Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Bypass with multiple doc.write calls #116

Closed
mmndaniel opened this issue Jun 29, 2023 · 5 comments · Fixed by #126
Closed

Bypass with multiple doc.write calls #116

mmndaniel opened this issue Jun 29, 2023 · 5 comments · Fixed by #126

Comments

@mmndaniel
Copy link
Contributor 

var f = document.createElement('iframe');
document.body.appendChild(f);
f.contentDocument.write('<iframe id="tst');
f.contentDocument.write('"></iframe><script>tst.contentWindow.alert(1);</script>');

What happens is that document.write calls are buffered, but handleHTML sees only one chunk at a time so it won't find anything inside the template.
@mmndaniel
Copy link
Contributor Author

related: bypass with multiple arguments to doc.write

var f = document.createElement('iframe');
document.body.appendChild(f);
f.contentDocument.write('<iframe id="tst', '"></iframe><script>tst.contentWindow.alert(1);</script>');

@serapath
Copy link

serapath commented Jul 4, 2023

wow, mental.

Given there is

snow/src/inserters.js

Line 33 in 48ec98b

return function() {
to deal with .innerHTML, could the same be applied here by hooking into contentDocument.write?

Basically this snippet fixes it and maybe can be generalized.

var f = document.createElement('iframe');
document.body.appendChild(f);
fix(f) // should be done by patched `.appendChild`
f.contentDocument.write('<iframe id="tst');
f.contentDocument.write('"></iframe><script>tst.contentWindow.alert(1);</script>');



function fix (f) {
  var old_write = f.contentDocument.write
  var content = ''
  const parser = document.createElement('div')
  f.contentDocument.write = patched_write
  
  function patched_write (...args) {
    content += args.join('')
    parser.innerHTML = content
    const iframes = [...parser.querySelectorAll('iframe')]
    if (iframes.length) {
      f.contentDocument.close()
      iframes.forEach(iframe => {
        var [s1, s2] = [
          `console.log('apply snow to iframe')`,
          `tst.contentWindow.alert = (...args) => console.log(...args)`
        ].map(s => Object.assign(document.createElement('script'), { textContent: `${s}` }))
        iframe.before(s1)
        iframe.after(s2)
      })
      console.log('fuck')
      console.log(parser.children)
      old_write.apply(f.contentDocument, [parser.innerHTML])
    } else {
      old_write.apply(f.contentDocument, args)
    }
  }
}

@mmndaniel
Copy link
Contributor Author

@serapath yes, something like that, the main points are that args should be joined (to address this), and buffered (to address the OP). I'd say the optimal parser for this case would be another document (new DOMParser().parseFromString('...', 'text/html') with the same readyState and content as the target document, because if reflects the actual resulting DOM the best. To illustrate my latest point:

var doc1 = new DOMParser().parseFromString('<html><head><body><frameset><frame src="/" /></frameset></body></head><html>', 'text/html');
var doc2 = new DOMParser().parseFromString('<html><frameset><frame src="/" /></frameset><html>', 'text/html');
// compare doc1 and 2

I found it the hard way when an attempted fix broke a similar test...

@weizman
Copy link
Member

weizman commented Jul 10, 2023

yes, and #80 (comment)

@weizman weizman linked a pull request Jul 17, 2023 that will close this issue
Fix multiple document.write calls #126
Merged
@weizman
Copy link
Member

weizman commented Jul 17, 2023

Sorry to ruin the party guys, but with the help of #118 we might not need to dig too deep into this (thanks for the help!)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Fix multiple document.write calls LavaMoat/snow
3 participants
@serapath @weizman @mmndaniel