duckduckgo
diff --git a/‎injected/integration-test/test-pages/tab-suspension/config/tab-suspension.json‎
Lines changed: 3 additions & 1 deletion b/‎injected/integration-test/test-pages/tab-suspension/config/tab-suspension.json‎
Lines changed: 3 additions & 1 deletion
diff --git a/‎injected/package.json‎
Lines changed: 1 addition & 1 deletion b/‎injected/package.json‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎injected/src/captured-globals.js‎
Lines changed: 1 addition & 0 deletions b/‎injected/src/captured-globals.js‎
Lines changed: 1 addition & 0 deletions
diff --git a/‎injected/src/features/api-manipulation.js‎
Lines changed: 186 additions & 24 deletions b/‎injected/src/features/api-manipulation.js‎
Lines changed: 186 additions & 24 deletions
diff --git a/‎injected/src/wrapper-utils.js‎
Lines changed: 43 additions & 11 deletions b/‎injected/src/wrapper-utils.js‎
Lines changed: 43 additions & 11 deletions
@@ -6,7 +6,9 @@
       "state": "enabled",
       "exceptions": [],
       "settings": {
-        "inputFieldFocusDetection": "enabled"
+        "inputFieldFocusDetection": {
+            "state": "enabled"
+        }
       }
     }
   },
 
@@ -35,7 +35,7 @@
   },
   "type": "module",
   "dependencies": {
-    "@duckduckgo/privacy-configuration": "github:duckduckgo/privacy-configuration#1772634901001",
+    "@duckduckgo/privacy-configuration": "github:duckduckgo/privacy-configuration#1779290401870",
     "@duckduckgo/tracker-surrogates": "github:duckduckgo/tracker-surrogates#0528e3226df15b1a3e319ad68ef76612a8f26623",
     "esbuild": "^0.27.4",
     "minimist": "^1.2.8",
 
@@ -38,6 +38,7 @@ export const JSONstringify = JSON.stringify;
 export const JSONparse = JSON.parse;
 export const Arrayfrom = Array.from;
 export const ReflectDeleteProperty = Reflect.deleteProperty.bind(Reflect);
+export const ReflectApply = Reflect.apply.bind(Reflect);
 export const getRandomValues = globalThis.crypto?.getRandomValues?.bind(globalThis.crypto);
 
 // Secure context only - crypto.subtle is unavailable on HTTP
 
@@ -1,13 +1,15 @@
 /**
  * This feature allows remote configuration of APIs that exist within the DOM.
- * We support removal of APIs and returning different values from getters.
+ * We support removal of APIs, returning different values from getters, and
+ * replacing value-based properties such as methods.
  *
  * @module API manipulation
  */
 import ContentFeature from '../content-feature.js';
 // eslint-disable-next-line no-redeclare
-import { hasOwnProperty } from '../captured-globals.js';
+import { ReflectApply, getOwnPropertyDescriptor, hasOwnProperty, objectDefineProperty } from '../captured-globals.js';
 import { processAttr } from '../utils.js';
+import { mergePropertyDescriptors, wrapToString } from '../wrapper-utils.js';
 
 /**
  * @internal
@@ -45,16 +47,23 @@ export default class ApiManipulation extends ContentFeature {
             return true;
         }
         if (change.type === 'descriptor') {
-            if (change.enumerable && typeof change.enumerable !== 'boolean') {
+            if ('enumerable' in change && typeof change.enumerable !== 'boolean') {
                 return false;
             }
-            if (change.configurable && typeof change.configurable !== 'boolean') {
+            if ('configurable' in change && typeof change.configurable !== 'boolean') {
                 return false;
             }
             if ('define' in change && typeof change.define !== 'boolean') {
                 return false;
             }
-            return typeof change.getterValue !== 'undefined';
+            const hasGetterValue = typeof change.getterValue !== 'undefined';
+            const hasSetterValue = typeof change.setterValue !== 'undefined';
+            const hasValue = typeof change.value !== 'undefined';
+            // Either a value descriptor (with `value`) or an accessor descriptor (with `getterValue`
+            // and/or `setterValue`) - the two shapes are mutually exclusive.
+            const isAccessorShape = hasGetterValue || hasSetterValue;
+            const isValueShape = hasValue;
+            return isAccessorShape !== isValueShape;
         }
         return false;
     }
@@ -66,9 +75,11 @@ export default class ApiManipulation extends ContentFeature {
      * @typedef {Object} APIChange
      * @property {"remove"|"descriptor"} type
      * @property {import('../utils.js').ConfigSetting} [getterValue] - The value returned from a getter.
+     * @property {import('../utils.js').ConfigSetting} [setterValue] - The function invoked when the property is assigned. Used alongside (or instead of) getterValue to override accessor-style properties such as event handlers (e.g., `MediaDevices.prototype.ondevicechange`).
+     * @property {import('../utils.js').ConfigSetting} [value] - The value assigned to a value descriptor, including methods.
      * @property {boolean} [enumerable] - Whether the property is enumerable.
      * @property {boolean} [configurable] - Whether the property is configurable.
-     * @property {boolean} [define] - Whether to define the property if it does not exist.
+     * @property {boolean} [define] - When true, define a new own property if the key is absent from `api` and its entire prototype chain. When false (default), skip changes for properties that do not exist at all; override own properties via `wrapProperty`; override inherited properties by shadow-defining an own property on `api`.
      */
 
     /**
@@ -111,29 +122,180 @@ export default class ApiManipulation extends ContentFeature {
      */
     wrapApiDescriptor(api, key, change) {
         const getterValue = change.getterValue;
-        if (getterValue) {
-            const descriptor = {
-                get: () => processAttr(getterValue, undefined),
-            };
-            if ('enumerable' in change) {
-                descriptor.enumerable = change.enumerable;
+        const setterValue = change.setterValue;
+        const value = change.value;
+        const descriptorKind =
+            getterValue !== undefined || setterValue !== undefined ? 'getter' : value !== undefined ? 'value' : undefined;
+        const configSetting = descriptorKind === 'getter' ? getterValue : value;
+        // `setterValue` may be supplied on its own (override only the setter, keep the original
+        // getter); in that case configSetting (getterValue) is undefined and createApiDescriptor
+        // skips the `get` half.
+        if (!descriptorKind || (descriptorKind === 'value' && configSetting === undefined)) {
+            return;
+        }
+        const descriptor = this.createApiDescriptor(descriptorKind, configSetting, change);
+        const origDescriptor = this.findPropertyDescriptor(api, key);
+        if (!origDescriptor) {
+            if (change.define === true) {
+                this.defineProperty(api, key, this.createDefineDescriptor(descriptor, descriptorKind));
             }
-            if ('configurable' in change) {
-                descriptor.configurable = change.configurable;
+            return;
+        }
+        // When replacing an existing method-valued descriptor, mask the replacement
+        // against the original method so `toString()`, `toString.toString()`, `.name`
+        // and `.length` continue to resemble the native method. Without this, sites can
+        // trivially detect the override via `fn.toString()` / `fn.name`.
+        if (descriptorKind === 'value') {
+            const valueDescriptor = /** @type {{ value?: any }} */ (descriptor);
+            if (typeof valueDescriptor.value === 'function' && typeof origDescriptor.value === 'function') {
+                valueDescriptor.value = this.maskMethodReplacement(valueDescriptor.value, origDescriptor.value);
             }
-            // If 'define' is true and property does not exist, define it directly
-            if (change.define === true && !(key in api)) {
-                // Ensure descriptor has required boolean fields
-                const defineDescriptor = {
-                    ...descriptor,
-                    enumerable: typeof descriptor.enumerable !== 'boolean' ? true : descriptor.enumerable,
-                    configurable: typeof descriptor.configurable !== 'boolean' ? true : descriptor.configurable,
-                };
-                this.defineProperty(api, key, defineDescriptor);
-                return;
+        } else if (descriptorKind === 'getter') {
+            // Mask the new setter against the original native setter (if any) so that
+            // descriptor inspection (`getOwnPropertyDescriptor(...).set.toString()` /
+            // `.set.name`) still resembles the original accessor. Event-handler IDL
+            // attributes such as `Element.prototype.onclick` and
+            // `MediaDevices.prototype.ondevicechange` expose a native setter; without
+            // masking, descriptor probes would see our JS `setter(v) {...}` shape.
+            const accessorDescriptor = /** @type {{ get?: () => any, set?: (v: any) => void }} */ (descriptor);
+            if (typeof accessorDescriptor.set === 'function' && typeof origDescriptor.set === 'function') {
+                accessorDescriptor.set = /** @type {(v: any) => void} */ (
+                    this.maskMethodReplacement(accessorDescriptor.set, origDescriptor.set)
+                );
             }
+        }
+        if (hasOwnProperty.call(api, key)) {
             this.wrapProperty(api, key, descriptor);
+        } else {
+            // API exists via the prototype chain (e.g. MediaDevices.prototype.addEventListener
+            // on EventTarget.prototype). Shadow-define an own property without requiring `define`.
+            const merged = mergePropertyDescriptors(origDescriptor, descriptor);
+            if (merged) {
+                this.defineProperty(api, key, merged);
+            }
+        }
+    }
+
+    /**
+     * Returns the property descriptor for `key` on `obj` or an ancestor in its prototype chain.
+     * @param {object} obj
+     * @param {string} key
+     * @returns {PropertyDescriptor | undefined}
+     */
+    findPropertyDescriptor(obj, key) {
+        let current = obj;
+        while (current) {
+            const descriptor = getOwnPropertyDescriptor(current, key);
+            if (descriptor) {
+                return descriptor;
+            }
+            current = Object.getPrototypeOf(current);
+        }
+        return undefined;
+    }
+
+    /**
+     * Wraps a config-supplied function so its observable identity (`toString`,
+     * `toString.toString`, `name`, `length`) mirrors the original DOM method it is
+     * replacing. The call itself still executes the configured replacement.
+     *
+     * Note: `processAttr` may return a shared function (e.g. `functionMap.noop`),
+     * so we always create a fresh wrapper before redefining `name`/`length` to
+     * avoid mutating module-level singletons.
+     *
+     * @param {Function} replacementFn - configured replacement to invoke
+     * @param {Function} origFn - original DOM method we are masking against
+     * @returns {Function}
+     */
+    maskMethodReplacement(replacementFn, origFn) {
+        // Use captured `ReflectApply` and `objectDefineProperty` so a hostile page
+        // cannot intercept the call into the configured replacement, nor tamper with
+        // the `name`/`length` masking, by reassigning `globalThis.Reflect.apply` or
+        // `globalThis.Object.defineProperty` after content scope has initialised.
+        const wrapper = function () {
+            return ReflectApply(replacementFn, this, arguments);
+        };
+        objectDefineProperty(wrapper, 'name', { value: origFn.name, configurable: true });
+        objectDefineProperty(wrapper, 'length', { value: origFn.length, configurable: true });
+        return wrapToString(wrapper, origFn);
+    }
+
+    /**
+     * @param {'getter' | 'value'} descriptorKind
+     * @param {import('../utils.js').ConfigSetting | import('../utils.js').ConfigSetting[] | undefined} configSetting
+     * @param {APIChange} change
+     * @returns {Partial<import('../wrapper-utils.js').StrictPropertyDescriptor>}
+     */
+    createApiDescriptor(descriptorKind, configSetting, change) {
+        // `Partial<StrictPropertyDescriptor>` is a union (data | accessor | get-only | set-only),
+        // so direct property access narrows poorly. Build with a permissive intermediate shape
+        // then return as the public type.
+        /** @type {{ value?: any, get?: () => any, set?: (v: any) => void, enumerable?: boolean, configurable?: boolean }} */
+        let descriptor;
+        if (descriptorKind === 'value') {
+            // `wrapApiDescriptor` guarantees `configSetting` is defined for the value kind.
+            const valueSetting = /** @type {import('../utils.js').ConfigSetting | import('../utils.js').ConfigSetting[]} */ (configSetting);
+            descriptor = { value: processAttr(valueSetting, undefined) };
+        } else {
+            descriptor = {};
+            // `configSetting` is the getterValue (may be undefined if only setterValue is set).
+            if (configSetting !== undefined) {
+                const getterSetting = configSetting;
+                descriptor.get = () => processAttr(getterSetting, undefined);
+            }
+            // `setterValue` is intentionally invoked through processAttr on every assignment so
+            // configurations using `functionMap.debug` log per-assignment. When omitted, we leave
+            // `set` unset on the new descriptor so wrapProperty's spread merge preserves the
+            // original setter (existing behaviour).
+            if (change.setterValue !== undefined) {
+                const setterSetting = /** @type {import('../utils.js').ConfigSetting} */ (change.setterValue);
+                descriptor.set = function setter(v) {
+                    const fn = processAttr(setterSetting, undefined);
+                    if (typeof fn === 'function') {
+                        ReflectApply(fn, this, [v]);
+                    }
+                };
+            }
+        }
+        if ('enumerable' in change) {
+            descriptor.enumerable = change.enumerable;
+        }
+        if ('configurable' in change) {
+            descriptor.configurable = change.configurable;
+        }
+        return /** @type {Partial<import('../wrapper-utils.js').StrictPropertyDescriptor>} */ (descriptor);
+    }
+
+    /**
+     * @param {Partial<import('../wrapper-utils.js').StrictPropertyDescriptor>} descriptor
+     * @param {'getter' | 'value'} descriptorKind
+     * @returns {import('../wrapper-utils.js').StrictPropertyDescriptor}
+     */
+    createDefineDescriptor(descriptor, descriptorKind) {
+        if (descriptorKind === 'value') {
+            const valueDescriptor = /** @type {{ value: any, enumerable?: boolean, configurable?: boolean }} */ (descriptor);
+            return {
+                value: valueDescriptor.value,
+                writable: true,
+                enumerable: typeof valueDescriptor.enumerable !== 'boolean' ? true : valueDescriptor.enumerable,
+                configurable: typeof valueDescriptor.configurable !== 'boolean' ? true : valueDescriptor.configurable,
+            };
+        }
+        const getterDescriptor = /** @type {{ get?: () => any, set?: (v: any) => void, enumerable?: boolean, configurable?: boolean }} */ (
+            descriptor
+        );
+        /** @type {any} */
+        const result = {
+            enumerable: typeof getterDescriptor.enumerable !== 'boolean' ? true : getterDescriptor.enumerable,
+            configurable: typeof getterDescriptor.configurable !== 'boolean' ? true : getterDescriptor.configurable,
+        };
+        if (typeof getterDescriptor.get === 'function') {
+            result.get = getterDescriptor.get;
+        }
+        if (typeof getterDescriptor.set === 'function') {
+            result.set = getterDescriptor.set;
         }
+        return result;
     }
 
     /**
 
@@ -111,6 +111,45 @@ export function wrapFunction(functionValue, realTarget) {
     });
 }
 
+/**
+ * Merge `partial` into `orig` only when the partial supplies the same descriptor kind
+ * (data `value` vs accessor `get`/`set`). Spreading incompatible shapes produces an
+ * invalid ECMAScript property descriptor and makes `Object.defineProperty` throw.
+ *
+ * @param {PropertyDescriptor} origDescriptor
+ * @param {Partial<PropertyDescriptor>} partialDescriptor
+ * @returns {import('./wrapper-utils').StrictPropertyDescriptor | undefined} merged descriptor, or undefined when kinds disagree
+ */
+export function mergePropertyDescriptors(origDescriptor, partialDescriptor) {
+    if (
+        ('value' in origDescriptor && 'value' in partialDescriptor) ||
+        ('get' in origDescriptor && 'get' in partialDescriptor) ||
+        ('set' in origDescriptor && 'set' in partialDescriptor)
+    ) {
+        const merged = {
+            ...origDescriptor,
+            ...partialDescriptor,
+        };
+        // DOM descriptors always include configurable/enumerable at runtime; default when absent
+        // so the result satisfies StrictPropertyDescriptor for defineProperty().
+        if ('value' in merged) {
+            return /** @type {import('./wrapper-utils').StrictPropertyDescriptor} */ ({
+                value: merged.value,
+                writable: typeof merged.writable === 'boolean' ? merged.writable : true,
+                configurable: typeof merged.configurable === 'boolean' ? merged.configurable : true,
+                enumerable: typeof merged.enumerable === 'boolean' ? merged.enumerable : true,
+            });
+        }
+        return /** @type {import('./wrapper-utils').StrictPropertyDescriptor} */ ({
+            get: merged.get,
+            set: merged.set,
+            configurable: typeof merged.configurable === 'boolean' ? merged.configurable : true,
+            enumerable: typeof merged.enumerable === 'boolean' ? merged.enumerable : true,
+        });
+    }
+    return undefined;
+}
+
 /**
  * Wrap a `get`/`set` or `value` property descriptor. Only for data properties. For methods, use wrapMethod(). For constructors, use wrapConstructor().
  * @param {object} object - object whose property we are wrapping (most commonly a prototype, e.g. globalThis.Screen.prototype)
@@ -132,20 +171,13 @@ export function wrapProperty(object, propertyName, descriptor, definePropertyFn)
         return;
     }
 
-    if (
-        ('value' in origDescriptor && 'value' in descriptor) ||
-        ('get' in origDescriptor && 'get' in descriptor) ||
-        ('set' in origDescriptor && 'set' in descriptor)
-    ) {
-        definePropertyFn(object, propertyName, {
-            ...origDescriptor,
-            ...descriptor,
-        });
-        return origDescriptor;
-    } else {
+    const merged = mergePropertyDescriptors(origDescriptor, descriptor);
+    if (!merged) {
         // if the property is defined with get/set it must be wrapped with a get/set. If it's defined with a `value`, it must be wrapped with a `value`
         throw new Error(`Property descriptor for ${propertyName} may only include the following keys: ${objectKeys(origDescriptor)}`);
     }
+    definePropertyFn(object, propertyName, merged);
+    return origDescriptor;
 }
 
 /**
Original file line number	Diff line number	Diff line change
`@@ -6,7 +6,9 @@`
`6`	`6`	`"state": "enabled",`
`7`	`7`	`"exceptions": [],`
`8`	`8`	`"settings": {`
`9`		`- "inputFieldFocusDetection": "enabled"`
	`9`	`+ "inputFieldFocusDetection": {`
	`10`	`+ "state": "enabled"`
	`11`	`+ }`
`10`	`12`	`}`
`11`	`13`	`}`
`12`	`14`	`},`