Build and connect fails on newer Chrome

[t2ym]

Build and connect fails on newer Chrome

Root Causes and Ad-hoc Patches (Under Investigation)

• puppeteer is too old (See [chrome] Not working on the latest Chrome browsers (151 at the time of the issue submission) reportage#13) - Update puppeteer

 "overrides": {
    "puppeteer": "^25.5.0",
  ...
  },

• puppeteer and Chrome refuses to access with untrusted certificates - Update cacheBundleGeneration.js and config.js ( ignoreHTTPSErrors: true, '--ignore-certificate-errors'); as well as --no-sandbox

diff --git a/backend/cacheBundleGeneration.js b/backend/cacheBundleGeneration.js
index c26e886..9b30a33 100644
--- a/backend/cacheBundleGeneration.js
+++ b/backend/cacheBundleGeneration.js
@@ -62,10 +62,12 @@ targetURL = (loadOnly ? process.argv[3] : process.argv[2]) || targetURL;
   console.log('serverSecret', serverSecret);
   await new Promise(resolve => setTimeout(resolve, 4000));
   console.log('wait 4000');
-  let browser = await puppeteer.launch({ headless: 'new', dumpio: true, args: ['--disable-gpu', '--no-sandbox', /*'--enable-logging=stderr',*/ '--no-setsuid-sandbox'], executablePath: chromePath }); // terse and fastest
-  //let browser = await puppeteer.launch({ headless: false, dumpio: true, args: [ '--disable-gpu', '--enable-logging=stderr' ], executablePath: chromePath });
+  //let browser = await puppeteer.launch({ headless: 'new', dumpio: true, args: ['--disable-gpu', '--no-sandbox', /*'--enable-logging=stderr',*/ '--no-setsuid-sandbox'], executablePath: chromePath }); // terse and fastest
+  let browser = await puppeteer.launch({ headless: false, dumpio: true, pipe: true, ignoreHTTPSErrors: true, 
+    args: [ '--disable-gpu', '--enable-logging=stderr', '--ignore-certificate-errors', ], executablePath: chromePath });
   //let browser = await puppeteer.launch({ headless: false, dumpio: true, args: [ '--disable-gpu', '--enable-logging=stderr', '--auto-open-devtools-for-tabs' ], executablePath: chromePath });
   let page = await browser.newPage();
+  await page.setDefaultNavigationTimeout(600000); 
   await page.setViewport({ width: 1200, height: 800 });
   /*

• Chrome caching strategy change causes the failure of 'only-if-cached' access in integrity.js - Use 'default' option for fetch() with slight security impact, which would be cancelled by validation.

diff node_modules/thin-hook/plugins/integrity-js/integrity.js /tmp/integrity.js 
1860c1860
<             ? await (await fetch(scriptElement.src, { mode: 'same-origin', cache: 'only-if-cached' })).text()
---
>             ? await (await fetch(scriptElement.src, { mode: 'same-origin', cache: 'default'/*'only-if-cached'*/})).text()
2055c2055
<           let request = new Request(serviceWorkerPath, { headers: headers, mode: 'same-origin', cache: 'only-if-cached', integrity: integrity });
---
>           let request = new Request(serviceWorkerPath, { headers: headers, mode: 'same-origin', cache: 'default'/*'only-if-cached'*/, integrity: integrity });
2560c2560
<                 response = await fetch(new Request(url), { mode: 'same-origin', cache: 'only-if-cached' });
---
>                 response = await fetch(new Request(url), { mode: 'same-origin', cache: 'default'/*'only-if-cached'*/ });
2573c2573
<                 response = await fetch(new Request(url), { mode: 'same-origin', cache: 'only-if-cached', integrity: scripts[url] });
---
>                 response = await fetch(new Request(url), { mode: 'same-origin', cache: 'default'/*'only-if-cached'*/, integrity: scripts[url] });

• Patching the integrity-js plugin is easier with the following approach: overrides the plugin locally in hooked-app

 "dependencies": {
    "@thin-hook/integrity-js": "file:plugins/integrity-js",
    ...
  },
  "overrides": {
    "@thin-hook/integrity-js": "$@thin-hook/integrity-js",
    ...
  }

hooked-app/plugins/
hooked-app/plugins/integrity-js
hooked-app/plugins/integrity-js/integrity.js
hooked-app/plugins/integrity-js/package.json
hooked-app/plugins/integrity-js/configurator.js

Notes

• The new Chrome behavior for caching has not been confirmed. The above observation may be fragile and dependent on my environments (such as race conditions on my slow VM, etc.)
• Other approaches are under investigation
  • Serve no-hook scripts with cache-control: private, max-age=1, no-transform and let fetch obtain the cached contents quickly and sleep 1 second - obviously fragile and introducing drawbacks
  • Other smart combinations of cache-control header values and fetching options

[t2ym]

Side effects of cache: 'default' instead of 'only-if-cached'

• The fetching of the no-hook scripts in integrity.js actually fetches the files from the server instead of the cached contents.
• The suggested vulnerability introduced by this behavior can be cancelled by implementing Validation Service, while the current HTMLHash and ScriptHash can also serve as blockers for naive MITM attacks