AG-55222 Fix 'isMatchingSuspended' in 'trusted-json-set' and 'trusted-replace-argument' scriptlets. #565

AdamWr · AdamWr · commit ca1b6e3cb5fc · 2026-06-16T14:26:33.000Z
Squashed commit of the following: commit cd1b6cc Merge: 938d3d2 a7a8050 Author: Adam Wróblewski <adam@adguard.com> Date: Tue Jun 16 16:22:32 2026 +0200 Merge branch 'master' into fix/AG-55222 commit 938d3d2 Author: Adam Wróblewski <adam@adguard.com> Date: Thu Jun 11 12:52:34 2026 +0200 Wrapped `applyWrapper` and `constructWrapper` in `try/catch` in `trusted-replace-argument` So that if an error occurs while `isMatchingSuspended` is `true`, the flag is reset and the scriptlet remains functional for subsequent calls. Previously, an internal error would permanently disable the scriptlet. commit ad2eff3 Author: Adam Wróblewski <adam@adguard.com> Date: Thu Jun 11 12:13:33 2026 +0200 Fix infinite loop in 'trusted-json-set' and 'trusted-replace-argument' when used with internally used methods
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -28,12 +28,15 @@ The format is based on [Keep a Changelog], and this project adheres to [Semantic
 
 ### Fixed
 
+- Issue with `Maximum call stack size exceeded` error when
+  `trusted-json-set` or `trusted-replace-argument` is called with method used inside scriptlet [#565].
 - Infinite loop in `getRecursiveCandidates` in `json-path-utils` [#563].
 - Added the missing `google.ima.dai.api.ui`, `google.ima.dai.api.customUi` surfaces and the
   default `StreamRequest.ui` container in the `google-ima3-dai` redirect.
 - Added the missing `google.ima.dai.api.StreamRequest.StreamFormat` object to the `google-ima3-dai` redirect.
 
 [Unreleased]: https://github.com/AdguardTeam/Scriptlets/compare/v2.4.2...HEAD
+[#565]: https://github.com/AdguardTeam/Scriptlets/issues/565
 [#563]: https://github.com/AdguardTeam/Scriptlets/issues/563
 [#560]: https://github.com/AdguardTeam/Scriptlets/issues/560
 [#529]: https://github.com/AdguardTeam/Scriptlets/issues/529
diff --git a/src/scriptlets/trusted-json-set.ts b/src/scriptlets/trusted-json-set.ts
@@ -1013,7 +1013,6 @@ export function trustedJsonSet(
     ) => {
         try {
             if (isMatchingSuspended) {
-                isMatchingSuspended = false;
                 return Reflect.apply(target, thisArg, args);
             }
             isMatchingSuspended = true;
diff --git a/src/scriptlets/trusted-replace-argument.ts b/src/scriptlets/trusted-replace-argument.ts
@@ -328,99 +328,109 @@ export function trustedReplaceArgument(
     let isMatchingSuspended = false;
 
     const applyWrapper = (target: Function, thisArg: any, argumentsList: unknown[]) => {
-        if (isMatchingSuspended) {
-            isMatchingSuspended = false;
-            return Reflect.apply(target, thisArg, argumentsList);
-        }
-        isMatchingSuspended = true;
+        try {
+            if (isMatchingSuspended) {
+                return Reflect.apply(target, thisArg, argumentsList);
+            }
+            isMatchingSuspended = true;
 
-        // Log the original arguments before modification
-        if (verbose === 'true') {
-            const formattedMessage = createFormattedMessage(argumentsList);
-            logMessage(source, formattedMessage);
-        }
+            // Log the original arguments before modification
+            if (verbose === 'true') {
+                const formattedMessage = createFormattedMessage(argumentsList);
+                logMessage(source, formattedMessage);
+            }
 
-        // If we only need to log the arguments, skip further processing
-        if (SHOULD_LOG_ONLY) {
-            isMatchingSuspended = false;
-            return Reflect.apply(target, thisArg, argumentsList);
-        }
+            // If we only need to log the arguments, skip further processing
+            if (SHOULD_LOG_ONLY) {
+                isMatchingSuspended = false;
+                return Reflect.apply(target, thisArg, argumentsList);
+            }
 
-        const argumentToReplace = argumentsList[Number(argumentIndex)];
+            const argumentToReplace = argumentsList[Number(argumentIndex)];
 
-        const shouldSetArgument = checkArgument(argumentToReplace);
+            const shouldSetArgument = checkArgument(argumentToReplace);
 
-        if (!shouldSetArgument) {
-            isMatchingSuspended = false;
-            return Reflect.apply(target, thisArg, argumentsList);
-        }
+            if (!shouldSetArgument) {
+                isMatchingSuspended = false;
+                return Reflect.apply(target, thisArg, argumentsList);
+            }
 
-        if (typeof argumentToReplace === 'string' && shouldReplaceArgument) {
-            argumentsList[Number(argumentIndex)] = argumentToReplace
-                .replace(replaceRegexValue, constantValue as string);
-        } else {
-            argumentsList[Number(argumentIndex)] = constantValue;
-        }
+            if (typeof argumentToReplace === 'string' && shouldReplaceArgument) {
+                argumentsList[Number(argumentIndex)] = argumentToReplace
+                    .replace(replaceRegexValue, constantValue as string);
+            } else {
+                argumentsList[Number(argumentIndex)] = constantValue;
+            }
 
-        // Log the modified arguments after replacement
-        if (verbose === 'true') {
-            const formattedMessage = createFormattedMessage(argumentsList, 'modified');
-            logMessage(source, formattedMessage);
-        }
+            // Log the modified arguments after replacement
+            if (verbose === 'true') {
+                const formattedMessage = createFormattedMessage(argumentsList, 'modified');
+                logMessage(source, formattedMessage);
+            }
 
-        hit(source);
+            hit(source);
 
-        isMatchingSuspended = false;
+            isMatchingSuspended = false;
 
-        return Reflect.apply(target, thisArg, argumentsList);
+            return Reflect.apply(target, thisArg, argumentsList);
+        } catch (error) {
+            isMatchingSuspended = false;
+            logMessage(source, `Unexpected error during argument replacement: ${(error as Error).message}`);
+            return Reflect.apply(target, thisArg, argumentsList);
+        }
     };
 
     const constructWrapper = (target: Function, argumentsList: unknown[], newTarget: any) => {
-        if (isMatchingSuspended) {
-            isMatchingSuspended = false;
-            return Reflect.construct(target, argumentsList, newTarget);
-        }
-        isMatchingSuspended = true;
+        try {
+            if (isMatchingSuspended) {
+                return Reflect.construct(target, argumentsList, newTarget);
+            }
+            isMatchingSuspended = true;
 
-        // Log the original arguments before modification
-        if (verbose === 'true') {
-            const formattedMessage = createFormattedMessage(argumentsList);
-            logMessage(source, formattedMessage);
-        }
+            // Log the original arguments before modification
+            if (verbose === 'true') {
+                const formattedMessage = createFormattedMessage(argumentsList);
+                logMessage(source, formattedMessage);
+            }
 
-        // If we only need to log the arguments, skip further processing
-        if (SHOULD_LOG_ONLY) {
-            isMatchingSuspended = false;
-            return Reflect.construct(target, argumentsList, newTarget);
-        }
+            // If we only need to log the arguments, skip further processing
+            if (SHOULD_LOG_ONLY) {
+                isMatchingSuspended = false;
+                return Reflect.construct(target, argumentsList, newTarget);
+            }
 
-        const argumentToReplace = argumentsList[Number(argumentIndex)];
+            const argumentToReplace = argumentsList[Number(argumentIndex)];
 
-        const shouldSetArgument = checkArgument(argumentToReplace);
+            const shouldSetArgument = checkArgument(argumentToReplace);
 
-        if (!shouldSetArgument) {
-            isMatchingSuspended = false;
-            return Reflect.construct(target, argumentsList, newTarget);
-        }
+            if (!shouldSetArgument) {
+                isMatchingSuspended = false;
+                return Reflect.construct(target, argumentsList, newTarget);
+            }
 
-        if (typeof argumentToReplace === 'string' && shouldReplaceArgument) {
-            argumentsList[Number(argumentIndex)] = argumentToReplace
-                .replace(replaceRegexValue, constantValue as string);
-        } else {
-            argumentsList[Number(argumentIndex)] = constantValue;
-        }
+            if (typeof argumentToReplace === 'string' && shouldReplaceArgument) {
+                argumentsList[Number(argumentIndex)] = argumentToReplace
+                    .replace(replaceRegexValue, constantValue as string);
+            } else {
+                argumentsList[Number(argumentIndex)] = constantValue;
+            }
 
-        // Log the modified arguments after replacement
-        if (verbose === 'true') {
-            const formattedMessage = createFormattedMessage(argumentsList, 'modified');
-            logMessage(source, formattedMessage);
-        }
+            // Log the modified arguments after replacement
+            if (verbose === 'true') {
+                const formattedMessage = createFormattedMessage(argumentsList, 'modified');
+                logMessage(source, formattedMessage);
+            }
 
-        hit(source);
+            hit(source);
 
-        isMatchingSuspended = false;
+            isMatchingSuspended = false;
 
-        return Reflect.construct(target, argumentsList, newTarget);
+            return Reflect.construct(target, argumentsList, newTarget);
+        } catch (error) {
+            isMatchingSuspended = false;
+            logMessage(source, `Unexpected error during argument replacement: ${(error as Error).message}`);
+            return Reflect.construct(target, argumentsList, newTarget);
+        }
     };
 
     const getWrapper = (target: Function, propName: string, receiver: any) => {
diff --git a/tests/scriptlets/trusted-json-set.test.js b/tests/scriptlets/trusted-json-set.test.js
@@ -1126,3 +1126,34 @@ test('creates missing nested path in JSON.parse result after earlier parse error
     );
     assert.strictEqual(window.hit, 'FIRED', 'hit function fired');
 });
+
+test('modifies thisArg when jsonSource is this and uses property used inside scriptlet', (assert) => {
+    runScriptlet(name, ['Object.prototype.hasOwnProperty', '$.*.foo.bar', '$remove$', '', 'this']);
+
+    const obj = {
+        test: {
+            foo: {
+                bar: 1,
+                baz: 1,
+            },
+        },
+        qwerty: 1,
+    };
+
+    // To test if "Maximum call stack size exceeded" error is avoided
+    // when the scriptlet uses a property that is also used inside the scriptlet code
+    Object.prototype.hasOwnProperty.call(window, 'whatever');
+
+    // eslint-disable-next-line no-prototype-builtins
+    const result = obj.hasOwnProperty('test');
+    assert.strictEqual(result, true, 'should check if the object has the property');
+    assert.deepEqual(obj, {
+        test: {
+            foo: {
+                baz: 1,
+            },
+        },
+        qwerty: 1,
+    }, 'should modify the thisArg object by removing the specified property');
+    assert.strictEqual(window.hit, 'FIRED', 'hit function fired');
+});
diff --git a/tests/scriptlets/trusted-replace-argument.test.js b/tests/scriptlets/trusted-replace-argument.test.js
@@ -12,6 +12,7 @@ const nativeDocumentQuerySelector = window.document.querySelector;
 const nativeDocumentQuerySelectorAll = window.document.querySelectorAll;
 const nativeMutationObserver = window.MutationObserver;
 const nativeObjectDefineProperty = window.Object.defineProperty;
+const nativeStringReplace = String.prototype.replace;
 
 const beforeEach = () => {
     window.__debug = () => {
@@ -29,6 +30,7 @@ const afterEach = () => {
     window.document.querySelectorAll = nativeDocumentQuerySelectorAll;
     window.MutationObserver = nativeMutationObserver;
     window.Object.defineProperty = nativeObjectDefineProperty;
+    window.String.prototype.replace = nativeStringReplace;
 };
 
 module(name, { beforeEach, afterEach });
@@ -242,3 +244,49 @@ test('Replace argument in Object.defineProperty if pattern matches, test for "js
     assert.strictEqual(objectToReplace.adblock, expected, `"The property 'adblock' should be '${expected}'`);
     assert.strictEqual(window.hit, 'FIRED', 'hit function fired');
 });
+
+test('Replace argument in JSON.parse after earlier error inside the scriptlet', (assert) => {
+    // Test to check if the scriptlet works correctly
+    // after an error occurred inside the scriptlet code while matching was suspended
+    runScriptlet(name, ['JSON.parse', '0', 'replace:/ads/no_ads/g', 'ads']);
+
+    try {
+        // String conversion of the argument throws,
+        // so the error occurs inside the scriptlet during pattern matching
+        const throwingArgument = () => {};
+        throwingArgument.toString = () => {
+            throw new Error('test error');
+        };
+        JSON.parse(throwingArgument);
+    } catch (error) {
+        console.error('An error occurred:', error);
+    }
+
+    const jsonString = '{ "ads1": 1, "content": "fooBar" }';
+    const result = JSON.parse(jsonString);
+
+    assert.deepEqual(result, { no_ads1: 1, content: 'fooBar' }, 'Replaced "ads" with "no_ads" after the error');
+    assert.strictEqual(
+        JSON.parse.toString(),
+        nativeJSONParse.toString(),
+        'JSON.parse.toString() returns the original value',
+    );
+    assert.strictEqual(window.hit, 'FIRED', 'hit function fired');
+});
+
+test('Replace argument in String.prototype.replace to "test" if pattern matches', (assert) => {
+    // Test to check if "Maximum call stack size exceeded" error is avoided
+    // when the scriptlet uses a property that is also used inside the scriptlet code
+    runScriptlet(name, ['String.prototype.replace', '1', 'test', 'foo']);
+
+    const string = 'regex';
+    const result = string.replace(/regex/, 'foo bar');
+
+    assert.strictEqual(result, 'test', 'The scriptlet should change the method result');
+    assert.strictEqual(
+        String.prototype.replace.toString(),
+        nativeStringReplace.toString(),
+        'String.prototype.replace.toString() returns the original value',
+    );
+    assert.strictEqual(window.hit, 'FIRED', 'hit function fired');
+});

Original file line number	Diff line number	Diff line change
`@@ -1013,7 +1013,6 @@ export function trustedJsonSet(`
`1013`	`1013`	`) => {`
`1014`	`1014`	`try {`
`1015`	`1015`	`if (isMatchingSuspended) {`
`1016`		`- isMatchingSuspended = false;`
`1017`	`1016`	`return Reflect.apply(target, thisArg, args);`
`1018`	`1017`	`}`
`1019`	`1018`	`isMatchingSuspended = true;`