From 7d587095acbf3505bfd5829ed28a8ab87a4d91ff Mon Sep 17 00:00:00 2001 From: wbamberg Date: Thu, 30 Aug 2018 10:55:06 -0700 Subject: [PATCH] Add an example using webRequest.getSecurityInfo() (#362) * Add an example using webRequest.getSecurityInfo() * Don't collect root certs if isUntrusted===true --- root-cert-stats/README.md | 15 ++++++++++++ root-cert-stats/background.js | 38 ++++++++++++++++++++++++++++++ root-cert-stats/icons/LICENSE | 1 + root-cert-stats/icons/icon-32.png | Bin 0 -> 259 bytes root-cert-stats/manifest.json | 25 ++++++++++++++++++++ root-cert-stats/popup.css | 13 ++++++++++ root-cert-stats/popup.html | 21 +++++++++++++++++ root-cert-stats/popup.js | 33 ++++++++++++++++++++++++++ 8 files changed, 146 insertions(+) create mode 100644 root-cert-stats/README.md create mode 100644 root-cert-stats/background.js create mode 100644 root-cert-stats/icons/LICENSE create mode 100644 root-cert-stats/icons/icon-32.png create mode 100644 root-cert-stats/manifest.json create mode 100644 root-cert-stats/popup.css create mode 100644 root-cert-stats/popup.html create mode 100644 root-cert-stats/popup.js diff --git a/root-cert-stats/README.md b/root-cert-stats/README.md new file mode 100644 index 0000000..f2b3d32 --- /dev/null +++ b/root-cert-stats/README.md @@ -0,0 +1,15 @@ +# root-cert-stats + +## What it does ## + +The extension includes: + +* a background page which collects stats about the trusted root certs used when +browsing the web. It records the subject name of each root cert, and how many +times that particular root cert was used to establish a TLS connection. + +* a browser action with a popup. The popup displays the collected stats. + +## What it shows ## + +* how to use the webRequest.getSecurityInfo() API. diff --git a/root-cert-stats/background.js b/root-cert-stats/background.js new file mode 100644 index 0000000..59c70f3 --- /dev/null +++ b/root-cert-stats/background.js @@ -0,0 +1,38 @@ +"use strict"; + +var rootCertStats = {}; + +/* +On an onHeadersReceived event, if there was a successful TLS connection +established, fetch the root cert and look at its subject. + +If we haven't seen this subject before, add it. If we have, increment its stats. +*/ +async function logRootCert(details) { + try { + let securityInfo = await browser.webRequest.getSecurityInfo( + details.requestId, + {"certificateChain": true} + ); + if ((securityInfo.state == "secure" || securityInfo.state == "weak") && + !securityInfo.isUntrusted) { + let rootName = securityInfo.certificates[securityInfo.certificates.length - 1].subject; + if (rootCertStats[rootName] === undefined) { + rootCertStats[rootName] = 1; + } else { + rootCertStats[rootName] = rootCertStats[rootName] + 1; + } + } + } + catch(error) { + console.error(error); + } +} + +/* +Listen for all onHeadersReceived events. +*/ +browser.webRequest.onHeadersReceived.addListener(logRootCert, + {urls: [""]}, + ["blocking"] +); diff --git a/root-cert-stats/icons/LICENSE b/root-cert-stats/icons/LICENSE new file mode 100644 index 0000000..e878a43 --- /dev/null +++ b/root-cert-stats/icons/LICENSE @@ -0,0 +1 @@ +The icon "icon-32.png" is taken from the IconBeast Lite iconset, and used under the terms of its license (http://www.iconbeast.com/faq/), with a link back to the website: http://www.iconbeast.com/free/. diff --git a/root-cert-stats/icons/icon-32.png b/root-cert-stats/icons/icon-32.png new file mode 100644 index 0000000000000000000000000000000000000000..b77538fa6b1663ecceb445d5aa86dbf3ffba992d GIT binary patch literal 259 zcmeAS@N?(olHy`uVBq!ia0vp^av;pX#=yYnV?NIW$dN2@jVKAuPb(=;EJ|f?Ovz75 zRq)JBOiv9;O-!jQJeg_(RJ7F7#WAGfR#L(N#(#$;e0W+I92f$b8Ce9BcWt$J(#ib) zWDzq^B_UJ>l>"], + "background": { + "scripts": [ "background.js" ] + }, + "icons": { + "32": "icons/icon-32.png" + }, + "applications": { + "gecko": { + "strict_min_version": "62.0b5" + } + } +} diff --git a/root-cert-stats/popup.css b/root-cert-stats/popup.css new file mode 100644 index 0000000..e590d0c --- /dev/null +++ b/root-cert-stats/popup.css @@ -0,0 +1,13 @@ +body { + font: 1rem/2 sans-serif; +} + +table, +td { + border: 1px solid #333; + padding: .3rem; +} + +.hidden { + display: none; +} diff --git a/root-cert-stats/popup.html b/root-cert-stats/popup.html new file mode 100644 index 0000000..6a705fc --- /dev/null +++ b/root-cert-stats/popup.html @@ -0,0 +1,21 @@ + + + + + + + Root cert stats + + + +
No data to display yet
+ + + + + + + + + + diff --git a/root-cert-stats/popup.js b/root-cert-stats/popup.js new file mode 100644 index 0000000..a7a582f --- /dev/null +++ b/root-cert-stats/popup.js @@ -0,0 +1,33 @@ +"use strict"; + +/* +Get the background page to access the rootCertStats object +*/ +const backgroundPage = browser.extension.getBackgroundPage(); + +let entries = Object.keys(backgroundPage.rootCertStats); + +/* +If there are any stats, show the table, and append one row for each entry. +Each row contains the name of the CA and the number of times it has been +used as a trust root. +*/ +if (entries.length > 0) { + + let noData = document.querySelector(".no-data"); + noData.classList.add("hidden"); + let entryTable = document.querySelector(".root-cert-table"); + entryTable.classList.remove("hidden"); + + for (let entry of entries) { + let entryTR = document.createElement("tr"); + let entryName = document.createElement("td"); + let entryValue = document.createElement("td"); + entryName.textContent = entry; + entryValue.textContent = backgroundPage.rootCertStats[entry]; + + entryTR.appendChild(entryName); + entryTR.appendChild(entryValue); + entryTable.appendChild(entryTR); + } +}