☰

secure-eval-blocker-enhanced

强化版：阻止 eval、Function、WASM、动态脚本注入，保护隐私，支持 HTTP/HTTPS 自动适配，防篡改，多层防御结构。

// ==UserScript==
// @name         secure-eval-blocker-enhanced
// @namespace    https://github.com/secure-scripting
// @version      2.0.0
// @description  强化版：阻止 eval、Function、WASM、动态脚本注入，保护隐私，支持 HTTP/HTTPS 自动适配，防篡改，多层防御结构。
// @author       anonymous
// @match        *://*/*
// @grant        none
// @run-at       document-start
// ==/UserScript==

(function() {
  'use strict';

  const $win = window, $doc = document, $obj = Object;
  const WHITELIST = ['trusted.com', 'example.com']; // ⬅️ 可自定义可信域名
  const isTrusted = WHITELIST.includes($doc.location.hostname);

  const BLOCK = (reason) => {
    const msg = `⚠️ Blocked: ${reason}`;
    console.warn(msg);
    throw new Error(msg);
  };

  // 🔐 拦截动态执行
  const blockDynamicCode = () => {
    const stub = () => BLOCK('Dynamic code execution (eval or Function)');
    $obj.defineProperty($win, 'eval', { value: stub, writable: false, configurable: false });
    $obj.defineProperty($win, 'Function', { value: stub, writable: false, configurable: false });
  };

  // ⏲️ 拦截字符串形式的定时器
  ['setTimeout', 'setInterval'].forEach((fn) => {
    const original = $win[fn];
    $win[fn] = function(arg, delay) {
      if (typeof arg === 'string' && !isTrusted) BLOCK(`${fn} with string argument`);
      return original(arg, delay);
    };
  });

  // 🧱 拦截 WebAssembly 和 Worker
  const blockWasmWorker = () => {
    $obj.defineProperty($win, 'WebAssembly', {
      value: { compile() { BLOCK('WebAssembly.compile'); } },
      writable: false,
      configurable: false
    });
    $obj.defineProperty($win, 'Worker', {
      value: function() { BLOCK('Web Worker'); },
      writable: false,
      configurable: false
    });
  };

  // 🔐 拦截本地存储与 cookie
  ['localStorage', 'sessionStorage', 'cookie'].forEach((key) => {
    try {
      $obj.defineProperty($win, key, {
        get: () => BLOCK(`Access to ${key}`),
        set: () => BLOCK(`Modification of ${key}`),
        configurable: false
      });
    } catch (_) {}
  });

  // 🧬 清洗 innerHTML/outerHTML
  const sanitizer = (str) => {
    if (typeof str !== 'string') return str;
    return str
      .replace(/<script[^>]*>.*?<\/script>/gi, '')
      .replace(/<svg[^>]*>.*?<\/svg>/gi, '')
      .replace(/\bon\w+\s*=/gi, '');
  };

  ['innerHTML', 'outerHTML'].forEach((prop) => {
    const original = $obj.getOwnPropertyDescriptor(Element.prototype, prop);
    $obj.defineProperty(Element.prototype, prop, {
      set: function(val) {
        if (!isTrusted) return original.set.call(this, sanitizer(val));
        return original.set.call(this, val);
      },
      get: original.get,
      configurable: false
    });
  });

  // 🧾 禁用 document.write
  const originalWrite = $doc.write;
  $doc.write = function(html) {
    if (!isTrusted) BLOCK('document.write usage');
    return originalWrite.call($doc, html);
  };

  // 📜 拦截 script 标签注入
  const originalCreateElement = $doc.createElement;
  $doc.createElement = function(tag, ...args) {
    const el = originalCreateElement.call(this, tag, ...args);
    if (tag.toLowerCase() === 'script' && !isTrusted) {
      $obj.defineProperty(el, 'innerHTML', {
        set: function() { BLOCK('Dynamic <script> injection'); }
      });
    }
    return el;
  };

  // 🧲 监控全页面 meta 标签 CSP 篡改
  const observer = new MutationObserver((mutations) => {
    mutations.forEach((m) => {
      m.addedNodes.forEach((node) => {
        if (node.tagName === 'META' && node.getAttribute('http-equiv') === 'Content-Security-Policy') {
          node.remove();
          BLOCK('CSP override attempt');
        }
      });
    });
  });
  observer.observe($doc.documentElement, { childList: true, subtree: true });

  // 🎯 设置 Content-Security-Policy（支持 HTTP / HTTPS）
  const meta = $doc.createElement('meta');
  meta.setAttribute('http-equiv', 'Content-Security-Policy');
  meta.setAttribute('content', "default-src 'none'; script-src 'self'; object-src 'none'; img-src 'self'; connect-src 'self'; style-src 'self';");
  $doc.head.appendChild(meta);

  // 🧪 自毁机制
  if (!$win.secureEvalBlocker) {
    $obj.defineProperty($win, 'secureEvalBlocker', { value: true, writable: false });
    blockDynamicCode();
    blockWasmWorker();
  }
})();