Issue 5382 - Wrap DOM mutation APIs to protect frames

inject.preload.js

 /*
  * This file is part of Adblock Plus <https://adblockplus.org/>,
  * Copyright (C) 2006-present eyeo GmbH
  *
  * Adblock Plus is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
  * published by the Free Software Foundation.
  *
  * Adblock Plus is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ skipping 63 matching lines @@
 
   function injectIntoAllFrames()
   {
     for (let i = 0; i < window.length; i++)
       injectIntoContentWindow(window[i]);
   }
 
   function wrapAPIForInjection(object, api, callback)
   {
     let func = object[api];
-    object[api] = function(...args)
-    {
-      let returnValue = func.apply(this, args);
-      callback(returnValue);
-      return returnValue;
-    };
+    if (!func || typeof func != "function")
+      return;
+    let applyFunc = Function.prototype.apply.bind(func);
+    Object.defineProperty(object, api, {
+      value(...args)
+      {
+        let returnValue = applyFunc(this, args);
+        callback(returnValue);
+        return returnValue;
+      }
+    });
   }
 
   function wrapPropertyAPIForInjection(object, api, method, callback)
   {
     let descriptor = Object.getOwnPropertyDescriptor(object, api);
+    // Apparently HTMLObjectElement.prototype.contentWindow does not exist in
+    // older versions of Chrome such as 42.
+    if (!descriptor)
+      return;
     wrapAPIForInjection(descriptor, method, callback);
     Object.defineProperty(object, api, descriptor);
   }
 
   wrapAPIForInjection(Node.prototype, "appendChild", injectIntoAllFrames);
   wrapAPIForInjection(Node.prototype, "insertBefore", injectIntoAllFrames);
   wrapAPIForInjection(Node.prototype, "replaceChild", injectIntoAllFrames);
 
   wrapPropertyAPIForInjection(Element.prototype,
                               "innerHTML", "set", injectIntoAllFrames);
 
   wrapPropertyAPIForInjection(HTMLObjectElement.prototype,
                               "contentWindow", "get", injectIntoContentWindow);
-  wrapPropertyAPIForInjection(HTMLObjectElement.prototype,
-                              "contentDocument", "get",
-                              doc => injectIntoContentWindow(doc.defaultView));
+  wrapPropertyAPIForInjection(
+    HTMLObjectElement.prototype,
+    "contentDocument", "get",
+    contentDocument =>
+    {
+      if (contentDocument)
+        injectIntoContentWindow(contentDocument.defaultView);
+    }
+  );
 
   /*
    * Shadow root getter wrapper
    *
    * After creating our shadowRoot we must wrap the getter to prevent the
    * website from accessing it (#4191, #4298). This is required as a
    * workaround for the lack of user style support in Chrome.
    * See https://bugs.chromium.org/p/chromium/issues/detail?id=632009&desc=2
    */
   if ("shadowRoot" in Element.prototype)
@@ skipping 286 matching lines @@
     // Firefox 58 only bypasses site CSPs when assigning to 'src'.
     let url = URL.createObjectURL(new Blob([
       "(" + injected + ")('" + randomEventName + "');"
     ]));
     script.src = url;
     document.documentElement.appendChild(script);
     document.documentElement.removeChild(script);
     URL.revokeObjectURL(url);
   }
 }