Issue 5382 - Wrap DOM mutation APIs to protect frames

inject.preload.js

 /*
  * This file is part of Adblock Plus <https://adblockplus.org/>,
  * Copyright (C) 2006-present eyeo GmbH
  *
  * Adblock Plus is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
  * published by the Free Software Foundation.
  *
  * Adblock Plus is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ skipping 54 matching lines @@
         contentWindow[eventName] = checkRequest;
         contentWindow.eval(
           "(" + injectedToString() + ")('" + eventName + "', true);"
         );
         delete contentWindow[eventName];
       }
       catch (e) {}
     }
   }
 
+  function wrapAPIForIFrame(object, api)
+  {
+    let func = object[api];
+    object[api] = function(...args)
+    {
+      let returnValue = func.apply(this, args);
+      for (let i = 0; i < window.length; i++)
+        injectIntoContentWindow(window[i]);
+      return returnValue;
+    };
+  }
+
+  function wrapPropertyAPIForIFrame(object, api)
+  {
+    let descriptor = Object.getOwnPropertyDescriptor(object, api);
+    wrapAPIForIFrame(descriptor, "set");
+    Object.defineProperty(object, api, descriptor);
+  }
+
+  wrapAPIForIFrame(Node.prototype, "appendChild");
+  wrapAPIForIFrame(Node.prototype, "insertBefore");
+  wrapAPIForIFrame(Node.prototype, "replaceChild");
+
+  wrapPropertyAPIForIFrame(Element.prototype, "innerHTML");
+
   for (let element of [HTMLFrameElement, HTMLIFrameElement, HTMLObjectElement])
   {
     let contentDocumentDesc = Object.getOwnPropertyDescriptor(
       element.prototype, "contentDocument"
     );
     let contentWindowDesc = Object.getOwnPropertyDescriptor(
       element.prototype, "contentWindow"
     );
 
     // Apparently in HTMLObjectElement.prototype.contentWindow does not exist
@@ skipping 311 matching lines @@
   if (typeof sandbox != "string" || /(^|\s)allow-scripts(\s|$)/i.test(sandbox))
   {
     let script = document.createElement("script");
     script.type = "application/javascript";
     script.async = false;
     script.textContent = "(" + injected + ")('" + randomEventName + "');";
     document.documentElement.appendChild(script);
     document.documentElement.removeChild(script);
   }
 }