fix: re-scan ad elements when href or text mutates in-place#20
Merged
Conversation
The MutationObserver was only watching childList+subtree, so elements that already had data-mt-checked=1 were never re-evaluated if a script mutated their href attribute or text content in-place — common on SPAs like YouTube or Instagram. Add attributes:true and characterData:true to the observer config. On attribute/characterData mutations, clear data-mt-checked from the directly-affected target before the debounced scan fires, so isMalicious gets a fresh look at the updated element. Fixes #15.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What's broken
The
MutationObserverinmaliciousAdBlocker.jsonly watcheschildList + subtree. That covers node additions and removals fine, but on SPAs (YouTube, Instagram, etc.) scripts frequently swap an existing element'shrefortextContentwithout touching the DOM tree structure — so those mutations never fire the observer. Because every scanned element getsdata-mt-checked = '1', a link that was clean on initial load stays unchecked forever even after a script rewrites it to a malicious URL.What this changes
attributes: truewithattributeFilter: ['href', 'src']to the observer config, so in-placehref/srcswaps trigger a rescan.characterData: trueto catch text content changes on existing nodes.data-mt-checkedfrom the directly-affected element before the debouncedscan()fires — soisMaliciousgets a fresh look at the updated content instead of skipping it.The debounce logic and scan behaviour are otherwise unchanged.
Fixes #15.