This work presents Unbundle-Rewrite-Rebundle (URR), a system for detecting privacy-harming portions of bundled JavaScript code, and rewriting that code at runtime to remove the privacy harming behavior without breaking the surrounding code or overall application. URR is a novel solution to the problem of JavaScript bundles, where websites pre-compile multiple code units into a single file, making it impossible for content filters and ad-blockers to differentiate between desired and unwanted resources. Where traditional content filtering tools rely on URLs, URR analyzes the code at the AST level, and replaces harmful AST sub-trees with privacy-and-functionality maintaining alternatives. We present an open-sourced implementation of URR as a Firefox extension, and evaluate it against JavaScript bundles generated by the most popular bundling system (Webpack) deployed on the Tranco 10k. We measure the performance, measured by precision (1.00), recall (0.95), and speed (0.43s per-script) when detecting and rewriting three representative privacy harming libraries often included in JavaScript bundles, and find URR to be an effective approach to a large-and-growing blind spot unaddressed by current privacy tools.

翻译：本文提出Unbundle-Rewrite-Rebundle（URR）系统，用于检测捆绑JavaScript代码中损害隐私的部分，并在运行时重写该代码以消除隐私损害行为，同时不破坏周围代码或整个应用程序。URR是针对JavaScript包问题的新颖解决方案——网站将多个代码单元预编译为单个文件，导致内容过滤器和广告拦截器无法区分预期资源与非预期资源。传统内容过滤工具依赖URL进行识别，而URR在抽象语法树（AST）层级分析代码，将有害AST子树替换为保持隐私与功能性的替代方案。我们以Firefox扩展形式开源实现了URR，并在Tranco 10k数据集上针对最流行的打包系统Webpack生成的JavaScript包进行评估。通过检测并重写JavaScript包中常含的三类代表性隐私损害库，测得性能指标为：精确率1.00、召回率0.95、检测速度0.43秒/脚本。实验表明，URR是有效应对当前隐私工具尚未覆盖的、规模日益增长的盲区问题的解决方案。