Issue 5382 - Wrap DOM mutation APIs to protect frames

inject.preload.js

 /*
  * This file is part of Adblock Plus <https://adblockplus.org/>,
  * Copyright (C) 2006-present eyeo GmbH
  *
  * Adblock Plus is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
  * published by the Free Software Foundation.
  *
  * Adblock Plus is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ skipping 54 matching lines @@
         contentWindow[eventName] = checkRequest;
         contentWindow.eval(
           "(" + injectedToString() + ")('" + eventName + "', true);"
         );
         delete contentWindow[eventName];
       }
       catch (e) {}
     }
   }
 
-  for (let element of [HTMLFrameElement, HTMLIFrameElement, HTMLObjectElement])
+  function injectIntoAllFrames()
   {
-    let contentDocumentDesc = Object.getOwnPropertyDescriptor(
-      element.prototype, "contentDocument"
-    );
-    let contentWindowDesc = Object.getOwnPropertyDescriptor(
-      element.prototype, "contentWindow"
-    );
+    for (let i = 0; i < window.length; i++)
+      injectIntoContentWindow(window[i]);
+  }
 
-    // Apparently in HTMLObjectElement.prototype.contentWindow does not exist
-    // in older versions of Chrome such as 42.
-    if (!contentWindowDesc)
-      continue;
+  function wrapAPIForInjection(object, api, callback)
+  {
+    let func = object[api];
+    object[api] = function(...args)
+    {
+      let returnValue = func.apply(this, args);
+      callback(returnValue);
+      return returnValue;
+    };
+  }
 
-    let getContentDocument = Function.prototype.call.bind(
-      contentDocumentDesc.get
-    );
-    let getContentWindow = Function.prototype.call.bind(
-      contentWindowDesc.get
-    );
+  function wrapPropertyAPIForInjection(object, api, method, callback)
+  {
+    let descriptor = Object.getOwnPropertyDescriptor(object, api);
+    wrapAPIForInjection(descriptor, method, callback);
+    Object.defineProperty(object, api, descriptor);
+  }
 
-    contentWindowDesc.get = function()
-    {
-      let contentWindow = getContentWindow(this);
-      injectIntoContentWindow(contentWindow);
-      return contentWindow;
-    };
-    contentDocumentDesc.get = function()
-    {
-      injectIntoContentWindow(getContentWindow(this));
-      return getContentDocument(this);
-    };
-    Object.defineProperty(element.prototype, "contentWindow",
-                          contentWindowDesc);
-    Object.defineProperty(element.prototype, "contentDocument",
-                          contentDocumentDesc);
-  }
+  wrapAPIForInjection(Node.prototype, "appendChild", injectIntoAllFrames);
+  wrapAPIForInjection(Node.prototype, "insertBefore", injectIntoAllFrames);
+  wrapAPIForInjection(Node.prototype, "replaceChild", injectIntoAllFrames);
+
+  wrapPropertyAPIForInjection(Element.prototype,
+                              "innerHTML", "set", injectIntoAllFrames);
+
+  wrapPropertyAPIForInjection(HTMLObjectElement.prototype,
+                              "contentWindow", "get", injectIntoContentWindow);
+  wrapPropertyAPIForInjection(HTMLObjectElement.prototype,
+                              "contentDocument", "get",
+                              doc => injectIntoContentWindow(doc.defaultView));
 
   /*
    * Shadow root getter wrapper
    *
    * After creating our shadowRoot we must wrap the getter to prevent the
    * website from accessing it (#4191, #4298). This is required as a
    * workaround for the lack of user style support in Chrome.
    * See https://bugs.chromium.org/p/chromium/issues/detail?id=632009&desc=2
    */
   if ("shadowRoot" in Element.prototype)
@@ skipping 286 matching lines @@
     // Firefox 58 only bypasses site CSPs when assigning to 'src'.
     let url = URL.createObjectURL(new Blob([
       "(" + injected + ")('" + randomEventName + "');"
     ]));
     script.src = url;
     document.documentElement.appendChild(script);
     document.documentElement.removeChild(script);
     URL.revokeObjectURL(url);
   }
 }