rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

cookiebanner: broaden resource detection via PerformanceObserver

Browse Source 
ThirdPartyDetector previously only saw <script src> and <iframe src>
because it scanned the DOM and watched mutations. Add a single
PerformanceObserver({type:'resource', buffered:true}) that picks up
everything the browser actually loaded:

  - tracking pixels (<img>, <picture>, srcset)
  - cross-origin stylesheets and web fonts
  - fetch / XHR / sendBeacon / ping calls (SDK call-homes)
  - video, audio, embed, object media

initiatorType is mapped to six new tracker_resource_type enum values
(IMAGE, STYLESHEET, FONT, BEACON, FETCH, MEDIA) and the existing
upsert path in tracker_resources picks them up unchanged.

Closes a real gap with headless cookie scanners: most SDKs phone home
via beacons after their script is gone, and the DOM scan never saw it.

Signed-off-by: Émile Ré <emile@getprobo.com>
This commit is contained in:
Émile Ré
2026-05-11 10:46:11 +04:00
parent d17c8ba044
commit 2b3449de1a
9 changed files with 201 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
pkg/coredata/migrations/20260511T063925Z.sql Normal file
View File

@@ -0,0 +1,24 @@
-- Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
--
-- Permission to use, copy, modify, and/or distribute this software for any
-- purpose with or without fee is hereby granted, provided that the above
-- copyright notice and this permission notice appear in all copies.
--
-- THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
-- REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
-- AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
-- INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
-- LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
-- OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
-- PERFORMANCE OF THIS SOFTWARE.
-- Extend tracker_resource_type to cover everything the in-page
-- PerformanceObserver can attribute: tracking pixels, fetch/XHR
-- call-homes, beacons, web fonts, cross-origin stylesheets, and
-- video/audio embeds.
ALTER TYPE tracker_resource_type ADD VALUE IF NOT EXISTS 'IMAGE';
ALTER TYPE tracker_resource_type ADD VALUE IF NOT EXISTS 'STYLESHEET';
ALTER TYPE tracker_resource_type ADD VALUE IF NOT EXISTS 'FONT';
ALTER TYPE tracker_resource_type ADD VALUE IF NOT EXISTS 'BEACON';
ALTER TYPE tracker_resource_type ADD VALUE IF NOT EXISTS 'FETCH';
ALTER TYPE tracker_resource_type ADD VALUE IF NOT EXISTS 'MEDIA';