Repository navigation
Chromium extension: reveal hidden Unicode on the page - #113
Conversation
Ship editors/browser as an unpacked MV3 extension using the same fuckmark-hidden-scan-v1 scan.js copy as VS Code. Popup scans pasted text, optional paste-safe strips hidden characters on paste while keeping emoji ZWJ sequences, and Reveal paints U+XXXX badges on the current http(s) page. Nothing is uploaded. Co-authored-by: Byte271 <byte271@users.noreply.github.com>
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Team Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
The popup can be opened as a plain page for the paste scanner. Do not paint Scan this page as the primary action unless chrome.tabs is present. Co-authored-by: Byte271 <byte271@users.noreply.github.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0bd3353aa4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| event.preventDefault(); | ||
| insertCleaned(event.target, result.cleaned); |
There was a problem hiding this comment.
When paste-safe is enabled on a contenteditable or custom editor with its own paste listener, preventDefault() only cancels the browser's default insertion; the page listener still receives the unchanged event.clipboardData and can insert the hidden Unicode after this handler inserts the cleaned text. Thus paste-safe can be bypassed or produce duplicate content on common rich-text editors unless the raw event is prevented from reaching page handlers.
Useful? React with 👍 / 👎.
| const security = new Set(scan.DEFAULT_SECURITY_CATEGORIES); | ||
| if (!finding || !security.has(finding.category)) return false; | ||
| return finding.severity !== "info"; |
There was a problem hiding this comment.
The scanner labels a ZWJ as info when either neighbor is emoji-like, and this blanket severity check therefore preserves inputs such as 😀admin or admin😀. Those are not emoji ZWJ sequences, yet both paste-safe and “Copy security-clean text” leave the invisible character intact; preservation should require a valid emoji sequence rather than merely an info severity.
Useful? React with 👍 / 👎.
| chrome.action.setBadgeBackgroundColor({ color: color }); | ||
| chrome.action.setBadgeText({ text: text }); |
There was a problem hiding this comment.
When multiple tabs are open, omitting tabId makes these badge settings global, so scanning tab A causes the same finding count to appear on unrelated tab B and remain there when the user switches tabs. Pass the originating tab ID through setBadge (including from the message sender) so the displayed count represents the current page.
Useful? React with 👍 / 👎.
Trojan Source bidi in a comment or string stays on that role even when the next glyph is emoji, so severity stays critical. Truncated Python /api/scan results now keep counts, the truncated flag, and peak severity across every hit, not only the first 256 listed findings. Freeze record v3 binds the new vectors. Co-authored-by: Byte271 <byte271@users.noreply.github.com>
Co-authored-by: Byte271 <byte271@users.noreply.github.com>
Paste-safe now stopImmediatePropagation so page listeners cannot insert the raw clipboard after a cleaned paste. ZWJ is kept only when both neighbors are emoji (or a variation selector), so grin+ZWJ+admin is stripped. Toolbar badges are scoped to the scanned tab. Co-authored-by: Byte271 <byte271@users.noreply.github.com>
2 participants
Stacked on #112 so this diff is the Chromium extension only.
What this does
Adds
editors/browser: an unpacked Manifest V3 extension that uses the samefuckmark-hidden-scan-v1scan.jscopy as VS Code (byte-identical; the freeze tests now include this copy).U+XXXXbadges (CSS Custom Highlight when the browser supports it).stopImmediatePropagationso page editors cannot insert the raw clipboard afterward.clipboardRead, no remote code, nothing uploaded. Content script ishttp://andhttps://only.Load unpacked from
chrome://extensions→ this folder.Depends on
#112 (language-aware
scan.js/ UMD export). Merge that first, then this.Review follow-up
Addressed the Codex notes: per-tab badges, ZWJ keep only for true emoji joins (
grin+ZWJ+adminis stripped), and paste-safe blocks later pagepastehandlers.Package version stays 0.4.1.