Fix EventTarget prototype abuse vulnerability (#115)

LavaMoat · Jun 27, 2023 · 81ac843 · 81ac843
1 parent d648e27
commit 81ac843
Show file tree

Hide file tree

Showing 3 changed files with 5 additions and 5 deletions.
diff --git a/snow.js b/snow.js
@@ -959,10 +959,10 @@ function setup(win) {
     return bag.setAttribute.call(element, attribute, value);
   }
   function addEventListener(element, event, listener, options) {
-    return bag.addEventListener.call(element, event, listener, options);
+    return bag.Function.prototype.call.call(bag.addEventListener, element, event, listener, options);
   }
   function removeEventListener(element, event, listener, options) {
-    return bag.removeEventListener.call(element, event, listener, options);
+    return bag.Function.prototype.call.call(bag.removeEventListener, element, event, listener, options);
   }
   function createElement(document, tagName, options) {
     return bag.createElement.call(document, tagName, options);