fix(extension): stop leaking Object.getPropertyDescriptor/getPropertyNames on the page-world Object

[vringar]

The tell

Closes #1187 (quick win).

The legacy JavaScript instrument (Extension/src/lib/js-instruments.ts) assigned two non-standard helpers onto the page-world Object and never removed them:

Object.getPropertyDescriptor = function (subject, name) { ... };
Object.getPropertyNames = function (subject) { ... };

Because the instrument is injected via a <script> element and runs in the page's principal, these assignments stay visible to page scripts. A one-liner

typeof Object.getPropertyDescriptor === "function"

detects OpenWPM instrumentation even with empty settings — a config-independent tell, named as a leaked-globals detection vector in Krumnow, Jonker & Karsch (arXiv:2205.08890, §4.1).

The fix (zero capture cost)

Pure refactor: both helpers are now module-local functions inside getInstrumentJS instead of being assigned onto the global Object, and the two call sites (the property-descriptor lookup and the property-name enumeration) call the locals. The implementations are byte-for-byte unchanged; only their location and how they're referenced changed. The declare global augmentation of Object is removed accordingly.

No behavior or capture change.

Verification

• grep -rn "Object.getPropertyDescriptor\|Object.getPropertyNames" Extension/src returns only the new module-local definitions — no Object.X = assignment and no Object.X( call remain.
• The built content.js bundle contains no Object.getProperty* = assignment while still bundling both helper functions.
• Extension build clean; ESLint reports no issues.
• test/test_js_instrument.py::TestJSInstrument::test_instrument_object passes, confirming instrumentation capture is unchanged.

Follow-up

A browser-side regression test asserting the page-world Object no longer carries these properties would need new test-page/harness wiring; left as a follow-up rather than over-building here.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 62.31%. Comparing base (975b09c) to head (44a8d12).

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #1191   +/-   ##
=======================================
  Coverage   62.31%   62.31%           
=======================================
  Files          40       40           
  Lines        3930     3930           
=======================================
  Hits         2449     2449           
  Misses       1481     1481           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull request overview

This PR hardens OpenWPM’s legacy page-world JavaScript instrumentation by removing two non-standard helper functions that were previously assigned onto the page’s global Object, which created a configuration-independent detectability “tell”.

Changes:

• Removes the declare global augmentation that added Object.getPropertyDescriptor / Object.getPropertyNames.
• Replaces the page-world Object.* assignments with function-scoped helpers inside getInstrumentJS.
• Updates the two call sites to use the local helper functions instead of Object.*.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.