browser_oxide 0.1.3

Stealth headless browser engine in Rust: real HTML/CSS/DOM/JS, V8 via deno_core, own BoringSSL TLS/JA4 fingerprint, no Chromium, no CDP — for anti-bot web scraping, archival, and AI agents
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144

//! Smoke tests for the real Web Worker implementation.
//!
//! Run: cargo test -p js_runtime --test worker -- --test-threads=1 --nocapture

use browser_oxide::js_runtime::BrowserJsRuntime;
use std::time::Duration;

fn drive_runtime(code: &str, wait_ms: u64) -> String {
    let dom = browser_oxide::html_parser::parse_html(
        "<html><head></head><body><div id=\"out\"></div></body></html>",
    );
    let rt = tokio::runtime::Builder::new_current_thread()
        .enable_all()
        .build()
        .unwrap();
    let local = tokio::task::LocalSet::new();
    local.block_on(&rt, async move {
        let mut runtime = BrowserJsRuntime::new(dom);
        runtime.execute_script(code, None).unwrap();
        // Drive the event loop with a bounded timeout, allowing setInterval
        // polling (Worker uses 5 ms poll) time to deliver the reply.
        let deadline = std::time::Instant::now() + Duration::from_millis(wait_ms);
        loop {
            if std::time::Instant::now() >= deadline {
                break;
            }
            let remaining = deadline - std::time::Instant::now();
            let tick = remaining.min(Duration::from_millis(50));
            let fut = Box::pin(runtime.run_event_loop());
            let _ = tokio::time::timeout(tick, fut).await;
            // Check if we got an answer yet.
            if let Ok(val) =
                runtime.execute_script("document.querySelector('#out').textContent || ''", None)
            {
                if !val.is_empty() {
                    return val;
                }
            }
        }
        runtime
            .execute_script("document.querySelector('#out').textContent || ''", None)
            .unwrap_or_default()
    })
}

#[test]
fn worker_echo_round_trip() {
    let code = r#"
        const src = `
            self.onmessage = function(e) {
                self.postMessage('echo:' + e.data);
            };
        `;
        const blob = new Blob([src], { type: 'text/javascript' });
        const url = URL.createObjectURL(blob);
        const w = new Worker(url);
        w.onmessage = function(e) {
            document.querySelector('#out').textContent = e.data;
            w.terminate();
        };
        setTimeout(() => w.postMessage('hello'), 20);
    "#;
    let out = drive_runtime(code, 2000);
    assert_eq!(out, "echo:hello", "worker should echo 'echo:hello'");
}

#[test]
fn worker_addeventlistener_roundtrip() {
    let code = r#"
        const src = `
            self.addEventListener('message', function(e) {
                self.postMessage({ type: 'reply', n: e.data.n + 1 });
            });
        `;
        const blob = new Blob([src], { type: 'text/javascript' });
        const url = URL.createObjectURL(blob);
        const w = new Worker(url);
        w.addEventListener('message', function(e) {
            document.querySelector('#out').textContent = JSON.stringify(e.data);
            w.terminate();
        });
        setTimeout(() => w.postMessage({ n: 41 }), 20);
    "#;
    let out = drive_runtime(code, 2000);
    assert_eq!(out, "{\"type\":\"reply\",\"n\":42}");
}

/// `self.location` must be populated from the URL the
/// worker was constructed with. Recaptcha enterprise's webworker reads
/// `self.location.origin` to verify it was loaded from a trusted
/// recaptcha.net URL; an undefined/missing location bails the token flow.
///
/// Uses a blob: URL so the worker source is deterministic across runs;
/// the `URL.createObjectURL` registers a real `blob:` scheme URL, which
/// `op_worker_self_url` echoes back, and `new URL(blob:…)` parses it
/// into origin/protocol/etc.
#[test]
fn worker_self_location_populated_from_construction_url() {
    let code = r#"
        const src = `
            self.onmessage = function(e) {
                self.postMessage(JSON.stringify({
                    has_location: typeof self.location === 'object' && self.location !== null,
                    href: self.location && self.location.href,
                    protocol: self.location && self.location.protocol,
                    origin: self.location && self.location.origin,
                    toString_works: self.location && (self.location + '') === self.location.href,
                }));
            };
        `;
        const blob = new Blob([src], { type: 'text/javascript' });
        const url = URL.createObjectURL(blob);
        const w = new Worker(url);
        w.onmessage = function(e) {
            document.querySelector('#out').textContent = e.data;
            w.terminate();
        };
        setTimeout(() => w.postMessage('go'), 20);
    "#;
    let out = drive_runtime(code, 2000);
    let v: serde_json::Value =
        serde_json::from_str(&out).unwrap_or_else(|e| panic!("invalid JSON: {e}; raw={out}"));
    assert_eq!(v["has_location"], true, "self.location must exist: {out}");
    assert!(
        v["href"].as_str().unwrap_or("").starts_with("blob:"),
        "href must echo the blob: URL: {out}"
    );
    // Load-bearing for recaptcha-class probes: location.toString() === href.
    assert_eq!(
        v["toString_works"], true,
        "location toString must equal href: {out}"
    );
    // vNext/10 URL polyfill blob: fix — real Chrome on a blob:null/uuid URL
    // returns `.protocol === "blob:"` and `.origin === "null"`. Pre-fix
    // the polyfill emitted "" for protocol; post-fix it matches Chrome.
    assert_eq!(
        v["protocol"], "blob:",
        "blob: URL must report protocol=\"blob:\": {out}"
    );
    assert_eq!(
        v["origin"], "null",
        "blob: URL must report origin=\"null\": {out}"
    );
}