/*

	~~~ Opera Arioso!  ~~~ 

	by rvdh, 0x000000.com



*/



// Ariosos magic (ghost) varibales

window.opera.defineMagicVariable('arioso_links', function() {}, null);

window.opera.defineMagicVariable('arioso_sanitize_xss', function() {}, null);



// Arioso variables

var arioso_links = document.links;

var arioso_sanitize_xss = true;

var bad_arioso_schemes = '';



// Arioso arrays

var arioso_schemes = ["chrome:", "file:", "opera:", "res:", "data:", "telnet:", "about:", "resource:", "view-source:", "acrobat:", "mms:", "localhost", "loopback"];



// Arioso link enumerator detecting bad schemes

for (var i = 0; i < arioso_links.length;++i) {

    for (j = 0; j < arioso_schemes.length;++j) {

        if (arioso_links[i].toString().match(arioso_schemes[j])) {

            bad_arioso_schemes += arioso_schemes[j] + ' | ';

        }

    }

}





// Arioso evil JS blocker

window.opera.addEventListener('BeforeScript', function(e) {

    // prevent heap spraying, denial of service

    if (e.element.text.match(/for\s*\(\s*[a-z]\s*\=\s*[0-9]\s*;\s*[a-z]\s*(<|>|<=|>=|<==|>==)\s*[0-9]{3,}\s*;\s*/gim)) {

        arioso_alert = 'Possible heapspraying or denial of service vector found and blocked';

        e.preventDefault();

        // prevent heap spraying, stack/heap overflows

        }

    if (e.element.text.match(/(while|for|space|block|memory).*unescape\(("|')%([0-9]|\\x|\\u)([a-z]|[0-9])("|')\)/gim)) {

        arioso_alert = 'Possible heapspraying or denial of service vector found and blocked';

        e.preventDefault();

        // VBinjection

        }

    if (e.element.text.match(/String\(\s*[0-9]{6,},\s*"[a-z]"\)/gim)) {

        arioso_alert = 'VBInjection vector found and blocked';

        e.preventDefault();

        // prevent JS cookie stealing

        }

    if (e.element.text.match(/http:\/\/.*\?.*=.*(\+|concat|join).*document\.cookie/gim)) {



        arioso_alert = 'Cookie stealing attempt blocked';

        e.preventDefault();

        // prevent  non-same origin bad URI sourcing

        }

    if (e.element.text.match(/(src|href|location)\s*=.*(localhost|loopback|telnet:|file:|res:|resource:|about:|javascript:|data:)/gim)) {

        arioso_alert = 'Prevented non-same origin URI sourcing';

        e.preventDefault();

        // prevent keycode logging



        }

    if (e.element.text.match(/(\.charCode|\.keyCode))/gim)) {

        arioso_alert = 'Prevented keylogging';

        e.preventDefault();

        // Arioso self protection, not really needed because of the 'ghost' variables.

        }

    if (e.element.text.match(/(bad_arioso_schemes|arioso_links|arioso_schemes|arioso_sanitize_xss))/gim)) {

        e.preventDefault();

    }

}, false);



// Arioso strict non-same origin JS blocker (think: ads, and cookie stealers)

window.opera.addEventListener('BeforeExternalScript', function(e) {

    // If JS is not on the same domain, block it

    if (!e.element.getAttribute('src').match(document.location)) {

        e.preventDefault();

    }

}, false);





document.addEventListener('load', function(e) {



    if (bad_arioso_schemes) {

        arioso_message = 'found and blocked unsafe URI hyperlink schemes.\r\nSchemes found and blocked: | ' + bad_arioso_schemes;

    } else if (arioso_alert) {

        arioso_message = arioso_alert;

    }



    if (arioso_message) {

        var ary = document.createElement('div');

        ary.style.position = 'fixed';

        ary.style.top = '0px';

        ary.style.left = '0px';

        ary.style.width = '100%';

        ary.style.border = '1px solid #999';

        ary.style.padding = '3px';

        ary.style.font = 'small-caps bold 10pt sans-serif';

        ary.style.backgroundColor = '#fffff0';

        ary.style.color = '#000';

        ary.appendChild(document.createTextNode('ARIOSO: ' + arioso_message))

            document.body.appendChild(ary);

    } else {

        return true;

    }

}, false);