CVE-2015-2692 (JavaScript, published 2017-06-08T21:29Z)
Description: value: AdBlock before 2.21 allows remote attackers to block arbitrary resources on arbitrary websites and to disable arbitrary blocking filters.
Severity: MEDIUM (CVSS v3 base score: 10)
Weakness: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Repository: https://github.com/kzar/watchadblock
Files changed:
.git_cache_meta
md5sum.txt
src/CHANGELOG.txt
src/Info.plist
src/_locales/en/messages.json
src/adblock_start_common.js
src/background.js
src/filtering/myfilters.js
src/jquery/css/jquery-ui.custom.css
src/jquery/css/override-page.css
src/manifest.json
src/options/customize.js
src/pages/adreport.html
src/tools/update_l10n.pl
Commit message: Release new version 2.21

+2.21:
+- Removed the Norwegian filter list since it is no longer active. (#489)
+- For each subscribe filter list, added the last update timestamp to debug data. (#482)
+- Added the malware notification setting to debug data. (#458)
+- Added additional CSS to whitelist/blacklist dialogs to avoid display issues on some websites. (#460)
+- Removed an unnecessary call to sendResponse. (#484)
+- Added a user confirmation prompt when subscribing to a new filter lists using the ABP syntax. (#486)
+- Fixed an issue when the request URL didn't contain a '.' (#500)
+- Updated the Chrome web store description.(#501)
+


Vulnerable code:
	<string>2.20.1</string>
	<string>102.20.1</string>
    "message":"The most popular Chrome extension in the world, a customizable ad blocker that blocks ALL ads for free by default.",
      BGcall("subscribe", {id: "url:" + loc, requires: reqList, title: title});
      // Open subscribe popup
      if (SAFARI) {
      } else {
            var pos = url.pathname.lastIndexOf('.');
            if (pos === -1) {
                return type;
        var ext = url.pathname.slice(pos) + '.';
        if ('.eot.ttf.otf.svg.woff.woff2.'.indexOf(ext) !== -1) {
            return 'font';
        }
        // Still need this because often behind-the-scene requests are wrongly
        // categorized as 'other'
        if ('.ico.png.gif.jpg.jpeg.webp.'.indexOf(ext) !== -1) {
            return 'image';
        }
        // https://code.google.com/p/chromium/issues/detail?id=410382
        if (type === 'other') {
            return 'object';
        }
          if (get_subscriptions[id].subscribed)
      if (id === "easylist_plus_spanish") {
      case 'no': return 'norwegian';
    "norwegian": {  // Additional Norwegian filters
      url: "http://home.fredfiber.no/langsholt/adblock.txt",
      requiresList: "easylist",
    },
.ui-dialog { position: absolute; width: 300px; overflow: hidden; background-color: #F1F1F1; box-shadow: 3px 1px 9px 1px rgba(0, 0, 0, 0.25);}
.ui-dialog .ui-dialog-titlebar-close span { display: none; }
.ui-dialog .ui-dialog-buttonpane button { margin: .5em .4em; cursor: pointer; padding: 1px 4px; background: -webkit-gradient( linear, left top, left bottom, color-stop(0.05, #ededed), color-stop(1, #dfdfdf) ) !important;}
.ui-dialog.ui-state-hover button {
.ui-dialog .ui-dialog-buttonpane { 
}
  "version": "2.20.1",
  sendResponse({});
          <option value="norwegian;mailto:mlan76 at gmail.com" i18n="filternorwegian"></option>
    # take path to a folder to search as input
    my $folder = shift(@_);
    # search for html and js files and store list
    find(sub{
        return unless -f;
        return unless (/\.html$/ || /\.js$/);
        push(@files,$File::Find::name);
    },$folder);
    if ($project eq "contributors" || $project eq "installed"){

Fixed code:
touch -d "2015-03-20 19:47:57.0000000000" releases/AdBlock-v2.21.zip
755502d4262c519647a7f0e590ced244  releases/AdBlock-v2.21.zip
2.21:
- Removed the Norwegian filter list since it is no longer active. (#489)
- For each subscribe filter list, added the last update timestamp to debug data. (#482)
- Added the malware notification setting to debug data. (#458)
- Added additional CSS to whitelist/blacklist dialogs to avoid display issues on some websites. (#460)
- Removed an unnecessary call to sendResponse. (#484)
- Added a user confirmation prompt when subscribing to a new filter lists using the ABP syntax. (#486)
- Fixed an issue when the request URL didn't contain a '.' (#500)
- Updated the Chrome web store description.(#501)

	<string>2.21</string>
	<string>102.21</string>
    "message":"AdBlock. The #1 ad blocker with over 200 million downloads. Blocks YouTube, Facebook and ALL ads by default (unlike Adblock Plus).",
  "subscribeconfirm":{
    "message":"Are you sure that you want to subscribe to the $title$ filter list?",
    "description":"Prompt question before subscribing to the filter list",
    "placeholders":{
      "title":{
        "content":"$1",
        "example":"Prebake"
      }
    }
  },
//cache a reference to window.confirm
//so that web sites can not clobber the default implementation
var abConfirm = window.confirm;
      if (abConfirm(translate("subscribeconfirm", (title || loc)))) {
        BGcall("subscribe", {id: "url:" + loc, requires: reqList, title: title});
        // Open subscribe popup
        if (SAFARI) {
        } else {
        }
          var pos = url.pathname.lastIndexOf('.');
          if (pos > -1) {
            var ext = url.pathname.slice(pos) + '.';
            if ('.eot.ttf.otf.svg.woff.woff2.'.indexOf(ext) !== -1) {
              return 'font';
            // Still need this because often behind-the-scene requests are wrongly
            // categorized as 'other'
            if ('.ico.png.gif.jpg.jpeg.webp.'.indexOf(ext) !== -1) {
              return 'image';
            }
          }
        // see crbug.com/410382
        return 'object';
          if (get_subscriptions[id].subscribed) {
              subscribed_filter_names.push("  last updated: " + new Date(get_subscriptions[id].last_update).toUTCString());
          }
      // We need to hardcode malware-notification setting,
      // because it isn't included in _settings object, but just in localStorage
      adblock_settings.push("malware-notification: " + storage_get('malware-notification') + "\n");
      if (id === "easylist_plus_spanish" || id === "norwegian") {
.ui-dialog { position: absolute; width: 300px; overflow: hidden; background-color: #F1F1F1; box-shadow: 3px 1px 9px 1px rgba(0, 0, 0, 0.25); padding: 1px;}
.ui-dialog .ui-dialog-titlebar-close span { display: none !important; }
.ui-dialog .ui-dialog-buttonpane button { margin: .5em .4em; cursor: pointer; padding: 1px 4px !important; background: -webkit-gradient( linear, left top, left bottom, color-stop(0.05, #ededed), color-stop(1, #dfdfdf) ) !important; float: none; line-height: inherit;}
.ui-button-text {
  display: block !important;
}
.ui-dialog .ui-corner-all {
  border-radius: 5px;
}
.ui-dialog .ui-state-hover button {
.ui-dialog .ui-dialog-buttonpane {
}
  "version": "2.21",
  // a call to sendResponse is not needed because of the call in filters.js
    # take paths to folders to search as input
    my @folders = @_;
    
    foreach my $folder (@folders){
        # search for html and js files and store list
        find(sub{
            return unless -f;
            return unless (/\.html$/ || /\.js$/);
            push(@files,$File::Find::name);
        },$folder);
    }
    if ($project eq "contributors"){
    } elsif ($project eq "installed"){
        # l10n for /installed also contains l10n for /pay
        @files = html_js_files("$locale_dirs{$project}/../../", "$locale_dirs{$project}/../../../pay/");
        @strings = strings_in_use(@files);