rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

cookiebanner: broaden resource detection via PerformanceObserver

Browse Source 
ThirdPartyDetector previously only saw <script src> and <iframe src>
because it scanned the DOM and watched mutations. Add a single
PerformanceObserver({type:'resource', buffered:true}) that picks up
everything the browser actually loaded:

  - tracking pixels (<img>, <picture>, srcset)
  - cross-origin stylesheets and web fonts
  - fetch / XHR / sendBeacon / ping calls (SDK call-homes)
  - video, audio, embed, object media

initiatorType is mapped to six new tracker_resource_type enum values
(IMAGE, STYLESHEET, FONT, BEACON, FETCH, MEDIA) and the existing
upsert path in tracker_resources picks them up unchanged.

Closes a real gap with headless cookie scanners: most SDKs phone home
via beacons after their script is gone, and the DOM scan never saw it.

Signed-off-by: Émile Ré <emile@getprobo.com>
This commit is contained in:
Émile Ré
2026-05-11 10:46:11 +04:00
parent d17c8ba044
commit 2b3449de1a
9 changed files with 201 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
pkg/coredata/migrations/20260511T063925Z.sql Normal file
View File

@@ -0,0 +1,24 @@
-- Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
--
-- Permission to use, copy, modify, and/or distribute this software for any
-- purpose with or without fee is hereby granted, provided that the above
-- copyright notice and this permission notice appear in all copies.
--
-- THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
-- REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
-- AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
-- INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
-- LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
-- OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
-- PERFORMANCE OF THIS SOFTWARE.
-- Extend tracker_resource_type to cover everything the in-page
-- PerformanceObserver can attribute: tracking pixels, fetch/XHR
-- call-homes, beacons, web fonts, cross-origin stylesheets, and
-- video/audio embeds.
ALTER TYPE tracker_resource_type ADD VALUE IF NOT EXISTS 'IMAGE';
ALTER TYPE tracker_resource_type ADD VALUE IF NOT EXISTS 'STYLESHEET';
ALTER TYPE tracker_resource_type ADD VALUE IF NOT EXISTS 'FONT';
ALTER TYPE tracker_resource_type ADD VALUE IF NOT EXISTS 'BEACON';
ALTER TYPE tracker_resource_type ADD VALUE IF NOT EXISTS 'FETCH';
ALTER TYPE tracker_resource_type ADD VALUE IF NOT EXISTS 'MEDIA';

36
pkg/coredata/tracker_resource_type.go
View File

@@ -22,14 +22,26 @@ import (
type TrackerResourceType string
const (
TrackerResourceTypeScript TrackerResourceType = "SCRIPT"
TrackerResourceTypeIframe TrackerResourceType = "IFRAME"
TrackerResourceTypeScript TrackerResourceType = "SCRIPT"
TrackerResourceTypeIframe TrackerResourceType = "IFRAME"
TrackerResourceTypeImage TrackerResourceType = "IMAGE"
TrackerResourceTypeStylesheet TrackerResourceType = "STYLESHEET"
TrackerResourceTypeFont TrackerResourceType = "FONT"
TrackerResourceTypeBeacon TrackerResourceType = "BEACON"
TrackerResourceTypeFetch TrackerResourceType = "FETCH"
TrackerResourceTypeMedia TrackerResourceType = "MEDIA"
)
func TrackerResourceTypes() []TrackerResourceType {
return []TrackerResourceType{
TrackerResourceTypeScript,
TrackerResourceTypeIframe,
TrackerResourceTypeImage,
TrackerResourceTypeStylesheet,
TrackerResourceTypeFont,
TrackerResourceTypeBeacon,
TrackerResourceTypeFetch,
TrackerResourceTypeMedia,
}
}
@@ -53,6 +65,18 @@ func (s *TrackerResourceType) Scan(value any) error {
*s = TrackerResourceTypeScript
case TrackerResourceTypeIframe:
*s = TrackerResourceTypeIframe
case TrackerResourceTypeImage:
*s = TrackerResourceTypeImage
case TrackerResourceTypeStylesheet:
*s = TrackerResourceTypeStylesheet
case TrackerResourceTypeFont:
*s = TrackerResourceTypeFont
case TrackerResourceTypeBeacon:
*s = TrackerResourceTypeBeacon
case TrackerResourceTypeFetch:
*s = TrackerResourceTypeFetch
case TrackerResourceTypeMedia:
*s = TrackerResourceTypeMedia
default:
return fmt.Errorf("invalid TrackerResourceType value: %q", v)
}
@@ -62,7 +86,13 @@ func (s *TrackerResourceType) Scan(value any) error {
func (s TrackerResourceType) Value() (driver.Value, error) {
switch s {
case TrackerResourceTypeScript,
TrackerResourceTypeIframe:
TrackerResourceTypeIframe,
TrackerResourceTypeImage,
TrackerResourceTypeStylesheet,
TrackerResourceTypeFont,
TrackerResourceTypeBeacon,
TrackerResourceTypeFetch,
TrackerResourceTypeMedia:
return string(s), nil
default:
return nil, fmt.Errorf("invalid TrackerResourceType: %s", s)