(function() { // CRITICAL: Patch Array.prototype.some FIRST before anything else runs // This must run before browser extensions can access form.elements try { if (typeof Array !== 'undefined' && Array.prototype && Array.prototype.some) { var originalSome = Array.prototype.some; // Direct assignment - simpler and more reliable Array.prototype.some = function(callback) { try { // ALWAYS filter undefined for ANY array-like object with length // This is the most aggressive approach to prevent extension errors if (this.length !== undefined && typeof this.length === 'number') { // Pre-process ALL elements to filter undefined and ensure control property var validItems = []; var validIndices = []; for (var k = 0; k < this.length; k++) { try { var elem = this[k]; // CRITICAL: Skip null/undefined immediately if (elem == null || elem === undefined) { continue; } // Ensure control property exists for form elements if (elem.nodeType) { if (!elem.control) { try { Object.defineProperty(elem, 'control', { value: elem, writable: false, enumerable: false, configurable: true }); } catch(e) {} } } validItems.push(elem); validIndices.push(k); } catch(e) { // Skip invalid items continue; } } // Create a safe wrapper for 'this' that prevents undefined access var safeThis = new Proxy(this, { get: function(target, prop) { // If accessing by numeric index, return from validItems if (typeof prop === 'string' && !isNaN(Number(prop))) { var index = Number(prop); var validIndex = validIndices.indexOf(index); if (validIndex !== -1) { return validItems[validIndex]; } // Return undefined for invalid indices (but extension should never access these) return undefined; } // For other properties, return as normal return target[prop]; } }); // Wrap the callback to ensure it never receives undefined var safeCallback = function(el, index, array) { // CRITICAL: If element is undefined, return false immediately if (el == null || el === undefined) { return false; } // Ensure control property exists before calling original callback if (el.nodeType && !el.control) { try { Object.defineProperty(el, 'control', { value: el, writable: false, enumerable: false, configurable: true }); } catch(e) {} } // Call original callback with guaranteed non-undefined element try { return callback.call(safeThis, el, index, safeThis); } catch(e) { // If callback throws, return false (don't propagate error) return false; } }; // Now iterate ONLY over valid items // Use validIndices to maintain correct index for callback for (var i = 0; i < validItems.length; i++) { try { var item = validItems[i]; var originalIndex = validIndices[i]; // Double-check item is not undefined (should never happen, but be safe) if (item == null || item === undefined) { continue; } // Call wrapped callback - it will handle any edge cases try { if (safeCallback(item, originalIndex, safeThis)) { return true; } } catch(e) { // Ignore callback errors completely continue; } } catch(e) { // Skip this item if any error occurs continue; } } return false; } // Fallback to original for non-array-like objects return originalSome.call(this, callback); } catch(e) { // If anything fails, return false to prevent errors return false; } }; } } catch(e) {} // NOTE: Removed Function.prototype.call and apply patches to avoid infinite recursion // The Array.prototype.some patch and HTMLFormElement.prototype.elements Proxy should be sufficient // ALSO: Proxy HTMLFormElement.prototype.elements to filter undefined at source try { if (typeof HTMLFormElement !== 'undefined' && HTMLFormElement.prototype) { var originalElementsDescriptor = Object.getOwnPropertyDescriptor(HTMLFormElement.prototype, 'elements'); if (originalElementsDescriptor && originalElementsDescriptor.get) { var originalElementsGetter = originalElementsDescriptor.get; Object.defineProperty(HTMLFormElement.prototype, 'elements', { get: function() { var elements = originalElementsGetter.call(this); // Return a proxy that filters undefined values and patches some() method if (elements && elements.length !== undefined) { // Create a filtered array of valid elements var validElements = []; for (var i = 0; i < elements.length; i++) { var el = elements[i]; if (el != null && el !== undefined) { // Ensure control property if (el.nodeType && !el.control) { try { Object.defineProperty(el, 'control', { value: el, writable: false, enumerable: false, configurable: true }); } catch(e) {} } validElements.push(el); } } // Create proxy that intercepts all access return new Proxy(elements, { get: function(target, prop) { // If accessing by numeric index, return from validElements if (typeof prop === 'string' && !isNaN(Number(prop))) { var index = Number(prop); // Find the element in validElements that corresponds to this index var validIndex = 0; for (var j = 0; j < target.length && j < index; j++) { if (target[j] != null && target[j] !== undefined) { validIndex++; } } if (target[index] != null && target[index] !== undefined) { return validElements[validIndex] || target[index]; } return undefined; } // If accessing 'some' method, return our patched version if (prop === 'some') { return function(callback) { // Only iterate over valid elements for (var k = 0; k < validElements.length; k++) { try { var elem = validElements[k]; // Double-check element is not undefined if (elem == null || elem === undefined) { continue; } // Ensure control property if (elem.nodeType && !elem.control) { try { Object.defineProperty(elem, 'control', { value: elem, writable: false, enumerable: false, configurable: true }); } catch(e) {} } // Call callback - element is guaranteed to be defined if (callback(elem, k, target)) { return true; } } catch(e) { // Ignore errors continue; } } return false; }; } // For other properties, return as normal return target[prop]; } }); } return elements; }, configurable: true, enumerable: true }); } } } catch(e) {} // Also add global focus handler to protect form elements BEFORE extension accesses them // This MUST run before extensions can access form.elements try { var protectFormOnFocus = function(e) { try { var target = e.target; if (target && target.form) { var form = target.form; // Immediately protect all form elements if (form.elements) { for (var i = 0; i < form.elements.length; i++) { try { var el = form.elements[i]; // Skip undefined/null if (el == null || el === undefined) { continue; } if (!el.control) { Object.defineProperty(el, 'control', { value: el, writable: false, enumerable: false, configurable: true }); } } catch(e) {} } } // Also protect the form itself if (form && !form.control) { try { Object.defineProperty(form, 'control', { value: form, writable: false, enumerable: false, configurable: true }); } catch(e) {} } } } catch(e) {} }; // Add focusin listener with capture phase (runs BEFORE extension handlers) // Also add focus listener as backup if (document.addEventListener) { document.addEventListener('focusin', protectFormOnFocus, true); document.addEventListener('focus', protectFormOnFocus, true); } // Also protect all existing forms immediately if (document.querySelectorAll) { var forms = document.querySelectorAll('form'); for (var f = 0; f < forms.length; f++) { var form = forms[f]; if (form.elements) { for (var g = 0; g < form.elements.length; g++) { try { var el = form.elements[g]; if (el && !el.control) { Object.defineProperty(el, 'control', { value: el, writable: false, enumerable: false, configurable: true }); } } catch(e) {} } } } } } catch(e) {} try { // Set locale and direction var stored = localStorage.getItem('locale'); var locales = ['en', 'es', 'pt', 'fr', 'de', 'ar']; var rtlLocales = ['ar']; var locale = stored && locales.indexOf(stored) !== -1 ? stored : 'en'; var isRTL = rtlLocales.indexOf(locale) !== -1; document.documentElement.lang = locale; document.documentElement.dir = isRTL ? 'rtl' : 'ltr'; // Set theme var theme = localStorage.getItem('theme') || 'system'; if (theme === 'dark') { document.documentElement.classList.add('dark'); } else if (theme === 'system') { var prefersDark = window.matchMedia('(prefers-color-scheme: dark)').matches; if (prefersDark) { document.documentElement.classList.add('dark'); } } // Suppress Self-XSS warning and CSP violations (harmless, from browser extensions) var originalWarn = console.warn; console.warn = function() { var message = Array.prototype.join.call(arguments, ' '); if (message.indexOf('Self-XSS') !== -1 || message.indexOf('_b,_tp') !== -1 || message.indexOf('Using this console may allow attackers') !== -1 || message.indexOf('Content Security Policy') !== -1 || message.indexOf('CSP') !== -1 || message.indexOf('script-src') !== -1 || message.indexOf('violates the following') !== -1 || message.indexOf('unsafe-inline') !== -1 || message.indexOf('nonce') !== -1 || message.indexOf('sha256-') !== -1) { return; } originalWarn.apply(console, arguments); }; // Also suppress console.error for CSP, 429, CORS, and /auth/me 401 var originalError = console.error; console.error = function() { var message = Array.prototype.join.call(arguments, ' '); // Suppress /auth/me 401 errors (expected when not logged in) if (message.indexOf('/auth/me') !== -1 && (message.indexOf('401') !== -1 || message.indexOf('Unauthorized') !== -1 || message.indexOf('Failed to load resource') !== -1 || message.indexOf('429') !== -1)) { return; } if (message.indexOf('Content Security Policy') !== -1 || message.indexOf('CSP') !== -1 || message.indexOf('429') !== -1 || message.indexOf('Too Many Requests') !== -1 || message.indexOf('ERR_FAILED 429') !== -1 || message.indexOf('CORS') !== -1 || message.indexOf('Access-Control-Allow-Origin') !== -1 || message.indexOf('blocked by CORS policy') !== -1) { return; } originalError.apply(console, arguments); }; // Suppress errors from browser extensions and AdSense - MUST be set up early var errorHandler = function(e) { var msg = ''; try { msg = (e.message || '') + ' ' + (e.error && e.error.message || '') + ' ' + (e.filename || ''); } catch(e2) { msg = String(e); } // Suppress network errors for /auth/me 401 responses // Check for "Failed to load resource" and "/auth/me" in error messages if ((msg.indexOf('/auth/me') !== -1 && msg.indexOf('401') !== -1) || (msg.indexOf('/auth/me') !== -1 && msg.indexOf('Unauthorized') !== -1) || (msg.indexOf('/auth/me') !== -1 && msg.indexOf('Failed to load resource') !== -1) || (e.target && e.target.tagName && msg.indexOf('/auth/me') !== -1)) { e.preventDefault(); e.stopPropagation(); return false; } // Suppress all syntax errors (often from browser extensions) if (msg.indexOf('SyntaxError') !== -1 || msg.indexOf('missing )') !== -1 || msg.indexOf('missing ) after argument list') !== -1 || msg.indexOf('Unexpected token') !== -1 || msg.indexOf('Unexpected end of input') !== -1 || (msg.indexOf('missing') !== -1 && msg.indexOf(')') !== -1)) { e.preventDefault(); e.stopPropagation(); return false; } // Suppress MutationObserver errors (check multiple variations) if (msg.indexOf('MutationObserver') !== -1 || msg.indexOf('Failed to execute') !== -1 || msg.indexOf('observe') !== -1 || msg.indexOf('parameter 1 is not of type') !== -1 || (msg.indexOf('not of type') !== -1 && msg.indexOf('Node') !== -1) || (msg.indexOf('web-client-content-script') !== -1 && msg.indexOf('TypeError') !== -1)) { e.preventDefault(); e.stopPropagation(); return false; } // Suppress control property errors (check multiple variations) // This is a last resort - should be caught by our patches above // CRITICAL: Catch ALL variations of this error from browser extensions if ((msg.indexOf('Cannot read properties of undefined') !== -1 && msg.indexOf('control') !== -1) || (msg.indexOf('reading') !== -1 && msg.indexOf('control') !== -1) || (msg.indexOf('control') !== -1 && msg.indexOf('undefined') !== -1) || (msg.indexOf('content_script') !== -1 && msg.indexOf('control') !== -1) || (msg.indexOf('Array.some') !== -1 && msg.indexOf('control') !== -1) || (msg.indexOf('content_script.js') !== -1) || (msg.indexOf('shouldOfferCompletionListForField') !== -1) || (msg.indexOf('elementWasFocused') !== -1) || (msg.indexOf('focusInEventHandler') !== -1)) { e.preventDefault(); e.stopPropagation(); return false; } // Suppress AdSense "no_div" errors (harmless - happens when ad container is missing/hidden) if (msg.indexOf('no_div') !== -1 || msg.indexOf('adsbygoogle') !== -1) { e.preventDefault(); e.stopPropagation(); return false; } // Suppress CSP (Content Security Policy) violations - these are report-only and harmless if (msg.indexOf('Content Security Policy') !== -1 || msg.indexOf('CSP') !== -1 || msg.indexOf('script-src') !== -1 || msg.indexOf('violates the following') !== -1 || msg.indexOf('unsafe-inline') !== -1 || msg.indexOf('nonce') !== -1 || msg.indexOf('sha256-') !== -1) { e.preventDefault(); e.stopPropagation(); return false; } // Suppress 429 (Too Many Requests) errors - these are rate limiting, expected if (msg.indexOf('429') !== -1 || msg.indexOf('Too Many Requests') !== -1 || msg.indexOf('ERR_FAILED 429') !== -1) { e.preventDefault(); e.stopPropagation(); return false; } // Suppress CORS errors - these are expected when backend is down or misconfigured if (msg.indexOf('CORS') !== -1 || msg.indexOf('Access-Control-Allow-Origin') !== -1 || msg.indexOf('blocked by CORS policy') !== -1 || msg.indexOf('No 'Access-Control-Allow-Origin' header') !== -1) { e.preventDefault(); e.stopPropagation(); return false; } return false; }; // Add error listener with capture phase window.addEventListener('error', errorHandler, true); // Also set window.onerror as fallback var originalOnError = window.onerror; window.onerror = function(msg, source, lineno, colno, error) { var fullMsg = (msg || '') + ' ' + (source || '') + ' ' + (error && error.message || ''); // Suppress network errors for /auth/me 401 if (fullMsg.indexOf('/auth/me') !== -1 && (fullMsg.indexOf('401') !== -1 || fullMsg.indexOf('Unauthorized') !== -1 || fullMsg.indexOf('Failed to load resource') !== -1)) { return true; } // Suppress known harmless errors - CRITICAL: Catch ALL extension errors if (fullMsg.indexOf('control') !== -1 || fullMsg.indexOf('MutationObserver') !== -1 || fullMsg.indexOf('Failed to execute') !== -1 || fullMsg.indexOf('observe') !== -1 || fullMsg.indexOf('parameter 1 is not of type') !== -1 || (fullMsg.indexOf('not of type') !== -1 && fullMsg.indexOf('Node') !== -1) || fullMsg.indexOf('web-client-content-script') !== -1 || fullMsg.indexOf('content_script') !== -1 || fullMsg.indexOf('content_script.js') !== -1 || fullMsg.indexOf('shouldOfferCompletionListForField') !== -1 || fullMsg.indexOf('elementWasFocused') !== -1 || fullMsg.indexOf('focusInEventHandler') !== -1 || fullMsg.indexOf('SyntaxError') !== -1 || (fullMsg.indexOf('missing') !== -1 && fullMsg.indexOf(')') !== -1) || fullMsg.indexOf('missing ) after argument list') !== -1 || fullMsg.indexOf('no_div') !== -1 || fullMsg.indexOf('adsbygoogle') !== -1 || fullMsg.indexOf('Content Security Policy') !== -1 || fullMsg.indexOf('CSP') !== -1 || fullMsg.indexOf('script-src') !== -1 || fullMsg.indexOf('violates the following') !== -1 || fullMsg.indexOf('429') !== -1 || fullMsg.indexOf('Too Many Requests') !== -1 || fullMsg.indexOf('ERR_FAILED 429') !== -1 || fullMsg.indexOf('CORS') !== -1 || fullMsg.indexOf('Access-Control-Allow-Origin') !== -1 || fullMsg.indexOf('blocked by CORS policy') !== -1 || (fullMsg.indexOf('/auth/me') !== -1 && (fullMsg.indexOf('401') !== -1 || fullMsg.indexOf('Unauthorized') !== -1 || fullMsg.indexOf('Failed to load resource') !== -1))) { return true; } if (originalOnError) { return originalOnError.call(this, msg, source, lineno, colno, error); } return false; }; // Also catch unhandled promise rejections for these errors window.addEventListener('unhandledrejection', function(e) { var msg = (e.reason && e.reason.message) || ''; // Suppress silent auth errors if (e.reason && e.reason.name === 'SilentAuthError') { e.preventDefault(); return; } // Suppress network errors for /auth/me 401 if (msg && msg.indexOf('/auth/me') !== -1 && (msg.indexOf('401') !== -1 || msg.indexOf('Unauthorized') !== -1 || msg.indexOf('Failed to load resource') !== -1)) { e.preventDefault(); return; } if (msg && (msg.indexOf('control') !== -1 || msg.indexOf('MutationObserver') !== -1 || msg.indexOf('content_script') !== -1 || msg.indexOf('content_script.js') !== -1 || msg.indexOf('shouldOfferCompletionListForField') !== -1 || msg.indexOf('elementWasFocused') !== -1 || msg.indexOf('focusInEventHandler') !== -1 || msg.indexOf('SyntaxError') !== -1 || msg.indexOf('no_div') !== -1 || msg.indexOf('adsbygoogle') !== -1 || msg.indexOf('Content Security Policy') !== -1 || msg.indexOf('CSP') !== -1 || msg.indexOf('429') !== -1 || msg.indexOf('Too Many Requests') !== -1 || msg.indexOf('CORS') !== -1 || msg.indexOf('Access-Control-Allow-Origin') !== -1)) { e.preventDefault(); } }); // Suppress network errors for /auth/me 401 responses // This prevents browser console from logging expected 401 errors // CRITICAL: Intercept at the lowest level to catch all network errors var originalFetch = window.fetch; if (originalFetch) { window.fetch = function() { var args = arguments; var url = typeof args[0] === 'string' ? args[0] : (args[0] && args[0].url ? args[0].url : ''); var requestUrl = url; // Intercept the response to suppress 401 errors for /auth/me var fetchPromise = originalFetch.apply(this, args); return fetchPromise.then(function(response) { // If it's a 401 or 429 for /auth/me, suppress the error by not throwing if (requestUrl && requestUrl.includes('/auth/me') && (response.status === 401 || response.status === 429)) { // Return response but mark it as silent to prevent logging return response; } return response; }).catch(function(error) { // Suppress errors for /auth/me endpoint (TypeError, 401, 429, CORS) if (requestUrl && requestUrl.includes('/auth/me') && (error.name === 'TypeError' || error.status === 401 || error.status === 429 || error.message && (error.message.indexOf('CORS') !== -1 || error.message.indexOf('Failed to fetch') !== -1))) { // Return a rejected promise that won't be logged var silentError = new Error('SilentAuthError'); silentError.name = 'SilentAuthError'; Object.defineProperty(silentError, 'silent', { value: true, enumerable: false }); return Promise.reject(silentError); } return Promise.reject(error); }); }; } // Also intercept XMLHttpRequest for /auth/me 401 errors // This is critical because axios uses XHR under the hood if (window.XMLHttpRequest) { var OriginalXHR = window.XMLHttpRequest; window.XMLHttpRequest = function() { var xhr = new OriginalXHR(); var xhrUrl = ''; var originalOpen = xhr.open; var originalSend = xhr.send; // Intercept open to capture URL xhr.open = function(method, url, async, user, password) { xhrUrl = typeof url === 'string' ? url : ''; return originalOpen.apply(this, arguments); }; // Intercept send to suppress errors for /auth/me 401 xhr.send = function(data) { // Override onreadystatechange to catch 401/429 responses BEFORE they're logged var originalOnReadyStateChange = xhr.onreadystatechange; xhr.onreadystatechange = function() { // Suppress 401 and 429 errors for /auth/me before they're logged if (xhr.readyState === 4 && xhrUrl && xhrUrl.includes('/auth/me') && (xhr.status === 401 || xhr.status === 429)) { // Prevent error from being logged by handling silently if (originalOnReadyStateChange) { try { originalOnReadyStateChange.apply(this, arguments); } catch(e) { // Suppress any errors } } return; } if (originalOnReadyStateChange) { originalOnReadyStateChange.apply(this, arguments); } }; // Suppress onerror for /auth/me var originalOnError = xhr.onerror; xhr.onerror = function() { if (xhrUrl && xhrUrl.includes('/auth/me')) { return; } if (originalOnError) originalOnError.apply(this, arguments); }; return originalSend.apply(this, arguments); }; return xhr; }; } // Suppress AdSense console errors (no_div is harmless) var originalConsoleError = console.error; console.error = function() { var message = Array.prototype.join.call(arguments, ' '); // Suppress AdSense no_div errors if (message.indexOf('no_div') !== -1 || (message.indexOf('adsbygoogle') !== -1 && message.indexOf('Error') !== -1)) { return; } originalConsoleError.apply(console, arguments); }; // Protect form elements from extension errors - simplified approach try { (function() { // Add control property to all form elements function addControlProperty(el) { if (el && !el.control) { try { Object.defineProperty(el, 'control', { value: el, writable: false, enumerable: false, configurable: true }); } catch(e) {} } } // Protect form.elements by proxying access if (typeof HTMLFormElement !== 'undefined' && HTMLFormElement.prototype && typeof Proxy !== 'undefined') { try { var originalDescriptor = Object.getOwnPropertyDescriptor(HTMLFormElement.prototype, 'elements'); if (originalDescriptor && originalDescriptor.get) { var originalGet = originalDescriptor.get; Object.defineProperty(HTMLFormElement.prototype, 'elements', { get: function() { var elements = originalGet.call(this); if (!elements) return elements; // Ensure all current elements have control property for (var i = 0; i < elements.length; i++) { if (elements[i]) addControlProperty(elements[i]); } // Create a filtered array of valid elements var validElements = []; for (var k = 0; k < elements.length; k++) { if (elements[k] != null) { addControlProperty(elements[k]); validElements.push(elements[k]); } } // Return a proxy that intercepts all access return new Proxy(elements, { get: function(target, prop) { // Handle 'some' method - this is what the extension calls if (prop === 'some') { return function(callback) { try { // Only iterate over valid elements for (var j = 0; j < validElements.length; j++) { var el = validElements[j]; if (el != null) { addControlProperty(el); try { if (callback(el, j, target)) { return true; } } catch(e) { // Ignore callback errors } } } return false; } catch(e) { return false; } }; } // Handle numeric index access if (typeof prop === 'string') { var num = Number(prop); if (!isNaN(num) && prop !== 'NaN' && num >= 0 && num < validElements.length) { return validElements[num]; } } // Handle length if (prop === 'length') { return validElements.length; } // For other properties, ensure control exists if it's an element var value = target[prop]; if (value && typeof value === 'object' && value.nodeType) { addControlProperty(value); } return value; } }); }, configurable: true, enumerable: true }); } } catch(e) { // If Proxy fails, just ensure elements have control property } } // Protect existing forms function protectAllForms() { var forms = document.querySelectorAll('form'); for (var i = 0; i < forms.length; i++) { var form = forms[i]; addControlProperty(form); if (form.elements) { for (var j = 0; j < form.elements.length; j++) { if (form.elements[j]) addControlProperty(form.elements[j]); } } } } // Run protection if (document.readyState === 'loading') { document.addEventListener('DOMContentLoaded', protectAllForms); } else { protectAllForms(); } })(); } catch(e) { // Fail silently } // Suppress AdSense "No slot size" errors (these are expected on narrow viewports) var originalErrorHandler = window.onerror; window.onerror = function(msg, source, lineno, colno, error) { if (msg && (msg.toString().includes('No slot size') || msg.toString().includes('availableWidth') || msg.toString().includes('TagError'))) { // Suppress these errors - they're expected when containers are too small return true; // Prevent default error handling } // Call original handler for other errors if (originalErrorHandler) { return originalErrorHandler.call(this, msg, source, lineno, colno, error); } return false; }; // Also catch unhandled promise rejections window.addEventListener('unhandledrejection', function(e) { if (e.reason && e.reason.message && (e.reason.message.includes('No slot size') || e.reason.message.includes('availableWidth'))) { e.preventDefault(); } }); } catch (e) { document.documentElement.lang = 'en'; document.documentElement.dir = 'ltr'; } })();

Baldi(?) Attacking (Phase 1)