Add a scriptlet to intercept atob call and prune its text output

[Yuki2718]

Prerequisites

• I verified that this is not a filter list issue. Report any issues with filter lists or broken website functionality in the uAssets issue tracker.
• This is NOT a YouTube, Facebook or Twitch report. These sites MUST be reported by clicking their respective links.
• This is not a support issue or a question. For support, questions, or help, visit /r/uBlockOrigin.
• I performed a cursory search of the issue tracker to avoid opening a duplicate issue.
• The issue is not present after disabling uBO in the browser.
• I checked the documentation to understand that the issue I am reporting is not normal behavior.

I tried to reproduce the issue when...

• uBO is the only extension.
• uBO uses default lists and settings.
• using a new, unmodified browser profile.

Description

AdguardTeam/Scriptlets#410

A specific URL where the issue occurs.

https://www.youtube.com/watch?v=35kwlY_RR08

Steps to Reproduce

Not trivial if you don't have an account reached the 3-strikes warning count but see the link

Expected behavior

NA

Actual behavior

NA

uBO version

1.56.0

Browser name and version

Google Chrome 122.0.6261.95

Operating System and version

Windows 10

[gorhill]

A generic approach of what you are asking is trusted-replace-outbound-text.

[stephenhawk8054]

Looks like recently they are using the same method for their new type of ads so I think it's good to have trusted-replace-outbound-text in this dev cycle.

[Yuki2718]

Yes, now this issue should be given higher priority than before, as it is used for SSAP ads too.

[troysjanda]

what would an example filter look like?

[iam-py-test]

As I understand it:

##+js(trusted-replace-outbound-text, [function to target], [string to replace/pattern], [replacement])

Example:

example.com##+js(trusted-replace-outbound-text, atob, foo, bar)

Thanks

[Yuki2718]

Update: NVM, as I replaced whole trackingParam, the error always occurs as it doesn't match actual trackingParam of mine.

I replicated 282054944 error with

||www.youtube.com/watch?v=$doc,xhr,1p,replace=/"trackingParam":"kx_fmPxhoPZR[-_0-9A-Za-z]+?[-_0-9A-Za-z]{45}lLKPQ-SS"\}/"trackingParam":"kx_fmPxhoPZRS0Wj9ol2lYijBzUieMcOF7P3Jfc8Boa8uj6tqwJxJcpJN3DxUP9Xk_c5292Mcn9BZ9ZQoa0PoLk8Q6kBWQKla3TeAwsdgE-iFUM4YAbzRgkuMsNLBwOcCE59TDtslLKPQ-SS"}/
||www.youtube.com/youtubei/v1/player?$xhr,1p,replace=/"trackingParam":"kx_fmPxhoPZR[-_0-9A-Za-z]+?[-_0-9A-Za-z]{45}lLKPQ-SS"\}/"trackingParam":"kx_fmPxhoPZRS0Wj9ol2lYijBzUieMcOF7P3Jfc8Boa8uj6tqwJxJcpJN3DxUP9Xk_c5292Mcn9BZ9ZQoa0PoLk8Q6kBWQKla3TeAwsdgE-iFUM4YAbzRgkuMsNLBwOcCE59TDtslLKPQ-SS"}/

but

www.youtube.com##+js(trusted-replace-outbound-text, atob, /\n.\n.playerConfig\.ssapConfig\.ssapPrerollEnabled.{2}(?:tru|fals)e/, )

doesn't work. Hm, but I'm not sure as neither

www.youtube.com##+js(trusted-rpnt, script, /^(\(function serverContract\(\))/s, "(()=>{const wrapper=(target,thisArg,args)=>{let content=Reflect.apply(target,thisArg,args);if(content.includes('ssapPrerollEnabled')){const modifiedContent=content.replace(/\n.\n.playerConfig\.ssapConfig\.ssapPrerollEnabled.{2}(?:tru|fals)e/,'');return modifiedContent;}return content;};const handler={apply:wrapper};window.atob=new Proxy(window.atob,handler);})();$1")

work in this case.

[Yuki2718]

How to log this scriptlet?

[ryanbr]

Maybe add an log option, so if its succesful or not in replacing a function.

[stephenhawk8054]

I haven't found how to log it when successful yet, but you can log the outbound text in general by

example.com##+js(trusted-replace-outbound-text, atob)

---

@gwarser Sorry, do you know how safe.logLevel works?

[gorhill]

do you know safe.logLevel works?

It's the speaker in the logger.

[stephenhawk8054]

Oh... This is the first time I hear about it. Don't know why I haven't wondered myself about what that button is 😄

---

Yeah, confirm I can see the outbound text now

[uBlock-user]

trusted-replace-outbound-text

They can be used to address reddit's data collection and tracking I think.