Ublock Code
Klaudia Aricas
uBlock Origin (/ˈjuːblɒk/ YOO-blok[5]) (previously uBlock and originally μBlock) is a free and open-source browser extension for content filtering, including ad blocking. The extension is available for Chrome, Chromium, Edge, Firefox, Brave, Opera, Pale Moon, as well as versions of Safari before 13.[6] uBlock Origin has received praise from technology websites and is reported to be much less memory-intensive than other extensions[7][8] with similar functionality.[9][10] uBlock Origin's stated purpose is to give users the means to enforce their own (content-filtering) choices.[11][12]
uBlock was initially named "μBlock" but the name was later changed to "uBlock" to avoid confusion as to how the Greek letter μ (Mu/Micro) in "μBlock" should be pronounced.[citation needed] Development started by forking from the codebase of HTTP Switchboard along with another blocking extension called uMatrix, designed for advanced users.[13] uBlock was developed by Raymond Hill to use community-maintained block lists,[14] while adding features and raising the code quality to release standards.[15] First released in June 2014 as a Chrome and Opera extension, in 2015 the extension became available in other browsers.[citation needed]
A joint Sourcepoint and comScore survey reported an 833% growth from November 2014 to August 2015, the strongest growth among adblockers listed.[16] The report attributed the growth to the desire of users for pure blockers, outside the "acceptable ads" program operated by Adblock Plus.[17]
On April 3, 2015, Hill transferred the uBlock project to Chris Aljoudi due to frustrations with dealing with requests as the project's popularity increased.[18] "These projects are to me, not a full time job. It stopped being a hobby when it felt more and more like a tedious job. I will keep maintaining my version (and share with whoever care to use it) because it guarantees the tool will match what I want out of it."[19] Hill created his own fork and renamed it uBlock Origin on April 6.[20]
Since October 2017, uBlock Origin has been completely separated from Aljoudi's uBlock.[21] Aljoudi created ublock.org to host and promote uBlock and to request donations. In response, uBlock's founder Raymond Hill stated that "the donations sought by ublock.org are not benefiting any of those who contributed most to create uBlock Origin."[6] The development of uBlock stopped in August 2015 but there were sporadic updates from January 2017.[22]
In July 2018, ublock.org was acquired by AdBlock and resumed development.[23] From February 2019, uBlock began allowing users to participate in "acceptable ads",[24][25] a program run by Adblock Plus that allows some ads deemed "acceptable" and nonintrusive, and for which larger publishers pay a fee.[26]
uBlock Origin remains independent and does not allow ads for payment.[27] The project refuses donations and instead advises supporters to donate to maintainers of block lists.[28] Hill continued to work on the extension under the name uBlock Origin, abbreviated as uBO[29] and originally as uBlock0.[30]
On December 11, 2016, Nik Rolls released a fork of uBlock Origin for the Microsoft Edge browser (now known as Microsoft Edge Legacy).[34] In April 2020, this fork was deprecated as Microsoft replaced Microsoft Edge Legacy with a Chromium-based Edge.[35]
uBlock Origin supports the majority of Adblock Plus's filter syntax. The popular filter lists EasyList and EasyPrivacy are enabled by default. The extensions are capable of importing hosts files and a number of community-maintained lists are available at installation. Among the host files available, Peter Lowe's ad servers & tracking list and lists of malware domains are also enabled as default. Some additional features include dynamic filtering of scripts and iframes and a tool for webpage element hiding.[citation needed]
Site-specific switches to toggle the blocking of pop-ups, strict domain blocking, cosmetic filtering, blocking remote fonts, and JavaScript disabling were also added to uBlock Origin.[39] The Firefox version of uBlock Origin has an extra feature which helps to foil attempts by web sites to circumvent blockers.[40]
In November 2019, a uBlock Origin user reported a novel technique used by some sites to bypass third-party tracker blocking. These sites link to URLs that are sub-domains of the page's domain, but those sub-domains resolve to third-party hosts via a CNAME record. Since the initial URL contained a sub-domain of the current page, it was interpreted by browsers as a first-party request and so was allowed by the filtering rules in uBlock Origin (and in similar extensions). The uBlock Origin developer came up with a solution using a DNS API which is exclusive to Firefox 60+.[41] The new feature was implemented in uBlock Origin 1.25, released on February 19, 2020.[42]
Technology websites and user reviews for uBlock Origin have regarded the extension as less resource-intensive than extensions that provide similar feature sets such as Adblock Plus.[43][44][45] A benchmark test, conducted in August 2015 with ten blocking extensions, showed uBlock Origin as the most resource-efficient among the extensions tested.[46]
uBlock Origin surveys what style resources are required for an individual web page rather than relying on a universal style sheet. The extension takes a snapshot of the filters the user has enabled, which contributes to accelerated browser start-up speed when compared to retrieving filters from cache every time.[47]
In 2023, Google made changes known as "Manifest V3" to the WebRequest API used by ad blocking and privacy extensions to block and modify network connections.[48][49] Following Google's implementation of Manifest V3 and the end of support for V2, uBlock Origin's effectiveness is drastically reduced in Google Chrome and other Chromium-based browsers.[50][51][52] The alternative 'uBlock Origin Lite' for Chromium browsers lacks filter list updates outside of extension updates, and has no custom filters, strict-blocked pages, per-site switches, or dynamic filtering. Non-Chromium browsers such as Firefox are unaffected.[53] Google has been criticized for implementing some of these features due to its domination in the online advertising market.[54][55][56][57]
I've recently cloned uBlock Origin's source code repository and attempted to add blocklists by editing the assets.json file. However, despite making the necessary changes, building the project using make, and then installing the extension in the browser, the blocklists are still not being added.
I expected a modification to include the specified blocklist in the built uBlock Origin extension, but it doesn't seem to be working as intended. Need to add blocklists.txt from my github repository as a default blocklists in ubo extenstion.
Can anyone provide guidance on why the blocklists aren't being added even after editing the assets.json file? Am I missing any additional steps or configurations that are necessary for integrating custom blocklists into the uBlock Origin build process?
uBlock is open source and suppose I trust the author. But filter lists are something that is maintained by other people. Is it possible to add something to a filter list to compromise computer/browser, for example, get my data and send them to the attacker's server?
High-medium generic filters are implemented as follow: All the high-medium generic filters which matches the 8 first characters of the URL of a link on a web page will be seen as relevant to the web page and thus a CSS selector based on these filters will be injected in the web page, in order to hide the unwanted links.
If the author of the extension not only hides DOM elements, but injects something (CSS?, only CSS?, is safe to inject CSS?) to the page, can it be possible to inject JS script to all my pages, which will send my data to the attacker's server?
Without doing a complete code review of uBlock, the answer would be "yes" the author of an extension that has access to modify the DOM could add and remove CSS and JS. The LastPass chrome extension injects javascript to form-fill passwords. uBlock uses CSS and blocks remote library requests. Both of these permissions can lead to vulnerabilities and unintended consequences such as the recent revelation that CSS can be used to steal credit card information under certain circumstances.
Thanks for the detailed background explanation @Mathwiz!
So, is there any disadvantage with using 1.17.4, which presumably will not now update any more on FF 52 ESR?
As long as it's still getting block list updates does it matter that 1.16.4.18 is actually later code?
Have any security flaws been patched which are in 1.17.4 for instance?
Cheers, Dave.
So, is there any disadvantage with using 1.17.4, which presumably will not now update any more on FF 52 ESR?
As long as it's still getting block list updates does it matter that 1.16.4.18 is actually later code?
Have any security flaws been patched which are in 1.17.4 for instance?
Thanks, again good to know more of the background to this.
I've uninstalled 1.17.4 and installed 1.16.4.18 instead.
Seems to be working fine except for the annoying warning in the add-ons list that it can't be verified.
Aside from the WebRTC blocking feature I mentioned (which may not be an issue for you; it probably matters only to users behind, e.g., corporate firewalls), the only major change was Convert new shorthands back to legacy syntax when fetching filter lists using firefox-legacy (pull request by JustOff). Basically the syntax for filter lists was updated recently, so older uBO versions like 1.17.4 won't understand filters with the new syntax.
Thank you.
1.16.4.18 seems to be still working fine.
I've also suppressed the warnings in the add-ons list using an addition to the userContent.css file I was already using to get the videos on Instagram to display.