?I thought something like this must work..

linkneverdie.net##+js(acis, DetecAdBlockByLoadJsFile*)
or
linkneverdie.net##+js(acis, DetecAdBlockByLoadJsFile$)
or
linkneverdie.net##+js(acis, DetecAdBlockByLoadJsFile2|DetecAdBlockByLoadJsFile3|DetecAdBlockByLoadJsFile4)

...but not working.

Other example: Its really bad when webpages using some devtools detectors to prevent analysing the webpage itself and doing some debugger stops etc.Now I tried to check out how to manage that problem and was checking some filters and found this one...

@@||sporizle1.pw^$ghide
*$image,redirect-rule=1x1.gif,domain=sporizle1.pw
sporizle1.pw##+js(acis, $, 'body')
sporizle1.pw##+js(nosiif, reklam)
sporizle1.pw##+js(nowoif)
sporizle1.pw##+js(nostif, detectLoop)
sporizle1.pw##+js(noeval-if, devtoolsDetector)
||sporizle1.pw/inc/zcx/frame/
sporizle1.pw##[src="/cdn/img/728x90.png"]
sporizle1.pw##a[href="https://hdweb.pw"][target="_blank"]

...this webpage has changed to sporizle4 in my case what means that the filter above don't work now (only if you change 1 to 4).So in this example you can see some filter called..."(noeval-if, devtoolsDetector)".When I visit the webpage with open devtools then it does stop "break by debugger" and in debugger tab is loaded a SOURCE file with any path what isnt to find (not sure where this comes from yet) and there is any Debugger entry where the debugger did stop.This wanna prevent of course and I was trying to find any devtools string but I found nothing anywhere.uBO said this for this filter...

noeval-if.js ↪

Prevent web pages from using eval() on specific matching payloads.

Parameters:

    optional, string/regular expression, matching in payload string.

Examples:

    orgyxxxhub.com##+js(noeval-if, replace)

....hmmm.Playloads?Anything with player or so right?So in debugger tab I could nothing find with devtools but the filter above seems to work if I change it to this..

sporizle4.pw##+js(noeval-if, devtoolsDetector)

...now the debugger stop is gone and the webpage is loading go on showing a new ADBlock image on the player.My question here is why the filter with the "devtoolsDetector" string is working when I not found any string of devtoolsDetector anywhere?Is it anything else maybe?Just don't understand this part.

greetz

[kao]

Nobody can manually unpack Themida without learning the basics of OllyDbg and how packers/protectors work..

Same thing here - if you want to do advanced things with HTML, JavaScript and uBlock, you need to learn the basics of web development. There is no shortcut.
 

 

1 hour ago, LCF-AT said:

My first question is how to inspect the whole content at once when using the browser dev tools (network / debugger) tabs?Lets say I wanna check every content to find specific names.So in the debugger tab I have to select any entry / html / script to check it whether something was found (strg+F enabled in middle pane)

This works in Chrome - please note it searches downloaded file content, not dynamically evaluated code!

No idea how it's done in other browsers.

 

1 hour ago, LCF-AT said:

My question here is why the filter with the "devtoolsDetector" string is working when I not found any string of devtoolsDetector anywhere?Is it anything else maybe?Just don't understand this part.

Because devtoolsDetector is there and comes from evaluated code:

 

 

 

 

[whoknows]

any filename starting with VM* is dynamic.

[Dusty]

5 hours ago, whoknows said:

any filename starting with VM* is dynamic.

Didn't know that that actually denoted the file as dynamic, thanks!

Normally also means that when you set breakpoints, and redo a session, those breakpoints no longer valid \ hit.

It also helps to check over the network calls, and see what is being brought into the website, and what actually called them in the first place. Normally this can mean going through several callbacks and such

Edited November 19, 2021 by Dusty

[LCF-AT]

Hi,

thanks for posting feedbacks so far.So I try to lern how to use that dev tools debugger (just lerning by doing mostly) but I still don't know how I have to use / interpret it.

Ah ok, good info about that on fly scripts / starting with VM.So now I can also find that string "devtoolsDetector" in that VM script a few times.My question in this specific example is how to see what it is and which possibilities I have (when using uBO) to use filters to prevent / change it etc?

So here I have found 4 hits about devtoolsDetector string....

!function(t, e) {
    "object" == typeof exports && "object" == typeof module ? module.exports = e() : "function" == typeof define && define.amd ? define([], e) : "object" == typeof exports ? exports.devtoolsDetector = e() : t.devtoolsDetector = e()
}



!function() {
    navigator.userAgent.match(/Android/i) || navigator.userAgent.match(/webOS/i) || navigator.userAgent.match(/iPhone/i) || navigator.userAgent.match(/iPad/i) || navigator.userAgent.match(/iPod/i) || navigator.userAgent.match(/BlackBerry/i) || navigator.userAgent.match(/Windows Phone/i) || (devtoolsDetector.addListener(function(t, e) {
        t && (document.location.href = "/no_video.html")
    }),
    devtoolsDetector.lanuch())

...but what is it to know which uBO filter I could use?Or which filter could I use which also COULD work to handle / prevent that devtoolsDetector action?So the working filter I found in a filterlist was this..

##+js(noeval-if, devtoolsDetector)

....how to know using the "noeval-if" filter?Can I just see it when checking the code / text alone or have I to set BPs and stop there + checking call stack?There I can find diffrent eval commands and one does point right on that "devtoolsDetector.lanuch())" line.So I would never find out that I have to use this "noeval-if" filter.In my thought I would use the "addEventListener-defuser.js"

sporizle4.pw##+js(aeld, devtoolsDetector)

Question: The code I have post above with that "devtoolsDetector.lanuch" and it has "eval" in stack when it was found inside that VMed script.So now I found the same code on another webpage but this time the code was inside the index html page and was not marked with "eval" in stack and had a "anonymous" mark.What filter I have to use in this case?I tried everything but always failed and the debugger runs / stops the site.

greetz

[LCF-AT]

Hi again,

I have another question about using uBO resource filter commands.

1) JS scriptlets and filter who using them.So what filter I have to use when?

Aborts execution of inline script...
Aborts execution of script...
Prevents attaching event listeners...
Prevent web pages from using eval()...
Defuses calls to setTimeout()....
Removes attribute(s) from DOM tree node(s)....##+js(ra, oncontextmenu)
Removes classes from DOM tree node(s)...
etc

So there are diffrent cases so far I know.Script/s parts can be inside of a html page by using script tags.Script itself can be loaded or attached.My question now is for what I can use the filter commands?For all JS situations or not?

Example: I found a page where I can set JS tags to text on fly etc.Here a small example.

https://www.w3schools.com/js/tryit.asp?filename=tryjs_addeventlistener_displaydate

<!DOCTYPE html>
<html>
<body>

<h2>JavaScript addEventListener()</h2>

<p>This example uses the addEventListener() method to attach a click event to a button.</p>

<button id="myBtn">Try it</button>

<p id="demo"></p>

<script>
document.getElementById("myBtn").addEventListener("click", displayDate);

function displayDate() {
  document.getElementById("demo").innerHTML = Date();
}
</script>

</body>
</html> 

In this example a JS is part of html page and I want to defuse / disable the click event or button or displayDate function.Now I was trying to use diffrent uBO filters.

w3schools.com##+js(aeld, click)
w3schools.com##+js(aopr, click)
w3schools.com##^script:has-text(myBtn)

I thought the first one "aeld" (addEventListener-defuser) (Prevents attaching event listeners) would work to prevent the click listener but it fails.But I also see the info about "prevents attaching".Does it mean it only works when any extern script gets loaded / exec THEN it will work?What is in this html case?How is that called and what filter I could use to prevent the AL click?Just wanna know which filter commands I can use for inside of html JS and outside/extern.

greetz

[LCF-AT]

Hi guys,

does anyone know how to tell uBO to use multible numbers / values (any value) after a class name?So I'a, trying to change some look if any websites like this...

website.com##.jss101:style(white-space: pre-line !important)
website.com##.jss101:style(height: 50px !important)
website.com##.jss101:style(overflow: visible !important)
website.com##.jss101:style(bottom: 115px !important)

....to change the class .jss101.Now the problem is that the value 101 after .jss is used with diffrent values from 100 - 400 something etc and I don't wanna write my code lines above for all of thoses jss classes I want to change.Just need to find out what sign I can set after class name .jss to tell uBO to change all classes with any value which comes after .jss.How to do that?I was trying to use * asterix but here it fails.Then I checked some uBO scripts itself and found some RegEx [0-9] etc in some URLs but not in any example to change classes like I want to do above.Found some example on internnet to use (even) or (odd) but only so....

...###js-article-text > div:nth-of-type(even) > div:nth-of-type(even)
...###js-article-text > div:nth-of-type(even) > div:nth-of-type(odd)

I tied using regex like this between...

/([0-9])/

website.com##.jss/([0-9])/:style(bottom: 115px !important)

...but fails.Anyone any idea how to manage numerous things for classes / ids / etc?

greetz

[kao]

What you're looking for is called CSS wildcard selector. See https://github.com/gorhill/uBlock/issues/619 for examples.

Edited February 3, 2022 by kao

[LCF-AT]

Hi guys,

just have a small question about the Logger Window. Somehow I don't get to see it anymore if I call it. Below in the window task bottom I can see 2 browser iccons for browser and the Logger Window and if I choose the logger window then nothing comes up. Somehow the size of it must be moved very small so thats no more visible or so. Also there is no  maximze button and to change the size isn't working too. How can change the logger size window anyhow else to make it visible again without to reset the settings?

Only thing I can do is to hold the shift key when clicking on logger icon in uBO and then it opens the logger window as tab instead of a own window but how can I make it showing as window again?

greetz

[LCF-AT]

Hey guys,

I have another new question about using uBO and to change css styles. In some cases I want to hide some elements of a webpage using uBO and its working but in many cases I have the problem that the scrollbar V-Scroll (up/down) is gone and I can not scroll the webpage. After some checking & trying I found out the css command overflow I could use / adding extra to body to create a scroller like this...

anywebpage.com##body:style(overflow: visible !important)

....and this is working but not for all websites. My question is now whether there are more css commands / methods I could try to bring back or create scrollers on a webpage?

Example: Most sites you visit first showing some cookie accpet info stuff etc you have to setup and confirm before the site gets shown. I want to hide such elements what also works but then scroller is gone and I need to make them visiable / bring back anyhow. Just would like to know whether you have some hints for me how to handle those situations when scrollers are not shown etc.

greetz

[NOP]

You can try

anywebpage.com##body,html:style(overflow: auto !important)

 

[LCF-AT]

Hey NOP,

its works! Great. Could you tell me why putting the html after body? What does it mean? Some kind of chain too or etc?

This I have in page source...

<html....>
<head>
<body class="enter" style="min-width: 400px;">

...there is class called enter which also has a "position: fixed" style. I found out when just using...

anywebpage.com##body:style(overflow: visible !important)

....no scrollbar is shown but when I change the position style of first class to any thing else than fixed (unset) then scroller is shown. Your method is better.

PS: Just have another question about uBO. So is it possible to block cookies with uBO? So I would like to block cookies (all and or specific cookies) for speicific websites. Same thing like to block websites just for cookies. On the uBO site I can find this info...

https://github.com/DandelionSprout/adfilt/blob/master/Wiki/SyntaxMeaningsThatAreActuallyHumanReadable.md

AdGuard only
--------------------------
Blocking

    $$script: Uses very advanced criteria to block scripts that meet them.
    $cookie: Blocks cookies.
    $cookie=: Blocks cookies with specific names.
    $cookie= + maxAge: Changes the cookie to have an expiration time in seconds.
    $cookie= + same-site: Changes the cookie to use the "Lax" mode of samesite known from the Set-Cookie browser HTTP response system.
    $mp4: Seems to be equivalent to $redirect=noopmp4, but does not require any AdGuard trust rights. Allegedly to be obsoleted soon.
    @@ + $urlblock: Turns off file-request blocking entirely while on that domain.

....to block cookies. Seems that uBO dosen't handle cookies blocks. Are there any other tools I could try? Just would like to block / check & change cookies for speicific sites.

greetz

[NOP]

anywebpage.com##body,html:style(overflow: auto !important)

is = to

anywebpage.com##body:style(overflow: auto !important)
anywebpage.com##html:style(overflow: auto !important)

No uBO cannot block cookies

cookies are generally good and required to store session data and user preferences like language and currency preference etc.

They are bad when stored cookies track your previous data. I use a cookie auto deleter so as soon as I close my browser tab the cookie is auto deleted unless on my whitelist for forum cookies which store logins

[LCF-AT]

Hi again,

ah ok you mean just both seperated by comma as hosts and classes etc. I tried this too with another webiste and it fails and I had again to unset the position css. I found other extension called...

https://github.com/Sesu8642/CookieRipper

....seems to be ok to block & whitelist specific cookies.

greetz

[NOP]

15 minutes ago, LCF-AT said:

I found other extension called...

https://github.com/Sesu8642/CookieRipper

....seems to be ok to block & whitelist specific cookies.

Looks good, I think I'll give it a try 😀

[LCF-AT]

One more info about that Cookie Ripper AddOn/Extension. Seems to be really good but the bad thing is thats not having any export / import options to save all whitelist & site exceptions like uBO & NoScript have. I also don't see any forks of this app anyone else would work go on with it etc.

My question now is whether there is a way to find out where the infos / settings are stored of this extension? Lets say I start / create a new browser instance and wanna import my whitelists / exceptions etc you know. Really bad that the app creater didn't add such a feature.

greetz

[NOP]

I also didn't like it. i've reverted back to my cookie autodeleter 🙂

[LCF-AT]

I still have it and test around. Problem in this extension is also that I can not save a specific cookie with a value X for specific site. Do you know any? I mean lets say I call a website and when this site is trying to create a cookie called "XTS: 0" then I wanna check for this cookie XTS and checking whats inside for a value which is 0 in this case and this I wanna set to 1 for example etc. Is there anything? Would be cool if uBO could do this to have blocking stuff & co into one AddOn. So in the example above the XTS: 0 cookie which is an local storage / web storage cookie tell the webpage that a popwindow was NOT executed yet what mean when I click anywhere on the webpage its calling a popup to any other webpage and right after that the XTS cookie does change to value 1 and the next times the popup will no more executed but when I change this back to 0 on fly then popup just again etc. Thats pretty bad I wanna remove this behavior and setting the XTS cookie to value 1 right after the cookie was created. Just need to find any other extension what can do this.

greetz

[LCF-AT]

One more thing. So how are those local web storage cookies set? In browser I don't see them. I found another extension...

https://github.com/gera2ld/request-x

....you can change requests etc and cookies (no storage cookies) but not working etc. Hhmm, need to find any other extension to manage all cookies.

greetz

[NOP]

You can see what a page is using by checking the storage inspector in developer tools

They are set via the webpage via PHP or Javascript etc.

[whoknows]

Quote

js - https://www.w3schools.com/js/js_cookies.asp
asp vanilla - https://www.w3schools.com/asp/asp_cookies.asp
php - https://www.w3schools.com/php/php_cookies.asp

 

[LCF-AT]

Hi again,

just checked out many different cookie addons but none of them can handle those storage cookies only session cookies. Hhmm. Is it just not possible to do this with any AddOn? I would like to modify a local storage cookie on fly but how except doing it manually in browser console?

greetz

Edited August 13, 2022 by LCF-AT

[LCF-AT]

Hi,

just wanna ask how I can execute and test some JavaScript examples codes in my Firefox console window?

Example page I can test JS to create a cookie etc.

https://www.w3schools.com/js/tryit.asp?filename=tryjs_cookie_username

Now I would like to do same directly in console window. Like this just to check a cookie. I tried to enter this code into the pad...

function checkCookie() {
  let user = getCookie("username");
  if (user != "") {
    alert("Welcome again " + user);
  } else {
     user = prompt("Please enter your name:","");
     if (user != "" && user != null) {
       setCookie("username", user, 30);
     }
  }
}

....and get just "<- undefined" in console after execute this code. How to do this here? Lets say I wanna write any example script and I want to test it directly in console you know. So whats the different now in console & website example? I thought I could write the same code I can read between the script tags. Can anyone tell me how to use this console with JS code parts etc?

greetz

[kao]

There are 2 steps:
1) enter the code. I'm guessing you did this. Did you remember to copy "getCookie" and setCookie" functions too?
2) actually run the code. Now try entering "checkCookie()" in the console few times.