Issue 4586 - Prevent access to shadowRoot via contentWindow

include.preload.js

 /*
  * This file is part of Adblock Plus <https://adblockplus.org/>,
  * Copyright (C) 2006-2017 eyeo GmbH
  *
  * Adblock Plus is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
  * published by the Free Software Foundation.
  *
  * Adblock Plus is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ skipping 561 matching lines @@
     shadow.appendChild(document.createElement("shadow"));
 
     // Stop the website from messing with our shadow root (#4191, #4298).
     if ("shadowRoot" in Element.prototype)
     {
       runInPageContext(() =>
       {
         let ourShadowRoot = document.documentElement.shadowRoot;
         if (!ourShadowRoot)
           return;
-        let desc = Object.getOwnPropertyDescriptor(Element.prototype,
-                                                   "shadowRoot");
-        let shadowRoot = Function.prototype.call.bind(desc.get);
 
-        Object.defineProperty(Element.prototype, "shadowRoot", {
-          configurable: true, enumerable: true, get()
+        let defineProperty = Object.defineProperty.bind(Object);
+
+        let shadowRootDesc = Object.getOwnPropertyDescriptor(Element.prototype,
+                                                             "shadowRoot");
+        let getShadowRoot = Function.prototype.call.bind(shadowRootDesc.get);
+
+        shadowRootDesc.get = function()
+        {
+          let shadowRoot = getShadowRoot(this);
+          return shadowRoot == ourShadowRoot ? null : shadowRoot;
+        };
+
+        defineProperty(Element.prototype, "shadowRoot", shadowRootDesc);
+
+        let contentWindowDesc = Object.getOwnPropertyDescriptor(
+                                  HTMLIFrameElement.prototype,
+                                  "contentWindow");
+        let getContentWindow = Function.prototype.call.bind(
+                                 contentWindowDesc.get);
+
+        let sandboxDesc = Object.getOwnPropertyDescriptor(
+                            HTMLIFrameElement.prototype,
+                            "sandbox");
+        let getSandbox = Function.prototype.call.bind(sandboxDesc.get);
+
+        contentWindowDesc.get = function()
+        {
+          let contentWindow = getContentWindow(this);
+
+          if (getSandbox(this).contains("allow-same-origin"))
           {
-            let thisShadow = shadowRoot(this);
-            return thisShadow == ourShadowRoot ? null : thisShadow;
+            defineProperty(contentWindow.Element.prototype, "shadowRoot",
+                           shadowRootDesc);
+
+            defineProperty(contentWindow.HTMLIFrameElement.prototype,
+                           "contentWindow", contentWindowDesc);
           }
-        });
+
+          return contentWindow;
+        };
+
+        defineProperty(HTMLIFrameElement.prototype, "contentWindow",
+                       contentWindowDesc);
       }, null);
     }
 
     return shadow;
   },
 
   addSelectors(selectors, filters)
   {
     if (selectors.length == 0)
       return;
@@ skipping 86 matching lines @@
     checkCollapse(event.target);
   }, true);
 
   document.addEventListener("load", event =>
   {
     let element = event.target;
     if (/^i?frame$/.test(element.localName))
       checkCollapse(element);
   }, true);
 }