From 0c4740a86abe650383c935a42f3293e2b3301a0e Mon Sep 17 00:00:00 2001
From: alectimison-maker <alec.timison@gmail.com>
Date: Fri, 31 Jul 2026 04:44:21 +0800
Subject: [PATCH] fix(js): execute dynamic data URL scripts

Decode JavaScript data URLs inside the serialized classic-script queue so each body runs before its load event advances a nested chain.

Fixes #520.
---
 .../tests/dynamic_script_onload_fires.rs      | 79 +++++++++++++++++++
 crates/obscura-js/js/bootstrap.js             | 46 +++++++++--
 2 files changed, 120 insertions(+), 5 deletions(-)

diff --git a/crates/obscura-cdp/tests/dynamic_script_onload_fires.rs b/crates/obscura-cdp/tests/dynamic_script_onload_fires.rs
index d80a92e..3967cdb 100644
--- a/crates/obscura-cdp/tests/dynamic_script_onload_fires.rs
+++ b/crates/obscura-cdp/tests/dynamic_script_onload_fires.rs
@@ -117,3 +117,82 @@ async fn dynamic_external_scripts_execute_and_fire_load() {
         "dynamic scripts must execute and fire load before navigation settles"
     );
 }
+
+#[tokio::test(flavor = "current_thread")]
+async fn dynamic_data_scripts_execute_before_chained_load_handlers() {
+    let mut ctx = CdpContext::new();
+    let page_id = ctx.create_page();
+    let session_id = "session-1";
+    ctx.sessions.insert(session_id.to_string(), page_id);
+
+    cdp(
+        &mut ctx,
+        1,
+        "Page.navigate",
+        json!({
+            "url": "data:text/html,<html><head></head><body></body></html>",
+            "waitUntil": "load"
+        }),
+        session_id,
+    )
+    .await;
+
+    cdp(
+        &mut ctx,
+        2,
+        "Runtime.evaluate",
+        json!({
+            "expression": r#"(function () {
+                var state = {
+                    aExec: false,
+                    aLoad: false,
+                    bExec: false,
+                    bLoad: false,
+                    cExec: false,
+                    cLoad: false
+                };
+                window.__dataScriptState = state;
+
+                var a = document.createElement('script');
+                a.src = 'data:text/javascript,window.__dataScriptState.aExec=true';
+                a.onload = function () {
+                    state.aLoad = true;
+                    var b = document.createElement('script');
+                    b.src = 'data:application/javascript,' + encodeURIComponent('window.__dataScriptState.bExec=true');
+                    b.onload = function () {
+                        state.bLoad = true;
+                        var c = document.createElement('script');
+                        c.src = 'data:text/javascript;base64,' + btoa('window.__dataScriptState.cExec=true');
+                        c.onload = function () { state.cLoad = true; };
+                        document.head.appendChild(c);
+                    };
+                    document.head.appendChild(b);
+                };
+                document.head.appendChild(a);
+                return 'kicked';
+            })()"#,
+            "returnByValue": true,
+        }),
+        session_id,
+    )
+    .await;
+
+    ctx.pages[0].settle(500).await;
+
+    let result = cdp(
+        &mut ctx,
+        3,
+        "Runtime.evaluate",
+        json!({
+            "expression": "JSON.stringify(window.__dataScriptState)",
+            "returnByValue": true,
+        }),
+        session_id,
+    )
+    .await;
+    assert_eq!(
+        result["result"]["value"],
+        r#"{"aExec":true,"aLoad":true,"bExec":true,"bLoad":true,"cExec":true,"cLoad":true}"#,
+        "data URL script bodies must execute before each chained load handler"
+    );
+}
diff --git a/crates/obscura-js/js/bootstrap.js b/crates/obscura-js/js/bootstrap.js
index 3ef371a..cc17415 100644
--- a/crates/obscura-js/js/bootstrap.js
+++ b/crates/obscura-js/js/bootstrap.js
@@ -18,7 +18,7 @@
     '__obscura_hw', '__obscura_mem',
     '__documentReadyState__', '__currentUrl',
     // internal helpers (var-declared throughout the file)
-    '__processDynScriptQueue', '_markNative', '_fpRand', '_fpNoise',
+    '__processDynScriptQueue', '_decodeDataScriptUrl', '_markNative', '_fpRand', '_fpNoise',
     '_fpCache', '_getFp', '_fp', '_splitAsciiWhitespace',
     '_getElementsByClassName', '_docEncoding', '_docIsUtf8',
     '_isSpecialScheme', '_applyDocQueryEncoding', '_anchorBase',
@@ -163,6 +163,37 @@ let _fpSeed = 0;
 // when SPAs dynamically insert multiple <script module> tags at once.
 let __dynScriptQueue = [];
 let __dynScriptBusy = false;
+function _decodeDataScriptUrl(url) {
+  let parsed;
+  try { parsed = new URL(url); }
+  catch(e) { throw new TypeError('Invalid dynamic script data URL'); }
+
+  const path = parsed.pathname;
+  const comma = path.indexOf(',');
+  if (comma < 0) throw new TypeError('Invalid dynamic script data URL');
+
+  const parts = path.slice(0, comma).split(';');
+  const mime = parts.shift().trim().toLowerCase();
+  const isJavaScript = mime === 'application/ecmascript' ||
+    mime === 'application/javascript' || mime === 'application/x-ecmascript' ||
+    mime === 'application/x-javascript' || mime === 'text/ecmascript' ||
+    mime === 'text/javascript' || /^text\/javascript1\.[0-5]$/.test(mime) ||
+    mime === 'text/jscript' || mime === 'text/livescript' ||
+    mime === 'text/x-ecmascript' || mime === 'text/x-javascript';
+  if (!isJavaScript) throw new TypeError('Unsupported dynamic script data URL MIME type');
+
+  let payload = path.slice(comma + 1);
+  try { payload = decodeURIComponent(payload); }
+  catch(e) { throw new TypeError('Invalid dynamic script data URL encoding'); }
+
+  const isBase64 = parts.some((part) => part.trim().toLowerCase() === 'base64');
+  if (!isBase64) return payload;
+  const clean = payload.replace(/[\r\n\s]/g, '');
+  if (!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(clean)) {
+    throw new TypeError('Invalid dynamic script data URL base64');
+  }
+  return new TextDecoder().decode(_base64ToUint8Array(clean));
+}
 async function __processDynScriptQueue() {
   if (__dynScriptBusy) return;
   __dynScriptBusy = true;
@@ -176,11 +207,16 @@ async function __processDynScriptQueue() {
         if (task.isModule) {
           await import(task.url);
         } else {
-          const raw = await Deno.core.ops.op_fetch_url(task.url, "GET", "{}", "", task.pageOrigin, "no-cors");
-          const parsed = JSON.parse(raw);
-          if (parsed.body) {
+          let body;
+          if (task.url.startsWith('data:')) {
+            body = _decodeDataScriptUrl(task.url);
+          } else {
+            const raw = await Deno.core.ops.op_fetch_url(task.url, "GET", "{}", "", task.pageOrigin, "no-cors");
+            body = JSON.parse(raw).body;
+          }
+          if (body) {
             globalThis.__currentScriptNid = task.nid;
-            try { (0, eval)(parsed.body); }
+            try { (0, eval)(body); }
             catch(e) { console.error('Dynamic script error (' + task.url + '):', e.message); }
             finally { globalThis.__currentScriptNid = task.prevNid || 0; }
           }