Run all Puppeteer commands in an Isolated World

Attempting to address this issue below and looking for feedback and ideas on any potential ways to achieve this more cleanly: https://github.com/berstend/puppeteer-extra/issues/209

The goal is to have Puppeteer run every command in a Isolated Worlds to avoid detection scripts being able to monitor execution.

The concept write up is here (sorry, needed too much detail to include within the issue text): https://github.com/prescience-data/harden-puppeteer

The only way I can figure out how to achieve this is by modifying the vanilla Puppeteer files directly in the node_modules folder, so hoping someone with experience writing Puppteer-Extra plugins can advise a way to do with with a plugin instead.

Thanks!

[prescience-data]

Ok so I can confirm that the patch works as intended.

I’ve made a test for it here that uses Vastel’s execution monitoring technique to figure out if the host site has any visibility into the patched context:

Puppeteer Test: https://github.com/prescience-data/puppeteer-botcheck/blob/b6848845b8b5887608784caa2fe7a078db866e9b/Botcheck.js#L45 Host Monitoring Execution: https://github.com/prescience-data/prescience-data.github.io/blob/master/execution-monitor.html

URL of the live test: https://prescience-data.github.io/execution-monitor.html

Here’s the differences between unpatched and patched:

Unpatched

Patched

You can see that the patched version only detects the inserted elements (which was left deliberately unisolated to allow user to inject scripts into the main context (ie all the extra-stealth modifications).

However, anything other than that is running isolated and outside the security scope of any bot detection script.

Naturally they would be able to observe changes you make to the DOM, but only the outcome, not how the execution is occurring.

[brunogaspar]

Have you looked/tried https://github.com/ds300/patch-package ?