Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

parent webpage can modify javascript objects inside `iframe.contentWindow` or `open()` before `injected-web.js` runs

See original GitHub issue

parent webpage can modify javascript objects inside iframe.contentWindow or open() before injected-web.js runs

you just need violentmonkey installed and enabled in your browser

example: type open(location.href).Object.prototype.hasOwnProperty=console.log; in javascript console and press enter on any web page like https://example.org/ (file: urls don’t work in chromium)

demo html (host on http server):

<!DOCTYPE html>
<html>
<head>
  <meta charset="UTF-8"/>
  <title>a spoopy 👻️</title>
</head>
<body>
<script type="text/javascript">
  if(window===window.parent){
    if(location.protocol==="file:")document.write("<h1>warning: \"file:\" urls don't work in chromium</h1>");
    const fr=document.createElement("iframe");
    fr.src=location.href;
    document.body.appendChild(fr);
    const op=fr.contentWindow.Object.prototype;
    Object.defineProperty(op,"post",{
      "configurable":true,
      "set":function(value){
        delete op.post;
        this.post=value;
        setTimeout(value,1000,"Notification",{
          "id":0,
          "text":"boo",
          "title":"a spoopy 👻️",
          "image":undefined
        });
      }
    });
  }else document.write("<h1>wait</h1>");
</script>
</body>
</html>

Issue Analytics

State:
Created 2 years ago
Comments:36 (32 by maintainers)

Top GitHub Comments

1reaction

tophfcommented, Nov 7, 2021

No, it’s not a specific detection of Violentmonkey, just of any extension that inserts a DOM node.

1reaction

Illya9999commented, Nov 4, 2021

@Illya9999, no, it’s not, assuming you use the latest beta and the demo in the OP.

I mean getting the notifications by having the webpage hook into violentmonkey. The demo here is patched yes, but the flaw itself where violentmonkey can be hooked isnt