`prevent-canvas` scriptlet can be bypassed with `OffScreenCanvas`

[celenityy]

Prerequisites

• I verified that this is not a filter list issue. Report any issues with filter lists or broken website functionality in the uAssets issue tracker.
• This is NOT a YouTube, Facebook or Twitch report. These sites MUST be reported by clicking their respective links.
• This is not a support issue or a question. For support, questions, or help, visit /r/uBlockOrigin.
• I performed a cursory search of the issue tracker to avoid opening a duplicate issue.
• The issue is not present after disabling uBO in the browser.
• I checked the documentation to understand that the issue I am reporting is not normal behavior.

I tried to reproduce the issue when...

• uBO is the only extension.
• uBO uses default lists and settings.
• using a new, unmodified browser profile.

Description

Currently, uBO's prevent-canvas scriptlet appears to only cover HTMLCanvasElement.getContext(). This means that it can be bypassed with OffscreenCanvas.getContext().

A specific URL where the issue occurs.

https://abrahamjuliot.github.io/creepjs/

Steps to Reproduce

1. Add abrahamjuliot.github.io##+js(prevent-canvas, /webgl/) to My filters in uBO's Dashboard, and select Apply changes.
2. Navigate to https://abrahamjuliot.github.io/creepjs/, and observe that WebGL is not blocked.
3. Navigate back to My filters, check the box to Allow custom filters requiring trust, add abrahamjuliot.github.io##+js(trusted-suppress-native-method, OffscreenCanvas.prototype.getContext, '"webgl"', abort) and abrahamjuliot.github.io##+js(trusted-suppress-native-method, OffscreenCanvas.prototype.getContext, '"webgl2"', abort) to My filters, and select Apply changes.
4. Navigate back to https://abrahamjuliot.github.io/creepjs/, and observe that WebGL is properly blocked as expected.

Expected behavior

prevent-canvas should protect against both HTMLCanvasElement and OffscreenCanvas methods, to prevent usage of Canvas APIs.

Actual behavior

prevent-canvas only protects against HTMLCanvasElement, meaning that Canvas APIs can still be used with OffscreenCanvas.

uBO version

1.65.0

Browser name and version

Firefox 141.0.3 (Phoenix)

Operating System and version

N/A

[uBlock-user]

This means that it can be bypassed with OffscreenCanvas.getContext().

Decompiler is indeed bypassing the prevent-canvas filter with the help of OffscreenCanvas.getContext()