Issue 4586 - Prevent access to shadowRoot via contentWindow

include.preload.js

Index: include.preload.js
===================================================================
--- a/include.preload.js
+++ b/include.preload.js
@@ -574,27 +574,60 @@
     // Stop the website from messing with our shadow root (#4191, #4298).
     if ("shadowRoot" in Element.prototype)
     {
       runInPageContext(() =>
       {
         let ourShadowRoot = document.documentElement.shadowRoot;
         if (!ourShadowRoot)
           return;
-        let desc = Object.getOwnPropertyDescriptor(Element.prototype,
-                                                   "shadowRoot");
-        let shadowRoot = Function.prototype.call.bind(desc.get);
+
+        let defineProperty = Object.defineProperty.bind(Object);
+
+        let shadowRootDesc = Object.getOwnPropertyDescriptor(Element.prototype,
+                                                             "shadowRoot");
+        let getShadowRoot = Function.prototype.call.bind(shadowRootDesc.get);
+
+        shadowRootDesc.get = function()
+        {
+          let shadowRoot = getShadowRoot(this);
+          return shadowRoot == ourShadowRoot ? null : shadowRoot;
+        };
+
+        defineProperty(Element.prototype, "shadowRoot", shadowRootDesc);
+
+        let contentWindowDesc = Object.getOwnPropertyDescriptor(
+                                  HTMLIFrameElement.prototype,
+                                  "contentWindow");
+        let getContentWindow = Function.prototype.call.bind(
+                                 contentWindowDesc.get);
 
-        Object.defineProperty(Element.prototype, "shadowRoot", {
-          configurable: true, enumerable: true, get()
+        let sandboxDesc = Object.getOwnPropertyDescriptor(
+                            HTMLIFrameElement.prototype,
+                            "sandbox");
+        let getSandbox = Function.prototype.call.bind(sandboxDesc.get);
+
+        contentWindowDesc.get = function()
+        {
+          let contentWindow = getContentWindow(this);
+
+          if (getSandbox(this).contains("allow-same-origin"))
           {
-            let thisShadow = shadowRoot(this);
-            return thisShadow == ourShadowRoot ? null : thisShadow;
+            defineProperty(contentWindow.Element.prototype, "shadowRoot",
+                           shadowRootDesc);
+
+            defineProperty(contentWindow.HTMLIFrameElement.prototype,
+                           "contentWindow", contentWindowDesc);
           }
-        });
+
+          return contentWindow;
+        };
+
+        defineProperty(HTMLIFrameElement.prototype, "contentWindow",
+                       contentWindowDesc);
       }, null);
     }
 
     return shadow;
   },
 
   addSelectors(selectors, filters)
   {