Skip to content

Implement is-cross-origin internally so it doesn't throw#111

Merged
weizman merged 1 commit intomainfrom
make-is-cross-origin-not-throw
Jun 23, 2023
Merged

Implement is-cross-origin internally so it doesn't throw#111
weizman merged 1 commit intomainfrom
make-is-cross-origin-not-throw

Conversation

@weizman
Copy link
Copy Markdown
Member

@weizman weizman commented Jun 23, 2023

  • is-cross-origin throws if received object isn't a window
  • this apparently is possible (dom clobbering with indexes 😱)
  • no reason for it to throw, just continue to next window in frames array
  • in fact, no reason for this to be an external package at all, implement internally instead
    • making Snow a deps-free project 🎉

@weizman
Copy link
Copy Markdown
Member Author

weizman commented Jun 23, 2023

This allowed Snow bypass:

(function(){
    const ifr = document.createElement('iframe');
    const ifr2 = document.createElement('iframe');
    document.body.appendChild(ifr);
    const div = document.createElement('div');
    div.id='0';
    setTimeout(() => { ifr2.contentWindow.alert.call(top,1); }, 500);
    try { ifr.contentWindow.document.body.appendChild(div); } catch {}
    document.body.appendChild(ifr2);
}());

@weizman weizman merged commit a14cfc1 into main Jun 23, 2023
@weizman weizman deleted the make-is-cross-origin-not-throw branch June 23, 2023 11:29
weizman added a commit that referenced this pull request Jun 25, 2023
@weizman
Copy link
Copy Markdown
Member Author

weizman commented Jun 25, 2023

Update, #111 was not strong enough, the isWindow function could have been easily bypassed, e2cf42e introduces a hardening fix to that (instead of walking the frames array until there's nothing in there, walk it according to the length prop. That way we only walk through windows and not through windows + clobbered elements)

@weizman weizman mentioned this pull request Jul 17, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant